2 Unix SMB/CIFS implementation.
4 Some Helpful wrappers on LDAP
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 a wrapper around ldap_search_s that retries depending on the error code
28 this is supposed to catch dropped connections and auto-reconnect
30 static ADS_STATUS
ads_do_search_retry_internal(ADS_STRUCT
*ads
, const char *bind_path
, int scope
,
32 const char **attrs
, void *args
,
35 ADS_STATUS status
= ADS_SUCCESS
;
42 time(NULL
) - ads
->ldap
.last_attempt
< ADS_RECONNECT_TIME
) {
43 return ADS_ERROR(LDAP_SERVER_DOWN
);
46 bp
= SMB_STRDUP(bind_path
);
49 return ADS_ERROR(LDAP_NO_MEMORY
);
54 /* when binding anonymously, we cannot use the paged search LDAP
55 * control - Guenther */
57 if (ads
->auth
.flags
& ADS_AUTH_ANON_BIND
) {
58 status
= ads_do_search(ads
, bp
, scope
, expr
, attrs
, res
);
60 status
= ads_do_search_all_args(ads
, bp
, scope
, expr
, attrs
, args
, res
);
62 if (ADS_ERR_OK(status
)) {
63 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
64 expr
, bp
, ads_count_replies(ads
, *res
)));
71 if (NT_STATUS_EQUAL(ads_ntstatus(status
), NT_STATUS_IO_TIMEOUT
) && ads
->config
.ldap_page_size
>= 250) {
72 int new_page_size
= (ads
->config
.ldap_page_size
/ 2);
73 DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
74 ads
->config
.ldap_page_size
, new_page_size
));
75 ads
->config
.ldap_page_size
= new_page_size
;
79 ads_msgfree(ads
, *res
);
82 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
83 ads
->config
.realm
, ads_errstr(status
)));
86 status
= ads_connect(ads
);
88 if (!ADS_ERR_OK(status
)) {
89 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
98 /* when binding anonymously, we cannot use the paged search LDAP
99 * control - Guenther */
101 if (ads
->auth
.flags
& ADS_AUTH_ANON_BIND
) {
102 status
= ads_do_search(ads
, bp
, scope
, expr
, attrs
, res
);
104 status
= ads_do_search_all_args(ads
, bp
, scope
, expr
, attrs
, args
, res
);
107 if (ADS_ERR_OK(status
)) {
108 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
109 expr
, bp
, ads_count_replies(ads
, *res
)));
116 if (!ADS_ERR_OK(status
)) {
117 DEBUG(1,("ads reopen failed after error %s\n",
118 ads_errstr(status
)));
123 ADS_STATUS
ads_do_search_retry(ADS_STRUCT
*ads
, const char *bind_path
,
124 int scope
, const char *expr
,
125 const char **attrs
, LDAPMessage
**res
)
127 return ads_do_search_retry_internal(ads
, bind_path
, scope
, expr
, attrs
, NULL
, res
);
130 ADS_STATUS
ads_do_search_retry_args(ADS_STRUCT
*ads
, const char *bind_path
,
131 int scope
, const char *expr
,
132 const char **attrs
, void *args
,
135 return ads_do_search_retry_internal(ads
, bind_path
, scope
, expr
, attrs
, args
, res
);
139 ADS_STATUS
ads_search_retry(ADS_STRUCT
*ads
, LDAPMessage
**res
,
140 const char *expr
, const char **attrs
)
142 return ads_do_search_retry(ads
, ads
->config
.bind_path
, LDAP_SCOPE_SUBTREE
,
146 ADS_STATUS
ads_search_retry_dn(ADS_STRUCT
*ads
, LDAPMessage
**res
,
150 return ads_do_search_retry(ads
, dn
, LDAP_SCOPE_BASE
,
151 "(objectclass=*)", attrs
, res
);
154 ADS_STATUS
ads_search_retry_extended_dn(ADS_STRUCT
*ads
, LDAPMessage
**res
,
157 enum ads_extended_dn_flags flags
)
161 args
.control
= ADS_EXTENDED_DN_OID
;
163 args
.critical
= True
;
165 return ads_do_search_retry_args(ads
, dn
, LDAP_SCOPE_BASE
,
166 "(objectclass=*)", attrs
, &args
, res
);
169 ADS_STATUS
ads_search_retry_dn_sd_flags(ADS_STRUCT
*ads
, LDAPMessage
**res
,
176 args
.control
= ADS_SD_FLAGS_OID
;
178 args
.critical
= True
;
180 return ads_do_search_retry_args(ads
, dn
, LDAP_SCOPE_BASE
,
181 "(objectclass=*)", attrs
, &args
, res
);
184 ADS_STATUS
ads_search_retry_extended_dn_ranged(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
187 enum ads_extended_dn_flags flags
,
193 args
.control
= ADS_EXTENDED_DN_OID
;
195 args
.critical
= True
;
197 /* we can only range process one attribute */
198 if (!attrs
|| !attrs
[0] || attrs
[1]) {
199 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
202 return ads_ranged_search(ads
, mem_ctx
, LDAP_SCOPE_BASE
, dn
,
203 "(objectclass=*)", &args
, attrs
[0],
204 strings
, num_strings
);
208 ADS_STATUS
ads_search_retry_sid(ADS_STRUCT
*ads
, LDAPMessage
**res
,
212 char *dn
, *sid_string
;
215 sid_string
= sid_binstring_hex(sid
);
216 if (sid_string
== NULL
) {
217 return ADS_ERROR(LDAP_NO_MEMORY
);
220 if (!asprintf(&dn
, "<SID=%s>", sid_string
)) {
221 SAFE_FREE(sid_string
);
222 return ADS_ERROR(LDAP_NO_MEMORY
);
225 status
= ads_do_search_retry(ads
, dn
, LDAP_SCOPE_BASE
,
226 "(objectclass=*)", attrs
, res
);
228 SAFE_FREE(sid_string
);
232 ADS_STATUS
ads_ranged_search(ADS_STRUCT
*ads
,
238 const char *range_attr
,
246 bool more_values
= False
;
251 attrs
= TALLOC_ARRAY(mem_ctx
, const char *, 3);
252 ADS_ERROR_HAVE_NO_MEMORY(attrs
);
254 attrs
[0] = talloc_strdup(mem_ctx
, range_attr
);
255 attrs
[1] = talloc_strdup(mem_ctx
, "usnChanged");
258 ADS_ERROR_HAVE_NO_MEMORY(attrs
[0]);
259 ADS_ERROR_HAVE_NO_MEMORY(attrs
[1]);
262 status
= ads_ranged_search_internal(ads
, mem_ctx
,
264 attrs
, args
, range_attr
,
265 strings
, num_strings
,
266 &first_usn
, &num_retries
,
269 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES
, ads_ntstatus(status
))) {
273 if (!ADS_ERR_OK(status
)) {
279 } while (more_values
);
282 DEBUG(10,("returning with %d strings\n", (int)*num_strings
));
287 ADS_STATUS
ads_ranged_search_internal(ADS_STRUCT
*ads
,
294 const char *range_attr
,
301 LDAPMessage
*res
= NULL
;
306 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs
[0], attrs
[1]));
308 *more_values
= False
;
310 status
= ads_do_search_retry_internal(ads
, base
, scope
, filter
, attrs
, args
, &res
);
312 if (!ADS_ERR_OK(status
)) {
313 DEBUG(1,("ads_search: %s\n",
314 ads_errstr(status
)));
319 return ADS_ERROR(LDAP_NO_MEMORY
);
322 count
= ads_count_replies(ads
, res
);
324 ads_msgfree(ads
, res
);
325 return ADS_ERROR(LDAP_SUCCESS
);
328 if (*num_strings
== 0) {
329 if (!ads_pull_uint32(ads
, res
, "usnChanged", first_usn
)) {
330 DEBUG(1, ("could not pull first usnChanged!\n"));
331 ads_msgfree(ads
, res
);
332 return ADS_ERROR(LDAP_NO_MEMORY
);
336 if (!ads_pull_uint32(ads
, res
, "usnChanged", ¤t_usn
)) {
337 DEBUG(1, ("could not pull current usnChanged!\n"));
338 ads_msgfree(ads
, res
);
339 return ADS_ERROR(LDAP_NO_MEMORY
);
342 if (*first_usn
!= current_usn
) {
343 DEBUG(5, ("USN on this record changed"
344 " - restarting search\n"));
345 if (*num_retries
< 5) {
348 ads_msgfree(ads
, res
);
349 return ADS_ERROR_NT(STATUS_MORE_ENTRIES
);
351 DEBUG(5, ("USN on this record changed"
352 " - restarted search too many times, aborting!\n"));
353 ads_msgfree(ads
, res
);
354 return ADS_ERROR(LDAP_NO_MEMORY
);
358 *strings
= ads_pull_strings_range(ads
, mem_ctx
, res
,
365 ads_msgfree(ads
, res
);
367 /* paranoia checks */
368 if (*strings
== NULL
&& *more_values
) {
369 DEBUG(0,("no strings found but more values???\n"));
370 return ADS_ERROR(LDAP_NO_MEMORY
);
372 if (*num_strings
== 0 && *more_values
) {
373 DEBUG(0,("no strings found but more values???\n"));
374 return ADS_ERROR(LDAP_NO_MEMORY
);
377 return (*more_values
) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES
) : ADS_ERROR(LDAP_SUCCESS
);