?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: make typedef write_cache private to fileio.c
[Samba/gebeck_regimport.git] / source3 / lib / smbldap.c
blob43ddaff53a67c5d5fc81f2cddb5160283bd8709c
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22
23 */
24
25 #include "includes.h"
26 #include "smbldap.h"
27 #include "../libcli/security/security.h"
28 #include <tevent.h>
29
30 /* Try not to hit the up or down server forever */
31
32 #define SMBLDAP_DONT_PING_TIME 10 /* ping only all 10 seconds */
33 #define SMBLDAP_NUM_RETRIES 8 /* retry only 8 times */
34
35 #define SMBLDAP_IDLE_TIME 150 /* After 2.5 minutes disconnect */
36
37
38 /*******************************************************************
39 Search an attribute and return the first value found.
40 ******************************************************************/
41
42 bool smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry,
43 const char *attribute, char *value,
44 int max_len)
45 {
46 char **values;
47 size_t size = 0;
48
49 if ( !attribute )
50 return False;
51
52 value[0] = '\0';
53
54 if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) {
55 DEBUG (10, ("smbldap_get_single_attribute: [%s] = [<does not exist>]\n", attribute));
56
57 return False;
58 }
59
60 if (!convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, max_len, &size)) {
61 DEBUG(1, ("smbldap_get_single_attribute: string conversion of [%s] = [%s] failed!\n",
62 attribute, values[0]));
63 ldap_value_free(values);
64 return False;
65 }
66
67 ldap_value_free(values);
68 #ifdef DEBUG_PASSWORDS
69 DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n", attribute, value));
70 #endif
71 return True;
72 }
73
74 char * smbldap_talloc_single_attribute(LDAP *ldap_struct, LDAPMessage *entry,
75 const char *attribute,
76 TALLOC_CTX *mem_ctx)
77 {
78 char **values;
79 char *result;
80 size_t converted_size;
81
82 if (attribute == NULL) {
83 return NULL;
84 }
85
86 values = ldap_get_values(ldap_struct, entry, attribute);
87
88 if (values == NULL) {
89 DEBUG(10, ("attribute %s does not exist\n", attribute));
90 return NULL;
91 }
92
93 if (ldap_count_values(values) != 1) {
94 DEBUG(10, ("attribute %s has %d values, expected only one\n",
95 attribute, ldap_count_values(values)));
96 ldap_value_free(values);
97 return NULL;
98 }
99
100 if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
101 DEBUG(10, ("pull_utf8_talloc failed\n"));
102 ldap_value_free(values);
103 return NULL;
104 }
105
106 ldap_value_free(values);
107
108 #ifdef DEBUG_PASSWORDS
109 DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
110 attribute, result));
111 #endif
112 return result;
113 }
114
115 char * smbldap_talloc_first_attribute(LDAP *ldap_struct, LDAPMessage *entry,
116 const char *attribute,
117 TALLOC_CTX *mem_ctx)
118 {
119 char **values;
120 char *result;
121 size_t converted_size;
122
123 if (attribute == NULL) {
124 return NULL;
125 }
126
127 values = ldap_get_values(ldap_struct, entry, attribute);
128
129 if (values == NULL) {
130 DEBUG(10, ("attribute %s does not exist\n", attribute));
131 return NULL;
132 }
133
134 if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
135 DEBUG(10, ("pull_utf8_talloc failed\n"));
136 ldap_value_free(values);
137 return NULL;
138 }
139
140 ldap_value_free(values);
141
142 #ifdef DEBUG_PASSWORDS
143 DEBUG (100, ("smbldap_get_first_attribute: [%s] = [%s]\n",
144 attribute, result));
145 #endif
146 return result;
147 }
148
149 char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
150 const char *attribute,
151 TALLOC_CTX *mem_ctx)
152 {
153 char **values;
154 char *result;
155 size_t converted_size;
156 int i, num_values;
157
158 if (attribute == NULL) {
159 return NULL;
160 }
161
162 values = ldap_get_values(ldap_struct, entry, attribute);
163
164 if (values == NULL) {
165 DEBUG(10, ("attribute %s does not exist\n", attribute));
166 return NULL;
167 }
168
169 if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
170 DEBUG(10, ("pull_utf8_talloc failed\n"));
171 ldap_value_free(values);
172 return NULL;
173 }
174
175 num_values = ldap_count_values(values);
176
177 for (i=1; i<num_values; i++) {
178 char *tmp;
179
180 if (!pull_utf8_talloc(mem_ctx, &tmp, values[i],
181 &converted_size)) {
182 DEBUG(10, ("pull_utf8_talloc failed\n"));
183 TALLOC_FREE(result);
184 ldap_value_free(values);
185 return NULL;
186 }
187
188 if (strcasecmp_m(tmp, result) < 0) {
189 TALLOC_FREE(result);
190 result = tmp;
191 } else {
192 TALLOC_FREE(tmp);
193 }
194 }
195
196 ldap_value_free(values);
197
198 #ifdef DEBUG_PASSWORDS
199 DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
200 attribute, result));
201 #endif
202 return result;
203 }
204
205 bool smbldap_talloc_single_blob(TALLOC_CTX *mem_ctx, LDAP *ld,
206 LDAPMessage *msg, const char *attrib,
207 DATA_BLOB *blob)
208 {
209 struct berval **values;
210
211 values = ldap_get_values_len(ld, msg, attrib);
212 if (!values) {
213 return false;
214 }
215
216 if (ldap_count_values_len(values) != 1) {
217 DEBUG(10, ("Expected one value for %s, got %d\n", attrib,
218 ldap_count_values_len(values)));
219 return false;
220 }
221
222 *blob = data_blob_talloc(mem_ctx, values[0]->bv_val,
223 values[0]->bv_len);
224 ldap_value_free_len(values);
225
226 return (blob->data != NULL);
227 }
228
229 bool smbldap_pull_sid(LDAP *ld, LDAPMessage *msg, const char *attrib,
230 struct dom_sid *sid)
231 {
232 DATA_BLOB blob;
233 bool ret;
234
235 if (!smbldap_talloc_single_blob(talloc_tos(), ld, msg, attrib,
236 &blob)) {
237 return false;
238 }
239 ret = sid_parse((char *)blob.data, blob.length, sid);
240 TALLOC_FREE(blob.data);
241 return ret;
242 }
243
244 static int ldapmsg_destructor(LDAPMessage **result) {
245 ldap_msgfree(*result);
246 return 0;
247 }
248
249 void talloc_autofree_ldapmsg(TALLOC_CTX *mem_ctx, LDAPMessage *result)
250 {
251 LDAPMessage **handle;
252
253 if (result == NULL) {
254 return;
255 }
256
257 handle = talloc(mem_ctx, LDAPMessage *);
258 SMB_ASSERT(handle != NULL);
259
260 *handle = result;
261 talloc_set_destructor(handle, ldapmsg_destructor);
262 }
263
264 static int ldapmod_destructor(LDAPMod ***mod) {
265 ldap_mods_free(*mod, True);
266 return 0;
267 }
268
269 void talloc_autofree_ldapmod(TALLOC_CTX *mem_ctx, LDAPMod **mod)
270 {
271 LDAPMod ***handle;
272
273 if (mod == NULL) {
274 return;
275 }
276
277 handle = talloc(mem_ctx, LDAPMod **);
278 SMB_ASSERT(handle != NULL);
279
280 *handle = mod;
281 talloc_set_destructor(handle, ldapmod_destructor);
282 }
283
284 /************************************************************************
285 Routine to manage the LDAPMod structure array
286 manage memory used by the array, by each struct, and values
287 ***********************************************************************/
288
289 static void smbldap_set_mod_internal(LDAPMod *** modlist, int modop, const char *attribute, const char *value, const DATA_BLOB *blob)
290 {
291 LDAPMod **mods;
292 int i;
293 int j;
294
295 mods = *modlist;
296
297 /* sanity checks on the mod values */
298
299 if (attribute == NULL || *attribute == '\0') {
300 return;
301 }
302
303 #if 0 /* commented out after discussion with abartlet. Do not reenable.
304 left here so other do not re-add similar code --jerry */
305 if (value == NULL || *value == '\0')
306 return;
307 #endif
308
309 if (mods == NULL) {
310 mods = SMB_MALLOC_P(LDAPMod *);
311 if (mods == NULL) {
312 smb_panic("smbldap_set_mod: out of memory!");
313 /* notreached. */
314 }
315 mods[0] = NULL;
316 }
317
318 for (i = 0; mods[i] != NULL; ++i) {
319 if (mods[i]->mod_op == modop && strequal(mods[i]->mod_type, attribute))
320 break;
321 }
322
323 if (mods[i] == NULL) {
324 mods = SMB_REALLOC_ARRAY (mods, LDAPMod *, i + 2);
325 if (mods == NULL) {
326 smb_panic("smbldap_set_mod: out of memory!");
327 /* notreached. */
328 }
329 mods[i] = SMB_MALLOC_P(LDAPMod);
330 if (mods[i] == NULL) {
331 smb_panic("smbldap_set_mod: out of memory!");
332 /* notreached. */
333 }
334 mods[i]->mod_op = modop;
335 mods[i]->mod_values = NULL;
336 mods[i]->mod_type = SMB_STRDUP(attribute);
337 mods[i + 1] = NULL;
338 }
339
340 if (blob && (modop & LDAP_MOD_BVALUES)) {
341 j = 0;
342 if (mods[i]->mod_bvalues != NULL) {
343 for (; mods[i]->mod_bvalues[j] != NULL; j++);
344 }
345 mods[i]->mod_bvalues = SMB_REALLOC_ARRAY(mods[i]->mod_bvalues, struct berval *, j + 2);
346
347 if (mods[i]->mod_bvalues == NULL) {
348 smb_panic("smbldap_set_mod: out of memory!");
349 /* notreached. */
350 }
351
352 mods[i]->mod_bvalues[j] = SMB_MALLOC_P(struct berval);
353 SMB_ASSERT(mods[i]->mod_bvalues[j] != NULL);
354
355 mods[i]->mod_bvalues[j]->bv_val = (char *)memdup(blob->data, blob->length);
356 SMB_ASSERT(mods[i]->mod_bvalues[j]->bv_val != NULL);
357 mods[i]->mod_bvalues[j]->bv_len = blob->length;
358
359 mods[i]->mod_bvalues[j + 1] = NULL;
360 } else if (value != NULL) {
361 char *utf8_value = NULL;
362 size_t converted_size;
363
364 j = 0;
365 if (mods[i]->mod_values != NULL) {
366 for (; mods[i]->mod_values[j] != NULL; j++);
367 }
368 mods[i]->mod_values = SMB_REALLOC_ARRAY(mods[i]->mod_values, char *, j + 2);
369
370 if (mods[i]->mod_values == NULL) {
371 smb_panic("smbldap_set_mod: out of memory!");
372 /* notreached. */
373 }
374
375 if (!push_utf8_talloc(talloc_tos(), &utf8_value, value, &converted_size)) {
376 smb_panic("smbldap_set_mod: String conversion failure!");
377 /* notreached. */
378 }
379
380 mods[i]->mod_values[j] = SMB_STRDUP(utf8_value);
381 TALLOC_FREE(utf8_value);
382 SMB_ASSERT(mods[i]->mod_values[j] != NULL);
383
384 mods[i]->mod_values[j + 1] = NULL;
385 }
386 *modlist = mods;
387 }
388
389 void smbldap_set_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value)
390 {
391 smbldap_set_mod_internal(modlist, modop, attribute, value, NULL);
392 }
393
394 void smbldap_set_mod_blob(LDAPMod *** modlist, int modop, const char *attribute, const DATA_BLOB *value)
395 {
396 smbldap_set_mod_internal(modlist, modop | LDAP_MOD_BVALUES, attribute, NULL, value);
397 }
398
399 /**********************************************************************
400 Set attribute to newval in LDAP, regardless of what value the
401 attribute had in LDAP before.
402 *********************************************************************/
403
404 static void smbldap_make_mod_internal(LDAP *ldap_struct, LDAPMessage *existing,
405 LDAPMod ***mods,
406 const char *attribute, int op,
407 const char *newval,
408 const DATA_BLOB *newblob)
409 {
410 char oldval[2048]; /* current largest allowed value is mungeddial */
411 bool existed;
412 DATA_BLOB oldblob = data_blob_null;
413
414 if (attribute == NULL) {
415 /* This can actually happen for ldapsam_compat where we for
416 * example don't have a password history */
417 return;
418 }
419
420 if (existing != NULL) {
421 if (op & LDAP_MOD_BVALUES) {
422 existed = smbldap_talloc_single_blob(talloc_tos(), ldap_struct, existing, attribute, &oldblob);
423 } else {
424 existed = smbldap_get_single_attribute(ldap_struct, existing, attribute, oldval, sizeof(oldval));
425 }
426 } else {
427 existed = False;
428 *oldval = '\0';
429 }
430
431 if (existed) {
432 bool equal = false;
433 if (op & LDAP_MOD_BVALUES) {
434 equal = (newblob && (data_blob_cmp(&oldblob, newblob) == 0));
435 } else {
436 /* all of our string attributes are case insensitive */
437 equal = (newval && (strcasecmp_m(oldval, newval) == 0));
438 }
439
440 if (equal) {
441 /* Believe it or not, but LDAP will deny a delete and
442 an add at the same time if the values are the
443 same... */
444 DEBUG(10,("smbldap_make_mod: attribute |%s| not changed.\n", attribute));
445 return;
446 }
447
448 /* There has been no value before, so don't delete it.
449 * Here's a possible race: We might end up with
450 * duplicate attributes */
451 /* By deleting exactly the value we found in the entry this
452 * should be race-free in the sense that the LDAP-Server will
453 * deny the complete operation if somebody changed the
454 * attribute behind our back. */
455 /* This will also allow modifying single valued attributes
456 * in Novell NDS. In NDS you have to first remove attribute and then
457 * you could add new value */
458
459 if (op & LDAP_MOD_BVALUES) {
460 DEBUG(10,("smbldap_make_mod: deleting attribute |%s| blob\n", attribute));
461 smbldap_set_mod_blob(mods, LDAP_MOD_DELETE, attribute, &oldblob);
462 } else {
463 DEBUG(10,("smbldap_make_mod: deleting attribute |%s| values |%s|\n", attribute, oldval));
464 smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, oldval);
465 }
466 }
467
468 /* Regardless of the real operation (add or modify)
469 we add the new value here. We rely on deleting
470 the old value, should it exist. */
471
472 if (op & LDAP_MOD_BVALUES) {
473 if (newblob && newblob->length) {
474 DEBUG(10,("smbldap_make_mod: adding attribute |%s| blob\n", attribute));
475 smbldap_set_mod_blob(mods, LDAP_MOD_ADD, attribute, newblob);
476 }
477 } else {
478 if ((newval != NULL) && (strlen(newval) > 0)) {
479 DEBUG(10,("smbldap_make_mod: adding attribute |%s| value |%s|\n", attribute, newval));
480 smbldap_set_mod(mods, LDAP_MOD_ADD, attribute, newval);
481 }
482 }
483 }
484
485 void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing,
486 LDAPMod ***mods,
487 const char *attribute, const char *newval)
488 {
489 smbldap_make_mod_internal(ldap_struct, existing, mods, attribute,
490 0, newval, NULL);
491 }
492
493 void smbldap_make_mod_blob(LDAP *ldap_struct, LDAPMessage *existing,
494 LDAPMod ***mods,
495 const char *attribute, const DATA_BLOB *newblob)
496 {
497 smbldap_make_mod_internal(ldap_struct, existing, mods, attribute,
498 LDAP_MOD_BVALUES, NULL, newblob);
499 }
500
501 /**********************************************************************
502 Some varients of the LDAP rebind code do not pass in the third 'arg'
503 pointer to a void*, so we try and work around it by assuming that the
504 value of the 'LDAP *' pointer is the same as the one we had passed in
505 **********************************************************************/
506
507 struct smbldap_state_lookup {
508 LDAP *ld;
509 struct smbldap_state *smbldap_state;
510 struct smbldap_state_lookup *prev, *next;
511 };
512
513 static struct smbldap_state_lookup *smbldap_state_lookup_list;
514
515 static struct smbldap_state *smbldap_find_state(LDAP *ld)
516 {
517 struct smbldap_state_lookup *t;
518
519 for (t = smbldap_state_lookup_list; t; t = t->next) {
520 if (t->ld == ld) {
521 return t->smbldap_state;
522 }
523 }
524 return NULL;
525 }
526
527 static void smbldap_delete_state(struct smbldap_state *smbldap_state)
528 {
529 struct smbldap_state_lookup *t;
530
531 for (t = smbldap_state_lookup_list; t; t = t->next) {
532 if (t->smbldap_state == smbldap_state) {
533 DLIST_REMOVE(smbldap_state_lookup_list, t);
534 SAFE_FREE(t);
535 return;
536 }
537 }
538 }
539
540 static void smbldap_store_state(LDAP *ld, struct smbldap_state *smbldap_state)
541 {
542 struct smbldap_state *tmp_ldap_state;
543 struct smbldap_state_lookup *t;
544
545 if ((tmp_ldap_state = smbldap_find_state(ld))) {
546 SMB_ASSERT(tmp_ldap_state == smbldap_state);
547 return;
548 }
549
550 t = SMB_XMALLOC_P(struct smbldap_state_lookup);
551 ZERO_STRUCTP(t);
552
553 DLIST_ADD_END(smbldap_state_lookup_list, t, struct smbldap_state_lookup *);
554 t->ld = ld;
555 t->smbldap_state = smbldap_state;
556 }
557
558 /********************************************************************
559 start TLS on an existing LDAP connection
560 *******************************************************************/
561
562 int smb_ldap_start_tls(LDAP *ldap_struct, int version)
563 {
564 #ifdef LDAP_OPT_X_TLS
565 int rc;
566 #endif
567
568 if (lp_ldap_ssl() != LDAP_SSL_START_TLS) {
569 return LDAP_SUCCESS;
570 }
571
572 #ifdef LDAP_OPT_X_TLS
573 if (version != LDAP_VERSION3) {
574 DEBUG(0, ("Need LDAPv3 for Start TLS\n"));
575 return LDAP_OPERATIONS_ERROR;
576 }
577
578 if ((rc = ldap_start_tls_s (ldap_struct, NULL, NULL)) != LDAP_SUCCESS) {
579 DEBUG(0,("Failed to issue the StartTLS instruction: %s\n",
580 ldap_err2string(rc)));
581 return rc;
582 }
583
584 DEBUG (3, ("StartTLS issued: using a TLS connection\n"));
585 return LDAP_SUCCESS;
586 #else
587 DEBUG(0,("StartTLS not supported by LDAP client libraries!\n"));
588 return LDAP_OPERATIONS_ERROR;
589 #endif
590 }
591
592 /********************************************************************
593 setup a connection to the LDAP server based on a uri
594 *******************************************************************/
595
596 static int smb_ldap_setup_conn(LDAP **ldap_struct, const char *uri)
597 {
598 int rc;
599
600 DEBUG(10, ("smb_ldap_setup_connection: %s\n", uri));
601
602 #ifdef HAVE_LDAP_INITIALIZE
603
604 rc = ldap_initialize(ldap_struct, uri);
605 if (rc) {
606 DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc)));
607 return rc;
608 }
609
610 if (lp_ldap_follow_referral() != Auto) {
611 rc = ldap_set_option(*ldap_struct, LDAP_OPT_REFERRALS,
612 lp_ldap_follow_referral() ? LDAP_OPT_ON : LDAP_OPT_OFF);
613 if (rc != LDAP_SUCCESS)
614 DEBUG(0, ("Failed to set LDAP_OPT_REFERRALS: %s\n",
615 ldap_err2string(rc)));
616 }
617
618 return LDAP_SUCCESS;
619 #else
620
621 /* Parse the string manually */
622
623 {
624 int port = 0;
625 fstring protocol;
626 fstring host;
627 SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254);
628
629
630 /* skip leading "URL:" (if any) */
631 if ( strnequal( uri, "URL:", 4 ) ) {
632 uri += 4;
633 }
634
635 sscanf(uri, "%10[^:]://%254[^:/]:%d", protocol, host, &port);
636
637 if (port == 0) {
638 if (strequal(protocol, "ldap")) {
639 port = LDAP_PORT;
640 } else if (strequal(protocol, "ldaps")) {
641 port = LDAPS_PORT;
642 } else {
643 DEBUG(0, ("unrecognised protocol (%s)!\n", protocol));
644 }
645 }
646
647 if ((*ldap_struct = ldap_init(host, port)) == NULL) {
648 DEBUG(0, ("ldap_init failed !\n"));
649 return LDAP_OPERATIONS_ERROR;
650 }
651
652 if (strequal(protocol, "ldaps")) {
653 #ifdef LDAP_OPT_X_TLS
654 int tls = LDAP_OPT_X_TLS_HARD;
655 if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
656 {
657 DEBUG(0, ("Failed to setup a TLS session\n"));
658 }
659
660 DEBUG(3,("LDAPS option set...!\n"));
661 #else
662 DEBUG(0,("smbldap_open_connection: Secure connection not supported by LDAP client libraries!\n"));
663 return LDAP_OPERATIONS_ERROR;
664 #endif /* LDAP_OPT_X_TLS */
665 }
666 }
667 #endif /* HAVE_LDAP_INITIALIZE */
668
669 /* now set connection timeout */
670 #ifdef LDAP_X_OPT_CONNECT_TIMEOUT /* Netscape */
671 {
672 int ct = lp_ldap_connection_timeout()*1000;
673 rc = ldap_set_option(*ldap_struct, LDAP_X_OPT_CONNECT_TIMEOUT, &ct);
674 if (rc != LDAP_SUCCESS) {
675 DEBUG(0,("Failed to setup an ldap connection timeout %d: %s\n",
676 ct, ldap_err2string(rc)));
677 }
678 }
679 #elif defined (LDAP_OPT_NETWORK_TIMEOUT) /* OpenLDAP */
680 {
681 struct timeval ct;
682 ct.tv_usec = 0;
683 ct.tv_sec = lp_ldap_connection_timeout();
684 rc = ldap_set_option(*ldap_struct, LDAP_OPT_NETWORK_TIMEOUT, &ct);
685 if (rc != LDAP_SUCCESS) {
686 DEBUG(0,("Failed to setup an ldap connection timeout %d: %s\n",
687 (int)ct.tv_sec, ldap_err2string(rc)));
688 }
689 }
690 #endif
691
692 return LDAP_SUCCESS;
693 }
694
695 /********************************************************************
696 try to upgrade to Version 3 LDAP if not already, in either case return current
697 version
698 *******************************************************************/
699
700 static int smb_ldap_upgrade_conn(LDAP *ldap_struct, int *new_version)
701 {
702 int version;
703 int rc;
704
705 /* assume the worst */
706 *new_version = LDAP_VERSION2;
707
708 rc = ldap_get_option(ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
709 if (rc) {
710 return rc;
711 }
712
713 if (version == LDAP_VERSION3) {
714 *new_version = LDAP_VERSION3;
715 return LDAP_SUCCESS;
716 }
717
718 /* try upgrade */
719 version = LDAP_VERSION3;
720 rc = ldap_set_option (ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
721 if (rc) {
722 return rc;
723 }
724
725 *new_version = LDAP_VERSION3;
726 return LDAP_SUCCESS;
727 }
728
729 /*******************************************************************
730 open a connection to the ldap server (just until the bind)
731 ******************************************************************/
732
733 int smb_ldap_setup_full_conn(LDAP **ldap_struct, const char *uri)
734 {
735 int rc, version;
736
737 rc = smb_ldap_setup_conn(ldap_struct, uri);
738 if (rc) {
739 return rc;
740 }
741
742 rc = smb_ldap_upgrade_conn(*ldap_struct, &version);
743 if (rc) {
744 return rc;
745 }
746
747 rc = smb_ldap_start_tls(*ldap_struct, version);
748 if (rc) {
749 return rc;
750 }
751
752 return LDAP_SUCCESS;
753 }
754
755 /*******************************************************************
756 open a connection to the ldap server.
757 ******************************************************************/
758 static int smbldap_open_connection (struct smbldap_state *ldap_state)
759
760 {
761 int rc = LDAP_SUCCESS;
762 int version;
763 int deref;
764 LDAP **ldap_struct = &ldap_state->ldap_struct;
765
766 rc = smb_ldap_setup_conn(ldap_struct, ldap_state->uri);
767 if (rc) {
768 return rc;
769 }
770
771 /* Store the LDAP pointer in a lookup list */
772
773 smbldap_store_state(*ldap_struct, ldap_state);
774
775 /* Upgrade to LDAPv3 if possible */
776
777 rc = smb_ldap_upgrade_conn(*ldap_struct, &version);
778 if (rc) {
779 return rc;
780 }
781
782 /* Start TLS if required */
783
784 rc = smb_ldap_start_tls(*ldap_struct, version);
785 if (rc) {
786 return rc;
787 }
788
789 /* Set alias dereferencing method */
790 deref = lp_ldap_deref();
791 if (deref != -1) {
792 if (ldap_set_option (*ldap_struct, LDAP_OPT_DEREF, &deref) != LDAP_OPT_SUCCESS) {
793 DEBUG(1,("smbldap_open_connection: Failed to set dereferencing method: %d\n", deref));
794 } else {
795 DEBUG(5,("Set dereferencing method: %d\n", deref));
796 }
797 }
798
799 DEBUG(2, ("smbldap_open_connection: connection opened\n"));
800 return rc;
801 }
802
803 /*******************************************************************
804 a rebind function for authenticated referrals
805 This version takes a void* that we can shove useful stuff in :-)
806 ******************************************************************/
807 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
808 #else
809 static int rebindproc_with_state (LDAP * ld, char **whop, char **credp,
810 int *methodp, int freeit, void *arg)
811 {
812 struct smbldap_state *ldap_state = arg;
813 struct timespec ts;
814
815 /** @TODO Should we be doing something to check what servers we rebind to?
816 Could we get a referral to a machine that we don't want to give our
817 username and password to? */
818
819 if (freeit) {
820 SAFE_FREE(*whop);
821 if (*credp) {
822 memset(*credp, '\0', strlen(*credp));
823 }
824 SAFE_FREE(*credp);
825 } else {
826 DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",
827 ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
828
829 if (ldap_state->anonymous) {
830 *whop = NULL;
831 *credp = NULL;
832 } else {
833 *whop = SMB_STRDUP(ldap_state->bind_dn);
834 if (!*whop) {
835 return LDAP_NO_MEMORY;
836 }
837 *credp = SMB_STRDUP(ldap_state->bind_secret);
838 if (!*credp) {
839 SAFE_FREE(*whop);
840 return LDAP_NO_MEMORY;
841 }
842 }
843 *methodp = LDAP_AUTH_SIMPLE;
844 }
845
846 clock_gettime_mono(&ts);
847 ldap_state->last_rebind = convert_timespec_to_timeval(ts);
848
849 return 0;
850 }
851 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
852
853 /*******************************************************************
854 a rebind function for authenticated referrals
855 This version takes a void* that we can shove useful stuff in :-)
856 and actually does the connection.
857 ******************************************************************/
858 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
859 static int rebindproc_connect_with_state (LDAP *ldap_struct,
860 LDAP_CONST char *url,
861 ber_tag_t request,
862 ber_int_t msgid, void *arg)
863 {
864 struct smbldap_state *ldap_state =
865 (struct smbldap_state *)arg;
866 int rc;
867 struct timespec ts;
868 int version;
869
870 DEBUG(5,("rebindproc_connect_with_state: Rebinding to %s as \"%s\"\n",
871 url, ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
872
873 /* call START_TLS again (ldaps:// is handled by the OpenLDAP library
874 * itself) before rebinding to another LDAP server to avoid to expose
875 * our credentials. At least *try* to secure the connection - Guenther */
876
877 smb_ldap_upgrade_conn(ldap_struct, &version);
878 smb_ldap_start_tls(ldap_struct, version);
879
880 /** @TODO Should we be doing something to check what servers we rebind to?
881 Could we get a referral to a machine that we don't want to give our
882 username and password to? */
883
884 rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
885
886 /* only set the last rebind timestamp when we did rebind after a
887 * non-read LDAP operation. That way we avoid the replication sleep
888 * after a simple redirected search operation - Guenther */
889
890 switch (request) {
891
892 case LDAP_REQ_MODIFY:
893 case LDAP_REQ_ADD:
894 case LDAP_REQ_DELETE:
895 case LDAP_REQ_MODDN:
896 case LDAP_REQ_EXTENDED:
897 DEBUG(10,("rebindproc_connect_with_state: "
898 "setting last_rebind timestamp "
899 "(req: 0x%02x)\n", (unsigned int)request));
900 clock_gettime_mono(&ts);
901 ldap_state->last_rebind = convert_timespec_to_timeval(ts);
902 break;
903 default:
904 ZERO_STRUCT(ldap_state->last_rebind);
905 break;
906 }
907
908 return rc;
909 }
910 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
911
912 /*******************************************************************
913 Add a rebind function for authenticated referrals
914 ******************************************************************/
915 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
916 #else
917 # if LDAP_SET_REBIND_PROC_ARGS == 2
918 static int rebindproc (LDAP *ldap_struct, char **whop, char **credp,
919 int *method, int freeit )
920 {
921 struct smbldap_state *ldap_state = smbldap_find_state(ldap_struct);
922
923 return rebindproc_with_state(ldap_struct, whop, credp,
924 method, freeit, ldap_state);
925 }
926 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
927 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
928
929 /*******************************************************************
930 a rebind function for authenticated referrals
931 this also does the connection, but no void*.
932 ******************************************************************/
933 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
934 # if LDAP_SET_REBIND_PROC_ARGS == 2
935 static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request,
936 ber_int_t msgid)
937 {
938 struct smbldap_state *ldap_state = smbldap_find_state(ld);
939
940 return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid,
941 ldap_state);
942 }
943 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
944 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
945
946 /*******************************************************************
947 connect to the ldap server under system privilege.
948 ******************************************************************/
949 static int smbldap_connect_system(struct smbldap_state *ldap_state)
950 {
951 LDAP *ldap_struct = ldap_state->ldap_struct;
952 int rc;
953 int version;
954
955 /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite
956 (OpenLDAP) doesnt' seem to support it */
957
958 DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n",
959 ldap_state->uri, ldap_state->bind_dn));
960
961 #ifdef HAVE_LDAP_SET_REBIND_PROC
962 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
963 # if LDAP_SET_REBIND_PROC_ARGS == 2
964 ldap_set_rebind_proc(ldap_struct, &rebindproc_connect);
965 # endif
966 # if LDAP_SET_REBIND_PROC_ARGS == 3
967 ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state);
968 # endif
969 #else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
970 # if LDAP_SET_REBIND_PROC_ARGS == 2
971 ldap_set_rebind_proc(ldap_struct, &rebindproc);
972 # endif
973 # if LDAP_SET_REBIND_PROC_ARGS == 3
974 ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state);
975 # endif
976 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
977 #endif
978
979 /* When there is an alternative bind callback is set,
980 attempt to use it to perform the bind */
981 if (ldap_state->bind_callback != NULL) {
982 /* We have to allow bind callback to be run under become_root/unbecome_root
983 to make sure within smbd the callback has proper write access to its resources,
984 like credential cache. This is similar to passdb case where this callback is supposed
985 to be used. When used outside smbd, become_root()/unbecome_root() are no-op.
986 */
987 become_root();
988 rc = ldap_state->bind_callback(ldap_struct, ldap_state, ldap_state->bind_callback_data);
989 unbecome_root();
990 } else {
991 rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
992 }
993
994 if (rc != LDAP_SUCCESS) {
995 char *ld_error = NULL;
996 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
997 &ld_error);
998 DEBUG(ldap_state->num_failures ? 2 : 0,
999 ("failed to bind to server %s with dn=\"%s\" Error: %s\n\t%s\n",
1000 ldap_state->uri,
1001 ldap_state->bind_dn ? ldap_state->bind_dn : "[Anonymous bind]",
1002 ldap_err2string(rc),
1003 ld_error ? ld_error : "(unknown)"));
1004 SAFE_FREE(ld_error);
1005 ldap_state->num_failures++;
1006 goto done;
1007 }
1008
1009 ldap_state->num_failures = 0;
1010 ldap_state->paged_results = False;
1011
1012 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
1013
1014 if (smbldap_has_control(ldap_state->ldap_struct, ADS_PAGE_CTL_OID) && version == 3) {
1015 ldap_state->paged_results = True;
1016 }
1017
1018 DEBUG(3, ("ldap_connect_system: successful connection to the LDAP server\n"));
1019 DEBUGADD(10, ("ldap_connect_system: LDAP server %s support paged results\n",
1020 ldap_state->paged_results ? "does" : "does not"));
1021 done:
1022 if (rc != 0) {
1023 ldap_unbind(ldap_struct);
1024 ldap_state->ldap_struct = NULL;
1025 }
1026 return rc;
1027 }
1028
1029 static void smbldap_idle_fn(struct tevent_context *tevent_ctx,
1030 struct timed_event *te,
1031 struct timeval now_abs,
1032 void *private_data);
1033
1034 /**********************************************************************
1035 Connect to LDAP server (called before every ldap operation)
1036 *********************************************************************/
1037 static int smbldap_open(struct smbldap_state *ldap_state)
1038 {
1039 int rc, opt_rc;
1040 bool reopen = False;
1041 SMB_ASSERT(ldap_state);
1042
1043 if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + SMBLDAP_DONT_PING_TIME) < time_mono(NULL))) {
1044
1045 #ifdef HAVE_UNIXSOCKET
1046 struct sockaddr_un addr;
1047 #else
1048 struct sockaddr addr;
1049 #endif
1050 socklen_t len = sizeof(addr);
1051 int sd;
1052
1053 opt_rc = ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd);
1054 if (opt_rc == 0 && (getpeername(sd, (struct sockaddr *) &addr, &len)) < 0 )
1055 reopen = True;
1056
1057 #ifdef HAVE_UNIXSOCKET
1058 if (opt_rc == 0 && addr.sun_family == AF_UNIX)
1059 reopen = True;
1060 #endif
1061 if (reopen) {
1062 /* the other end has died. reopen. */
1063 ldap_unbind(ldap_state->ldap_struct);
1064 ldap_state->ldap_struct = NULL;
1065 ldap_state->last_ping = (time_t)0;
1066 } else {
1067 ldap_state->last_ping = time_mono(NULL);
1068 }
1069 }
1070
1071 if (ldap_state->ldap_struct != NULL) {
1072 DEBUG(11,("smbldap_open: already connected to the LDAP server\n"));
1073 return LDAP_SUCCESS;
1074 }
1075
1076 if ((rc = smbldap_open_connection(ldap_state))) {
1077 return rc;
1078 }
1079
1080 if ((rc = smbldap_connect_system(ldap_state))) {
1081 return rc;
1082 }
1083
1084
1085 ldap_state->last_ping = time_mono(NULL);
1086 ldap_state->pid = getpid();
1087
1088 TALLOC_FREE(ldap_state->idle_event);
1089
1090 if (ldap_state->tevent_context != NULL) {
1091 ldap_state->idle_event = tevent_add_timer(
1092 ldap_state->tevent_context, ldap_state,
1093 timeval_current_ofs(SMBLDAP_IDLE_TIME, 0),
1094 smbldap_idle_fn, ldap_state);
1095 }
1096
1097 DEBUG(4,("The LDAP server is successfully connected\n"));
1098
1099 return LDAP_SUCCESS;
1100 }
1101
1102 /**********************************************************************
1103 Disconnect from LDAP server
1104 *********************************************************************/
1105 static NTSTATUS smbldap_close(struct smbldap_state *ldap_state)
1106 {
1107 if (!ldap_state)
1108 return NT_STATUS_INVALID_PARAMETER;
1109
1110 if (ldap_state->ldap_struct != NULL) {
1111 ldap_unbind(ldap_state->ldap_struct);
1112 ldap_state->ldap_struct = NULL;
1113 }
1114
1115 smbldap_delete_state(ldap_state);
1116
1117 TALLOC_FREE(ldap_state->idle_event);
1118
1119 DEBUG(5,("The connection to the LDAP server was closed\n"));
1120 /* maybe free the results here --metze */
1121
1122 return NT_STATUS_OK;
1123 }
1124
1125 static SIG_ATOMIC_T got_alarm;
1126
1127 static void gotalarm_sig(int dummy)
1128 {
1129 got_alarm = 1;
1130 }
1131
1132 static time_t calc_ldap_abs_endtime(int ldap_to)
1133 {
1134 if (ldap_to == 0) {
1135 /* No timeout - don't
1136 return a value for
1137 the alarm. */
1138 return (time_t)0;
1139 }
1140
1141 /* Make the alarm time one second beyond
1142 the timout we're setting for the
1143 remote search timeout, to allow that
1144 to fire in preference. */
1145
1146 return time_mono(NULL)+ldap_to+1;
1147 }
1148
1149 static int end_ldap_local_alarm(time_t absolute_endtime, int rc)
1150 {
1151 if (absolute_endtime) {
1152 alarm(0);
1153 CatchSignal(SIGALRM, SIG_IGN);
1154 if (got_alarm) {
1155 /* Client timeout error code. */
1156 got_alarm = 0;
1157 return LDAP_TIMEOUT;
1158 }
1159 }
1160 return rc;
1161 }
1162
1163 static void setup_ldap_local_alarm(struct smbldap_state *ldap_state, time_t absolute_endtime)
1164 {
1165 time_t now = time_mono(NULL);
1166
1167 if (absolute_endtime) {
1168 got_alarm = 0;
1169 CatchSignal(SIGALRM, gotalarm_sig);
1170 alarm(absolute_endtime - now);
1171 }
1172
1173 if (ldap_state->pid != getpid()) {
1174 smbldap_close(ldap_state);
1175 }
1176 }
1177
1178 static void get_ldap_errs(struct smbldap_state *ldap_state, char **pp_ld_error, int *p_ld_errno)
1179 {
1180 ldap_get_option(ldap_state->ldap_struct,
1181 LDAP_OPT_ERROR_NUMBER, p_ld_errno);
1182
1183 ldap_get_option(ldap_state->ldap_struct,
1184 LDAP_OPT_ERROR_STRING, pp_ld_error);
1185 }
1186
1187 static int get_cached_ldap_connect(struct smbldap_state *ldap_state, time_t abs_endtime)
1188 {
1189 int attempts = 0;
1190
1191 while (1) {
1192 int rc;
1193 time_t now;
1194
1195 now = time_mono(NULL);
1196 ldap_state->last_use = now;
1197
1198 if (abs_endtime && now > abs_endtime) {
1199 smbldap_close(ldap_state);
1200 return LDAP_TIMEOUT;
1201 }
1202
1203 rc = smbldap_open(ldap_state);
1204
1205 if (rc == LDAP_SUCCESS) {
1206 return LDAP_SUCCESS;
1207 }
1208
1209 attempts++;
1210 DEBUG(1, ("Connection to LDAP server failed for the "
1211 "%d try!\n", attempts));
1212
1213 if (rc == LDAP_INSUFFICIENT_ACCESS) {
1214 /* The fact that we are non-root or any other
1215 * access-denied condition will not change in the next
1216 * round of trying */
1217 return rc;
1218 }
1219
1220 if (got_alarm) {
1221 smbldap_close(ldap_state);
1222 return LDAP_TIMEOUT;
1223 }
1224
1225 smb_msleep(1000);
1226
1227 if (got_alarm) {
1228 smbldap_close(ldap_state);
1229 return LDAP_TIMEOUT;
1230 }
1231 }
1232 }
1233
1234 /*********************************************************************
1235 ********************************************************************/
1236
1237 static int smbldap_search_ext(struct smbldap_state *ldap_state,
1238 const char *base, int scope, const char *filter,
1239 const char *attrs[], int attrsonly,
1240 LDAPControl **sctrls, LDAPControl **cctrls,
1241 int sizelimit, LDAPMessage **res)
1242 {
1243 int rc = LDAP_SERVER_DOWN;
1244 char *utf8_filter;
1245 int to = lp_ldap_timeout();
1246 time_t abs_endtime = calc_ldap_abs_endtime(to);
1247 struct timeval timeout;
1248 struct timeval *timeout_ptr = NULL;
1249 size_t converted_size;
1250
1251 SMB_ASSERT(ldap_state);
1252
1253 DEBUG(5,("smbldap_search_ext: base => [%s], filter => [%s], "
1254 "scope => [%d]\n", base, filter, scope));
1255
1256 if (ldap_state->last_rebind.tv_sec > 0) {
1257 struct timeval tval;
1258 struct timespec ts;
1259 int64_t tdiff = 0;
1260 int sleep_time = 0;
1261
1262 clock_gettime_mono(&ts);
1263 tval = convert_timespec_to_timeval(ts);
1264
1265 tdiff = usec_time_diff(&tval, &ldap_state->last_rebind);
1266 tdiff /= 1000; /* Convert to milliseconds. */
1267
1268 sleep_time = lp_ldap_replication_sleep()-(int)tdiff;
1269 sleep_time = MIN(sleep_time, MAX_LDAP_REPLICATION_SLEEP_TIME);
1270
1271 if (sleep_time > 0) {
1272 /* we wait for the LDAP replication */
1273 DEBUG(5,("smbldap_search_ext: waiting %d milliseconds "
1274 "for LDAP replication.\n",sleep_time));
1275 smb_msleep(sleep_time);
1276 DEBUG(5,("smbldap_search_ext: go on!\n"));
1277 }
1278 ZERO_STRUCT(ldap_state->last_rebind);
1279 }
1280
1281 if (!push_utf8_talloc(talloc_tos(), &utf8_filter, filter, &converted_size)) {
1282 return LDAP_NO_MEMORY;
1283 }
1284
1285 /* Setup remote timeout for the ldap_search_ext_s call. */
1286 if (to) {
1287 timeout.tv_sec = to;
1288 timeout.tv_usec = 0;
1289 timeout_ptr = &timeout;
1290 }
1291
1292 setup_ldap_local_alarm(ldap_state, abs_endtime);
1293
1294 while (1) {
1295 char *ld_error = NULL;
1296 int ld_errno;
1297
1298 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1299 if (rc != LDAP_SUCCESS) {
1300 break;
1301 }
1302
1303 rc = ldap_search_ext_s(ldap_state->ldap_struct, base, scope,
1304 utf8_filter,
1305 discard_const_p(char *, attrs),
1306 attrsonly, sctrls, cctrls, timeout_ptr,
1307 sizelimit, res);
1308 if (rc == LDAP_SUCCESS) {
1309 break;
1310 }
1311
1312 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1313
1314 DEBUG(10, ("Failed search for base: %s, error: %d (%s) "
1315 "(%s)\n", base, ld_errno,
1316 ldap_err2string(rc),
1317 ld_error ? ld_error : "unknown"));
1318 SAFE_FREE(ld_error);
1319
1320 if (ld_errno != LDAP_SERVER_DOWN) {
1321 break;
1322 }
1323 ldap_unbind(ldap_state->ldap_struct);
1324 ldap_state->ldap_struct = NULL;
1325 }
1326
1327 TALLOC_FREE(utf8_filter);
1328 return end_ldap_local_alarm(abs_endtime, rc);
1329 }
1330
1331 int smbldap_search(struct smbldap_state *ldap_state,
1332 const char *base, int scope, const char *filter,
1333 const char *attrs[], int attrsonly,
1334 LDAPMessage **res)
1335 {
1336 return smbldap_search_ext(ldap_state, base, scope, filter, attrs,
1337 attrsonly, NULL, NULL, LDAP_NO_LIMIT, res);
1338 }
1339
1340 int smbldap_search_paged(struct smbldap_state *ldap_state,
1341 const char *base, int scope, const char *filter,
1342 const char **attrs, int attrsonly, int pagesize,
1343 LDAPMessage **res, void **cookie)
1344 {
1345 LDAPControl pr;
1346 LDAPControl **rcontrols;
1347 LDAPControl *controls[2] = { NULL, NULL};
1348 BerElement *cookie_be = NULL;
1349 struct berval *cookie_bv = NULL;
1350 int tmp = 0, i, rc;
1351 bool critical = True;
1352
1353 *res = NULL;
1354
1355 DEBUG(3,("smbldap_search_paged: base => [%s], filter => [%s],"
1356 "scope => [%d], pagesize => [%d]\n",
1357 base, filter, scope, pagesize));
1358
1359 cookie_be = ber_alloc_t(LBER_USE_DER);
1360 if (cookie_be == NULL) {
1361 DEBUG(0,("smbldap_create_page_control: ber_alloc_t returns "
1362 "NULL\n"));
1363 return LDAP_NO_MEMORY;
1364 }
1365
1366 /* construct cookie */
1367 if (*cookie != NULL) {
1368 ber_printf(cookie_be, "{iO}", (ber_int_t) pagesize, *cookie);
1369 ber_bvfree((struct berval *)*cookie); /* don't need it from last time */
1370 *cookie = NULL;
1371 } else {
1372 ber_printf(cookie_be, "{io}", (ber_int_t) pagesize, "", 0);
1373 }
1374 ber_flatten(cookie_be, &cookie_bv);
1375
1376 pr.ldctl_oid = discard_const_p(char, ADS_PAGE_CTL_OID);
1377 pr.ldctl_iscritical = (char) critical;
1378 pr.ldctl_value.bv_len = cookie_bv->bv_len;
1379 pr.ldctl_value.bv_val = cookie_bv->bv_val;
1380
1381 controls[0] = &pr;
1382 controls[1] = NULL;
1383
1384 rc = smbldap_search_ext(ldap_state, base, scope, filter, attrs,
1385 0, controls, NULL, LDAP_NO_LIMIT, res);
1386
1387 ber_free(cookie_be, 1);
1388 ber_bvfree(cookie_bv);
1389
1390 if (rc != 0) {
1391 DEBUG(3,("smbldap_search_paged: smbldap_search_ext(%s) "
1392 "failed with [%s]\n", filter, ldap_err2string(rc)));
1393 goto done;
1394 }
1395
1396 DEBUG(3,("smbldap_search_paged: search was successful\n"));
1397
1398 rc = ldap_parse_result(ldap_state->ldap_struct, *res, NULL, NULL,
1399 NULL, NULL, &rcontrols, 0);
1400 if (rc != 0) {
1401 DEBUG(3,("smbldap_search_paged: ldap_parse_result failed " \
1402 "with [%s]\n", ldap_err2string(rc)));
1403 goto done;
1404 }
1405
1406 if (rcontrols == NULL)
1407 goto done;
1408
1409 for (i=0; rcontrols[i]; i++) {
1410
1411 if (strcmp(ADS_PAGE_CTL_OID, rcontrols[i]->ldctl_oid) != 0)
1412 continue;
1413
1414 cookie_be = ber_init(&rcontrols[i]->ldctl_value);
1415 ber_scanf(cookie_be,"{iO}", &tmp, &cookie_bv);
1416 /* the berval is the cookie, but must be freed when it is all
1417 done */
1418 if (cookie_bv->bv_len)
1419 *cookie=ber_bvdup(cookie_bv);
1420 else
1421 *cookie=NULL;
1422 ber_bvfree(cookie_bv);
1423 ber_free(cookie_be, 1);
1424 break;
1425 }
1426 ldap_controls_free(rcontrols);
1427 done:
1428 return rc;
1429 }
1430
1431 int smbldap_modify(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[])
1432 {
1433 int rc = LDAP_SERVER_DOWN;
1434 char *utf8_dn;
1435 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1436 size_t converted_size;
1437
1438 SMB_ASSERT(ldap_state);
1439
1440 DEBUG(5,("smbldap_modify: dn => [%s]\n", dn ));
1441
1442 if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1443 return LDAP_NO_MEMORY;
1444 }
1445
1446 setup_ldap_local_alarm(ldap_state, abs_endtime);
1447
1448 while (1) {
1449 char *ld_error = NULL;
1450 int ld_errno;
1451
1452 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1453 if (rc != LDAP_SUCCESS) {
1454 break;
1455 }
1456
1457 rc = ldap_modify_s(ldap_state->ldap_struct, utf8_dn, attrs);
1458 if (rc == LDAP_SUCCESS) {
1459 break;
1460 }
1461
1462 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1463
1464 DEBUG(10, ("Failed to modify dn: %s, error: %d (%s) "
1465 "(%s)\n", dn, ld_errno,
1466 ldap_err2string(rc),
1467 ld_error ? ld_error : "unknown"));
1468 SAFE_FREE(ld_error);
1469
1470 if (ld_errno != LDAP_SERVER_DOWN) {
1471 break;
1472 }
1473 ldap_unbind(ldap_state->ldap_struct);
1474 ldap_state->ldap_struct = NULL;
1475 }
1476
1477 TALLOC_FREE(utf8_dn);
1478 return end_ldap_local_alarm(abs_endtime, rc);
1479 }
1480
1481 int smbldap_add(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[])
1482 {
1483 int rc = LDAP_SERVER_DOWN;
1484 char *utf8_dn;
1485 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1486 size_t converted_size;
1487
1488 SMB_ASSERT(ldap_state);
1489
1490 DEBUG(5,("smbldap_add: dn => [%s]\n", dn ));
1491
1492 if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1493 return LDAP_NO_MEMORY;
1494 }
1495
1496 setup_ldap_local_alarm(ldap_state, abs_endtime);
1497
1498 while (1) {
1499 char *ld_error = NULL;
1500 int ld_errno;
1501
1502 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1503 if (rc != LDAP_SUCCESS) {
1504 break;
1505 }
1506
1507 rc = ldap_add_s(ldap_state->ldap_struct, utf8_dn, attrs);
1508 if (rc == LDAP_SUCCESS) {
1509 break;
1510 }
1511
1512 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1513
1514 DEBUG(10, ("Failed to add dn: %s, error: %d (%s) "
1515 "(%s)\n", dn, ld_errno,
1516 ldap_err2string(rc),
1517 ld_error ? ld_error : "unknown"));
1518 SAFE_FREE(ld_error);
1519
1520 if (ld_errno != LDAP_SERVER_DOWN) {
1521 break;
1522 }
1523 ldap_unbind(ldap_state->ldap_struct);
1524 ldap_state->ldap_struct = NULL;
1525 }
1526
1527 TALLOC_FREE(utf8_dn);
1528 return end_ldap_local_alarm(abs_endtime, rc);
1529 }
1530
1531 int smbldap_delete(struct smbldap_state *ldap_state, const char *dn)
1532 {
1533 int rc = LDAP_SERVER_DOWN;
1534 char *utf8_dn;
1535 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1536 size_t converted_size;
1537
1538 SMB_ASSERT(ldap_state);
1539
1540 DEBUG(5,("smbldap_delete: dn => [%s]\n", dn ));
1541
1542 if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1543 return LDAP_NO_MEMORY;
1544 }
1545
1546 setup_ldap_local_alarm(ldap_state, abs_endtime);
1547
1548 while (1) {
1549 char *ld_error = NULL;
1550 int ld_errno;
1551
1552 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1553 if (rc != LDAP_SUCCESS) {
1554 break;
1555 }
1556
1557 rc = ldap_delete_s(ldap_state->ldap_struct, utf8_dn);
1558 if (rc == LDAP_SUCCESS) {
1559 break;
1560 }
1561
1562 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1563
1564 DEBUG(10, ("Failed to delete dn: %s, error: %d (%s) "
1565 "(%s)\n", dn, ld_errno,
1566 ldap_err2string(rc),
1567 ld_error ? ld_error : "unknown"));
1568 SAFE_FREE(ld_error);
1569
1570 if (ld_errno != LDAP_SERVER_DOWN) {
1571 break;
1572 }
1573 ldap_unbind(ldap_state->ldap_struct);
1574 ldap_state->ldap_struct = NULL;
1575 }
1576
1577 TALLOC_FREE(utf8_dn);
1578 return end_ldap_local_alarm(abs_endtime, rc);
1579 }
1580
1581 int smbldap_extended_operation(struct smbldap_state *ldap_state,
1582 LDAP_CONST char *reqoid, struct berval *reqdata,
1583 LDAPControl **serverctrls, LDAPControl **clientctrls,
1584 char **retoidp, struct berval **retdatap)
1585 {
1586 int rc = LDAP_SERVER_DOWN;
1587 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1588
1589 if (!ldap_state)
1590 return (-1);
1591
1592 setup_ldap_local_alarm(ldap_state, abs_endtime);
1593
1594 while (1) {
1595 char *ld_error = NULL;
1596 int ld_errno;
1597
1598 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1599 if (rc != LDAP_SUCCESS) {
1600 break;
1601 }
1602
1603 rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid,
1604 reqdata, serverctrls,
1605 clientctrls, retoidp, retdatap);
1606 if (rc == LDAP_SUCCESS) {
1607 break;
1608 }
1609
1610 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1611
1612 DEBUG(10, ("Extended operation failed with error: "
1613 "%d (%s) (%s)\n", ld_errno,
1614 ldap_err2string(rc),
1615 ld_error ? ld_error : "unknown"));
1616 SAFE_FREE(ld_error);
1617
1618 if (ld_errno != LDAP_SERVER_DOWN) {
1619 break;
1620 }
1621 ldap_unbind(ldap_state->ldap_struct);
1622 ldap_state->ldap_struct = NULL;
1623 }
1624
1625 return end_ldap_local_alarm(abs_endtime, rc);
1626 }
1627
1628 /*******************************************************************
1629 run the search by name.
1630 ******************************************************************/
1631 int smbldap_search_suffix (struct smbldap_state *ldap_state,
1632 const char *filter, const char **search_attr,
1633 LDAPMessage ** result)
1634 {
1635 return smbldap_search(ldap_state, lp_ldap_suffix(), LDAP_SCOPE_SUBTREE,
1636 filter, search_attr, 0, result);
1637 }
1638
1639 static void smbldap_idle_fn(struct tevent_context *tevent_ctx,
1640 struct timed_event *te,
1641 struct timeval now_abs,
1642 void *private_data)
1643 {
1644 struct smbldap_state *state = (struct smbldap_state *)private_data;
1645
1646 TALLOC_FREE(state->idle_event);
1647
1648 if (state->ldap_struct == NULL) {
1649 DEBUG(10,("ldap connection not connected...\n"));
1650 return;
1651 }
1652
1653 if ((state->last_use+SMBLDAP_IDLE_TIME) > time_mono(NULL)) {
1654 DEBUG(10,("ldap connection not idle...\n"));
1655
1656 /* this needs to be made monotonic clock aware inside tevent: */
1657 state->idle_event = tevent_add_timer(
1658 tevent_ctx, state,
1659 timeval_add(&now_abs, SMBLDAP_IDLE_TIME, 0),
1660 smbldap_idle_fn,
1661 private_data);
1662 return;
1663 }
1664
1665 DEBUG(7,("ldap connection idle...closing connection\n"));
1666 smbldap_close(state);
1667 }
1668
1669 /**********************************************************************
1670 Housekeeping
1671 *********************************************************************/
1672
1673 void smbldap_free_struct(struct smbldap_state **ldap_state)
1674 {
1675 smbldap_close(*ldap_state);
1676
1677 if ((*ldap_state)->bind_secret) {
1678 memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret));
1679 }
1680
1681 SAFE_FREE((*ldap_state)->bind_dn);
1682 SAFE_FREE((*ldap_state)->bind_secret);
1683 (*ldap_state)->bind_callback = NULL;
1684 (*ldap_state)->bind_callback_data = NULL;
1685
1686 TALLOC_FREE(*ldap_state);
1687
1688 /* No need to free any further, as it is talloc()ed */
1689 }
1690
1691 static int smbldap_state_destructor(struct smbldap_state *state)
1692 {
1693 smbldap_free_struct(&state);
1694 return 0;
1695 }
1696
1697
1698 /**********************************************************************
1699 Intitalise the 'general' ldap structures, on which ldap operations may be conducted
1700 *********************************************************************/
1701
1702 NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, struct tevent_context *tevent_ctx,
1703 const char *location,
1704 bool anon,
1705 const char *bind_dn,
1706 const char *bind_secret,
1707 struct smbldap_state **smbldap_state)
1708 {
1709 *smbldap_state = talloc_zero(mem_ctx, struct smbldap_state);
1710 if (!*smbldap_state) {
1711 DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));
1712 return NT_STATUS_NO_MEMORY;
1713 }
1714
1715 if (location) {
1716 (*smbldap_state)->uri = talloc_strdup(mem_ctx, location);
1717 } else {
1718 (*smbldap_state)->uri = "ldap://localhost";
1719 }
1720
1721 (*smbldap_state)->tevent_context = tevent_ctx;
1722
1723 if (bind_dn && bind_secret) {
1724 smbldap_set_creds(*smbldap_state, anon, bind_dn, bind_secret);
1725 }
1726
1727 talloc_set_destructor(*smbldap_state, smbldap_state_destructor);
1728 return NT_STATUS_OK;
1729 }
1730
1731 char *smbldap_talloc_dn(TALLOC_CTX *mem_ctx, LDAP *ld,
1732 LDAPMessage *entry)
1733 {
1734 char *utf8_dn, *unix_dn;
1735 size_t converted_size;
1736
1737 utf8_dn = ldap_get_dn(ld, entry);
1738 if (!utf8_dn) {
1739 DEBUG (5, ("smbldap_talloc_dn: ldap_get_dn failed\n"));
1740 return NULL;
1741 }
1742 if (!pull_utf8_talloc(mem_ctx, &unix_dn, utf8_dn, &converted_size)) {
1743 DEBUG (0, ("smbldap_talloc_dn: String conversion failure utf8 "
1744 "[%s]\n", utf8_dn));
1745 return NULL;
1746 }
1747 ldap_memfree(utf8_dn);
1748 return unix_dn;
1749 }
1750
1751 /*******************************************************************
1752 Check if root-dse has a certain Control or Extension
1753 ********************************************************************/
1754
1755 static bool smbldap_check_root_dse(LDAP *ld, const char **attrs, const char *value)
1756 {
1757 LDAPMessage *msg = NULL;
1758 LDAPMessage *entry = NULL;
1759 char **values = NULL;
1760 int rc, num_result, num_values, i;
1761 bool result = False;
1762
1763 if (!attrs[0]) {
1764 DEBUG(3,("smbldap_check_root_dse: nothing to look for\n"));
1765 return False;
1766 }
1767
1768 if (!strequal(attrs[0], "supportedExtension") &&
1769 !strequal(attrs[0], "supportedControl") &&
1770 !strequal(attrs[0], "namingContexts")) {
1771 DEBUG(3,("smbldap_check_root_dse: no idea what to query root-dse for: %s ?\n", attrs[0]));
1772 return False;
1773 }
1774
1775 rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE,
1776 "(objectclass=*)", discard_const_p(char *, attrs), 0 , &msg);
1777
1778 if (rc != LDAP_SUCCESS) {
1779 DEBUG(3,("smbldap_check_root_dse: Could not search rootDSE\n"));
1780 return False;
1781 }
1782
1783 num_result = ldap_count_entries(ld, msg);
1784
1785 if (num_result != 1) {
1786 DEBUG(3,("smbldap_check_root_dse: Expected one rootDSE, got %d\n", num_result));
1787 goto done;
1788 }
1789
1790 entry = ldap_first_entry(ld, msg);
1791
1792 if (entry == NULL) {
1793 DEBUG(3,("smbldap_check_root_dse: Could not retrieve rootDSE\n"));
1794 goto done;
1795 }
1796
1797 values = ldap_get_values(ld, entry, attrs[0]);
1798
1799 if (values == NULL) {
1800 DEBUG(5,("smbldap_check_root_dse: LDAP Server does not support any %s\n", attrs[0]));
1801 goto done;
1802 }
1803
1804 num_values = ldap_count_values(values);
1805
1806 if (num_values == 0) {
1807 DEBUG(5,("smbldap_check_root_dse: LDAP Server does not have any %s\n", attrs[0]));
1808 goto done;
1809 }
1810
1811 for (i=0; i<num_values; i++) {
1812 if (strcmp(values[i], value) == 0)
1813 result = True;
1814 }
1815
1816
1817 done:
1818 if (values != NULL)
1819 ldap_value_free(values);
1820 if (msg != NULL)
1821 ldap_msgfree(msg);
1822
1823 return result;
1824
1825 }
1826
1827 /*******************************************************************
1828 Check if LDAP-Server supports a certain Control (OID in string format)
1829 ********************************************************************/
1830
1831 bool smbldap_has_control(LDAP *ld, const char *control)
1832 {
1833 const char *attrs[] = { "supportedControl", NULL };
1834 return smbldap_check_root_dse(ld, attrs, control);
1835 }
1836
1837 /*******************************************************************
1838 Check if LDAP-Server supports a certain Extension (OID in string format)
1839 ********************************************************************/
1840
1841 bool smbldap_has_extension(LDAP *ld, const char *extension)
1842 {
1843 const char *attrs[] = { "supportedExtension", NULL };
1844 return smbldap_check_root_dse(ld, attrs, extension);
1845 }
1846
1847 /*******************************************************************
1848 Check if LDAP-Server holds a given namingContext
1849 ********************************************************************/
1850
1851 bool smbldap_has_naming_context(LDAP *ld, const char *naming_context)
1852 {
1853 const char *attrs[] = { "namingContexts", NULL };
1854 return smbldap_check_root_dse(ld, attrs, naming_context);
1855 }
1856
1857 bool smbldap_set_creds(struct smbldap_state *ldap_state, bool anon, const char *dn, const char *secret)
1858 {
1859 ldap_state->anonymous = anon;
1860
1861 /* free any previously set credential */
1862
1863 SAFE_FREE(ldap_state->bind_dn);
1864 ldap_state->bind_callback = NULL;
1865 ldap_state->bind_callback_data = NULL;
1866
1867 if (ldap_state->bind_secret) {
1868 /* make sure secrets are zeroed out of memory */
1869 memset(ldap_state->bind_secret, '\0', strlen(ldap_state->bind_secret));
1870 SAFE_FREE(ldap_state->bind_secret);
1871 }
1872
1873 if ( ! anon) {
1874 ldap_state->bind_dn = SMB_STRDUP(dn);
1875 ldap_state->bind_secret = SMB_STRDUP(secret);
1876 }
1877
1878 return True;
1879 }
reg import