2 Unix SMB/CIFS implementation.
4 Some Helpful wrappers on LDAP
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 a wrapper around ldap_search_s that retries depending on the error code
29 this is supposed to catch dropped connections and auto-reconnect
31 static ADS_STATUS
ads_do_search_retry_internal(ADS_STRUCT
*ads
, const char *bind_path
, int scope
,
33 const char **attrs
, void *args
,
36 ADS_STATUS status
= ADS_SUCCESS
;
43 time_mono(NULL
) - ads
->ldap
.last_attempt
< ADS_RECONNECT_TIME
) {
44 return ADS_ERROR(LDAP_SERVER_DOWN
);
47 bp
= SMB_STRDUP(bind_path
);
50 return ADS_ERROR(LDAP_NO_MEMORY
);
55 /* when binding anonymously, we cannot use the paged search LDAP
56 * control - Guenther */
58 if (ads
->auth
.flags
& ADS_AUTH_ANON_BIND
) {
59 status
= ads_do_search(ads
, bp
, scope
, expr
, attrs
, res
);
61 status
= ads_do_search_all_args(ads
, bp
, scope
, expr
, attrs
, args
, res
);
63 if (ADS_ERR_OK(status
)) {
64 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
65 expr
, bp
, ads_count_replies(ads
, *res
)));
73 ads_msgfree(ads
, *res
);
76 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
77 ads
->config
.realm
, ads_errstr(status
)));
80 status
= ads_connect(ads
);
82 if (!ADS_ERR_OK(status
)) {
83 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
92 /* when binding anonymously, we cannot use the paged search LDAP
93 * control - Guenther */
95 if (ads
->auth
.flags
& ADS_AUTH_ANON_BIND
) {
96 status
= ads_do_search(ads
, bp
, scope
, expr
, attrs
, res
);
98 status
= ads_do_search_all_args(ads
, bp
, scope
, expr
, attrs
, args
, res
);
101 if (ADS_ERR_OK(status
)) {
102 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
103 expr
, bp
, ads_count_replies(ads
, *res
)));
110 if (!ADS_ERR_OK(status
)) {
111 DEBUG(1,("ads reopen failed after error %s\n",
112 ads_errstr(status
)));
117 ADS_STATUS
ads_do_search_retry(ADS_STRUCT
*ads
, const char *bind_path
,
118 int scope
, const char *expr
,
119 const char **attrs
, LDAPMessage
**res
)
121 return ads_do_search_retry_internal(ads
, bind_path
, scope
, expr
, attrs
, NULL
, res
);
124 ADS_STATUS
ads_do_search_retry_args(ADS_STRUCT
*ads
, const char *bind_path
,
125 int scope
, const char *expr
,
126 const char **attrs
, void *args
,
129 return ads_do_search_retry_internal(ads
, bind_path
, scope
, expr
, attrs
, args
, res
);
133 ADS_STATUS
ads_search_retry(ADS_STRUCT
*ads
, LDAPMessage
**res
,
134 const char *expr
, const char **attrs
)
136 return ads_do_search_retry(ads
, ads
->config
.bind_path
, LDAP_SCOPE_SUBTREE
,
140 ADS_STATUS
ads_search_retry_dn(ADS_STRUCT
*ads
, LDAPMessage
**res
,
144 return ads_do_search_retry(ads
, dn
, LDAP_SCOPE_BASE
,
145 "(objectclass=*)", attrs
, res
);
148 ADS_STATUS
ads_search_retry_extended_dn(ADS_STRUCT
*ads
, LDAPMessage
**res
,
151 enum ads_extended_dn_flags flags
)
155 args
.control
= ADS_EXTENDED_DN_OID
;
157 args
.critical
= True
;
159 return ads_do_search_retry_args(ads
, dn
, LDAP_SCOPE_BASE
,
160 "(objectclass=*)", attrs
, &args
, res
);
163 ADS_STATUS
ads_search_retry_dn_sd_flags(ADS_STRUCT
*ads
, LDAPMessage
**res
,
170 args
.control
= ADS_SD_FLAGS_OID
;
172 args
.critical
= True
;
174 return ads_do_search_retry_args(ads
, dn
, LDAP_SCOPE_BASE
,
175 "(objectclass=*)", attrs
, &args
, res
);
178 ADS_STATUS
ads_search_retry_extended_dn_ranged(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
181 enum ads_extended_dn_flags flags
,
187 args
.control
= ADS_EXTENDED_DN_OID
;
189 args
.critical
= True
;
191 /* we can only range process one attribute */
192 if (!attrs
|| !attrs
[0] || attrs
[1]) {
193 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
196 return ads_ranged_search(ads
, mem_ctx
, LDAP_SCOPE_BASE
, dn
,
197 "(objectclass=*)", &args
, attrs
[0],
198 strings
, num_strings
);
202 ADS_STATUS
ads_search_retry_sid(ADS_STRUCT
*ads
, LDAPMessage
**res
,
203 const struct dom_sid
*sid
,
206 char *dn
, *sid_string
;
209 sid_string
= sid_binstring_hex(sid
);
210 if (sid_string
== NULL
) {
211 return ADS_ERROR(LDAP_NO_MEMORY
);
214 if (!asprintf(&dn
, "<SID=%s>", sid_string
)) {
215 SAFE_FREE(sid_string
);
216 return ADS_ERROR(LDAP_NO_MEMORY
);
219 status
= ads_do_search_retry(ads
, dn
, LDAP_SCOPE_BASE
,
220 "(objectclass=*)", attrs
, res
);
222 SAFE_FREE(sid_string
);
226 ADS_STATUS
ads_ranged_search(ADS_STRUCT
*ads
,
232 const char *range_attr
,
240 bool more_values
= False
;
245 attrs
= TALLOC_ARRAY(mem_ctx
, const char *, 3);
246 ADS_ERROR_HAVE_NO_MEMORY(attrs
);
248 attrs
[0] = talloc_strdup(mem_ctx
, range_attr
);
249 attrs
[1] = talloc_strdup(mem_ctx
, "usnChanged");
252 ADS_ERROR_HAVE_NO_MEMORY(attrs
[0]);
253 ADS_ERROR_HAVE_NO_MEMORY(attrs
[1]);
256 status
= ads_ranged_search_internal(ads
, mem_ctx
,
258 attrs
, args
, range_attr
,
259 strings
, num_strings
,
260 &first_usn
, &num_retries
,
263 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES
, ads_ntstatus(status
))) {
267 if (!ADS_ERR_OK(status
)) {
273 } while (more_values
);
276 DEBUG(10,("returning with %d strings\n", (int)*num_strings
));
281 ADS_STATUS
ads_ranged_search_internal(ADS_STRUCT
*ads
,
288 const char *range_attr
,
295 LDAPMessage
*res
= NULL
;
300 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs
[0], attrs
[1]));
302 *more_values
= False
;
304 status
= ads_do_search_retry_internal(ads
, base
, scope
, filter
, attrs
, args
, &res
);
306 if (!ADS_ERR_OK(status
)) {
307 DEBUG(1,("ads_search: %s\n",
308 ads_errstr(status
)));
313 return ADS_ERROR(LDAP_NO_MEMORY
);
316 count
= ads_count_replies(ads
, res
);
318 ads_msgfree(ads
, res
);
319 return ADS_ERROR(LDAP_SUCCESS
);
322 if (*num_strings
== 0) {
323 if (!ads_pull_uint32(ads
, res
, "usnChanged", first_usn
)) {
324 DEBUG(1, ("could not pull first usnChanged!\n"));
325 ads_msgfree(ads
, res
);
326 return ADS_ERROR(LDAP_NO_MEMORY
);
330 if (!ads_pull_uint32(ads
, res
, "usnChanged", ¤t_usn
)) {
331 DEBUG(1, ("could not pull current usnChanged!\n"));
332 ads_msgfree(ads
, res
);
333 return ADS_ERROR(LDAP_NO_MEMORY
);
336 if (*first_usn
!= current_usn
) {
337 DEBUG(5, ("USN on this record changed"
338 " - restarting search\n"));
339 if (*num_retries
< 5) {
342 ads_msgfree(ads
, res
);
343 return ADS_ERROR_NT(STATUS_MORE_ENTRIES
);
345 DEBUG(5, ("USN on this record changed"
346 " - restarted search too many times, aborting!\n"));
347 ads_msgfree(ads
, res
);
348 return ADS_ERROR(LDAP_NO_MEMORY
);
352 *strings
= ads_pull_strings_range(ads
, mem_ctx
, res
,
359 ads_msgfree(ads
, res
);
361 /* paranoia checks */
362 if (*strings
== NULL
&& *more_values
) {
363 DEBUG(0,("no strings found but more values???\n"));
364 return ADS_ERROR(LDAP_NO_MEMORY
);
366 if (*num_strings
== 0 && *more_values
) {
367 DEBUG(0,("no strings found but more values???\n"));
368 return ADS_ERROR(LDAP_NO_MEMORY
);
371 return (*more_values
) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES
) : ADS_ERROR(LDAP_SUCCESS
);