schema.py: add optional name_map={} to get_schema_descriptor()
[Samba/gebeck_regimport.git] / source3 / libads / ldap_utils.c
blob88db3a3ab73e09e3ade386029d98e5bc15c7dbfc
1 /*
2 Unix SMB/CIFS implementation.
4 Some Helpful wrappers on LDAP
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "includes.h"
24 #include "ads.h"
25 #include "lib/param/loadparm.h"
27 #ifdef HAVE_LDAP
29 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
30 TALLOC_CTX *mem_ctx,
31 int scope,
32 const char *base,
33 const char *filter,
34 const char **attrs,
35 void *args,
36 const char *range_attr,
37 char ***strings,
38 size_t *num_strings,
39 uint32 *first_usn,
40 int *num_retries,
41 bool *more_values);
44 a wrapper around ldap_search_s that retries depending on the error code
45 this is supposed to catch dropped connections and auto-reconnect
47 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
48 const char *expr,
49 const char **attrs, void *args,
50 LDAPMessage **res)
52 ADS_STATUS status = ADS_SUCCESS;
53 int count = 3;
54 char *bp;
56 *res = NULL;
58 if (!ads->ldap.ld &&
59 time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
60 return ADS_ERROR(LDAP_SERVER_DOWN);
63 bp = SMB_STRDUP(bind_path);
65 if (!bp) {
66 return ADS_ERROR(LDAP_NO_MEMORY);
69 *res = NULL;
71 /* when binding anonymously, we cannot use the paged search LDAP
72 * control - Guenther */
74 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
75 status = ads_do_search(ads, bp, scope, expr, attrs, res);
76 } else {
77 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
79 if (ADS_ERR_OK(status)) {
80 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
81 expr, bp, ads_count_replies(ads, *res)));
82 SAFE_FREE(bp);
83 return status;
86 while (--count) {
88 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) && ads->config.ldap_page_size >= 250) {
89 int new_page_size = (ads->config.ldap_page_size / 2);
90 DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
91 ads->config.ldap_page_size, new_page_size));
92 ads->config.ldap_page_size = new_page_size;
95 if (*res)
96 ads_msgfree(ads, *res);
97 *res = NULL;
99 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
100 ads->config.realm, ads_errstr(status)));
102 ads_disconnect(ads);
103 status = ads_connect(ads);
105 if (!ADS_ERR_OK(status)) {
106 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
107 ads_errstr(status)));
108 ads_destroy(&ads);
109 SAFE_FREE(bp);
110 return status;
113 *res = NULL;
115 /* when binding anonymously, we cannot use the paged search LDAP
116 * control - Guenther */
118 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
119 status = ads_do_search(ads, bp, scope, expr, attrs, res);
120 } else {
121 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
124 if (ADS_ERR_OK(status)) {
125 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
126 expr, bp, ads_count_replies(ads, *res)));
127 SAFE_FREE(bp);
128 return status;
131 SAFE_FREE(bp);
133 if (!ADS_ERR_OK(status)) {
134 DEBUG(1,("ads reopen failed after error %s\n",
135 ads_errstr(status)));
137 return status;
140 ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
141 int scope, const char *expr,
142 const char **attrs, LDAPMessage **res)
144 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
147 static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
148 int scope, const char *expr,
149 const char **attrs, void *args,
150 LDAPMessage **res)
152 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
156 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
157 const char *expr, const char **attrs)
159 return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
160 expr, attrs, res);
163 ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
164 const char *dn,
165 const char **attrs)
167 return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
168 "(objectclass=*)", attrs, res);
171 ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
172 uint32 sd_flags,
173 const char *dn,
174 const char **attrs)
176 ads_control args;
178 args.control = ADS_SD_FLAGS_OID;
179 args.val = sd_flags;
180 args.critical = True;
182 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
183 "(objectclass=*)", attrs, &args, res);
186 ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
187 const char *dn,
188 const char **attrs,
189 enum ads_extended_dn_flags flags,
190 char ***strings,
191 size_t *num_strings)
193 ads_control args;
195 args.control = ADS_EXTENDED_DN_OID;
196 args.val = flags;
197 args.critical = True;
199 /* we can only range process one attribute */
200 if (!attrs || !attrs[0] || attrs[1]) {
201 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
204 return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
205 "(objectclass=*)", &args, attrs[0],
206 strings, num_strings);
210 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
211 const struct dom_sid *sid,
212 const char **attrs)
214 char *dn, *sid_string;
215 ADS_STATUS status;
217 sid_string = sid_binstring_hex(sid);
218 if (sid_string == NULL) {
219 return ADS_ERROR(LDAP_NO_MEMORY);
222 if (!asprintf(&dn, "<SID=%s>", sid_string)) {
223 SAFE_FREE(sid_string);
224 return ADS_ERROR(LDAP_NO_MEMORY);
227 status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
228 "(objectclass=*)", attrs, res);
229 SAFE_FREE(dn);
230 SAFE_FREE(sid_string);
231 return status;
234 ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
235 TALLOC_CTX *mem_ctx,
236 int scope,
237 const char *base,
238 const char *filter,
239 void *args,
240 const char *range_attr,
241 char ***strings,
242 size_t *num_strings)
244 ADS_STATUS status;
245 uint32 first_usn;
246 int num_retries = 0;
247 const char **attrs;
248 bool more_values = False;
250 *num_strings = 0;
251 *strings = NULL;
253 attrs = talloc_array(mem_ctx, const char *, 3);
254 ADS_ERROR_HAVE_NO_MEMORY(attrs);
256 attrs[0] = talloc_strdup(mem_ctx, range_attr);
257 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
258 attrs[2] = NULL;
260 ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
261 ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
263 do {
264 status = ads_ranged_search_internal(ads, mem_ctx,
265 scope, base, filter,
266 attrs, args, range_attr,
267 strings, num_strings,
268 &first_usn, &num_retries,
269 &more_values);
271 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
272 continue;
275 if (!ADS_ERR_OK(status)) {
276 *num_strings = 0;
277 strings = NULL;
278 goto done;
281 } while (more_values);
283 done:
284 DEBUG(10,("returning with %d strings\n", (int)*num_strings));
286 return status;
289 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
290 TALLOC_CTX *mem_ctx,
291 int scope,
292 const char *base,
293 const char *filter,
294 const char **attrs,
295 void *args,
296 const char *range_attr,
297 char ***strings,
298 size_t *num_strings,
299 uint32 *first_usn,
300 int *num_retries,
301 bool *more_values)
303 LDAPMessage *res = NULL;
304 ADS_STATUS status;
305 int count;
306 uint32 current_usn;
308 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
310 *more_values = False;
312 status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
314 if (!ADS_ERR_OK(status)) {
315 DEBUG(1,("ads_search: %s\n",
316 ads_errstr(status)));
317 return status;
320 if (!res) {
321 return ADS_ERROR(LDAP_NO_MEMORY);
324 count = ads_count_replies(ads, res);
325 if (count == 0) {
326 ads_msgfree(ads, res);
327 return ADS_ERROR(LDAP_SUCCESS);
330 if (*num_strings == 0) {
331 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
332 DEBUG(1, ("could not pull first usnChanged!\n"));
333 ads_msgfree(ads, res);
334 return ADS_ERROR(LDAP_NO_MEMORY);
338 if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
339 DEBUG(1, ("could not pull current usnChanged!\n"));
340 ads_msgfree(ads, res);
341 return ADS_ERROR(LDAP_NO_MEMORY);
344 if (*first_usn != current_usn) {
345 DEBUG(5, ("USN on this record changed"
346 " - restarting search\n"));
347 if (*num_retries < 5) {
348 (*num_retries)++;
349 *num_strings = 0;
350 ads_msgfree(ads, res);
351 return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
352 } else {
353 DEBUG(5, ("USN on this record changed"
354 " - restarted search too many times, aborting!\n"));
355 ads_msgfree(ads, res);
356 return ADS_ERROR(LDAP_NO_MEMORY);
360 *strings = ads_pull_strings_range(ads, mem_ctx, res,
361 range_attr,
362 *strings,
363 &attrs[0],
364 num_strings,
365 more_values);
367 ads_msgfree(ads, res);
369 /* paranoia checks */
370 if (*strings == NULL && *more_values) {
371 DEBUG(0,("no strings found but more values???\n"));
372 return ADS_ERROR(LDAP_NO_MEMORY);
374 if (*num_strings == 0 && *more_values) {
375 DEBUG(0,("no strings found but more values???\n"));
376 return ADS_ERROR(LDAP_NO_MEMORY);
379 return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
382 #endif