source3/libads/ldap_utils.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Some Helpful wrappers on LDAP
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Guenther Deschner 2006,2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "ads.h"
  25
  26 #ifdef HAVE_LDAP
  27
  28 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
  29                                              TALLOC_CTX *mem_ctx,
  30                                              int scope,
  31                                              const char *base,
  32                                              const char *filter,
  33                                              const char **attrs,
  34                                              void *args,
  35                                              const char *range_attr,
  36                                              char ***strings,
  37                                              size_t *num_strings,
  38                                              uint32 *first_usn,
  39                                              int *num_retries,
  40                                              bool *more_values);
  41
  42 /*
  43   a wrapper around ldap_search_s that retries depending on the error code
  44   this is supposed to catch dropped connections and auto-reconnect
  45 */
  46 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
  47                                                const char *expr,
  48                                                const char **attrs, void *args,
  49                                                LDAPMessage **res)
  50 {
  51         ADS_STATUS status = ADS_SUCCESS;
  52         int count = 3;
  53         char *bp;
  54
  55         *res = NULL;
  56
  57         if (!ads->ldap.ld &&
  58             time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
  59                 return ADS_ERROR(LDAP_SERVER_DOWN);
  60         }
  61
  62         bp = SMB_STRDUP(bind_path);
  63
  64         if (!bp) {
  65                 return ADS_ERROR(LDAP_NO_MEMORY);
  66         }
  67
  68         *res = NULL;
  69
  70         /* when binding anonymously, we cannot use the paged search LDAP
  71          * control - Guenther */
  72
  73         if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
  74                 status = ads_do_search(ads, bp, scope, expr, attrs, res);
  75         } else {
  76                 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
  77         }
  78         if (ADS_ERR_OK(status)) {
  79                DEBUG(5,("Search for %s in <%s> gave %d replies\n",
  80                         expr, bp, ads_count_replies(ads, *res)));
  81                 SAFE_FREE(bp);
  82                 return status;
  83         }
  84
  85         while (--count) {
  86
  87                 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) && ads->config.ldap_page_size >= 250) {
  88                         int new_page_size = (ads->config.ldap_page_size / 2);
  89                         DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
  90                                   ads->config.ldap_page_size, new_page_size));
  91                         ads->config.ldap_page_size = new_page_size;
  92                 }
  93
  94                 if (*res)
  95                         ads_msgfree(ads, *res);
  96                 *res = NULL;
  97
  98                 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
  99                          ads->config.realm, ads_errstr(status)));
 100
 101                 ads_disconnect(ads);
 102                 status = ads_connect(ads);
 103
 104                 if (!ADS_ERR_OK(status)) {
 105                         DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
 106                                  ads_errstr(status)));
 107                         ads_destroy(&ads);
 108                         SAFE_FREE(bp);
 109                         return status;
 110                 }
 111
 112                 *res = NULL;
 113
 114                 /* when binding anonymously, we cannot use the paged search LDAP
 115                  * control - Guenther */
 116
 117                 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
 118                         status = ads_do_search(ads, bp, scope, expr, attrs, res);
 119                 } else {
 120                         status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
 121                 }
 122
 123                 if (ADS_ERR_OK(status)) {
 124                         DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
 125                                  expr, bp, ads_count_replies(ads, *res)));
 126                         SAFE_FREE(bp);
 127                         return status;
 128                 }
 129         }
 130         SAFE_FREE(bp);
 131
 132         if (!ADS_ERR_OK(status)) {
 133                 DEBUG(1,("ads reopen failed after error %s\n",
 134                          ads_errstr(status)));
 135         }
 136         return status;
 137 }
 138
 139  ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
 140                                 int scope, const char *expr,
 141                                 const char **attrs, LDAPMessage **res)
 142 {
 143         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
 144 }
 145
 146 static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
 147                                            int scope, const char *expr,
 148                                            const char **attrs, void *args,
 149                                            LDAPMessage **res)
 150 {
 151         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
 152 }
 153
 154
 155  ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
 156                              const char *expr, const char **attrs)
 157 {
 158         return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
 159                                    expr, attrs, res);
 160 }
 161
 162  ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
 163                                 const char *dn,
 164                                 const char **attrs)
 165 {
 166         return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 167                                    "(objectclass=*)", attrs, res);
 168 }
 169
 170  ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
 171                                          uint32 sd_flags,
 172                                          const char *dn,
 173                                          const char **attrs)
 174 {
 175         ads_control args;
 176
 177         args.control = ADS_SD_FLAGS_OID;
 178         args.val = sd_flags;
 179         args.critical = True;
 180
 181         return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
 182                                         "(objectclass=*)", attrs, &args, res);
 183 }
 184
 185  ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
 186                                                 const char *dn,
 187                                                 const char **attrs,
 188                                                 enum ads_extended_dn_flags flags,
 189                                                 char ***strings,
 190                                                 size_t *num_strings)
 191 {
 192         ads_control args;
 193
 194         args.control = ADS_EXTENDED_DN_OID;
 195         args.val = flags;
 196         args.critical = True;
 197
 198         /* we can only range process one attribute */
 199         if (!attrs || !attrs[0] || attrs[1]) {
 200                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 201         }
 202
 203         return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
 204                                  "(objectclass=*)", &args, attrs[0],
 205                                  strings, num_strings);
 206
 207 }
 208
 209  ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
 210                                  const struct dom_sid *sid,
 211                                  const char **attrs)
 212 {
 213         char *dn, *sid_string;
 214         ADS_STATUS status;
 215
 216         sid_string = sid_binstring_hex(sid);
 217         if (sid_string == NULL) {
 218                 return ADS_ERROR(LDAP_NO_MEMORY);
 219         }
 220
 221         if (!asprintf(&dn, "<SID=%s>", sid_string)) {
 222                 SAFE_FREE(sid_string);
 223                 return ADS_ERROR(LDAP_NO_MEMORY);
 224         }
 225
 226         status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 227                                    "(objectclass=*)", attrs, res);
 228         SAFE_FREE(dn);
 229         SAFE_FREE(sid_string);
 230         return status;
 231 }
 232
 233 ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
 234                              TALLOC_CTX *mem_ctx,
 235                              int scope,
 236                              const char *base,
 237                              const char *filter,
 238                              void *args,
 239                              const char *range_attr,
 240                              char ***strings,
 241                              size_t *num_strings)
 242 {
 243         ADS_STATUS status;
 244         uint32 first_usn;
 245         int num_retries = 0;
 246         const char **attrs;
 247         bool more_values = False;
 248
 249         *num_strings = 0;
 250         *strings = NULL;
 251
 252         attrs = talloc_array(mem_ctx, const char *, 3);
 253         ADS_ERROR_HAVE_NO_MEMORY(attrs);
 254
 255         attrs[0] = talloc_strdup(mem_ctx, range_attr);
 256         attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
 257         attrs[2] = NULL;
 258
 259         ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
 260         ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
 261
 262         do {
 263                 status = ads_ranged_search_internal(ads, mem_ctx,
 264                                                     scope, base, filter,
 265                                                     attrs, args, range_attr,
 266                                                     strings, num_strings,
 267                                                     &first_usn, &num_retries,
 268                                                     &more_values);
 269
 270                 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
 271                         continue;
 272                 }
 273
 274                 if (!ADS_ERR_OK(status)) {
 275                         *num_strings = 0;
 276                         strings = NULL;
 277                         goto done;
 278                 }
 279
 280         } while (more_values);
 281
 282  done:
 283         DEBUG(10,("returning with %d strings\n", (int)*num_strings));
 284
 285         return status;
 286 }
 287
 288 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
 289                                       TALLOC_CTX *mem_ctx,
 290                                       int scope,
 291                                       const char *base,
 292                                       const char *filter,
 293                                       const char **attrs,
 294                                       void *args,
 295                                       const char *range_attr,
 296                                       char ***strings,
 297                                       size_t *num_strings,
 298                                       uint32 *first_usn,
 299                                       int *num_retries,
 300                                       bool *more_values)
 301 {
 302         LDAPMessage *res = NULL;
 303         ADS_STATUS status;
 304         int count;
 305         uint32 current_usn;
 306
 307         DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
 308
 309         *more_values = False;
 310
 311         status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
 312
 313         if (!ADS_ERR_OK(status)) {
 314                 DEBUG(1,("ads_search: %s\n",
 315                          ads_errstr(status)));
 316                 return status;
 317         }
 318
 319         if (!res) {
 320                 return ADS_ERROR(LDAP_NO_MEMORY);
 321         }
 322
 323         count = ads_count_replies(ads, res);
 324         if (count == 0) {
 325                 ads_msgfree(ads, res);
 326                 return ADS_ERROR(LDAP_SUCCESS);
 327         }
 328
 329         if (*num_strings == 0) {
 330                 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
 331                         DEBUG(1, ("could not pull first usnChanged!\n"));
 332                         ads_msgfree(ads, res);
 333                         return ADS_ERROR(LDAP_NO_MEMORY);
 334                 }
 335         }
 336
 337         if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
 338                 DEBUG(1, ("could not pull current usnChanged!\n"));
 339                 ads_msgfree(ads, res);
 340                 return ADS_ERROR(LDAP_NO_MEMORY);
 341         }
 342
 343         if (*first_usn != current_usn) {
 344                 DEBUG(5, ("USN on this record changed"
 345                           " - restarting search\n"));
 346                 if (*num_retries < 5) {
 347                         (*num_retries)++;
 348                         *num_strings = 0;
 349                         ads_msgfree(ads, res);
 350                         return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
 351                 } else {
 352                         DEBUG(5, ("USN on this record changed"
 353                                   " - restarted search too many times, aborting!\n"));
 354                         ads_msgfree(ads, res);
 355                         return ADS_ERROR(LDAP_NO_MEMORY);
 356                 }
 357         }
 358
 359         *strings = ads_pull_strings_range(ads, mem_ctx, res,
 360                                          range_attr,
 361                                          *strings,
 362                                          &attrs[0],
 363                                          num_strings,
 364                                          more_values);
 365
 366         ads_msgfree(ads, res);
 367
 368         /* paranoia checks */
 369         if (*strings == NULL && *more_values) {
 370                 DEBUG(0,("no strings found but more values???\n"));
 371                 return ADS_ERROR(LDAP_NO_MEMORY);
 372         }
 373         if (*num_strings == 0 && *more_values) {
 374                 DEBUG(0,("no strings found but more values???\n"));
 375                 return ADS_ERROR(LDAP_NO_MEMORY);
 376         }
 377
 378         return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
 379 }
 380
 381 #endif