source3/libads/ldap_utils.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Some Helpful wrappers on LDAP
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Guenther Deschner 2006,2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "ads.h"
  25 #include "lib/param/loadparm.h"
  26
  27 #ifdef HAVE_LDAP
  28
  29 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
  30                                              TALLOC_CTX *mem_ctx,
  31                                              int scope,
  32                                              const char *base,
  33                                              const char *filter,
  34                                              const char **attrs,
  35                                              void *args,
  36                                              const char *range_attr,
  37                                              char ***strings,
  38                                              size_t *num_strings,
  39                                              uint32_t *first_usn,
  40                                              int *num_retries,
  41                                              bool *more_values);
  42
  43 /*
  44   a wrapper around ldap_search_s that retries depending on the error code
  45   this is supposed to catch dropped connections and auto-reconnect
  46 */
  47 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
  48                                                const char *expr,
  49                                                const char **attrs, void *args,
  50                                                LDAPMessage **res)
  51 {
  52         ADS_STATUS status;
  53         int count = 3;
  54         char *bp;
  55
  56         *res = NULL;
  57
  58         if (!ads->ldap.ld &&
  59             time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
  60                 return ADS_ERROR(LDAP_SERVER_DOWN);
  61         }
  62
  63         bp = SMB_STRDUP(bind_path);
  64
  65         if (!bp) {
  66                 return ADS_ERROR(LDAP_NO_MEMORY);
  67         }
  68
  69         *res = NULL;
  70
  71         /* when binding anonymously, we cannot use the paged search LDAP
  72          * control - Guenther */
  73
  74         if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
  75                 status = ads_do_search(ads, bp, scope, expr, attrs, res);
  76         } else {
  77                 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
  78         }
  79         if (ADS_ERR_OK(status)) {
  80                DEBUG(5,("Search for %s in <%s> gave %d replies\n",
  81                         expr, bp, ads_count_replies(ads, *res)));
  82                 SAFE_FREE(bp);
  83                 return status;
  84         }
  85
  86         while (--count) {
  87
  88                 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
  89                     ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
  90                     lp_ldap_page_size() > 4) {
  91                         int new_page_size = (ads->config.ldap_page_size / 2);
  92                         DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
  93                                   ads->config.ldap_page_size, new_page_size));
  94                         ads->config.ldap_page_size = new_page_size;
  95                 }
  96
  97                 if (*res)
  98                         ads_msgfree(ads, *res);
  99                 *res = NULL;
 100
 101                 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
 102                          ads->config.realm, ads_errstr(status)));
 103
 104                 ads_disconnect(ads);
 105                 status = ads_connect(ads);
 106
 107                 if (!ADS_ERR_OK(status)) {
 108                         bool orig_is_mine = ads->is_mine;
 109
 110                         DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
 111                                  ads_errstr(status)));
 112                         /*
 113                          * We need to keep the ads pointer
 114                          * from being freed here as we don't own it and
 115                          * callers depend on it being around.
 116                          */
 117                         ads->is_mine = false;
 118                         ads_destroy(&ads);
 119                         ads->is_mine = orig_is_mine;
 120                         SAFE_FREE(bp);
 121                         return status;
 122                 }
 123
 124                 *res = NULL;
 125
 126                 /* when binding anonymously, we cannot use the paged search LDAP
 127                  * control - Guenther */
 128
 129                 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
 130                         status = ads_do_search(ads, bp, scope, expr, attrs, res);
 131                 } else {
 132                         status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
 133                 }
 134
 135                 if (ADS_ERR_OK(status)) {
 136                         DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
 137                                  expr, bp, ads_count_replies(ads, *res)));
 138                         SAFE_FREE(bp);
 139                         return status;
 140                 }
 141         }
 142         SAFE_FREE(bp);
 143
 144         if (!ADS_ERR_OK(status)) {
 145                 DEBUG(1,("ads reopen failed after error %s\n",
 146                          ads_errstr(status)));
 147         }
 148         return status;
 149 }
 150
 151  ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
 152                                 int scope, const char *expr,
 153                                 const char **attrs, LDAPMessage **res)
 154 {
 155         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
 156 }
 157
 158 static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
 159                                            int scope, const char *expr,
 160                                            const char **attrs, void *args,
 161                                            LDAPMessage **res)
 162 {
 163         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
 164 }
 165
 166
 167  ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
 168                              const char *expr, const char **attrs)
 169 {
 170         return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
 171                                    expr, attrs, res);
 172 }
 173
 174  ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
 175                                 const char *dn,
 176                                 const char **attrs)
 177 {
 178         return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 179                                    "(objectclass=*)", attrs, res);
 180 }
 181
 182  ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
 183                                          uint32_t sd_flags,
 184                                          const char *dn,
 185                                          const char **attrs)
 186 {
 187         ads_control args;
 188
 189         args.control = ADS_SD_FLAGS_OID;
 190         args.val = sd_flags;
 191         args.critical = True;
 192
 193         return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
 194                                         "(objectclass=*)", attrs, &args, res);
 195 }
 196
 197  ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
 198                                                 const char *dn,
 199                                                 const char **attrs,
 200                                                 enum ads_extended_dn_flags flags,
 201                                                 char ***strings,
 202                                                 size_t *num_strings)
 203 {
 204         ads_control args;
 205
 206         args.control = ADS_EXTENDED_DN_OID;
 207         args.val = flags;
 208         args.critical = True;
 209
 210         /* we can only range process one attribute */
 211         if (!attrs || !attrs[0] || attrs[1]) {
 212                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 213         }
 214
 215         return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
 216                                  "(objectclass=*)", &args, attrs[0],
 217                                  strings, num_strings);
 218
 219 }
 220
 221  ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
 222                                  const struct dom_sid *sid,
 223                                  const char **attrs)
 224 {
 225         char *dn, *sid_string;
 226         ADS_STATUS status;
 227
 228         sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
 229         if (sid_string == NULL) {
 230                 return ADS_ERROR(LDAP_NO_MEMORY);
 231         }
 232
 233         if (!asprintf(&dn, "<SID=%s>", sid_string)) {
 234                 TALLOC_FREE(sid_string);
 235                 return ADS_ERROR(LDAP_NO_MEMORY);
 236         }
 237
 238         status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 239                                    "(objectclass=*)", attrs, res);
 240         SAFE_FREE(dn);
 241         TALLOC_FREE(sid_string);
 242         return status;
 243 }
 244
 245 ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
 246                              TALLOC_CTX *mem_ctx,
 247                              int scope,
 248                              const char *base,
 249                              const char *filter,
 250                              void *args,
 251                              const char *range_attr,
 252                              char ***strings,
 253                              size_t *num_strings)
 254 {
 255         ADS_STATUS status;
 256         uint32_t first_usn;
 257         int num_retries = 0;
 258         const char **attrs;
 259         bool more_values = False;
 260
 261         *num_strings = 0;
 262         *strings = NULL;
 263
 264         attrs = talloc_array(mem_ctx, const char *, 3);
 265         ADS_ERROR_HAVE_NO_MEMORY(attrs);
 266
 267         attrs[0] = talloc_strdup(mem_ctx, range_attr);
 268         attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
 269         attrs[2] = NULL;
 270
 271         ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
 272         ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
 273
 274         do {
 275                 status = ads_ranged_search_internal(ads, mem_ctx,
 276                                                     scope, base, filter,
 277                                                     attrs, args, range_attr,
 278                                                     strings, num_strings,
 279                                                     &first_usn, &num_retries,
 280                                                     &more_values);
 281
 282                 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
 283                         continue;
 284                 }
 285
 286                 if (!ADS_ERR_OK(status)) {
 287                         *num_strings = 0;
 288                         strings = NULL;
 289                         goto done;
 290                 }
 291
 292         } while (more_values);
 293
 294  done:
 295         DEBUG(10,("returning with %d strings\n", (int)*num_strings));
 296
 297         return status;
 298 }
 299
 300 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
 301                                       TALLOC_CTX *mem_ctx,
 302                                       int scope,
 303                                       const char *base,
 304                                       const char *filter,
 305                                       const char **attrs,
 306                                       void *args,
 307                                       const char *range_attr,
 308                                       char ***strings,
 309                                       size_t *num_strings,
 310                                       uint32_t *first_usn,
 311                                       int *num_retries,
 312                                       bool *more_values)
 313 {
 314         LDAPMessage *res = NULL;
 315         ADS_STATUS status;
 316         int count;
 317         uint32_t current_usn;
 318
 319         DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
 320
 321         *more_values = False;
 322
 323         status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
 324
 325         if (!ADS_ERR_OK(status)) {
 326                 DEBUG(1,("ads_search: %s\n",
 327                          ads_errstr(status)));
 328                 return status;
 329         }
 330
 331         if (!res) {
 332                 return ADS_ERROR(LDAP_NO_MEMORY);
 333         }
 334
 335         count = ads_count_replies(ads, res);
 336         if (count == 0) {
 337                 ads_msgfree(ads, res);
 338                 return ADS_ERROR(LDAP_SUCCESS);
 339         }
 340
 341         if (*num_strings == 0) {
 342                 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
 343                         DEBUG(1, ("could not pull first usnChanged!\n"));
 344                         ads_msgfree(ads, res);
 345                         return ADS_ERROR(LDAP_NO_MEMORY);
 346                 }
 347         }
 348
 349         if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
 350                 DEBUG(1, ("could not pull current usnChanged!\n"));
 351                 ads_msgfree(ads, res);
 352                 return ADS_ERROR(LDAP_NO_MEMORY);
 353         }
 354
 355         if (*first_usn != current_usn) {
 356                 DEBUG(5, ("USN on this record changed"
 357                           " - restarting search\n"));
 358                 if (*num_retries < 5) {
 359                         (*num_retries)++;
 360                         *num_strings = 0;
 361                         ads_msgfree(ads, res);
 362                         return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
 363                 } else {
 364                         DEBUG(5, ("USN on this record changed"
 365                                   " - restarted search too many times, aborting!\n"));
 366                         ads_msgfree(ads, res);
 367                         return ADS_ERROR(LDAP_NO_MEMORY);
 368                 }
 369         }
 370
 371         *strings = ads_pull_strings_range(ads, mem_ctx, res,
 372                                          range_attr,
 373                                          *strings,
 374                                          &attrs[0],
 375                                          num_strings,
 376                                          more_values);
 377
 378         ads_msgfree(ads, res);
 379
 380         /* paranoia checks */
 381         if (*strings == NULL && *more_values) {
 382                 DEBUG(0,("no strings found but more values???\n"));
 383                 return ADS_ERROR(LDAP_NO_MEMORY);
 384         }
 385         if (*num_strings == 0 && *more_values) {
 386                 DEBUG(0,("no strings found but more values???\n"));
 387                 return ADS_ERROR(LDAP_NO_MEMORY);
 388         }
 389
 390         return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
 391 }
 392
 393 #endif