2 Unix SMB/CIFS implementation.
4 Some Helpful wrappers on LDAP
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/param/loadparm.h"
29 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
36 const char *range_attr,
44 a wrapper around ldap_search_s that retries depending on the error code
45 this is supposed to catch dropped connections and auto-reconnect
47 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
49 const char **attrs, void *args,
59 time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
60 return ADS_ERROR(LDAP_SERVER_DOWN);
63 bp = SMB_STRDUP(bind_path);
66 return ADS_ERROR(LDAP_NO_MEMORY);
71 /* when binding anonymously, we cannot use the paged search LDAP
72 * control - Guenther */
74 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
75 status = ads_do_search(ads, bp, scope, expr, attrs, res);
77 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
79 if (ADS_ERR_OK(status)) {
80 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
81 expr, bp, ads_count_replies(ads, *res)));
88 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
89 ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
90 lp_ldap_page_size() > 4) {
91 int new_page_size = (ads->config.ldap_page_size / 2);
92 DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
93 ads->config.ldap_page_size, new_page_size));
94 ads->config.ldap_page_size = new_page_size;
98 ads_msgfree(ads, *res);
101 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
102 ads->config.realm, ads_errstr(status)));
105 status = ads_connect(ads);
107 if (!ADS_ERR_OK(status)) {
108 bool orig_is_mine = ads->is_mine;
110 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
111 ads_errstr(status)));
113 * We need to keep the ads pointer
114 * from being freed here as we don't own it and
115 * callers depend on it being around.
117 ads->is_mine = false;
119 ads->is_mine = orig_is_mine;
126 /* when binding anonymously, we cannot use the paged search LDAP
127 * control - Guenther */
129 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
130 status = ads_do_search(ads, bp, scope, expr, attrs, res);
132 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
135 if (ADS_ERR_OK(status)) {
136 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
137 expr, bp, ads_count_replies(ads, *res)));
144 if (!ADS_ERR_OK(status)) {
145 DEBUG(1,("ads reopen failed after error %s\n",
146 ads_errstr(status)));
151 ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
152 int scope, const char *expr,
153 const char **attrs, LDAPMessage **res)
155 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
158 static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
159 int scope, const char *expr,
160 const char **attrs, void *args,
163 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
167 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
168 const char *expr, const char **attrs)
170 return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
174 ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
178 return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
179 "(objectclass=*)", attrs, res);
182 ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
189 args.control = ADS_SD_FLAGS_OID;
191 args.critical = True;
193 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
194 "(objectclass=*)", attrs, &args, res);
197 ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
200 enum ads_extended_dn_flags flags,
206 args.control = ADS_EXTENDED_DN_OID;
208 args.critical = True;
210 /* we can only range process one attribute */
211 if (!attrs || !attrs[0] || attrs[1]) {
212 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
215 return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
216 "(objectclass=*)", &args, attrs[0],
217 strings, num_strings);
221 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
222 const struct dom_sid *sid,
225 char *dn, *sid_string;
228 sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
229 if (sid_string == NULL) {
230 return ADS_ERROR(LDAP_NO_MEMORY);
233 if (!asprintf(&dn, "<SID=%s>", sid_string)) {
234 TALLOC_FREE(sid_string);
235 return ADS_ERROR(LDAP_NO_MEMORY);
238 status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
239 "(objectclass=*)", attrs, res);
241 TALLOC_FREE(sid_string);
245 ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
251 const char *range_attr,
259 bool more_values = False;
264 attrs = talloc_array(mem_ctx, const char *, 3);
265 ADS_ERROR_HAVE_NO_MEMORY(attrs);
267 attrs[0] = talloc_strdup(mem_ctx, range_attr);
268 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
271 ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
272 ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
275 status = ads_ranged_search_internal(ads, mem_ctx,
277 attrs, args, range_attr,
278 strings, num_strings,
279 &first_usn, &num_retries,
282 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
286 if (!ADS_ERR_OK(status)) {
292 } while (more_values);
295 DEBUG(10,("returning with %d strings\n", (int)*num_strings));
300 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
307 const char *range_attr,
314 LDAPMessage *res = NULL;
317 uint32_t current_usn;
319 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
321 *more_values = False;
323 status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
325 if (!ADS_ERR_OK(status)) {
326 DEBUG(1,("ads_search: %s\n",
327 ads_errstr(status)));
332 return ADS_ERROR(LDAP_NO_MEMORY);
335 count = ads_count_replies(ads, res);
337 ads_msgfree(ads, res);
338 return ADS_ERROR(LDAP_SUCCESS);
341 if (*num_strings == 0) {
342 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
343 DEBUG(1, ("could not pull first usnChanged!\n"));
344 ads_msgfree(ads, res);
345 return ADS_ERROR(LDAP_NO_MEMORY);
349 if (!ads_pull_uint32(ads, res, "usnChanged", ¤t_usn)) {
350 DEBUG(1, ("could not pull current usnChanged!\n"));
351 ads_msgfree(ads, res);
352 return ADS_ERROR(LDAP_NO_MEMORY);
355 if (*first_usn != current_usn) {
356 DEBUG(5, ("USN on this record changed"
357 " - restarting search\n"));
358 if (*num_retries < 5) {
361 ads_msgfree(ads, res);
362 return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
364 DEBUG(5, ("USN on this record changed"
365 " - restarted search too many times, aborting!\n"));
366 ads_msgfree(ads, res);
367 return ADS_ERROR(LDAP_NO_MEMORY);
371 *strings = ads_pull_strings_range(ads, mem_ctx, res,
378 ads_msgfree(ads, res);
380 /* paranoia checks */
381 if (*strings == NULL && *more_values) {
382 DEBUG(0,("no strings found but more values???\n"));
383 return ADS_ERROR(LDAP_NO_MEMORY);
385 if (*num_strings == 0 && *more_values) {
386 DEBUG(0,("no strings found but more values???\n"));
387 return ADS_ERROR(LDAP_NO_MEMORY);
390 return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);