2 Unix SMB/CIFS implementation.
4 Some Helpful wrappers on LDAP
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 a wrapper around ldap_search_s that retries depending on the error code
29 this is supposed to catch dropped connections and auto-reconnect
31 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
33 const char **attrs, void *args,
36 ADS_STATUS status = ADS_SUCCESS;
43 time(NULL) - ads->last_attempt < ADS_RECONNECT_TIME) {
44 return ADS_ERROR(LDAP_SERVER_DOWN);
47 bp = SMB_STRDUP(bind_path);
50 return ADS_ERROR(LDAP_NO_MEMORY);
55 /* when binding anonymously, we cannot use the paged search LDAP
56 * control - Guenther */
58 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
59 status = ads_do_search(ads, bp, scope, expr, attrs, res);
61 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
63 if (ADS_ERR_OK(status)) {
64 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
65 expr, bp, ads_count_replies(ads, *res)));
73 ads_msgfree(ads, *res);
76 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
77 ads->config.realm, ads_errstr(status)));
84 status = ads_connect(ads);
86 if (!ADS_ERR_OK(status)) {
87 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
96 /* when binding anonymously, we cannot use the paged search LDAP
97 * control - Guenther */
99 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
100 status = ads_do_search(ads, bp, scope, expr, attrs, res);
102 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
105 if (ADS_ERR_OK(status)) {
106 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
107 expr, bp, ads_count_replies(ads, *res)));
114 if (!ADS_ERR_OK(status)) {
115 DEBUG(1,("ads reopen failed after error %s\n",
116 ads_errstr(status)));
121 ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
122 int scope, const char *expr,
123 const char **attrs, LDAPMessage **res)
125 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
128 ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
129 int scope, const char *expr,
130 const char **attrs, void *args,
133 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
137 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
138 const char *expr, const char **attrs)
140 return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
144 ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
148 return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
149 "(objectclass=*)", attrs, res);
152 ADS_STATUS ads_search_retry_extended_dn(ADS_STRUCT *ads, LDAPMessage **res,
155 enum ads_extended_dn_flags flags)
159 args.control = ADS_EXTENDED_DN_OID;
161 args.critical = True;
163 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
164 "(objectclass=*)", attrs, &args, res);
167 ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
170 enum ads_extended_dn_flags flags,
176 args.control = ADS_EXTENDED_DN_OID;
178 args.critical = True;
180 /* we can only range process one attribute */
181 if (!attrs || !attrs[0] || attrs[1]) {
182 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
185 return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
186 "(objectclass=*)", &args, attrs[0],
187 strings, num_strings);
191 ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
198 args.control = ADS_SD_FLAGS_OID;
200 args.critical = True;
202 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
203 "(objectclass=*)", attrs, &args, res);
206 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
210 char *dn, *sid_string;
213 sid_string = sid_binstring_hex(sid);
214 if (sid_string == NULL) {
215 return ADS_ERROR(LDAP_NO_MEMORY);
218 if (!asprintf(&dn, "<SID=%s>", sid_string)) {
219 SAFE_FREE(sid_string);
220 return ADS_ERROR(LDAP_NO_MEMORY);
223 status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
224 "(objectclass=*)", attrs, res);
226 SAFE_FREE(sid_string);
230 ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
236 const char *range_attr,
244 BOOL more_values = False;
249 attrs = TALLOC_ARRAY(mem_ctx, const char *, 3);
250 ADS_ERROR_HAVE_NO_MEMORY(attrs);
252 attrs[0] = talloc_strdup(mem_ctx, range_attr);
253 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
256 ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
257 ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
260 status = ads_ranged_search_internal(ads, mem_ctx,
262 attrs, args, range_attr,
263 strings, num_strings,
264 &first_usn, &num_retries,
267 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
271 if (!ADS_ERR_OK(status)) {
277 } while (more_values);
280 DEBUG(10,("returning with %d strings\n", (int)*num_strings));
285 ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
292 const char *range_attr,
299 LDAPMessage *res = NULL;
304 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
306 *more_values = False;
308 status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
310 if (!ADS_ERR_OK(status)) {
311 DEBUG(1,("ads_search: %s\n",
312 ads_errstr(status)));
317 return ADS_ERROR(LDAP_NO_MEMORY);
320 count = ads_count_replies(ads, res);
322 ads_msgfree(ads, res);
323 return ADS_ERROR(LDAP_SUCCESS);
326 if (*num_strings == 0) {
327 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
328 DEBUG(1, ("could not pull first usnChanged!\n"));
329 ads_msgfree(ads, res);
330 return ADS_ERROR(LDAP_NO_MEMORY);
334 if (!ads_pull_uint32(ads, res, "usnChanged", ¤t_usn)) {
335 DEBUG(1, ("could not pull current usnChanged!\n"));
336 ads_msgfree(ads, res);
337 return ADS_ERROR(LDAP_NO_MEMORY);
340 if (*first_usn != current_usn) {
341 DEBUG(5, ("USN on this record changed"
342 " - restarting search\n"));
343 if (*num_retries < 5) {
346 ads_msgfree(ads, res);
347 return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
349 DEBUG(5, ("USN on this record changed"
350 " - restarted search too many times, aborting!\n"));
351 ads_msgfree(ads, res);
352 return ADS_ERROR(LDAP_NO_MEMORY);
356 *strings = ads_pull_strings_range(ads, mem_ctx, res,
363 ads_msgfree(ads, res);
365 /* paranoia checks */
366 if (*strings == NULL && *more_values) {
367 DEBUG(0,("no strings found but more values???\n"));
368 return ADS_ERROR(LDAP_NO_MEMORY);
370 if (*num_strings == 0 && *more_values) {
371 DEBUG(0,("no strings found but more values???\n"));
372 return ADS_ERROR(LDAP_NO_MEMORY);
375 return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);