2 Unix SMB/CIFS mplementation.
3 LDAP protocol helper functions for SAMBA
5 Copyright (C) Andrew Tridgell 2004
6 Copyright (C) Volker Lendecke 2004
7 Copyright (C) Stefan Metzmacher 2004
8 Copyright (C) Simo Sorce 2004
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "lib/socket/socket.h"
28 #include "lib/tsocket/tsocket.h"
29 #include "libcli/util/tstream.h"
30 #include "../lib/util/asn1.h"
31 #include "../lib/util/dlinklist.h"
32 #include "libcli/ldap/libcli_ldap.h"
33 #include "libcli/ldap/ldap_proto.h"
34 #include "libcli/ldap/ldap_client.h"
35 #include "libcli/composite/composite.h"
36 #include "lib/tls/tls.h"
37 #include "auth/gensec/gensec.h"
38 #include "system/time.h"
39 #include "param/param.h"
40 #include "libcli/resolve/resolve.h"
42 static void ldap_connection_dead(struct ldap_connection *conn, NTSTATUS status);
44 static int ldap_connection_destructor(struct ldap_connection *conn)
47 * NT_STATUS_OK means that callbacks of pending requests are not
50 ldap_connection_dead(conn, NT_STATUS_OK);
55 create a new ldap_connection stucture. The event context is optional
58 _PUBLIC_ struct ldap_connection *ldap4_new_connection(TALLOC_CTX *mem_ctx,
59 struct loadparm_context *lp_ctx,
60 struct tevent_context *ev)
62 struct ldap_connection *conn;
68 conn = talloc_zero(mem_ctx, struct ldap_connection);
73 conn->next_messageid = 1;
74 conn->event.event_ctx = ev;
76 conn->sockets.send_queue = tevent_queue_create(conn,
77 "ldap_connection send_queue");
78 if (conn->sockets.send_queue == NULL) {
83 conn->lp_ctx = lp_ctx;
85 /* set a reasonable request timeout */
88 /* explicitly avoid reconnections by default */
89 conn->reconnect.max_retries = 0;
91 talloc_set_destructor(conn, ldap_connection_destructor);
96 the connection is dead
98 static void ldap_connection_dead(struct ldap_connection *conn, NTSTATUS status)
100 struct ldap_request *req;
102 tevent_queue_stop(conn->sockets.send_queue);
103 TALLOC_FREE(conn->sockets.recv_subreq);
104 conn->sockets.active = NULL;
105 TALLOC_FREE(conn->sockets.sasl);
106 TALLOC_FREE(conn->sockets.tls);
107 TALLOC_FREE(conn->sockets.raw);
109 /* return an error for any pending request ... */
110 while (conn->pending) {
112 DLIST_REMOVE(req->conn->pending, req);
114 req->state = LDAP_REQUEST_DONE;
115 if (NT_STATUS_IS_OK(status)) {
118 req->status = status;
125 static void ldap_reconnect(struct ldap_connection *conn);
130 static void ldap_error_handler(struct ldap_connection *conn, NTSTATUS status)
132 ldap_connection_dead(conn, status);
134 /* but try to reconnect so that the ldb client can go on */
135 ldap_reconnect(conn);
140 match up with a pending message, adding to the replies list
142 static void ldap_match_message(struct ldap_connection *conn, struct ldap_message *msg)
144 struct ldap_request *req;
147 for (req=conn->pending; req; req=req->next) {
148 if (req->messageid == msg->messageid) break;
150 /* match a zero message id to the last request sent.
151 It seems that servers send 0 if unable to parse */
152 if (req == NULL && msg->messageid == 0) {
156 DEBUG(0,("ldap: no matching message id for %u\n",
162 /* Check for undecoded critical extensions */
163 for (i=0; msg->controls && msg->controls[i]; i++) {
164 if (!msg->controls_decoded[i] &&
165 msg->controls[i]->critical) {
167 req->status = NT_STATUS_LDAP(LDAP_UNAVAILABLE_CRITICAL_EXTENSION);
168 req->state = LDAP_REQUEST_DONE;
169 DLIST_REMOVE(conn->pending, req);
177 /* add to the list of replies received */
178 req->replies = talloc_realloc(req, req->replies,
179 struct ldap_message *, req->num_replies+1);
180 if (req->replies == NULL) {
182 req->status = NT_STATUS_NO_MEMORY;
183 req->state = LDAP_REQUEST_DONE;
184 DLIST_REMOVE(conn->pending, req);
191 req->replies[req->num_replies] = talloc_steal(req->replies, msg);
194 if (msg->type != LDAP_TAG_SearchResultEntry &&
195 msg->type != LDAP_TAG_SearchResultReference) {
196 /* currently only search results expect multiple
198 req->state = LDAP_REQUEST_DONE;
199 DLIST_REMOVE(conn->pending, req);
207 static void ldap_connection_recv_done(struct tevent_req *subreq);
209 static void ldap_connection_recv_next(struct ldap_connection *conn)
211 struct tevent_req *subreq = NULL;
213 if (conn->sockets.recv_subreq != NULL) {
217 if (conn->sockets.active == NULL) {
221 if (conn->pending == NULL) {
226 * The minimun size of a LDAP pdu is 7 bytes
228 * dumpasn1 -hh ldap-unbind-min.dat
230 * <30 05 02 01 09 42 00>
235 * 5 0: [APPLICATION 2]
236 * : Error: Object has zero length.
239 * dumpasn1 -hh ldap-unbind-windows.dat
241 * <30 84 00 00 00 05 02 01 09 42 00>
246 * 9 0: [APPLICATION 2]
247 * : Error: Object has zero length.
250 * This means using an initial read size
253 subreq = tstream_read_pdu_blob_send(conn,
254 conn->event.event_ctx,
255 conn->sockets.active,
256 7, /* initial_read_size */
259 if (subreq == NULL) {
260 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
263 tevent_req_set_callback(subreq, ldap_connection_recv_done, conn);
264 conn->sockets.recv_subreq = subreq;
269 decode/process LDAP data
271 static void ldap_connection_recv_done(struct tevent_req *subreq)
274 struct ldap_connection *conn =
275 tevent_req_callback_data(subreq,
276 struct ldap_connection);
277 struct ldap_message *msg;
278 struct asn1_data *asn1;
281 msg = talloc_zero(conn, struct ldap_message);
283 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
287 asn1 = asn1_init(conn);
290 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
294 conn->sockets.recv_subreq = NULL;
296 status = tstream_read_pdu_blob_recv(subreq,
300 if (!NT_STATUS_IS_OK(status)) {
303 ldap_error_handler(conn, status);
307 asn1_load_nocopy(asn1, blob.data, blob.length);
309 status = ldap_decode(asn1, samba_ldap_control_handlers(), msg);
311 if (!NT_STATUS_IS_OK(status)) {
313 ldap_error_handler(conn, status);
317 ldap_match_message(conn, msg);
318 ldap_connection_recv_next(conn);
326 static NTSTATUS ldap_parse_basic_url(TALLOC_CTX *mem_ctx, const char *url,
327 char **host, uint16_t *port, bool *ldaps)
335 SMB_ASSERT(sizeof(protocol)>10 && sizeof(tmp_host)>254);
337 ret = sscanf(url, "%10[^:]://%254[^:/]:%d", protocol, tmp_host, &tmp_port);
339 return NT_STATUS_INVALID_PARAMETER;
342 if (strequal(protocol, "ldap")) {
345 } else if (strequal(protocol, "ldaps")) {
349 DEBUG(0, ("unrecognised ldap protocol (%s)!\n", protocol));
350 return NT_STATUS_PROTOCOL_UNREACHABLE;
356 *host = talloc_strdup(mem_ctx, tmp_host);
357 NT_STATUS_HAVE_NO_MEMORY(*host);
363 connect to a ldap server
366 struct ldap_connect_state {
367 struct composite_context *ctx;
368 struct ldap_connection *conn;
369 struct socket_context *sock;
370 struct tstream_context *raw;
371 struct tstream_tls_params *tls_params;
372 struct tstream_context *tls;
375 static void ldap_connect_recv_unix_conn(struct composite_context *ctx);
376 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx);
378 _PUBLIC_ struct composite_context *ldap_connect_send(struct ldap_connection *conn,
381 struct composite_context *result, *ctx;
382 struct ldap_connect_state *state;
386 result = talloc_zero(conn, struct composite_context);
387 if (result == NULL) goto failed;
388 result->state = COMPOSITE_STATE_IN_PROGRESS;
389 result->async.fn = NULL;
390 result->event_ctx = conn->event.event_ctx;
392 state = talloc(result, struct ldap_connect_state);
393 if (state == NULL) goto failed;
395 result->private_data = state;
399 if (conn->reconnect.url == NULL) {
400 conn->reconnect.url = talloc_strdup(conn, url);
401 if (conn->reconnect.url == NULL) goto failed;
405 SMB_ASSERT(sizeof(protocol)>10);
407 ret = sscanf(url, "%10[^:]://", protocol);
412 if (strequal(protocol, "ldapi")) {
413 struct socket_address *unix_addr;
416 NTSTATUS status = socket_create("unix", SOCKET_TYPE_STREAM, &state->sock, 0);
417 if (!NT_STATUS_IS_OK(status)) {
420 talloc_steal(state, state->sock);
421 SMB_ASSERT(sizeof(protocol)>10);
422 SMB_ASSERT(sizeof(path)>1024);
424 /* LDAPI connections are to localhost, so give the
425 * local host name as the target for gensec's
426 * DIGEST-MD5 mechanism */
427 conn->host = talloc_asprintf(conn, "%s.%s",
428 lpcfg_netbios_name(conn->lp_ctx),
429 lpcfg_dnsdomain(conn->lp_ctx));
430 if (composite_nomem(conn->host, state->ctx)) {
434 /* The %c specifier doesn't null terminate :-( */
436 ret = sscanf(url, "%10[^:]://%1025c", protocol, path);
438 composite_error(state->ctx, NT_STATUS_INVALID_PARAMETER);
442 rfc1738_unescape(path);
444 unix_addr = socket_address_from_strings(state, state->sock->backend_name,
446 if (composite_nomem(unix_addr, result)) {
451 ctx = socket_connect_send(state->sock, NULL, unix_addr,
452 0, result->event_ctx);
453 ctx->async.fn = ldap_connect_recv_unix_conn;
454 ctx->async.private_data = state;
457 NTSTATUS status = ldap_parse_basic_url(conn, url, &conn->host,
458 &conn->port, &conn->ldaps);
459 if (!NT_STATUS_IS_OK(status)) {
460 composite_error(result, status);
465 char *ca_file = lpcfg_tls_cafile(state, conn->lp_ctx);
466 char *crl_file = lpcfg_tls_crlfile(state, conn->lp_ctx);
468 if (!ca_file || !*ca_file) {
469 composite_error(result,
470 NT_STATUS_INVALID_PARAMETER_MIX);
474 status = tstream_tls_params_client(state,
478 if (!NT_STATUS_IS_OK(status)) {
479 composite_error(result, status);
484 ctx = socket_connect_multi_send(state, conn->host, 1, &conn->port,
485 lpcfg_resolve_context(conn->lp_ctx),
487 if (composite_nomem(ctx, result)) {
491 ctx->async.fn = ldap_connect_recv_tcp_conn;
492 ctx->async.private_data = state;
500 static void ldap_connect_got_tls(struct tevent_req *subreq);
502 static void ldap_connect_got_sock(struct composite_context *ctx,
503 struct ldap_connection *conn)
505 struct ldap_connect_state *state =
506 talloc_get_type_abort(ctx->private_data,
507 struct ldap_connect_state);
508 struct tevent_req *subreq = NULL;
512 socket_set_flags(state->sock, SOCKET_FLAG_NOCLOSE);
513 fd = socket_get_fd(state->sock);
514 TALLOC_FREE(state->sock);
516 smb_set_close_on_exec(fd);
517 set_blocking(fd, false);
519 ret = tstream_bsd_existing_socket(state, fd, &state->raw);
521 NTSTATUS status = map_nt_error_from_unix_common(errno);
522 composite_error(state->ctx, status);
527 conn->sockets.raw = talloc_move(conn, &state->raw);
528 conn->sockets.active = conn->sockets.raw;
529 composite_done(state->ctx);
533 subreq = tstream_tls_connect_send(state, state->ctx->event_ctx,
534 state->raw, state->tls_params);
535 if (composite_nomem(subreq, state->ctx)) {
538 tevent_req_set_callback(subreq, ldap_connect_got_tls, state);
541 static void ldap_connect_got_tls(struct tevent_req *subreq)
543 struct ldap_connect_state *state =
544 tevent_req_callback_data(subreq,
545 struct ldap_connect_state);
549 ret = tstream_tls_connect_recv(subreq, &err, state, &state->tls);
552 NTSTATUS status = map_nt_error_from_unix_common(err);
553 composite_error(state->ctx, status);
557 talloc_steal(state->tls, state->tls_params);
559 state->conn->sockets.raw = talloc_move(state->conn, &state->raw);
560 state->conn->sockets.tls = talloc_move(state->conn->sockets.raw,
562 state->conn->sockets.active = state->conn->sockets.tls;
563 composite_done(state->ctx);
566 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx)
568 struct ldap_connect_state *state =
569 talloc_get_type_abort(ctx->async.private_data,
570 struct ldap_connect_state);
571 struct ldap_connection *conn = state->conn;
573 NTSTATUS status = socket_connect_multi_recv(ctx, state, &state->sock,
575 if (!NT_STATUS_IS_OK(status)) {
576 composite_error(state->ctx, status);
580 ldap_connect_got_sock(state->ctx, conn);
583 static void ldap_connect_recv_unix_conn(struct composite_context *ctx)
585 struct ldap_connect_state *state =
586 talloc_get_type_abort(ctx->async.private_data,
587 struct ldap_connect_state);
588 struct ldap_connection *conn = state->conn;
590 NTSTATUS status = socket_connect_recv(ctx);
592 if (!NT_STATUS_IS_OK(state->ctx->status)) {
593 composite_error(state->ctx, status);
597 ldap_connect_got_sock(state->ctx, conn);
600 _PUBLIC_ NTSTATUS ldap_connect_recv(struct composite_context *ctx)
602 NTSTATUS status = composite_wait(ctx);
607 _PUBLIC_ NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url)
609 struct composite_context *ctx = ldap_connect_send(conn, url);
610 return ldap_connect_recv(ctx);
613 /* set reconnect parameters */
615 _PUBLIC_ void ldap_set_reconn_params(struct ldap_connection *conn, int max_retries)
618 conn->reconnect.max_retries = max_retries;
619 conn->reconnect.retries = 0;
620 conn->reconnect.previous = time_mono(NULL);
624 /* Actually this function is NOT ASYNC safe, FIXME? */
625 static void ldap_reconnect(struct ldap_connection *conn)
628 time_t now = time_mono(NULL);
630 /* do we have set up reconnect ? */
631 if (conn->reconnect.max_retries == 0) return;
633 /* is the retry time expired ? */
634 if (now > conn->reconnect.previous + 30) {
635 conn->reconnect.retries = 0;
636 conn->reconnect.previous = now;
639 /* are we reconnectind too often and too fast? */
640 if (conn->reconnect.retries > conn->reconnect.max_retries) return;
642 /* keep track of the number of reconnections */
643 conn->reconnect.retries++;
646 status = ldap_connect(conn, conn->reconnect.url);
647 if ( ! NT_STATUS_IS_OK(status)) {
652 status = ldap_rebind(conn);
653 if ( ! NT_STATUS_IS_OK(status)) {
654 ldap_connection_dead(conn, status);
658 /* destroy an open ldap request */
659 static int ldap_request_destructor(struct ldap_request *req)
661 if (req->state == LDAP_REQUEST_PENDING) {
662 DLIST_REMOVE(req->conn->pending, req);
668 called on timeout of a ldap request
670 static void ldap_request_timeout(struct tevent_context *ev, struct tevent_timer *te,
671 struct timeval t, void *private_data)
673 struct ldap_request *req =
674 talloc_get_type_abort(private_data,
675 struct ldap_request);
677 req->status = NT_STATUS_IO_TIMEOUT;
678 if (req->state == LDAP_REQUEST_PENDING) {
679 DLIST_REMOVE(req->conn->pending, req);
681 req->state = LDAP_REQUEST_DONE;
689 called on completion of a failed ldap request
691 static void ldap_request_failed_complete(struct tevent_context *ev, struct tevent_timer *te,
692 struct timeval t, void *private_data)
694 struct ldap_request *req =
695 talloc_get_type_abort(private_data,
696 struct ldap_request);
703 static void ldap_request_written(struct tevent_req *subreq);
706 send a ldap message - async interface
708 _PUBLIC_ struct ldap_request *ldap_request_send(struct ldap_connection *conn,
709 struct ldap_message *msg)
711 struct ldap_request *req;
712 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
713 struct tevent_req *subreq = NULL;
715 req = talloc_zero(conn, struct ldap_request);
716 if (req == NULL) return NULL;
718 if (conn->sockets.active == NULL) {
719 status = NT_STATUS_INVALID_CONNECTION;
723 req->state = LDAP_REQUEST_SEND;
725 req->messageid = conn->next_messageid++;
726 if (conn->next_messageid == 0) {
727 conn->next_messageid = 1;
729 req->type = msg->type;
730 if (req->messageid == -1) {
734 talloc_set_destructor(req, ldap_request_destructor);
736 msg->messageid = req->messageid;
738 if (!ldap_encode(msg, samba_ldap_control_handlers(), &req->data, req)) {
739 status = NT_STATUS_INTERNAL_ERROR;
743 /* put a timeout on the request */
744 req->time_event = tevent_add_timer(conn->event.event_ctx, req,
745 timeval_current_ofs(conn->timeout, 0),
746 ldap_request_timeout, req);
747 if (req->time_event == NULL) {
748 status = NT_STATUS_NO_MEMORY;
752 req->write_iov.iov_base = req->data.data;
753 req->write_iov.iov_len = req->data.length;
755 subreq = tstream_writev_queue_send(req, conn->event.event_ctx,
756 conn->sockets.active,
757 conn->sockets.send_queue,
759 if (subreq == NULL) {
760 status = NT_STATUS_NO_MEMORY;
763 tevent_req_set_callback(subreq, ldap_request_written, req);
765 req->state = LDAP_REQUEST_PENDING;
766 DLIST_ADD(conn->pending, req);
771 req->status = status;
772 req->state = LDAP_REQUEST_ERROR;
773 tevent_add_timer(conn->event.event_ctx, req, timeval_zero(),
774 ldap_request_failed_complete, req);
779 static void ldap_request_written(struct tevent_req *subreq)
781 struct ldap_request *req =
782 tevent_req_callback_data(subreq,
783 struct ldap_request);
787 ret = tstream_writev_queue_recv(subreq, &err);
790 NTSTATUS error = map_nt_error_from_unix_common(err);
791 ldap_error_handler(req->conn, error);
795 if (req->type == LDAP_TAG_AbandonRequest ||
796 req->type == LDAP_TAG_UnbindRequest)
798 if (req->state == LDAP_REQUEST_PENDING) {
799 DLIST_REMOVE(req->conn->pending, req);
801 req->state = LDAP_REQUEST_DONE;
808 ldap_connection_recv_next(req->conn);
813 wait for a request to complete
814 note that this does not destroy the request
816 _PUBLIC_ NTSTATUS ldap_request_wait(struct ldap_request *req)
818 while (req->state < LDAP_REQUEST_DONE) {
819 if (tevent_loop_once(req->conn->event.event_ctx) != 0) {
820 req->state = LDAP_REQUEST_ERROR;
821 req->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
830 a mapping of ldap response code to strings
832 static const struct {
833 enum ldap_result_code code;
835 } ldap_code_map[] = {
836 #define _LDAP_MAP_CODE(c) { c, #c }
837 _LDAP_MAP_CODE(LDAP_SUCCESS),
838 _LDAP_MAP_CODE(LDAP_OPERATIONS_ERROR),
839 _LDAP_MAP_CODE(LDAP_PROTOCOL_ERROR),
840 _LDAP_MAP_CODE(LDAP_TIME_LIMIT_EXCEEDED),
841 _LDAP_MAP_CODE(LDAP_SIZE_LIMIT_EXCEEDED),
842 _LDAP_MAP_CODE(LDAP_COMPARE_FALSE),
843 _LDAP_MAP_CODE(LDAP_COMPARE_TRUE),
844 _LDAP_MAP_CODE(LDAP_AUTH_METHOD_NOT_SUPPORTED),
845 _LDAP_MAP_CODE(LDAP_STRONG_AUTH_REQUIRED),
846 _LDAP_MAP_CODE(LDAP_REFERRAL),
847 _LDAP_MAP_CODE(LDAP_ADMIN_LIMIT_EXCEEDED),
848 _LDAP_MAP_CODE(LDAP_UNAVAILABLE_CRITICAL_EXTENSION),
849 _LDAP_MAP_CODE(LDAP_CONFIDENTIALITY_REQUIRED),
850 _LDAP_MAP_CODE(LDAP_SASL_BIND_IN_PROGRESS),
851 _LDAP_MAP_CODE(LDAP_NO_SUCH_ATTRIBUTE),
852 _LDAP_MAP_CODE(LDAP_UNDEFINED_ATTRIBUTE_TYPE),
853 _LDAP_MAP_CODE(LDAP_INAPPROPRIATE_MATCHING),
854 _LDAP_MAP_CODE(LDAP_CONSTRAINT_VIOLATION),
855 _LDAP_MAP_CODE(LDAP_ATTRIBUTE_OR_VALUE_EXISTS),
856 _LDAP_MAP_CODE(LDAP_INVALID_ATTRIBUTE_SYNTAX),
857 _LDAP_MAP_CODE(LDAP_NO_SUCH_OBJECT),
858 _LDAP_MAP_CODE(LDAP_ALIAS_PROBLEM),
859 _LDAP_MAP_CODE(LDAP_INVALID_DN_SYNTAX),
860 _LDAP_MAP_CODE(LDAP_ALIAS_DEREFERENCING_PROBLEM),
861 _LDAP_MAP_CODE(LDAP_INAPPROPRIATE_AUTHENTICATION),
862 _LDAP_MAP_CODE(LDAP_INVALID_CREDENTIALS),
863 _LDAP_MAP_CODE(LDAP_INSUFFICIENT_ACCESS_RIGHTS),
864 _LDAP_MAP_CODE(LDAP_BUSY),
865 _LDAP_MAP_CODE(LDAP_UNAVAILABLE),
866 _LDAP_MAP_CODE(LDAP_UNWILLING_TO_PERFORM),
867 _LDAP_MAP_CODE(LDAP_LOOP_DETECT),
868 _LDAP_MAP_CODE(LDAP_NAMING_VIOLATION),
869 _LDAP_MAP_CODE(LDAP_OBJECT_CLASS_VIOLATION),
870 _LDAP_MAP_CODE(LDAP_NOT_ALLOWED_ON_NON_LEAF),
871 _LDAP_MAP_CODE(LDAP_NOT_ALLOWED_ON_RDN),
872 _LDAP_MAP_CODE(LDAP_ENTRY_ALREADY_EXISTS),
873 _LDAP_MAP_CODE(LDAP_OBJECT_CLASS_MODS_PROHIBITED),
874 _LDAP_MAP_CODE(LDAP_AFFECTS_MULTIPLE_DSAS),
875 _LDAP_MAP_CODE(LDAP_OTHER)
879 used to setup the status code from a ldap response
881 _PUBLIC_ NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r)
884 const char *codename = "unknown";
886 if (r->resultcode == LDAP_SUCCESS) {
890 if (conn->last_error) {
891 talloc_free(conn->last_error);
894 for (i=0;i<ARRAY_SIZE(ldap_code_map);i++) {
895 if (r->resultcode == ldap_code_map[i].code) {
896 codename = ldap_code_map[i].str;
901 conn->last_error = talloc_asprintf(conn, "LDAP error %u %s - %s <%s> <%s>",
904 r->dn?r->dn:"(NULL)",
905 r->errormessage?r->errormessage:"",
906 r->referral?r->referral:"");
908 return NT_STATUS_LDAP(r->resultcode);
912 return error string representing the last error
914 _PUBLIC_ const char *ldap_errstr(struct ldap_connection *conn,
918 if (NT_STATUS_IS_LDAP(status) && conn->last_error != NULL) {
919 return talloc_strdup(mem_ctx, conn->last_error);
921 return talloc_asprintf(mem_ctx, "LDAP client internal error: %s", nt_errstr(status));
926 return the Nth result message, waiting if necessary
928 _PUBLIC_ NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **msg)
932 NT_STATUS_HAVE_NO_MEMORY(req);
934 while (req->state < LDAP_REQUEST_DONE && n >= req->num_replies) {
935 if (tevent_loop_once(req->conn->event.event_ctx) != 0) {
936 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
940 if (n < req->num_replies) {
941 *msg = req->replies[n];
945 if (!NT_STATUS_IS_OK(req->status)) {
949 return NT_STATUS_NO_MORE_ENTRIES;
954 return a single result message, checking if it is of the expected LDAP type
956 _PUBLIC_ NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, int type)
959 status = ldap_result_n(req, 0, msg);
960 if (!NT_STATUS_IS_OK(status)) {
963 if ((*msg)->type != type) {
965 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
971 a simple ldap transaction, for single result requests that only need a status code
972 this relies on single valued requests having the response type == request type + 1
974 _PUBLIC_ NTSTATUS ldap_transaction(struct ldap_connection *conn, struct ldap_message *msg)
976 struct ldap_request *req = ldap_request_send(conn, msg);
977 struct ldap_message *res;
979 status = ldap_result_n(req, 0, &res);
980 if (!NT_STATUS_IS_OK(status)) {
984 if (res->type != msg->type + 1) {
986 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
988 status = ldap_check_response(conn, &res->r.GeneralResult);