152d5b9dbc7cce97ebb06dc8edd723fbfc0b0f13
[samba.git] / source4 / libcli / ldap / ldap_client.c
1 /* 
2    Unix SMB/CIFS mplementation.
3    LDAP protocol helper functions for SAMBA
4    
5    Copyright (C) Andrew Tridgell  2004
6    Copyright (C) Volker Lendecke 2004
7    Copyright (C) Stefan Metzmacher 2004
8    Copyright (C) Simo Sorce 2004
9     
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19    
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22    
23 */
24
25 #include "includes.h"
26 #include <tevent.h>
27 #include "lib/socket/socket.h"
28 #include "lib/tsocket/tsocket.h"
29 #include "libcli/util/tstream.h"
30 #include "../lib/util/asn1.h"
31 #include "../lib/util/dlinklist.h"
32 #include "libcli/ldap/libcli_ldap.h"
33 #include "libcli/ldap/ldap_proto.h"
34 #include "libcli/ldap/ldap_client.h"
35 #include "libcli/composite/composite.h"
36 #include "lib/tls/tls.h"
37 #include "auth/gensec/gensec.h"
38 #include "system/time.h"
39 #include "param/param.h"
40 #include "libcli/resolve/resolve.h"
41
42 static void ldap_connection_dead(struct ldap_connection *conn, NTSTATUS status);
43
44 static int ldap_connection_destructor(struct ldap_connection *conn)
45 {
46         /*
47          * NT_STATUS_OK means that callbacks of pending requests are not
48          * triggered
49          */
50         ldap_connection_dead(conn, NT_STATUS_OK);
51         return 0;
52 }
53
54 /**
55   create a new ldap_connection stucture. The event context is optional
56 */
57
58 _PUBLIC_ struct ldap_connection *ldap4_new_connection(TALLOC_CTX *mem_ctx, 
59                                              struct loadparm_context *lp_ctx,
60                                              struct tevent_context *ev)
61 {
62         struct ldap_connection *conn;
63
64         if (ev == NULL) {
65                 return NULL;
66         }
67
68         conn = talloc_zero(mem_ctx, struct ldap_connection);
69         if (conn == NULL) {
70                 return NULL;
71         }
72
73         conn->next_messageid  = 1;
74         conn->event.event_ctx = ev;
75
76         conn->sockets.send_queue = tevent_queue_create(conn,
77                                         "ldap_connection send_queue");
78         if (conn->sockets.send_queue == NULL) {
79                 TALLOC_FREE(conn);
80                 return NULL;
81         }
82
83         conn->lp_ctx = lp_ctx;
84
85         /* set a reasonable request timeout */
86         conn->timeout = 60;
87
88         /* explicitly avoid reconnections by default */
89         conn->reconnect.max_retries = 0;
90
91         talloc_set_destructor(conn, ldap_connection_destructor);
92         return conn;
93 }
94
95 /*
96   the connection is dead
97 */
98 static void ldap_connection_dead(struct ldap_connection *conn, NTSTATUS status)
99 {
100         struct ldap_request *req;
101
102         tevent_queue_stop(conn->sockets.send_queue);
103         TALLOC_FREE(conn->sockets.recv_subreq);
104         conn->sockets.active = NULL;
105         TALLOC_FREE(conn->sockets.sasl);
106         TALLOC_FREE(conn->sockets.tls);
107         TALLOC_FREE(conn->sockets.raw);
108
109         /* return an error for any pending request ... */
110         while (conn->pending) {
111                 req = conn->pending;
112                 DLIST_REMOVE(req->conn->pending, req);
113                 req->conn = NULL;
114                 req->state = LDAP_REQUEST_DONE;
115                 if (NT_STATUS_IS_OK(status)) {
116                         continue;
117                 }
118                 req->status = status;
119                 if (req->async.fn) {
120                         req->async.fn(req);
121                 }
122         }
123 }
124
125 static void ldap_reconnect(struct ldap_connection *conn);
126
127 /*
128   handle packet errors
129 */
130 static void ldap_error_handler(struct ldap_connection *conn, NTSTATUS status)
131 {
132         ldap_connection_dead(conn, status);
133
134         /* but try to reconnect so that the ldb client can go on */
135         ldap_reconnect(conn);
136 }
137
138
139 /*
140   match up with a pending message, adding to the replies list
141 */
142 static void ldap_match_message(struct ldap_connection *conn, struct ldap_message *msg)
143 {
144         struct ldap_request *req;
145         int i;
146
147         for (req=conn->pending; req; req=req->next) {
148                 if (req->messageid == msg->messageid) break;
149         }
150         /* match a zero message id to the last request sent.
151            It seems that servers send 0 if unable to parse */
152         if (req == NULL && msg->messageid == 0) {
153                 req = conn->pending;
154         }
155         if (req == NULL) {
156                 DEBUG(0,("ldap: no matching message id for %u\n",
157                          msg->messageid));
158                 TALLOC_FREE(msg);
159                 return;
160         }
161
162         /* Check for undecoded critical extensions */
163         for (i=0; msg->controls && msg->controls[i]; i++) {
164                 if (!msg->controls_decoded[i] && 
165                     msg->controls[i]->critical) {
166                         TALLOC_FREE(msg);
167                         req->status = NT_STATUS_LDAP(LDAP_UNAVAILABLE_CRITICAL_EXTENSION);
168                         req->state = LDAP_REQUEST_DONE;
169                         DLIST_REMOVE(conn->pending, req);
170                         if (req->async.fn) {
171                                 req->async.fn(req);
172                         }
173                         return;
174                 }
175         }
176
177         /* add to the list of replies received */
178         req->replies = talloc_realloc(req, req->replies, 
179                                       struct ldap_message *, req->num_replies+1);
180         if (req->replies == NULL) {
181                 TALLOC_FREE(msg);
182                 req->status = NT_STATUS_NO_MEMORY;
183                 req->state = LDAP_REQUEST_DONE;
184                 DLIST_REMOVE(conn->pending, req);
185                 if (req->async.fn) {
186                         req->async.fn(req);
187                 }
188                 return;
189         }
190
191         req->replies[req->num_replies] = talloc_steal(req->replies, msg);
192         req->num_replies++;
193
194         if (msg->type != LDAP_TAG_SearchResultEntry &&
195             msg->type != LDAP_TAG_SearchResultReference) {
196                 /* currently only search results expect multiple
197                    replies */
198                 req->state = LDAP_REQUEST_DONE;
199                 DLIST_REMOVE(conn->pending, req);
200         }
201
202         if (req->async.fn) {
203                 req->async.fn(req);
204         }
205 }
206
207 static void ldap_connection_recv_done(struct tevent_req *subreq);
208
209 static void ldap_connection_recv_next(struct ldap_connection *conn)
210 {
211         struct tevent_req *subreq = NULL;
212
213         if (conn->sockets.recv_subreq != NULL) {
214                 return;
215         }
216
217         if (conn->sockets.active == NULL) {
218                 return;
219         }
220
221         if (conn->pending == NULL) {
222                 return;
223         }
224
225         /*
226          * The minimum size of a LDAP pdu is 7 bytes
227          *
228          * dumpasn1 -hh ldap-unbind-min.dat
229          *
230          *     <30 05 02 01 09 42 00>
231          *    0    5: SEQUENCE {
232          *     <02 01 09>
233          *    2    1:   INTEGER 9
234          *     <42 00>
235          *    5    0:   [APPLICATION 2]
236          *          :     Error: Object has zero length.
237          *          :   }
238          *
239          * dumpasn1 -hh ldap-unbind-windows.dat
240          *
241          *     <30 84 00 00 00 05 02 01 09 42 00>
242          *    0    5: SEQUENCE {
243          *     <02 01 09>
244          *    6    1:   INTEGER 9
245          *     <42 00>
246          *    9    0:   [APPLICATION 2]
247          *          :     Error: Object has zero length.
248          *          :   }
249          *
250          * This means using an initial read size
251          * of 7 is ok.
252          */
253         subreq = tstream_read_pdu_blob_send(conn,
254                                             conn->event.event_ctx,
255                                             conn->sockets.active,
256                                             7, /* initial_read_size */
257                                             ldap_full_packet,
258                                             conn);
259         if (subreq == NULL) {
260                 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
261                 return;
262         }
263         tevent_req_set_callback(subreq, ldap_connection_recv_done, conn);
264         conn->sockets.recv_subreq = subreq;
265         return;
266 }
267
268 /*
269   decode/process LDAP data
270 */
271 static void ldap_connection_recv_done(struct tevent_req *subreq)
272 {
273         NTSTATUS status;
274         struct ldap_connection *conn =
275                 tevent_req_callback_data(subreq,
276                 struct ldap_connection);
277         struct ldap_message *msg;
278         struct asn1_data *asn1;
279         DATA_BLOB blob;
280
281         msg = talloc_zero(conn, struct ldap_message);
282         if (msg == NULL) {
283                 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
284                 return;
285         }
286
287         asn1 = asn1_init(conn);
288         if (asn1 == NULL) {
289                 TALLOC_FREE(msg);
290                 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
291                 return;
292         }
293
294         conn->sockets.recv_subreq = NULL;
295
296         status = tstream_read_pdu_blob_recv(subreq,
297                                             asn1,
298                                             &blob);
299         TALLOC_FREE(subreq);
300         if (!NT_STATUS_IS_OK(status)) {
301                 TALLOC_FREE(msg);
302                 asn1_free(asn1);
303                 ldap_error_handler(conn, status);
304                 return;
305         }
306
307         asn1_load_nocopy(asn1, blob.data, blob.length);
308
309         status = ldap_decode(asn1, samba_ldap_control_handlers(), msg);
310         asn1_free(asn1);
311         if (!NT_STATUS_IS_OK(status)) {
312                 TALLOC_FREE(msg);
313                 ldap_error_handler(conn, status);
314                 return;
315         }
316
317         ldap_match_message(conn, msg);
318         ldap_connection_recv_next(conn);
319
320         return;
321 }
322
323 /*
324   parse a ldap URL
325 */
326 static NTSTATUS ldap_parse_basic_url(TALLOC_CTX *mem_ctx, const char *url,
327                                      char **host, uint16_t *port, bool *ldaps)
328 {
329         int tmp_port = 0;
330         char protocol[11];
331         char tmp_host[1025];
332         int ret;
333
334         /* Paranoia check */
335         SMB_ASSERT(sizeof(protocol)>10 && sizeof(tmp_host)>254);
336                 
337         ret = sscanf(url, "%10[^:]://%254[^:/]:%d", protocol, tmp_host, &tmp_port);
338         if (ret < 2) {
339                 return NT_STATUS_INVALID_PARAMETER;
340         }
341
342         if (strequal(protocol, "ldap")) {
343                 *port = 389;
344                 *ldaps = false;
345         } else if (strequal(protocol, "ldaps")) {
346                 *port = 636;
347                 *ldaps = true;
348         } else {
349                 DEBUG(0, ("unrecognised ldap protocol (%s)!\n", protocol));
350                 return NT_STATUS_PROTOCOL_UNREACHABLE;
351         }
352
353         if (tmp_port != 0)
354                 *port = tmp_port;
355
356         *host = talloc_strdup(mem_ctx, tmp_host);
357         NT_STATUS_HAVE_NO_MEMORY(*host);
358
359         return NT_STATUS_OK;
360 }
361
362 /*
363   connect to a ldap server
364 */
365
366 struct ldap_connect_state {
367         struct composite_context *ctx;
368         struct ldap_connection *conn;
369         struct socket_context *sock;
370         struct tstream_context *raw;
371         struct tstream_tls_params *tls_params;
372         struct tstream_context *tls;
373 };
374
375 static void ldap_connect_recv_unix_conn(struct composite_context *ctx);
376 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx);
377
378 _PUBLIC_ struct composite_context *ldap_connect_send(struct ldap_connection *conn,
379                                             const char *url)
380 {
381         struct composite_context *result, *ctx;
382         struct ldap_connect_state *state;
383         char protocol[11];
384         int ret;
385
386         result = talloc_zero(conn, struct composite_context);
387         if (result == NULL) goto failed;
388         result->state = COMPOSITE_STATE_IN_PROGRESS;
389         result->async.fn = NULL;
390         result->event_ctx = conn->event.event_ctx;
391
392         state = talloc(result, struct ldap_connect_state);
393         if (state == NULL) goto failed;
394         state->ctx = result;
395         result->private_data = state;
396
397         state->conn = conn;
398
399         if (conn->reconnect.url == NULL) {
400                 conn->reconnect.url = talloc_strdup(conn, url);
401                 if (conn->reconnect.url == NULL) goto failed;
402         }
403
404         /* Paranoia check */
405         SMB_ASSERT(sizeof(protocol)>10);
406
407         ret = sscanf(url, "%10[^:]://", protocol);
408         if (ret < 1) {
409                 return NULL;
410         }
411
412         if (strequal(protocol, "ldapi")) {
413                 struct socket_address *unix_addr;
414                 char path[1025];
415         
416                 NTSTATUS status = socket_create("unix", SOCKET_TYPE_STREAM, &state->sock, 0);
417                 if (!NT_STATUS_IS_OK(status)) {
418                         return NULL;
419                 }
420                 talloc_steal(state, state->sock);
421                 SMB_ASSERT(sizeof(protocol)>10);
422                 SMB_ASSERT(sizeof(path)>1024);
423         
424                 /* LDAPI connections are to localhost, so give the
425                  * local host name as the target for gensec's
426                  * DIGEST-MD5 mechanism */
427                 conn->host = talloc_asprintf(conn, "%s.%s",
428                                              lpcfg_netbios_name(conn->lp_ctx),
429                                              lpcfg_dnsdomain(conn->lp_ctx));
430                 if (composite_nomem(conn->host, state->ctx)) {
431                         return result;
432                 }
433
434                 /* The %c specifier doesn't null terminate :-( */
435                 ZERO_STRUCT(path);
436                 ret = sscanf(url, "%10[^:]://%1025c", protocol, path);
437                 if (ret < 2) {
438                         composite_error(state->ctx, NT_STATUS_INVALID_PARAMETER);
439                         return result;
440                 }
441
442                 rfc1738_unescape(path);
443
444                 unix_addr = socket_address_from_strings(state, state->sock->backend_name,
445                                                         path, 0);
446                 if (composite_nomem(unix_addr, result)) {
447                         return result;
448                 }
449
450
451                 ctx = socket_connect_send(state->sock, NULL, unix_addr,
452                                           0, result->event_ctx);
453                 ctx->async.fn = ldap_connect_recv_unix_conn;
454                 ctx->async.private_data = state;
455                 return result;
456         } else {
457                 NTSTATUS status = ldap_parse_basic_url(conn, url, &conn->host,
458                                                           &conn->port, &conn->ldaps);
459                 if (!NT_STATUS_IS_OK(status)) {
460                         composite_error(result, status);
461                         return result;
462                 }
463
464                 if (conn->ldaps) {
465                         char *ca_file = lpcfg_tls_cafile(state, conn->lp_ctx);
466                         char *crl_file = lpcfg_tls_crlfile(state, conn->lp_ctx);
467                         const char *tls_priority = lpcfg_tls_priority(conn->lp_ctx);
468                         if (!ca_file || !*ca_file) {
469                                 composite_error(result,
470                                                 NT_STATUS_INVALID_PARAMETER_MIX);
471                                 return result;
472                         }
473
474                         status = tstream_tls_params_client(state,
475                                                            ca_file,
476                                                            crl_file,
477                                                            tls_priority,
478                                                            TLS_VERIFY_PEER_NO_CHECK,
479                                                            NULL,
480                                                            &state->tls_params);
481                         if (!NT_STATUS_IS_OK(status)) {
482                                 composite_error(result, status);
483                                 return result;
484                         }
485                 }
486
487                 ctx = socket_connect_multi_send(state, conn->host, 1, &conn->port,
488                                                 lpcfg_resolve_context(conn->lp_ctx),
489                                                 result->event_ctx);
490                 if (composite_nomem(ctx, result)) {
491                         return result;
492                 }
493
494                 ctx->async.fn = ldap_connect_recv_tcp_conn;
495                 ctx->async.private_data = state;
496                 return result;
497         }
498  failed:
499         talloc_free(result);
500         return NULL;
501 }
502
503 static void ldap_connect_got_tls(struct tevent_req *subreq);
504
505 static void ldap_connect_got_sock(struct composite_context *ctx, 
506                                   struct ldap_connection *conn)
507 {
508         struct ldap_connect_state *state =
509                 talloc_get_type_abort(ctx->private_data,
510                 struct ldap_connect_state);
511         struct tevent_req *subreq = NULL;
512         int fd;
513         int ret;
514
515         socket_set_flags(state->sock, SOCKET_FLAG_NOCLOSE);
516         fd = socket_get_fd(state->sock);
517         TALLOC_FREE(state->sock);
518
519         smb_set_close_on_exec(fd);
520
521         ret = set_blocking(fd, false);
522         if (ret == -1) {
523                 NTSTATUS status = map_nt_error_from_unix_common(errno);
524                 composite_error(state->ctx, status);
525                 return;
526         }
527
528         ret = tstream_bsd_existing_socket(state, fd, &state->raw);
529         if (ret == -1) {
530                 NTSTATUS status = map_nt_error_from_unix_common(errno);
531                 composite_error(state->ctx, status);
532                 return;
533         }
534
535         if (!conn->ldaps) {
536                 conn->sockets.raw = talloc_move(conn, &state->raw);
537                 conn->sockets.active = conn->sockets.raw;
538                 composite_done(state->ctx);
539                 return;
540         }
541
542         subreq = tstream_tls_connect_send(state, state->ctx->event_ctx,
543                                           state->raw, state->tls_params);
544         if (composite_nomem(subreq, state->ctx)) {
545                 return;
546         }
547         tevent_req_set_callback(subreq, ldap_connect_got_tls, state);
548 }
549
550 static void ldap_connect_got_tls(struct tevent_req *subreq)
551 {
552         struct ldap_connect_state *state =
553                 tevent_req_callback_data(subreq,
554                 struct ldap_connect_state);
555         int err;
556         int ret;
557
558         ret = tstream_tls_connect_recv(subreq, &err, state, &state->tls);
559         TALLOC_FREE(subreq);
560         if (ret == -1) {
561                 NTSTATUS status = map_nt_error_from_unix_common(err);
562                 composite_error(state->ctx, status);
563                 return;
564         }
565
566         talloc_steal(state->tls, state->tls_params);
567
568         state->conn->sockets.raw = talloc_move(state->conn, &state->raw);
569         state->conn->sockets.tls = talloc_move(state->conn->sockets.raw,
570                                                &state->tls);
571         state->conn->sockets.active = state->conn->sockets.tls;
572         composite_done(state->ctx);
573 }
574
575 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx)
576 {
577         struct ldap_connect_state *state =
578                 talloc_get_type_abort(ctx->async.private_data,
579                 struct ldap_connect_state);
580         struct ldap_connection *conn = state->conn;
581         uint16_t port;
582         NTSTATUS status = socket_connect_multi_recv(ctx, state, &state->sock,
583                                                        &port);
584         if (!NT_STATUS_IS_OK(status)) {
585                 composite_error(state->ctx, status);
586                 return;
587         }
588
589         ldap_connect_got_sock(state->ctx, conn);
590 }
591
592 static void ldap_connect_recv_unix_conn(struct composite_context *ctx)
593 {
594         struct ldap_connect_state *state =
595                 talloc_get_type_abort(ctx->async.private_data,
596                 struct ldap_connect_state);
597         struct ldap_connection *conn = state->conn;
598
599         NTSTATUS status = socket_connect_recv(ctx);
600
601         if (!NT_STATUS_IS_OK(state->ctx->status)) {
602                 composite_error(state->ctx, status);
603                 return;
604         }
605
606         ldap_connect_got_sock(state->ctx, conn);
607 }
608
609 _PUBLIC_ NTSTATUS ldap_connect_recv(struct composite_context *ctx)
610 {
611         NTSTATUS status = composite_wait(ctx);
612         talloc_free(ctx);
613         return status;
614 }
615
616 _PUBLIC_ NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url)
617 {
618         struct composite_context *ctx = ldap_connect_send(conn, url);
619         return ldap_connect_recv(ctx);
620 }
621
622 /* set reconnect parameters */
623
624 _PUBLIC_ void ldap_set_reconn_params(struct ldap_connection *conn, int max_retries)
625 {
626         if (conn) {
627                 conn->reconnect.max_retries = max_retries;
628                 conn->reconnect.retries = 0;
629                 conn->reconnect.previous = time_mono(NULL);
630         }
631 }
632
633 /* Actually this function is NOT ASYNC safe, FIXME? */
634 static void ldap_reconnect(struct ldap_connection *conn)
635 {
636         NTSTATUS status;
637         time_t now = time_mono(NULL);
638
639         /* do we have set up reconnect ? */
640         if (conn->reconnect.max_retries == 0) return;
641
642         /* is the retry time expired ? */
643         if (now > conn->reconnect.previous + 30) {
644                 conn->reconnect.retries = 0;
645                 conn->reconnect.previous = now;
646         }
647
648         /* are we reconnectind too often and too fast? */
649         if (conn->reconnect.retries > conn->reconnect.max_retries) return;
650
651         /* keep track of the number of reconnections */
652         conn->reconnect.retries++;
653
654         /* reconnect */
655         status = ldap_connect(conn, conn->reconnect.url);
656         if ( ! NT_STATUS_IS_OK(status)) {
657                 return;
658         }
659
660         /* rebind */
661         status = ldap_rebind(conn);
662         if ( ! NT_STATUS_IS_OK(status)) {
663                 ldap_connection_dead(conn, status);
664         }
665 }
666
667 static void ldap_request_destructor_abandon(struct ldap_request *abandon)
668 {
669         TALLOC_FREE(abandon);
670 }
671
672 /* destroy an open ldap request */
673 static int ldap_request_destructor(struct ldap_request *req)
674 {
675         if (req->state == LDAP_REQUEST_PENDING) {
676                 struct ldap_message msg = {
677                         .type = LDAP_TAG_AbandonRequest,
678                         .r.AbandonRequest.messageid = req->messageid,
679                 };
680                 struct ldap_request *abandon = NULL;
681
682                 DLIST_REMOVE(req->conn->pending, req);
683
684                 abandon = ldap_request_send(req->conn, &msg);
685                 if (abandon == NULL) {
686                         ldap_error_handler(req->conn, NT_STATUS_NO_MEMORY);
687                         return 0;
688                 }
689                 abandon->async.fn = ldap_request_destructor_abandon;
690                 abandon->async.private_data = NULL;
691         }
692
693         return 0;
694 }
695
696 static void ldap_request_timeout_abandon(struct ldap_request *abandon)
697 {
698         struct ldap_request *req =
699                 talloc_get_type_abort(abandon->async.private_data,
700                 struct ldap_request);
701
702         if (req->state == LDAP_REQUEST_PENDING) {
703                 DLIST_REMOVE(req->conn->pending, req);
704         }
705         req->state = LDAP_REQUEST_DONE;
706         if (req->async.fn) {
707                 req->async.fn(req);
708         }
709 }
710
711 /*
712   called on timeout of a ldap request
713 */
714 static void ldap_request_timeout(struct tevent_context *ev, struct tevent_timer *te, 
715                                       struct timeval t, void *private_data)
716 {
717         struct ldap_request *req =
718                 talloc_get_type_abort(private_data,
719                 struct ldap_request);
720
721         req->status = NT_STATUS_IO_TIMEOUT;
722         if (req->state == LDAP_REQUEST_PENDING) {
723                 struct ldap_message msg = {
724                         .type = LDAP_TAG_AbandonRequest,
725                         .r.AbandonRequest.messageid = req->messageid,
726                 };
727                 struct ldap_request *abandon = NULL;
728
729                 abandon = ldap_request_send(req->conn, &msg);
730                 if (abandon == NULL) {
731                         ldap_error_handler(req->conn, NT_STATUS_NO_MEMORY);
732                         return;
733                 }
734                 talloc_reparent(req->conn, req, abandon);
735                 abandon->async.fn = ldap_request_timeout_abandon;
736                 abandon->async.private_data = req;
737                 DLIST_REMOVE(req->conn->pending, req);
738                 return;
739         }
740         req->state = LDAP_REQUEST_DONE;
741         if (req->async.fn) {
742                 req->async.fn(req);
743         }
744 }
745
746
747 /*
748   called on completion of a failed ldap request
749 */
750 static void ldap_request_failed_complete(struct tevent_context *ev, struct tevent_timer *te,
751                                       struct timeval t, void *private_data)
752 {
753         struct ldap_request *req =
754                 talloc_get_type_abort(private_data,
755                 struct ldap_request);
756
757         if (req->async.fn) {
758                 req->async.fn(req);
759         }
760 }
761
762 static void ldap_request_written(struct tevent_req *subreq);
763
764 /*
765   send a ldap message - async interface
766 */
767 _PUBLIC_ struct ldap_request *ldap_request_send(struct ldap_connection *conn,
768                                        struct ldap_message *msg)
769 {
770         struct ldap_request *req;
771         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
772         struct tevent_req *subreq = NULL;
773
774         req = talloc_zero(conn, struct ldap_request);
775         if (req == NULL) return NULL;
776
777         if (conn->sockets.active == NULL) {
778                 status = NT_STATUS_INVALID_CONNECTION;
779                 goto failed;
780         }
781
782         req->state       = LDAP_REQUEST_SEND;
783         req->conn        = conn;
784         req->messageid   = conn->next_messageid++;
785         if (conn->next_messageid == 0) {
786                 conn->next_messageid = 1;
787         }
788         req->type        = msg->type;
789         if (req->messageid == -1) {
790                 goto failed;
791         }
792
793         talloc_set_destructor(req, ldap_request_destructor);
794
795         msg->messageid = req->messageid;
796
797         if (!ldap_encode(msg, samba_ldap_control_handlers(), &req->data, req)) {
798                 status = NT_STATUS_INTERNAL_ERROR;
799                 goto failed;            
800         }
801
802         /* put a timeout on the request */
803         req->time_event = tevent_add_timer(conn->event.event_ctx, req,
804                                            timeval_current_ofs(conn->timeout, 0),
805                                            ldap_request_timeout, req);
806         if (req->time_event == NULL) {
807                 status = NT_STATUS_NO_MEMORY;
808                 goto failed;
809         }
810
811         req->write_iov.iov_base = req->data.data;
812         req->write_iov.iov_len = req->data.length;
813
814         subreq = tstream_writev_queue_send(req, conn->event.event_ctx,
815                                            conn->sockets.active,
816                                            conn->sockets.send_queue,
817                                            &req->write_iov, 1);
818         if (subreq == NULL) {
819                 status = NT_STATUS_NO_MEMORY;
820                 goto failed;
821         }
822         tevent_req_set_callback(subreq, ldap_request_written, req);
823
824         req->state = LDAP_REQUEST_PENDING;
825         DLIST_ADD(conn->pending, req);
826
827         return req;
828
829 failed:
830         req->status = status;
831         req->state = LDAP_REQUEST_ERROR;
832         tevent_add_timer(conn->event.event_ctx, req, timeval_zero(),
833                          ldap_request_failed_complete, req);
834
835         return req;
836 }
837
838 static void ldap_request_written(struct tevent_req *subreq)
839 {
840         struct ldap_request *req =
841                 tevent_req_callback_data(subreq,
842                 struct ldap_request);
843         int err;
844         ssize_t ret;
845
846         ret = tstream_writev_queue_recv(subreq, &err);
847         TALLOC_FREE(subreq);
848         if (ret == -1) {
849                 NTSTATUS error = map_nt_error_from_unix_common(err);
850                 ldap_error_handler(req->conn, error);
851                 return;
852         }
853
854         if (req->type == LDAP_TAG_AbandonRequest ||
855             req->type == LDAP_TAG_UnbindRequest)
856         {
857                 if (req->state == LDAP_REQUEST_PENDING) {
858                         DLIST_REMOVE(req->conn->pending, req);
859                 }
860                 req->state = LDAP_REQUEST_DONE;
861                 if (req->async.fn) {
862                         req->async.fn(req);
863                 }
864                 return;
865         }
866
867         ldap_connection_recv_next(req->conn);
868 }
869
870
871 /*
872   wait for a request to complete
873   note that this does not destroy the request
874 */
875 _PUBLIC_ NTSTATUS ldap_request_wait(struct ldap_request *req)
876 {
877         while (req->state < LDAP_REQUEST_DONE) {
878                 if (tevent_loop_once(req->conn->event.event_ctx) != 0) {
879                         req->state = LDAP_REQUEST_ERROR;
880                         req->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
881                         break;
882                 }
883         }
884         return req->status;
885 }
886
887
888 /*
889   a mapping of ldap response code to strings
890 */
891 static const struct {
892         enum ldap_result_code code;
893         const char *str;
894 } ldap_code_map[] = {
895 #define _LDAP_MAP_CODE(c) { c, #c }
896         _LDAP_MAP_CODE(LDAP_SUCCESS),
897         _LDAP_MAP_CODE(LDAP_OPERATIONS_ERROR),
898         _LDAP_MAP_CODE(LDAP_PROTOCOL_ERROR),
899         _LDAP_MAP_CODE(LDAP_TIME_LIMIT_EXCEEDED),
900         _LDAP_MAP_CODE(LDAP_SIZE_LIMIT_EXCEEDED),
901         _LDAP_MAP_CODE(LDAP_COMPARE_FALSE),
902         _LDAP_MAP_CODE(LDAP_COMPARE_TRUE),
903         _LDAP_MAP_CODE(LDAP_AUTH_METHOD_NOT_SUPPORTED),
904         _LDAP_MAP_CODE(LDAP_STRONG_AUTH_REQUIRED),
905         _LDAP_MAP_CODE(LDAP_REFERRAL),
906         _LDAP_MAP_CODE(LDAP_ADMIN_LIMIT_EXCEEDED),
907         _LDAP_MAP_CODE(LDAP_UNAVAILABLE_CRITICAL_EXTENSION),
908         _LDAP_MAP_CODE(LDAP_CONFIDENTIALITY_REQUIRED),
909         _LDAP_MAP_CODE(LDAP_SASL_BIND_IN_PROGRESS),
910         _LDAP_MAP_CODE(LDAP_NO_SUCH_ATTRIBUTE),
911         _LDAP_MAP_CODE(LDAP_UNDEFINED_ATTRIBUTE_TYPE),
912         _LDAP_MAP_CODE(LDAP_INAPPROPRIATE_MATCHING),
913         _LDAP_MAP_CODE(LDAP_CONSTRAINT_VIOLATION),
914         _LDAP_MAP_CODE(LDAP_ATTRIBUTE_OR_VALUE_EXISTS),
915         _LDAP_MAP_CODE(LDAP_INVALID_ATTRIBUTE_SYNTAX),
916         _LDAP_MAP_CODE(LDAP_NO_SUCH_OBJECT),
917         _LDAP_MAP_CODE(LDAP_ALIAS_PROBLEM),
918         _LDAP_MAP_CODE(LDAP_INVALID_DN_SYNTAX),
919         _LDAP_MAP_CODE(LDAP_ALIAS_DEREFERENCING_PROBLEM),
920         _LDAP_MAP_CODE(LDAP_INAPPROPRIATE_AUTHENTICATION),
921         _LDAP_MAP_CODE(LDAP_INVALID_CREDENTIALS),
922         _LDAP_MAP_CODE(LDAP_INSUFFICIENT_ACCESS_RIGHTS),
923         _LDAP_MAP_CODE(LDAP_BUSY),
924         _LDAP_MAP_CODE(LDAP_UNAVAILABLE),
925         _LDAP_MAP_CODE(LDAP_UNWILLING_TO_PERFORM),
926         _LDAP_MAP_CODE(LDAP_LOOP_DETECT),
927         _LDAP_MAP_CODE(LDAP_NAMING_VIOLATION),
928         _LDAP_MAP_CODE(LDAP_OBJECT_CLASS_VIOLATION),
929         _LDAP_MAP_CODE(LDAP_NOT_ALLOWED_ON_NON_LEAF),
930         _LDAP_MAP_CODE(LDAP_NOT_ALLOWED_ON_RDN),
931         _LDAP_MAP_CODE(LDAP_ENTRY_ALREADY_EXISTS),
932         _LDAP_MAP_CODE(LDAP_OBJECT_CLASS_MODS_PROHIBITED),
933         _LDAP_MAP_CODE(LDAP_AFFECTS_MULTIPLE_DSAS),
934         _LDAP_MAP_CODE(LDAP_OTHER)
935 };
936
937 /*
938   used to setup the status code from a ldap response
939 */
940 _PUBLIC_ NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r)
941 {
942         int i;
943         const char *codename = "unknown";
944
945         if (r->resultcode == LDAP_SUCCESS) {
946                 return NT_STATUS_OK;
947         }
948
949         if (conn->last_error) {
950                 talloc_free(conn->last_error);
951         }
952
953         for (i=0;i<ARRAY_SIZE(ldap_code_map);i++) {
954                 if (r->resultcode == ldap_code_map[i].code) {
955                         codename = ldap_code_map[i].str;
956                         break;
957                 }
958         }
959
960         conn->last_error = talloc_asprintf(conn, "LDAP error %u %s - %s <%s> <%s>", 
961                                            r->resultcode,
962                                            codename,
963                                            r->dn?r->dn:"(NULL)", 
964                                            r->errormessage?r->errormessage:"", 
965                                            r->referral?r->referral:"");
966         
967         return NT_STATUS_LDAP(r->resultcode);
968 }
969
970 /*
971   return error string representing the last error
972 */
973 _PUBLIC_ const char *ldap_errstr(struct ldap_connection *conn, 
974                         TALLOC_CTX *mem_ctx, 
975                         NTSTATUS status)
976 {
977         if (NT_STATUS_IS_LDAP(status) && conn->last_error != NULL) {
978                 return talloc_strdup(mem_ctx, conn->last_error);
979         }
980         return talloc_asprintf(mem_ctx, "LDAP client internal error: %s", nt_errstr(status));
981 }
982
983
984 /*
985   return the Nth result message, waiting if necessary
986 */
987 _PUBLIC_ NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **msg)
988 {
989         *msg = NULL;
990
991         NT_STATUS_HAVE_NO_MEMORY(req);
992
993         while (req->state < LDAP_REQUEST_DONE && n >= req->num_replies) {
994                 if (tevent_loop_once(req->conn->event.event_ctx) != 0) {
995                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
996                 }
997         }
998
999         if (n < req->num_replies) {
1000                 *msg = req->replies[n];
1001                 return NT_STATUS_OK;
1002         }
1003
1004         if (!NT_STATUS_IS_OK(req->status)) {
1005                 return req->status;
1006         }
1007
1008         return NT_STATUS_NO_MORE_ENTRIES;
1009 }
1010
1011
1012 /*
1013   return a single result message, checking if it is of the expected LDAP type
1014 */
1015 _PUBLIC_ NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, int type)
1016 {
1017         NTSTATUS status;
1018         status = ldap_result_n(req, 0, msg);
1019         if (!NT_STATUS_IS_OK(status)) {
1020                 return status;
1021         }
1022         if ((*msg)->type != type) {
1023                 *msg = NULL;
1024                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
1025         }
1026         return status;
1027 }
1028
1029 /*
1030   a simple ldap transaction, for single result requests that only need a status code
1031   this relies on single valued requests having the response type == request type + 1
1032 */
1033 _PUBLIC_ NTSTATUS ldap_transaction(struct ldap_connection *conn, struct ldap_message *msg)
1034 {
1035         struct ldap_request *req = ldap_request_send(conn, msg);
1036         struct ldap_message *res;
1037         NTSTATUS status;
1038         status = ldap_result_n(req, 0, &res);
1039         if (!NT_STATUS_IS_OK(status)) {
1040                 talloc_free(req);
1041                 return status;
1042         }
1043         if (res->type != msg->type + 1) {
1044                 talloc_free(req);
1045                 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
1046         }
1047         status = ldap_check_response(conn, &res->r.GeneralResult);
1048         talloc_free(req);
1049         return status;
1050 }