Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : Some Helpful wrappers on LDAP
5 :
6 : Copyright (C) Andrew Tridgell 2001
7 : Copyright (C) Guenther Deschner 2006,2007
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "ads.h"
25 : #include "lib/param/loadparm.h"
26 : #include "auth/credentials/credentials.h"
27 :
28 : #ifdef HAVE_LDAP
29 :
30 0 : void ads_set_reconnect_fn(ADS_STRUCT *ads,
31 : NTSTATUS (*fn)(struct ads_struct *ads,
32 : void *private_data,
33 : TALLOC_CTX *mem_ctx,
34 : struct cli_credentials **creds),
35 : void *private_data)
36 : {
37 0 : ads->auth.reconnect_state->fn = fn;
38 0 : ads->auth.reconnect_state->private_data = private_data;
39 0 : }
40 :
41 : static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
42 : TALLOC_CTX *mem_ctx,
43 : int scope,
44 : const char *base,
45 : const char *filter,
46 : const char **attrs,
47 : void *args,
48 : const char *range_attr,
49 : char ***strings,
50 : size_t *num_strings,
51 : uint32_t *first_usn,
52 : int *num_retries,
53 : bool *more_values);
54 :
55 : /*
56 : a wrapper around ldap_search_s that retries depending on the error code
57 : this is supposed to catch dropped connections and auto-reconnect
58 : */
59 63 : static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
60 : const char *expr,
61 : const char **attrs, void *args,
62 : LDAPMessage **res)
63 : {
64 0 : ADS_STATUS status;
65 63 : int count = 3;
66 0 : char *bp;
67 :
68 63 : *res = NULL;
69 :
70 63 : if (!ads->ldap.ld &&
71 0 : time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
72 0 : return ADS_ERROR(LDAP_SERVER_DOWN);
73 : }
74 :
75 63 : bp = SMB_STRDUP(bind_path);
76 :
77 63 : if (!bp) {
78 0 : return ADS_ERROR(LDAP_NO_MEMORY);
79 : }
80 :
81 63 : *res = NULL;
82 :
83 : /* when binding anonymously, we cannot use the paged search LDAP
84 : * control - Guenther */
85 :
86 63 : if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
87 0 : status = ads_do_search(ads, bp, scope, expr, attrs, res);
88 : } else {
89 63 : status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
90 : }
91 63 : if (ADS_ERR_OK(status)) {
92 63 : DEBUG(5,("Search for %s in <%s> gave %d replies\n",
93 : expr, bp, ads_count_replies(ads, *res)));
94 63 : SAFE_FREE(bp);
95 63 : return status;
96 : }
97 :
98 0 : while (--count) {
99 0 : struct cli_credentials *creds = NULL;
100 0 : char *cred_name = NULL;
101 0 : NTSTATUS ntstatus;
102 :
103 0 : if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
104 0 : ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
105 0 : lp_ldap_page_size() > 4) {
106 0 : int new_page_size = (ads->config.ldap_page_size / 2);
107 0 : DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
108 : ads->config.ldap_page_size, new_page_size));
109 0 : ads->config.ldap_page_size = new_page_size;
110 : }
111 :
112 0 : if (*res)
113 0 : ads_msgfree(ads, *res);
114 0 : *res = NULL;
115 :
116 0 : ads_disconnect(ads);
117 :
118 0 : if (ads->auth.reconnect_state->fn == NULL) {
119 0 : DBG_NOTICE("Search for %s in <%s> failed: %s\n",
120 : expr, bp, ads_errstr(status));
121 0 : SAFE_FREE(bp);
122 0 : return status;
123 : }
124 :
125 0 : ntstatus = ads->auth.reconnect_state->fn(ads,
126 0 : ads->auth.reconnect_state->private_data,
127 : ads, &creds);
128 0 : if (!NT_STATUS_IS_OK(ntstatus)) {
129 0 : DBG_WARNING("Failed to get creds for realm(%s): %s\n",
130 : ads->server.realm, nt_errstr(ntstatus));
131 0 : DBG_WARNING("Search for %s in <%s> failed: %s\n",
132 : expr, bp, ads_errstr(status));
133 0 : SAFE_FREE(bp);
134 0 : return status;
135 : }
136 :
137 0 : cred_name = cli_credentials_get_unparsed_name(creds, creds);
138 0 : DBG_NOTICE("Reopening ads connection as %s to "
139 : "realm '%s' after error %s\n",
140 : cred_name, ads->server.realm, ads_errstr(status));
141 :
142 0 : status = ads_connect_creds(ads, creds);
143 0 : if (!ADS_ERR_OK(status)) {
144 0 : DBG_WARNING("Reconnect ads connection as %s to "
145 : "realm '%s' failed: %s\n",
146 : cred_name, ads->server.realm,
147 : ads_errstr(status));
148 : /*
149 : * We need to keep the ads pointer
150 : * from being freed here as we don't own it and
151 : * callers depend on it being around.
152 : */
153 0 : ads_disconnect(ads);
154 0 : TALLOC_FREE(creds);
155 0 : SAFE_FREE(bp);
156 0 : return status;
157 : }
158 0 : TALLOC_FREE(creds);
159 :
160 0 : *res = NULL;
161 :
162 : /* when binding anonymously, we cannot use the paged search LDAP
163 : * control - Guenther */
164 :
165 0 : if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
166 0 : status = ads_do_search(ads, bp, scope, expr, attrs, res);
167 : } else {
168 0 : status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
169 : }
170 :
171 0 : if (ADS_ERR_OK(status)) {
172 0 : DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
173 : expr, bp, ads_count_replies(ads, *res)));
174 0 : SAFE_FREE(bp);
175 0 : return status;
176 : }
177 : }
178 0 : SAFE_FREE(bp);
179 :
180 0 : if (!ADS_ERR_OK(status)) {
181 0 : DEBUG(1,("ads reopen failed after error %s\n",
182 : ads_errstr(status)));
183 : }
184 0 : return status;
185 : }
186 :
187 59 : ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
188 : int scope, const char *expr,
189 : const char **attrs, LDAPMessage **res)
190 : {
191 59 : return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
192 : }
193 :
194 4 : static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
195 : int scope, const char *expr,
196 : const char **attrs, void *args,
197 : LDAPMessage **res)
198 : {
199 4 : return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
200 : }
201 :
202 :
203 0 : ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
204 : const char *expr, const char **attrs)
205 : {
206 0 : return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
207 : expr, attrs, res);
208 : }
209 :
210 2 : ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
211 : const char *dn,
212 : const char **attrs)
213 : {
214 2 : return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
215 : "(objectclass=*)", attrs, res);
216 : }
217 :
218 4 : ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
219 : uint32_t sd_flags,
220 : const char *dn,
221 : const char **attrs)
222 : {
223 0 : ads_control args;
224 :
225 4 : args.control = ADS_SD_FLAGS_OID;
226 4 : args.val = sd_flags;
227 4 : args.critical = True;
228 :
229 4 : return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
230 : "(objectclass=*)", attrs, &args, res);
231 : }
232 :
233 0 : ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
234 : const char *dn,
235 : const char **attrs,
236 : enum ads_extended_dn_flags flags,
237 : char ***strings,
238 : size_t *num_strings)
239 : {
240 0 : ads_control args;
241 :
242 0 : args.control = ADS_EXTENDED_DN_OID;
243 0 : args.val = flags;
244 0 : args.critical = True;
245 :
246 : /* we can only range process one attribute */
247 0 : if (!attrs || !attrs[0] || attrs[1]) {
248 0 : return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
249 : }
250 :
251 0 : return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
252 : "(objectclass=*)", &args, attrs[0],
253 : strings, num_strings);
254 :
255 : }
256 :
257 0 : ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
258 : const struct dom_sid *sid,
259 : const char **attrs)
260 : {
261 0 : char *dn, *sid_string;
262 0 : ADS_STATUS status;
263 :
264 0 : sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
265 0 : if (sid_string == NULL) {
266 0 : return ADS_ERROR(LDAP_NO_MEMORY);
267 : }
268 :
269 0 : if (!asprintf(&dn, "<SID=%s>", sid_string)) {
270 0 : TALLOC_FREE(sid_string);
271 0 : return ADS_ERROR(LDAP_NO_MEMORY);
272 : }
273 :
274 0 : status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
275 : "(objectclass=*)", attrs, res);
276 0 : SAFE_FREE(dn);
277 0 : TALLOC_FREE(sid_string);
278 0 : return status;
279 : }
280 :
281 0 : ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
282 : TALLOC_CTX *mem_ctx,
283 : int scope,
284 : const char *base,
285 : const char *filter,
286 : void *args,
287 : const char *range_attr,
288 : char ***strings,
289 : size_t *num_strings)
290 : {
291 0 : ADS_STATUS status;
292 0 : uint32_t first_usn;
293 0 : int num_retries = 0;
294 0 : const char **attrs;
295 0 : bool more_values = False;
296 :
297 0 : *num_strings = 0;
298 0 : *strings = NULL;
299 :
300 0 : attrs = talloc_array(mem_ctx, const char *, 3);
301 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs);
302 :
303 0 : attrs[0] = talloc_strdup(mem_ctx, range_attr);
304 0 : attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
305 0 : attrs[2] = NULL;
306 :
307 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
308 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
309 :
310 0 : do {
311 0 : status = ads_ranged_search_internal(ads, mem_ctx,
312 : scope, base, filter,
313 : attrs, args, range_attr,
314 : strings, num_strings,
315 : &first_usn, &num_retries,
316 : &more_values);
317 :
318 0 : if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
319 0 : continue;
320 : }
321 :
322 0 : if (!ADS_ERR_OK(status)) {
323 0 : *num_strings = 0;
324 0 : strings = NULL;
325 0 : goto done;
326 : }
327 :
328 0 : } while (more_values);
329 :
330 0 : done:
331 0 : DEBUG(10,("returning with %d strings\n", (int)*num_strings));
332 :
333 0 : return status;
334 : }
335 :
336 0 : static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
337 : TALLOC_CTX *mem_ctx,
338 : int scope,
339 : const char *base,
340 : const char *filter,
341 : const char **attrs,
342 : void *args,
343 : const char *range_attr,
344 : char ***strings,
345 : size_t *num_strings,
346 : uint32_t *first_usn,
347 : int *num_retries,
348 : bool *more_values)
349 : {
350 0 : LDAPMessage *res = NULL;
351 0 : ADS_STATUS status;
352 0 : int count;
353 0 : uint32_t current_usn;
354 :
355 0 : DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
356 :
357 0 : *more_values = False;
358 :
359 0 : status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
360 :
361 0 : if (!ADS_ERR_OK(status)) {
362 0 : DEBUG(1,("ads_search: %s\n",
363 : ads_errstr(status)));
364 0 : return status;
365 : }
366 :
367 0 : if (!res) {
368 0 : return ADS_ERROR(LDAP_NO_MEMORY);
369 : }
370 :
371 0 : count = ads_count_replies(ads, res);
372 0 : if (count == 0) {
373 0 : ads_msgfree(ads, res);
374 0 : return ADS_ERROR(LDAP_SUCCESS);
375 : }
376 :
377 0 : if (*num_strings == 0) {
378 0 : if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
379 0 : DEBUG(1, ("could not pull first usnChanged!\n"));
380 0 : ads_msgfree(ads, res);
381 0 : return ADS_ERROR(LDAP_NO_MEMORY);
382 : }
383 : }
384 :
385 0 : if (!ads_pull_uint32(ads, res, "usnChanged", ¤t_usn)) {
386 0 : DEBUG(1, ("could not pull current usnChanged!\n"));
387 0 : ads_msgfree(ads, res);
388 0 : return ADS_ERROR(LDAP_NO_MEMORY);
389 : }
390 :
391 0 : if (*first_usn != current_usn) {
392 0 : DEBUG(5, ("USN on this record changed"
393 : " - restarting search\n"));
394 0 : if (*num_retries < 5) {
395 0 : (*num_retries)++;
396 0 : *num_strings = 0;
397 0 : ads_msgfree(ads, res);
398 0 : return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
399 : } else {
400 0 : DEBUG(5, ("USN on this record changed"
401 : " - restarted search too many times, aborting!\n"));
402 0 : ads_msgfree(ads, res);
403 0 : return ADS_ERROR(LDAP_NO_MEMORY);
404 : }
405 : }
406 :
407 0 : *strings = ads_pull_strings_range(ads, mem_ctx, res,
408 : range_attr,
409 : *strings,
410 : &attrs[0],
411 : num_strings,
412 : more_values);
413 :
414 0 : ads_msgfree(ads, res);
415 :
416 : /* paranoia checks */
417 0 : if (*strings == NULL && *more_values) {
418 0 : DEBUG(0,("no strings found but more values???\n"));
419 0 : return ADS_ERROR(LDAP_NO_MEMORY);
420 : }
421 0 : if (*num_strings == 0 && *more_values) {
422 0 : DEBUG(0,("no strings found but more values???\n"));
423 0 : return ADS_ERROR(LDAP_NO_MEMORY);
424 : }
425 :
426 0 : return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
427 : }
428 :
429 : #endif
|
