source3/libads/ldap_utils.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Some Helpful wrappers on LDAP
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Guenther Deschner 2006,2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "ads.h"
  25 #include "lib/param/loadparm.h"
  26 #include "auth/credentials/credentials.h"
  27
  28 #ifdef HAVE_LDAP
  29
  30 void ads_set_reconnect_fn(ADS_STRUCT *ads,
  31                           NTSTATUS (*fn)(struct ads_struct *ads,
  32                                          void *private_data,
  33                                          TALLOC_CTX *mem_ctx,
  34                                          struct cli_credentials **creds),
  35                           void *private_data)
  36 {
  37         ads->auth.reconnect_state->fn = fn;
  38         ads->auth.reconnect_state->private_data = private_data;
  39 }
  40
  41 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
  42                                              TALLOC_CTX *mem_ctx,
  43                                              int scope,
  44                                              const char *base,
  45                                              const char *filter,
  46                                              const char **attrs,
  47                                              void *args,
  48                                              const char *range_attr,
  49                                              char ***strings,
  50                                              size_t *num_strings,
  51                                              uint32_t *first_usn,
  52                                              int *num_retries,
  53                                              bool *more_values);
  54
  55 /*
  56   a wrapper around ldap_search_s that retries depending on the error code
  57   this is supposed to catch dropped connections and auto-reconnect
  58 */
  59 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
  60                                                const char *expr,
  61                                                const char **attrs, void *args,
  62                                                LDAPMessage **res)
  63 {
  64         ADS_STATUS status;
  65         int count = 3;
  66         char *bp;
  67
  68         *res = NULL;
  69
  70         if (!ads->ldap.ld &&
  71             time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
  72                 return ADS_ERROR(LDAP_SERVER_DOWN);
  73         }
  74
  75         bp = SMB_STRDUP(bind_path);
  76
  77         if (!bp) {
  78                 return ADS_ERROR(LDAP_NO_MEMORY);
  79         }
  80
  81         *res = NULL;
  82
  83         /* when binding anonymously, we cannot use the paged search LDAP
  84          * control - Guenther */
  85
  86         if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
  87                 status = ads_do_search(ads, bp, scope, expr, attrs, res);
  88         } else {
  89                 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
  90         }
  91         if (ADS_ERR_OK(status)) {
  92                DEBUG(5,("Search for %s in <%s> gave %d replies\n",
  93                         expr, bp, ads_count_replies(ads, *res)));
  94                 SAFE_FREE(bp);
  95                 return status;
  96         }
  97
  98         while (--count) {
  99                 struct cli_credentials *creds = NULL;
 100                 char *cred_name = NULL;
 101                 NTSTATUS ntstatus;
 102
 103                 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
 104                     ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
 105                     lp_ldap_page_size() > 4) {
 106                         int new_page_size = (ads->config.ldap_page_size / 2);
 107                         DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
 108                                   ads->config.ldap_page_size, new_page_size));
 109                         ads->config.ldap_page_size = new_page_size;
 110                 }
 111
 112                 if (*res)
 113                         ads_msgfree(ads, *res);
 114                 *res = NULL;
 115
 116                 ads_disconnect(ads);
 117
 118                 if (ads->auth.reconnect_state->fn == NULL) {
 119                         DBG_NOTICE("Search for %s in <%s> failed: %s\n",
 120                                    expr, bp, ads_errstr(status));
 121                         SAFE_FREE(bp);
 122                         return status;
 123                 }
 124
 125                 ntstatus = ads->auth.reconnect_state->fn(ads,
 126                                 ads->auth.reconnect_state->private_data,
 127                                 ads, &creds);
 128                 if (!NT_STATUS_IS_OK(ntstatus)) {
 129                         DBG_WARNING("Failed to get creds for realm(%s): %s\n",
 130                                     ads->server.realm, nt_errstr(ntstatus));
 131                         DBG_WARNING("Search for %s in <%s> failed: %s\n",
 132                                    expr, bp, ads_errstr(status));
 133                         SAFE_FREE(bp);
 134                         return status;
 135                 }
 136
 137                 cred_name = cli_credentials_get_unparsed_name(creds, creds);
 138                 DBG_NOTICE("Reopening ads connection as %s to "
 139                            "realm '%s' after error %s\n",
 140                            cred_name, ads->server.realm, ads_errstr(status));
 141
 142                 status = ads_connect_creds(ads, creds);
 143                 if (!ADS_ERR_OK(status)) {
 144                         DBG_WARNING("Reconnect ads connection as %s to "
 145                                     "realm '%s' failed: %s\n",
 146                                     cred_name, ads->server.realm,
 147                                     ads_errstr(status));
 148                         /*
 149                          * We need to keep the ads pointer
 150                          * from being freed here as we don't own it and
 151                          * callers depend on it being around.
 152                          */
 153                         ads_disconnect(ads);
 154                         TALLOC_FREE(creds);
 155                         SAFE_FREE(bp);
 156                         return status;
 157                 }
 158                 TALLOC_FREE(creds);
 159
 160                 *res = NULL;
 161
 162                 /* when binding anonymously, we cannot use the paged search LDAP
 163                  * control - Guenther */
 164
 165                 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
 166                         status = ads_do_search(ads, bp, scope, expr, attrs, res);
 167                 } else {
 168                         status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
 169                 }
 170
 171                 if (ADS_ERR_OK(status)) {
 172                         DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
 173                                  expr, bp, ads_count_replies(ads, *res)));
 174                         SAFE_FREE(bp);
 175                         return status;
 176                 }
 177         }
 178         SAFE_FREE(bp);
 179
 180         if (!ADS_ERR_OK(status)) {
 181                 DEBUG(1,("ads reopen failed after error %s\n",
 182                          ads_errstr(status)));
 183         }
 184         return status;
 185 }
 186
 187  ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
 188                                 int scope, const char *expr,
 189                                 const char **attrs, LDAPMessage **res)
 190 {
 191         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
 192 }
 193
 194 static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
 195                                            int scope, const char *expr,
 196                                            const char **attrs, void *args,
 197                                            LDAPMessage **res)
 198 {
 199         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
 200 }
 201
 202
 203  ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
 204                              const char *expr, const char **attrs)
 205 {
 206         return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
 207                                    expr, attrs, res);
 208 }
 209
 210  ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
 211                                 const char *dn,
 212                                 const char **attrs)
 213 {
 214         return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 215                                    "(objectclass=*)", attrs, res);
 216 }
 217
 218  ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
 219                                          uint32_t sd_flags,
 220                                          const char *dn,
 221                                          const char **attrs)
 222 {
 223         ads_control args;
 224
 225         args.control = ADS_SD_FLAGS_OID;
 226         args.val = sd_flags;
 227         args.critical = True;
 228
 229         return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
 230                                         "(objectclass=*)", attrs, &args, res);
 231 }
 232
 233  ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
 234                                                 const char *dn,
 235                                                 const char **attrs,
 236                                                 enum ads_extended_dn_flags flags,
 237                                                 char ***strings,
 238                                                 size_t *num_strings)
 239 {
 240         ads_control args;
 241
 242         args.control = ADS_EXTENDED_DN_OID;
 243         args.val = flags;
 244         args.critical = True;
 245
 246         /* we can only range process one attribute */
 247         if (!attrs || !attrs[0] || attrs[1]) {
 248                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 249         }
 250
 251         return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
 252                                  "(objectclass=*)", &args, attrs[0],
 253                                  strings, num_strings);
 254
 255 }
 256
 257  ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
 258                                  const struct dom_sid *sid,
 259                                  const char **attrs)
 260 {
 261         char *dn, *sid_string;
 262         ADS_STATUS status;
 263
 264         sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
 265         if (sid_string == NULL) {
 266                 return ADS_ERROR(LDAP_NO_MEMORY);
 267         }
 268
 269         if (!asprintf(&dn, "<SID=%s>", sid_string)) {
 270                 TALLOC_FREE(sid_string);
 271                 return ADS_ERROR(LDAP_NO_MEMORY);
 272         }
 273
 274         status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 275                                    "(objectclass=*)", attrs, res);
 276         SAFE_FREE(dn);
 277         TALLOC_FREE(sid_string);
 278         return status;
 279 }
 280
 281 ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
 282                              TALLOC_CTX *mem_ctx,
 283                              int scope,
 284                              const char *base,
 285                              const char *filter,
 286                              void *args,
 287                              const char *range_attr,
 288                              char ***strings,
 289                              size_t *num_strings)
 290 {
 291         ADS_STATUS status;
 292         uint32_t first_usn;
 293         int num_retries = 0;
 294         const char **attrs;
 295         bool more_values = False;
 296
 297         *num_strings = 0;
 298         *strings = NULL;
 299
 300         attrs = talloc_array(mem_ctx, const char *, 3);
 301         ADS_ERROR_HAVE_NO_MEMORY(attrs);
 302
 303         attrs[0] = talloc_strdup(mem_ctx, range_attr);
 304         attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
 305         attrs[2] = NULL;
 306
 307         ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
 308         ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
 309
 310         do {
 311                 status = ads_ranged_search_internal(ads, mem_ctx,
 312                                                     scope, base, filter,
 313                                                     attrs, args, range_attr,
 314                                                     strings, num_strings,
 315                                                     &first_usn, &num_retries,
 316                                                     &more_values);
 317
 318                 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
 319                         continue;
 320                 }
 321
 322                 if (!ADS_ERR_OK(status)) {
 323                         *num_strings = 0;
 324                         strings = NULL;
 325                         goto done;
 326                 }
 327
 328         } while (more_values);
 329
 330  done:
 331         DEBUG(10,("returning with %d strings\n", (int)*num_strings));
 332
 333         return status;
 334 }
 335
 336 static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
 337                                       TALLOC_CTX *mem_ctx,
 338                                       int scope,
 339                                       const char *base,
 340                                       const char *filter,
 341                                       const char **attrs,
 342                                       void *args,
 343                                       const char *range_attr,
 344                                       char ***strings,
 345                                       size_t *num_strings,
 346                                       uint32_t *first_usn,
 347                                       int *num_retries,
 348                                       bool *more_values)
 349 {
 350         LDAPMessage *res = NULL;
 351         ADS_STATUS status;
 352         int count;
 353         uint32_t current_usn;
 354
 355         DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
 356
 357         *more_values = False;
 358
 359         status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
 360
 361         if (!ADS_ERR_OK(status)) {
 362                 DEBUG(1,("ads_search: %s\n",
 363                          ads_errstr(status)));
 364                 return status;
 365         }
 366
 367         if (!res) {
 368                 return ADS_ERROR(LDAP_NO_MEMORY);
 369         }
 370
 371         count = ads_count_replies(ads, res);
 372         if (count == 0) {
 373                 ads_msgfree(ads, res);
 374                 return ADS_ERROR(LDAP_SUCCESS);
 375         }
 376
 377         if (*num_strings == 0) {
 378                 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
 379                         DEBUG(1, ("could not pull first usnChanged!\n"));
 380                         ads_msgfree(ads, res);
 381                         return ADS_ERROR(LDAP_NO_MEMORY);
 382                 }
 383         }
 384
 385         if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
 386                 DEBUG(1, ("could not pull current usnChanged!\n"));
 387                 ads_msgfree(ads, res);
 388                 return ADS_ERROR(LDAP_NO_MEMORY);
 389         }
 390
 391         if (*first_usn != current_usn) {
 392                 DEBUG(5, ("USN on this record changed"
 393                           " - restarting search\n"));
 394                 if (*num_retries < 5) {
 395                         (*num_retries)++;
 396                         *num_strings = 0;
 397                         ads_msgfree(ads, res);
 398                         return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
 399                 } else {
 400                         DEBUG(5, ("USN on this record changed"
 401                                   " - restarted search too many times, aborting!\n"));
 402                         ads_msgfree(ads, res);
 403                         return ADS_ERROR(LDAP_NO_MEMORY);
 404                 }
 405         }
 406
 407         *strings = ads_pull_strings_range(ads, mem_ctx, res,
 408                                          range_attr,
 409                                          *strings,
 410                                          &attrs[0],
 411                                          num_strings,
 412                                          more_values);
 413
 414         ads_msgfree(ads, res);
 415
 416         /* paranoia checks */
 417         if (*strings == NULL && *more_values) {
 418                 DEBUG(0,("no strings found but more values???\n"));
 419                 return ADS_ERROR(LDAP_NO_MEMORY);
 420         }
 421         if (*num_strings == 0 && *more_values) {
 422                 DEBUG(0,("no strings found but more values???\n"));
 423                 return ADS_ERROR(LDAP_NO_MEMORY);
 424         }
 425
 426         return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
 427 }
 428
 429 #endif