?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:registry: Initialize struct security_ace ace[]
[samba4-gss.git] / source3 / lib / smbldap.c
blobc0d6884a7835cae1b3cfd7791822339ad8c74bb8
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22
23 */
24
25 #include "includes.h"
26 #include "smbldap.h"
27 #include "../libcli/security/security.h"
28 #include <tevent.h>
29 #include "lib/param/loadparm.h"
30
31 /* Try not to hit the up or down server forever */
32
33 #define SMBLDAP_DONT_PING_TIME 10 /* ping only all 10 seconds */
34 #define SMBLDAP_NUM_RETRIES 8 /* retry only 8 times */
35
36 #define SMBLDAP_IDLE_TIME 150 /* After 2.5 minutes disconnect */
37
38 struct smbldap_state {
39 LDAP *ldap_struct;
40 pid_t pid;
41 time_t last_ping; /* monotonic */
42 /* retrieve-once info */
43 const char *uri;
44
45 /* credentials */
46 bool anonymous;
47 char *bind_dn;
48 char *bind_secret;
49 smbldap_bind_callback_fn bind_callback;
50 void *bind_callback_data;
51
52 bool paged_results;
53
54 unsigned int num_failures;
55
56 time_t last_use; /* monotonic */
57 struct tevent_context *tevent_context;
58 struct tevent_timer *idle_event;
59
60 struct timeval last_rebind; /* monotonic */
61 };
62
63 LDAP *smbldap_get_ldap(struct smbldap_state *state)
64 {
65 return state->ldap_struct;
66 }
67
68 bool smbldap_get_paged_results(struct smbldap_state *state)
69 {
70 return state->paged_results;
71 }
72
73 void smbldap_set_paged_results(struct smbldap_state *state,
74 bool paged_results)
75 {
76 state->paged_results = paged_results;
77 }
78
79 void smbldap_set_bind_callback(struct smbldap_state *state,
80 smbldap_bind_callback_fn callback,
81 void *callback_data)
82 {
83 state->bind_callback = callback;
84 state->bind_callback_data = callback_data;
85 }
86 /*******************************************************************
87 Search an attribute and return the first value found.
88 ******************************************************************/
89
90 bool smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry,
91 const char *attribute, char *value,
92 int max_len)
93 {
94 char **values;
95 size_t size = 0;
96
97 if ( !attribute )
98 return False;
99
100 value[0] = '\0';
101
102 if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) {
103 DEBUG (10, ("smbldap_get_single_attribute: [%s] = [<does not exist>]\n", attribute));
104
105 return False;
106 }
107
108 if (!convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, max_len, &size)) {
109 DEBUG(1, ("smbldap_get_single_attribute: string conversion of [%s] = [%s] failed!\n",
110 attribute, values[0]));
111 ldap_value_free(values);
112 return False;
113 }
114
115 ldap_value_free(values);
116 #ifdef DEBUG_PASSWORDS
117 DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n", attribute, value));
118 #endif
119 return True;
120 }
121
122 char * smbldap_talloc_single_attribute(LDAP *ldap_struct, LDAPMessage *entry,
123 const char *attribute,
124 TALLOC_CTX *mem_ctx)
125 {
126 char **values;
127 char *result;
128 size_t converted_size;
129
130 if (attribute == NULL) {
131 return NULL;
132 }
133
134 values = ldap_get_values(ldap_struct, entry, attribute);
135
136 if (values == NULL) {
137 DEBUG(10, ("attribute %s does not exist\n", attribute));
138 return NULL;
139 }
140
141 if (ldap_count_values(values) != 1) {
142 DEBUG(10, ("attribute %s has %d values, expected only one\n",
143 attribute, ldap_count_values(values)));
144 ldap_value_free(values);
145 return NULL;
146 }
147
148 if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
149 DEBUG(10, ("pull_utf8_talloc failed\n"));
150 ldap_value_free(values);
151 return NULL;
152 }
153
154 ldap_value_free(values);
155
156 #ifdef DEBUG_PASSWORDS
157 DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
158 attribute, result));
159 #endif
160 return result;
161 }
162
163 char * smbldap_talloc_first_attribute(LDAP *ldap_struct, LDAPMessage *entry,
164 const char *attribute,
165 TALLOC_CTX *mem_ctx)
166 {
167 char **values;
168 char *result;
169 size_t converted_size;
170
171 if (attribute == NULL) {
172 return NULL;
173 }
174
175 values = ldap_get_values(ldap_struct, entry, attribute);
176
177 if (values == NULL) {
178 DEBUG(10, ("attribute %s does not exist\n", attribute));
179 return NULL;
180 }
181
182 if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
183 DEBUG(10, ("pull_utf8_talloc failed\n"));
184 ldap_value_free(values);
185 return NULL;
186 }
187
188 ldap_value_free(values);
189
190 #ifdef DEBUG_PASSWORDS
191 DEBUG (100, ("smbldap_get_first_attribute: [%s] = [%s]\n",
192 attribute, result));
193 #endif
194 return result;
195 }
196
197 char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
198 const char *attribute,
199 TALLOC_CTX *mem_ctx)
200 {
201 char **values;
202 char *result;
203 size_t converted_size;
204 int i, num_values;
205
206 if (attribute == NULL) {
207 return NULL;
208 }
209
210 values = ldap_get_values(ldap_struct, entry, attribute);
211
212 if (values == NULL) {
213 DEBUG(10, ("attribute %s does not exist\n", attribute));
214 return NULL;
215 }
216
217 if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
218 DEBUG(10, ("pull_utf8_talloc failed\n"));
219 ldap_value_free(values);
220 return NULL;
221 }
222
223 num_values = ldap_count_values(values);
224
225 for (i=1; i<num_values; i++) {
226 char *tmp;
227
228 if (!pull_utf8_talloc(mem_ctx, &tmp, values[i],
229 &converted_size)) {
230 DEBUG(10, ("pull_utf8_talloc failed\n"));
231 TALLOC_FREE(result);
232 ldap_value_free(values);
233 return NULL;
234 }
235
236 if (strcasecmp_m(tmp, result) < 0) {
237 TALLOC_FREE(result);
238 result = tmp;
239 } else {
240 TALLOC_FREE(tmp);
241 }
242 }
243
244 ldap_value_free(values);
245
246 #ifdef DEBUG_PASSWORDS
247 DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
248 attribute, result));
249 #endif
250 return result;
251 }
252
253 bool smbldap_talloc_single_blob(TALLOC_CTX *mem_ctx, LDAP *ld,
254 LDAPMessage *msg, const char *attrib,
255 DATA_BLOB *blob)
256 {
257 struct berval **values;
258
259 values = ldap_get_values_len(ld, msg, attrib);
260 if (!values) {
261 return false;
262 }
263
264 if (ldap_count_values_len(values) != 1) {
265 DEBUG(10, ("Expected one value for %s, got %d\n", attrib,
266 ldap_count_values_len(values)));
267 return false;
268 }
269
270 *blob = data_blob_talloc(mem_ctx, values[0]->bv_val,
271 values[0]->bv_len);
272 ldap_value_free_len(values);
273
274 return (blob->data != NULL);
275 }
276
277 bool smbldap_pull_sid(LDAP *ld, LDAPMessage *msg, const char *attrib,
278 struct dom_sid *sid)
279 {
280 DATA_BLOB blob;
281 ssize_t ret;
282
283 if (!smbldap_talloc_single_blob(talloc_tos(), ld, msg, attrib,
284 &blob)) {
285 return false;
286 }
287 ret = sid_parse(blob.data, blob.length, sid);
288 TALLOC_FREE(blob.data);
289 return (ret != -1);
290 }
291
292 static int ldapmsg_destructor(LDAPMessage **result) {
293 ldap_msgfree(*result);
294 return 0;
295 }
296
297 void smbldap_talloc_autofree_ldapmsg(TALLOC_CTX *mem_ctx, LDAPMessage *result)
298 {
299 LDAPMessage **handle;
300
301 if (result == NULL) {
302 return;
303 }
304
305 handle = talloc(mem_ctx, LDAPMessage *);
306 SMB_ASSERT(handle != NULL);
307
308 *handle = result;
309 talloc_set_destructor(handle, ldapmsg_destructor);
310 }
311
312 static int ldapmod_destructor(LDAPMod ***mod) {
313 ldap_mods_free(*mod, True);
314 return 0;
315 }
316
317 void smbldap_talloc_autofree_ldapmod(TALLOC_CTX *mem_ctx, LDAPMod **mod)
318 {
319 LDAPMod ***handle;
320
321 if (mod == NULL) {
322 return;
323 }
324
325 handle = talloc(mem_ctx, LDAPMod **);
326 SMB_ASSERT(handle != NULL);
327
328 *handle = mod;
329 talloc_set_destructor(handle, ldapmod_destructor);
330 }
331
332 /************************************************************************
333 Routine to manage the LDAPMod structure array
334 manage memory used by the array, by each struct, and values
335 ***********************************************************************/
336
337 static void smbldap_set_mod_internal(LDAPMod *** modlist, int modop, const char *attribute, const char *value, const DATA_BLOB *blob)
338 {
339 LDAPMod **mods;
340 int i;
341 int j;
342
343 mods = *modlist;
344
345 /* sanity checks on the mod values */
346
347 if (attribute == NULL || *attribute == '\0') {
348 return;
349 }
350
351 #if 0 /* commented out after discussion with abartlet. Do not re-enable.
352 left here so other do not re-add similar code --jerry */
353 if (value == NULL || *value == '\0')
354 return;
355 #endif
356
357 if (mods == NULL) {
358 mods = SMB_MALLOC_P(LDAPMod *);
359 if (mods == NULL) {
360 smb_panic("smbldap_set_mod: out of memory!");
361 /* notreached. */
362 }
363 mods[0] = NULL;
364 }
365
366 for (i = 0; mods[i] != NULL; ++i) {
367 if (mods[i]->mod_op == modop && strequal(mods[i]->mod_type, attribute))
368 break;
369 }
370
371 if (mods[i] == NULL) {
372 mods = SMB_REALLOC_ARRAY (mods, LDAPMod *, i + 2);
373 if (mods == NULL) {
374 smb_panic("smbldap_set_mod: out of memory!");
375 /* notreached. */
376 }
377 mods[i] = SMB_MALLOC_P(LDAPMod);
378 if (mods[i] == NULL) {
379 smb_panic("smbldap_set_mod: out of memory!");
380 /* notreached. */
381 }
382 mods[i]->mod_op = modop;
383 mods[i]->mod_values = NULL;
384 mods[i]->mod_type = SMB_STRDUP(attribute);
385 mods[i + 1] = NULL;
386 }
387
388 if (blob && (modop & LDAP_MOD_BVALUES)) {
389 j = 0;
390 if (mods[i]->mod_bvalues != NULL) {
391 for (; mods[i]->mod_bvalues[j] != NULL; j++);
392 }
393 mods[i]->mod_bvalues = SMB_REALLOC_ARRAY(mods[i]->mod_bvalues, struct berval *, j + 2);
394
395 if (mods[i]->mod_bvalues == NULL) {
396 smb_panic("smbldap_set_mod: out of memory!");
397 /* notreached. */
398 }
399
400 mods[i]->mod_bvalues[j] = SMB_MALLOC_P(struct berval);
401 SMB_ASSERT(mods[i]->mod_bvalues[j] != NULL);
402
403 mods[i]->mod_bvalues[j]->bv_val = (char *)smb_memdup(blob->data, blob->length);
404 SMB_ASSERT(mods[i]->mod_bvalues[j]->bv_val != NULL);
405 mods[i]->mod_bvalues[j]->bv_len = blob->length;
406
407 mods[i]->mod_bvalues[j + 1] = NULL;
408 } else if (value != NULL) {
409 char *utf8_value = NULL;
410 size_t converted_size;
411
412 j = 0;
413 if (mods[i]->mod_values != NULL) {
414 for (; mods[i]->mod_values[j] != NULL; j++);
415 }
416 mods[i]->mod_values = SMB_REALLOC_ARRAY(mods[i]->mod_values, char *, j + 2);
417
418 if (mods[i]->mod_values == NULL) {
419 smb_panic("smbldap_set_mod: out of memory!");
420 /* notreached. */
421 }
422
423 if (!push_utf8_talloc(talloc_tos(), &utf8_value, value, &converted_size)) {
424 smb_panic("smbldap_set_mod: String conversion failure!");
425 /* notreached. */
426 }
427
428 mods[i]->mod_values[j] = SMB_STRDUP(utf8_value);
429 TALLOC_FREE(utf8_value);
430 SMB_ASSERT(mods[i]->mod_values[j] != NULL);
431
432 mods[i]->mod_values[j + 1] = NULL;
433 }
434 *modlist = mods;
435 }
436
437 void smbldap_set_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value)
438 {
439 smbldap_set_mod_internal(modlist, modop, attribute, value, NULL);
440 }
441
442 void smbldap_set_mod_blob(LDAPMod *** modlist, int modop, const char *attribute, const DATA_BLOB *value)
443 {
444 smbldap_set_mod_internal(modlist, modop | LDAP_MOD_BVALUES, attribute, NULL, value);
445 }
446
447 /**********************************************************************
448 Set attribute to newval in LDAP, regardless of what value the
449 attribute had in LDAP before.
450 *********************************************************************/
451
452 static void smbldap_make_mod_internal(LDAP *ldap_struct, LDAPMessage *existing,
453 LDAPMod ***mods,
454 const char *attribute, int op,
455 const char *newval,
456 const DATA_BLOB *newblob)
457 {
458 char oldval[2048]; /* current largest allowed value is mungeddial */
459 bool existed;
460 DATA_BLOB oldblob = data_blob_null;
461
462 if (existing != NULL) {
463 if (op & LDAP_MOD_BVALUES) {
464 existed = smbldap_talloc_single_blob(talloc_tos(), ldap_struct, existing, attribute, &oldblob);
465 } else {
466 existed = smbldap_get_single_attribute(ldap_struct, existing, attribute, oldval, sizeof(oldval));
467 }
468 } else {
469 existed = False;
470 *oldval = '\0';
471 }
472
473 if (existed) {
474 bool equal = false;
475 if (op & LDAP_MOD_BVALUES) {
476 equal = (newblob && (data_blob_cmp(&oldblob, newblob) == 0));
477 } else {
478 /* all of our string attributes are case insensitive */
479 equal = (newval && (strcasecmp_m(oldval, newval) == 0));
480 }
481
482 if (equal) {
483 /* Believe it or not, but LDAP will deny a delete and
484 an add at the same time if the values are the
485 same... */
486 DEBUG(10,("smbldap_make_mod: attribute |%s| not changed.\n", attribute));
487 return;
488 }
489
490 /* There has been no value before, so don't delete it.
491 * Here's a possible race: We might end up with
492 * duplicate attributes */
493 /* By deleting exactly the value we found in the entry this
494 * should be race-free in the sense that the LDAP-Server will
495 * deny the complete operation if somebody changed the
496 * attribute behind our back. */
497 /* This will also allow modifying single valued attributes
498 * in Novell NDS. In NDS you have to first remove attribute and then
499 * you could add new value */
500
501 if (op & LDAP_MOD_BVALUES) {
502 DEBUG(10,("smbldap_make_mod: deleting attribute |%s| blob\n", attribute));
503 smbldap_set_mod_blob(mods, LDAP_MOD_DELETE, attribute, &oldblob);
504 } else {
505 DEBUG(10,("smbldap_make_mod: deleting attribute |%s| values |%s|\n", attribute, oldval));
506 smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, oldval);
507 }
508 }
509
510 /* Regardless of the real operation (add or modify)
511 we add the new value here. We rely on deleting
512 the old value, should it exist. */
513
514 if (op & LDAP_MOD_BVALUES) {
515 if (newblob && newblob->length) {
516 DEBUG(10,("smbldap_make_mod: adding attribute |%s| blob\n", attribute));
517 smbldap_set_mod_blob(mods, LDAP_MOD_ADD, attribute, newblob);
518 }
519 } else {
520 if ((newval != NULL) && (strlen(newval) > 0)) {
521 DEBUG(10,("smbldap_make_mod: adding attribute |%s| value |%s|\n", attribute, newval));
522 smbldap_set_mod(mods, LDAP_MOD_ADD, attribute, newval);
523 }
524 }
525 }
526
527 void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing,
528 LDAPMod ***mods,
529 const char *attribute, const char *newval)
530 {
531 smbldap_make_mod_internal(ldap_struct, existing, mods, attribute,
532 0, newval, NULL);
533 }
534
535 void smbldap_make_mod_blob(LDAP *ldap_struct, LDAPMessage *existing,
536 LDAPMod ***mods,
537 const char *attribute, const DATA_BLOB *newblob)
538 {
539 smbldap_make_mod_internal(ldap_struct, existing, mods, attribute,
540 LDAP_MOD_BVALUES, NULL, newblob);
541 }
542
543 /**********************************************************************
544 Some variants of the LDAP rebind code do not pass in the third 'arg'
545 pointer to a void*, so we try and work around it by assuming that the
546 value of the 'LDAP *' pointer is the same as the one we had passed in
547 **********************************************************************/
548
549 struct smbldap_state_lookup {
550 LDAP *ld;
551 struct smbldap_state *smbldap_state;
552 struct smbldap_state_lookup *prev, *next;
553 };
554
555 static struct smbldap_state_lookup *smbldap_state_lookup_list;
556
557 static struct smbldap_state *smbldap_find_state(LDAP *ld)
558 {
559 struct smbldap_state_lookup *t;
560
561 for (t = smbldap_state_lookup_list; t; t = t->next) {
562 if (t->ld == ld) {
563 return t->smbldap_state;
564 }
565 }
566 return NULL;
567 }
568
569 static void smbldap_delete_state(struct smbldap_state *smbldap_state)
570 {
571 struct smbldap_state_lookup *t;
572
573 for (t = smbldap_state_lookup_list; t; t = t->next) {
574 if (t->smbldap_state == smbldap_state) {
575 DLIST_REMOVE(smbldap_state_lookup_list, t);
576 SAFE_FREE(t);
577 return;
578 }
579 }
580 }
581
582 static void smbldap_store_state(LDAP *ld, struct smbldap_state *smbldap_state)
583 {
584 struct smbldap_state *tmp_ldap_state;
585 struct smbldap_state_lookup *t;
586
587 if ((tmp_ldap_state = smbldap_find_state(ld))) {
588 SMB_ASSERT(tmp_ldap_state == smbldap_state);
589 return;
590 }
591
592 t = SMB_XMALLOC_P(struct smbldap_state_lookup);
593 ZERO_STRUCTP(t);
594
595 DLIST_ADD_END(smbldap_state_lookup_list, t);
596 t->ld = ld;
597 t->smbldap_state = smbldap_state;
598 }
599
600 /********************************************************************
601 start TLS on an existing LDAP connection per config
602 *******************************************************************/
603
604 int smbldap_start_tls(LDAP *ldap_struct, int version)
605 {
606 if (lp_ldap_ssl() != LDAP_SSL_START_TLS) {
607 return LDAP_SUCCESS;
608 }
609
610 return smbldap_start_tls_start(ldap_struct, version);
611 }
612
613 /********************************************************************
614 start TLS on an existing LDAP connection unconditionally
615 *******************************************************************/
616
617 int smbldap_start_tls_start(LDAP *ldap_struct, int version)
618 {
619 #ifdef LDAP_OPT_X_TLS
620 int rc,tls;
621
622 /* check if we use ldaps already */
623 ldap_get_option(ldap_struct, LDAP_OPT_X_TLS, &tls);
624 if (tls == LDAP_OPT_X_TLS_HARD) {
625 return LDAP_SUCCESS;
626 }
627
628 if (version != LDAP_VERSION3) {
629 DEBUG(0, ("Need LDAPv3 for Start TLS\n"));
630 return LDAP_OPERATIONS_ERROR;
631 }
632
633 if ((rc = ldap_start_tls_s (ldap_struct, NULL, NULL)) != LDAP_SUCCESS) {
634 DEBUG(0,("Failed to issue the StartTLS instruction: %s\n",
635 ldap_err2string(rc)));
636 return rc;
637 }
638
639 DEBUG (3, ("StartTLS issued: using a TLS connection\n"));
640 return LDAP_SUCCESS;
641 #else
642 DEBUG(0,("StartTLS not supported by LDAP client libraries!\n"));
643 return LDAP_OPERATIONS_ERROR;
644 #endif
645 }
646
647 /********************************************************************
648 setup a connection to the LDAP server based on a uri
649 *******************************************************************/
650
651 static int smb_ldap_setup_conn(LDAP **ldap_struct, const char *uri)
652 {
653 int rc;
654
655 DEBUG(10, ("smb_ldap_setup_connection: %s\n", uri));
656
657 #ifdef HAVE_LDAP_INITIALIZE
658
659 rc = ldap_initialize(ldap_struct, uri);
660 if (rc) {
661 DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc)));
662 return rc;
663 }
664
665 if (lp_ldap_follow_referral() != Auto) {
666 rc = ldap_set_option(*ldap_struct, LDAP_OPT_REFERRALS,
667 lp_ldap_follow_referral() ? LDAP_OPT_ON : LDAP_OPT_OFF);
668 if (rc != LDAP_SUCCESS)
669 DEBUG(0, ("Failed to set LDAP_OPT_REFERRALS: %s\n",
670 ldap_err2string(rc)));
671 }
672
673 #else
674
675 /* Parse the string manually */
676
677 {
678 int port = 0;
679 fstring protocol;
680 fstring host;
681 SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254);
682
683
684 /* skip leading "URL:" (if any) */
685 if ( strnequal( uri, "URL:", 4 ) ) {
686 uri += 4;
687 }
688
689 sscanf(uri, "%10[^:]://%254[^:/]:%d", protocol, host, &port);
690
691 if (port == 0) {
692 if (strequal(protocol, "ldap")) {
693 port = LDAP_PORT;
694 } else if (strequal(protocol, "ldaps")) {
695 port = LDAPS_PORT;
696 } else {
697 DEBUG(0, ("unrecognised protocol (%s)!\n", protocol));
698 }
699 }
700
701 if ((*ldap_struct = ldap_init(host, port)) == NULL) {
702 DEBUG(0, ("ldap_init failed !\n"));
703 return LDAP_OPERATIONS_ERROR;
704 }
705
706 if (strequal(protocol, "ldaps")) {
707 #ifdef LDAP_OPT_X_TLS
708 int tls = LDAP_OPT_X_TLS_HARD;
709 if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
710 {
711 DEBUG(0, ("Failed to setup a TLS session\n"));
712 }
713
714 DEBUG(3,("LDAPS option set...!\n"));
715 #else
716 DEBUG(0,("smbldap_open_connection: Secure connection not supported by LDAP client libraries!\n"));
717 return LDAP_OPERATIONS_ERROR;
718 #endif /* LDAP_OPT_X_TLS */
719 }
720 }
721
722 /* now set connection timeout */
723 #ifdef LDAP_X_OPT_CONNECT_TIMEOUT /* Netscape */
724 {
725 int ct = lp_ldap_connection_timeout()*1000;
726 rc = ldap_set_option(*ldap_struct, LDAP_X_OPT_CONNECT_TIMEOUT, &ct);
727 if (rc != LDAP_SUCCESS) {
728 DEBUG(0,("Failed to setup an ldap connection timeout %d: %s\n",
729 ct, ldap_err2string(rc)));
730 }
731 }
732 #elif defined (LDAP_OPT_NETWORK_TIMEOUT) /* OpenLDAP */
733 {
734 struct timeval ct;
735 ct.tv_usec = 0;
736 ct.tv_sec = lp_ldap_connection_timeout();
737 rc = ldap_set_option(*ldap_struct, LDAP_OPT_NETWORK_TIMEOUT, &ct);
738 if (rc != LDAP_SUCCESS) {
739 DEBUG(0,("Failed to setup an ldap connection timeout %d: %s\n",
740 (int)ct.tv_sec, ldap_err2string(rc)));
741 }
742 }
743 #endif
744
745 #endif /* HAVE_LDAP_INITIALIZE */
746 return LDAP_SUCCESS;
747 }
748
749 /********************************************************************
750 try to upgrade to Version 3 LDAP if not already, in either case return current
751 version
752 *******************************************************************/
753
754 static int smb_ldap_upgrade_conn(LDAP *ldap_struct, int *new_version)
755 {
756 int version;
757 int rc;
758
759 /* assume the worst */
760 *new_version = LDAP_VERSION2;
761
762 rc = ldap_get_option(ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
763 if (rc) {
764 return rc;
765 }
766
767 if (version == LDAP_VERSION3) {
768 *new_version = LDAP_VERSION3;
769 return LDAP_SUCCESS;
770 }
771
772 /* try upgrade */
773 version = LDAP_VERSION3;
774 rc = ldap_set_option (ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
775 if (rc) {
776 return rc;
777 }
778
779 *new_version = LDAP_VERSION3;
780 return LDAP_SUCCESS;
781 }
782
783 /*******************************************************************
784 open a connection to the ldap server (just until the bind)
785 ******************************************************************/
786
787 int smbldap_setup_full_conn(LDAP **ldap_struct, const char *uri)
788 {
789 int rc, version;
790
791 rc = smb_ldap_setup_conn(ldap_struct, uri);
792 if (rc) {
793 return rc;
794 }
795
796 rc = smb_ldap_upgrade_conn(*ldap_struct, &version);
797 if (rc) {
798 return rc;
799 }
800
801 rc = smbldap_start_tls(*ldap_struct, version);
802 if (rc) {
803 return rc;
804 }
805
806 return LDAP_SUCCESS;
807 }
808
809 /*******************************************************************
810 open a connection to the ldap server.
811 ******************************************************************/
812 static int smbldap_open_connection (struct smbldap_state *ldap_state)
813
814 {
815 int rc = LDAP_SUCCESS;
816 int version;
817 int deref;
818 LDAP **ldap_struct = &ldap_state->ldap_struct;
819
820 rc = smb_ldap_setup_conn(ldap_struct, ldap_state->uri);
821 if (rc) {
822 return rc;
823 }
824
825 /* Store the LDAP pointer in a lookup list */
826
827 smbldap_store_state(*ldap_struct, ldap_state);
828
829 /* Upgrade to LDAPv3 if possible */
830
831 rc = smb_ldap_upgrade_conn(*ldap_struct, &version);
832 if (rc) {
833 return rc;
834 }
835
836 /* Start TLS if required */
837
838 rc = smbldap_start_tls(*ldap_struct, version);
839 if (rc) {
840 return rc;
841 }
842
843 /* Set alias dereferencing method */
844 deref = lp_ldap_deref();
845 if (deref != -1) {
846 if (ldap_set_option (*ldap_struct, LDAP_OPT_DEREF, &deref) != LDAP_OPT_SUCCESS) {
847 DEBUG(1,("smbldap_open_connection: Failed to set dereferencing method: %d\n", deref));
848 } else {
849 DEBUG(5,("Set dereferencing method: %d\n", deref));
850 }
851 }
852
853 DEBUG(2, ("smbldap_open_connection: connection opened\n"));
854 return rc;
855 }
856
857 /*******************************************************************
858 a rebind function for authenticated referrals
859 This version takes a void* that we can shove useful stuff in :-)
860 ******************************************************************/
861 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
862 #else
863 static int rebindproc_with_state (LDAP * ld, char **whop, char **credp,
864 int *methodp, int freeit, void *arg)
865 {
866 struct smbldap_state *ldap_state = arg;
867 struct timespec ts;
868
869 /** @TODO Should we be doing something to check what servers we rebind to?
870 Could we get a referral to a machine that we don't want to give our
871 username and password to? */
872
873 if (freeit) {
874 SAFE_FREE(*whop);
875 if (*credp) {
876 memset(*credp, '\0', strlen(*credp));
877 }
878 SAFE_FREE(*credp);
879 } else {
880 DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",
881 ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
882
883 if (ldap_state->anonymous) {
884 *whop = NULL;
885 *credp = NULL;
886 } else {
887 *whop = SMB_STRDUP(ldap_state->bind_dn);
888 if (!*whop) {
889 return LDAP_NO_MEMORY;
890 }
891 *credp = SMB_STRDUP(ldap_state->bind_secret);
892 if (!*credp) {
893 SAFE_FREE(*whop);
894 return LDAP_NO_MEMORY;
895 }
896 }
897 *methodp = LDAP_AUTH_SIMPLE;
898 }
899
900 clock_gettime_mono(&ts);
901 ldap_state->last_rebind = convert_timespec_to_timeval(ts);
902
903 return 0;
904 }
905 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
906
907 /*******************************************************************
908 a rebind function for authenticated referrals
909 This version takes a void* that we can shove useful stuff in :-)
910 and actually does the connection.
911 ******************************************************************/
912 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
913 static int rebindproc_connect_with_state (LDAP *ldap_struct,
914 LDAP_CONST char *url,
915 ber_tag_t request,
916 ber_int_t msgid, void *arg)
917 {
918 struct smbldap_state *ldap_state =
919 (struct smbldap_state *)arg;
920 int rc;
921 struct timespec ts;
922 int version;
923
924 DEBUG(5,("rebindproc_connect_with_state: Rebinding to %s as \"%s\"\n",
925 url, ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
926
927 /* call START_TLS again (ldaps:// is handled by the OpenLDAP library
928 * itself) before rebinding to another LDAP server to avoid to expose
929 * our credentials. At least *try* to secure the connection - Guenther */
930
931 smb_ldap_upgrade_conn(ldap_struct, &version);
932 smbldap_start_tls(ldap_struct, version);
933
934 /** @TODO Should we be doing something to check what servers we rebind to?
935 Could we get a referral to a machine that we don't want to give our
936 username and password to? */
937
938 rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
939
940 /* only set the last rebind timestamp when we did rebind after a
941 * non-read LDAP operation. That way we avoid the replication sleep
942 * after a simple redirected search operation - Guenther */
943
944 switch (request) {
945
946 case LDAP_REQ_MODIFY:
947 case LDAP_REQ_ADD:
948 case LDAP_REQ_DELETE:
949 case LDAP_REQ_MODDN:
950 case LDAP_REQ_EXTENDED:
951 DEBUG(10,("rebindproc_connect_with_state: "
952 "setting last_rebind timestamp "
953 "(req: 0x%02x)\n", (unsigned int)request));
954 clock_gettime_mono(&ts);
955 ldap_state->last_rebind = convert_timespec_to_timeval(ts);
956 break;
957 default:
958 ZERO_STRUCT(ldap_state->last_rebind);
959 break;
960 }
961
962 return rc;
963 }
964 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
965
966 /*******************************************************************
967 Add a rebind function for authenticated referrals
968 ******************************************************************/
969 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
970 #else
971 # if LDAP_SET_REBIND_PROC_ARGS == 2
972 static int rebindproc (LDAP *ldap_struct, char **whop, char **credp,
973 int *method, int freeit )
974 {
975 struct smbldap_state *ldap_state = smbldap_find_state(ldap_struct);
976
977 return rebindproc_with_state(ldap_struct, whop, credp,
978 method, freeit, ldap_state);
979 }
980 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
981 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
982
983 /*******************************************************************
984 a rebind function for authenticated referrals
985 this also does the connection, but no void*.
986 ******************************************************************/
987 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
988 # if LDAP_SET_REBIND_PROC_ARGS == 2
989 static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request,
990 ber_int_t msgid)
991 {
992 struct smbldap_state *ldap_state = smbldap_find_state(ld);
993
994 return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid,
995 ldap_state);
996 }
997 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
998 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
999
1000 /*******************************************************************
1001 connect to the ldap server under system privilege.
1002 ******************************************************************/
1003 static int smbldap_connect_system(struct smbldap_state *ldap_state)
1004 {
1005 LDAP *ldap_struct = smbldap_get_ldap(ldap_state);
1006 int rc;
1007 int version;
1008
1009 /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite
1010 (OpenLDAP) doesn't seem to support it */
1011
1012 DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n",
1013 ldap_state->uri, ldap_state->bind_dn));
1014
1015 #ifdef HAVE_LDAP_SET_REBIND_PROC
1016 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
1017 # if LDAP_SET_REBIND_PROC_ARGS == 2
1018 ldap_set_rebind_proc(ldap_struct, &rebindproc_connect);
1019 # endif
1020 # if LDAP_SET_REBIND_PROC_ARGS == 3
1021 ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state);
1022 # endif
1023 #else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
1024 # if LDAP_SET_REBIND_PROC_ARGS == 2
1025 ldap_set_rebind_proc(ldap_struct, &rebindproc);
1026 # endif
1027 # if LDAP_SET_REBIND_PROC_ARGS == 3
1028 ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state);
1029 # endif
1030 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
1031 #endif
1032
1033 /* When there is an alternative bind callback is set,
1034 attempt to use it to perform the bind */
1035 if (ldap_state->bind_callback != NULL) {
1036 /* We have to allow bind callback to be run under become_root/unbecome_root
1037 to make sure within smbd the callback has proper write access to its resources,
1038 like credential cache. This is similar to passdb case where this callback is supposed
1039 to be used. When used outside smbd, become_root()/unbecome_root() are no-op.
1040 */
1041 become_root();
1042 rc = ldap_state->bind_callback(ldap_struct, ldap_state, ldap_state->bind_callback_data);
1043 unbecome_root();
1044 } else {
1045 rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
1046 }
1047
1048 if (rc != LDAP_SUCCESS) {
1049 char *ld_error = NULL;
1050 ldap_get_option(smbldap_get_ldap(ldap_state),
1051 LDAP_OPT_ERROR_STRING,
1052 &ld_error);
1053 DEBUG(ldap_state->num_failures ? 2 : 0,
1054 ("failed to bind to server %s with dn=\"%s\" Error: %s\n\t%s\n",
1055 ldap_state->uri,
1056 ldap_state->bind_dn ? ldap_state->bind_dn : "[Anonymous bind]",
1057 ldap_err2string(rc),
1058 ld_error ? ld_error : "(unknown)"));
1059 SAFE_FREE(ld_error);
1060 ldap_state->num_failures++;
1061 goto done;
1062 }
1063
1064 ldap_state->num_failures = 0;
1065 ldap_state->paged_results = False;
1066
1067 ldap_get_option(smbldap_get_ldap(ldap_state),
1068 LDAP_OPT_PROTOCOL_VERSION, &version);
1069
1070 if (smbldap_has_control(smbldap_get_ldap(ldap_state), ADS_PAGE_CTL_OID)
1071 && version == 3) {
1072 ldap_state->paged_results = True;
1073 }
1074
1075 DEBUG(3, ("ldap_connect_system: successful connection to the LDAP server\n"));
1076 DEBUGADD(10, ("ldap_connect_system: LDAP server %s support paged results\n",
1077 ldap_state->paged_results ? "does" : "does not"));
1078 done:
1079 if (rc != 0) {
1080 ldap_unbind(ldap_struct);
1081 ldap_state->ldap_struct = NULL;
1082 }
1083 return rc;
1084 }
1085
1086 static void smbldap_idle_fn(struct tevent_context *tevent_ctx,
1087 struct tevent_timer *te,
1088 struct timeval now_abs,
1089 void *private_data);
1090
1091 /**********************************************************************
1092 Connect to LDAP server (called before every ldap operation)
1093 *********************************************************************/
1094 static int smbldap_open(struct smbldap_state *ldap_state)
1095 {
1096 int rc, opt_rc;
1097 bool reopen = False;
1098 SMB_ASSERT(ldap_state);
1099
1100 if ((smbldap_get_ldap(ldap_state) != NULL) &&
1101 ((ldap_state->last_ping + SMBLDAP_DONT_PING_TIME) <
1102 time_mono(NULL))) {
1103
1104 #ifdef HAVE_UNIXSOCKET
1105 struct sockaddr_un addr;
1106 #else
1107 struct sockaddr_storage addr;
1108 #endif
1109 socklen_t len = sizeof(addr);
1110 int sd;
1111
1112 opt_rc = ldap_get_option(smbldap_get_ldap(ldap_state),
1113 LDAP_OPT_DESC, &sd);
1114 if (opt_rc == 0 && (getpeername(sd, (struct sockaddr *) &addr, &len)) < 0 )
1115 reopen = True;
1116
1117 #ifdef HAVE_UNIXSOCKET
1118 if (opt_rc == 0 && addr.sun_family == AF_UNIX)
1119 reopen = True;
1120 #endif
1121 if (reopen) {
1122 /* the other end has died. reopen. */
1123 ldap_unbind(smbldap_get_ldap(ldap_state));
1124 ldap_state->ldap_struct = NULL;
1125 ldap_state->last_ping = (time_t)0;
1126 } else {
1127 ldap_state->last_ping = time_mono(NULL);
1128 }
1129 }
1130
1131 if (smbldap_get_ldap(ldap_state) != NULL) {
1132 DEBUG(11,("smbldap_open: already connected to the LDAP server\n"));
1133 return LDAP_SUCCESS;
1134 }
1135
1136 if ((rc = smbldap_open_connection(ldap_state))) {
1137 return rc;
1138 }
1139
1140 if ((rc = smbldap_connect_system(ldap_state))) {
1141 return rc;
1142 }
1143
1144
1145 ldap_state->last_ping = time_mono(NULL);
1146 ldap_state->pid = getpid();
1147
1148 TALLOC_FREE(ldap_state->idle_event);
1149
1150 if (ldap_state->tevent_context != NULL) {
1151 ldap_state->idle_event = tevent_add_timer(
1152 ldap_state->tevent_context, ldap_state,
1153 timeval_current_ofs(SMBLDAP_IDLE_TIME, 0),
1154 smbldap_idle_fn, ldap_state);
1155 }
1156
1157 DEBUG(4,("The LDAP server is successfully connected\n"));
1158
1159 return LDAP_SUCCESS;
1160 }
1161
1162 /**********************************************************************
1163 Disconnect from LDAP server
1164 *********************************************************************/
1165 static NTSTATUS smbldap_close(struct smbldap_state *ldap_state)
1166 {
1167 if (!ldap_state)
1168 return NT_STATUS_INVALID_PARAMETER;
1169
1170 if (smbldap_get_ldap(ldap_state) != NULL) {
1171 ldap_unbind(smbldap_get_ldap(ldap_state));
1172 ldap_state->ldap_struct = NULL;
1173 }
1174
1175 smbldap_delete_state(ldap_state);
1176
1177 TALLOC_FREE(ldap_state->idle_event);
1178
1179 DEBUG(5,("The connection to the LDAP server was closed\n"));
1180 /* maybe free the results here --metze */
1181
1182 return NT_STATUS_OK;
1183 }
1184
1185 static SIG_ATOMIC_T got_alarm;
1186
1187 static void gotalarm_sig(int dummy)
1188 {
1189 got_alarm = 1;
1190 }
1191
1192 static time_t calc_ldap_abs_endtime(int ldap_to)
1193 {
1194 if (ldap_to == 0) {
1195 /* No timeout - don't
1196 return a value for
1197 the alarm. */
1198 return (time_t)0;
1199 }
1200
1201 /* Make the alarm time one second beyond
1202 the timeout we're setting for the
1203 remote search timeout, to allow that
1204 to fire in preference. */
1205
1206 return time_mono(NULL)+ldap_to+1;
1207 }
1208
1209 static int end_ldap_local_alarm(time_t absolute_endtime, int rc)
1210 {
1211 if (absolute_endtime) {
1212 alarm(0);
1213 CatchSignal(SIGALRM, SIG_IGN);
1214 if (got_alarm) {
1215 /* Client timeout error code. */
1216 got_alarm = 0;
1217 return LDAP_TIMEOUT;
1218 }
1219 }
1220 return rc;
1221 }
1222
1223 static void setup_ldap_local_alarm(struct smbldap_state *ldap_state, time_t absolute_endtime)
1224 {
1225 time_t now = time_mono(NULL);
1226
1227 if (absolute_endtime) {
1228 got_alarm = 0;
1229 CatchSignal(SIGALRM, gotalarm_sig);
1230 alarm(absolute_endtime - now);
1231 }
1232
1233 if (ldap_state->pid != getpid()) {
1234 smbldap_close(ldap_state);
1235 }
1236 }
1237
1238 static void get_ldap_errs(struct smbldap_state *ldap_state, char **pp_ld_error, int *p_ld_errno)
1239 {
1240 ldap_get_option(smbldap_get_ldap(ldap_state),
1241 LDAP_OPT_ERROR_NUMBER, p_ld_errno);
1242
1243 ldap_get_option(smbldap_get_ldap(ldap_state),
1244 LDAP_OPT_ERROR_STRING, pp_ld_error);
1245 }
1246
1247 static int get_cached_ldap_connect(struct smbldap_state *ldap_state, time_t abs_endtime)
1248 {
1249 int attempts = 0;
1250
1251 while (1) {
1252 int rc;
1253 time_t now;
1254
1255 now = time_mono(NULL);
1256 ldap_state->last_use = now;
1257
1258 if (abs_endtime && now > abs_endtime) {
1259 smbldap_close(ldap_state);
1260 return LDAP_TIMEOUT;
1261 }
1262
1263 rc = smbldap_open(ldap_state);
1264
1265 if (rc == LDAP_SUCCESS) {
1266 return LDAP_SUCCESS;
1267 }
1268
1269 attempts++;
1270 DEBUG(1, ("Connection to LDAP server failed for the "
1271 "%d try!\n", attempts));
1272
1273 if (rc == LDAP_INSUFFICIENT_ACCESS) {
1274 /* The fact that we are non-root or any other
1275 * access-denied condition will not change in the next
1276 * round of trying */
1277 return rc;
1278 }
1279
1280 if (got_alarm) {
1281 smbldap_close(ldap_state);
1282 return LDAP_TIMEOUT;
1283 }
1284
1285 smb_msleep(1000);
1286
1287 if (got_alarm) {
1288 smbldap_close(ldap_state);
1289 return LDAP_TIMEOUT;
1290 }
1291 }
1292 }
1293
1294 /*********************************************************************
1295 ********************************************************************/
1296
1297 static int smbldap_search_ext(struct smbldap_state *ldap_state,
1298 const char *base, int scope, const char *filter,
1299 const char *attrs[], int attrsonly,
1300 LDAPControl **sctrls, LDAPControl **cctrls,
1301 int sizelimit, LDAPMessage **res)
1302 {
1303 int rc = LDAP_SERVER_DOWN;
1304 char *utf8_filter;
1305 int to = lp_ldap_timeout();
1306 time_t abs_endtime = calc_ldap_abs_endtime(to);
1307 struct timeval timeout;
1308 struct timeval *timeout_ptr = NULL;
1309 size_t converted_size;
1310
1311 SMB_ASSERT(ldap_state);
1312
1313 DEBUG(5,("smbldap_search_ext: base => [%s], filter => [%s], "
1314 "scope => [%d]\n", base, filter, scope));
1315
1316 if (ldap_state->last_rebind.tv_sec > 0) {
1317 struct timeval tval;
1318 struct timespec ts;
1319 int64_t tdiff = 0;
1320 int sleep_time = 0;
1321
1322 clock_gettime_mono(&ts);
1323 tval = convert_timespec_to_timeval(ts);
1324
1325 tdiff = usec_time_diff(&tval, &ldap_state->last_rebind);
1326 tdiff /= 1000; /* Convert to milliseconds. */
1327
1328 sleep_time = lp_ldap_replication_sleep()-(int)tdiff;
1329 sleep_time = MIN(sleep_time, MAX_LDAP_REPLICATION_SLEEP_TIME);
1330
1331 if (sleep_time > 0) {
1332 /* we wait for the LDAP replication */
1333 DEBUG(5,("smbldap_search_ext: waiting %d milliseconds "
1334 "for LDAP replication.\n",sleep_time));
1335 smb_msleep(sleep_time);
1336 DEBUG(5,("smbldap_search_ext: go on!\n"));
1337 }
1338 ZERO_STRUCT(ldap_state->last_rebind);
1339 }
1340
1341 if (!push_utf8_talloc(talloc_tos(), &utf8_filter, filter, &converted_size)) {
1342 return LDAP_NO_MEMORY;
1343 }
1344
1345 /* Setup remote timeout for the ldap_search_ext_s call. */
1346 if (to) {
1347 timeout.tv_sec = to;
1348 timeout.tv_usec = 0;
1349 timeout_ptr = &timeout;
1350 }
1351
1352 setup_ldap_local_alarm(ldap_state, abs_endtime);
1353
1354 while (1) {
1355 char *ld_error = NULL;
1356 int ld_errno;
1357
1358 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1359 if (rc != LDAP_SUCCESS) {
1360 break;
1361 }
1362
1363 rc = ldap_search_ext_s(smbldap_get_ldap(ldap_state),
1364 base, scope,
1365 utf8_filter,
1366 discard_const_p(char *, attrs),
1367 attrsonly, sctrls, cctrls, timeout_ptr,
1368 sizelimit, res);
1369 if (rc == LDAP_SUCCESS) {
1370 break;
1371 }
1372
1373 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1374
1375 DEBUG(10, ("Failed search for base: %s, error: %d (%s) "
1376 "(%s)\n", base, ld_errno,
1377 ldap_err2string(rc),
1378 ld_error ? ld_error : "unknown"));
1379 SAFE_FREE(ld_error);
1380
1381 if (ld_errno != LDAP_SERVER_DOWN) {
1382 break;
1383 }
1384 ldap_unbind(smbldap_get_ldap(ldap_state));
1385 ldap_state->ldap_struct = NULL;
1386 }
1387
1388 TALLOC_FREE(utf8_filter);
1389 return end_ldap_local_alarm(abs_endtime, rc);
1390 }
1391
1392 int smbldap_search(struct smbldap_state *ldap_state,
1393 const char *base, int scope, const char *filter,
1394 const char *attrs[], int attrsonly,
1395 LDAPMessage **res)
1396 {
1397 return smbldap_search_ext(ldap_state, base, scope, filter, attrs,
1398 attrsonly, NULL, NULL, LDAP_NO_LIMIT, res);
1399 }
1400
1401 int smbldap_search_paged(struct smbldap_state *ldap_state,
1402 const char *base, int scope, const char *filter,
1403 const char **attrs, int attrsonly, int pagesize,
1404 LDAPMessage **res, void **cookie)
1405 {
1406 LDAPControl pr;
1407 LDAPControl **rcontrols;
1408 LDAPControl *controls[2] = { NULL, NULL};
1409 BerElement *cookie_be = NULL;
1410 struct berval *cookie_bv = NULL;
1411 int tmp = 0, i, rc;
1412 bool critical = True;
1413
1414 *res = NULL;
1415
1416 DEBUG(3,("smbldap_search_paged: base => [%s], filter => [%s],"
1417 "scope => [%d], pagesize => [%d]\n",
1418 base, filter, scope, pagesize));
1419
1420 cookie_be = ber_alloc_t(LBER_USE_DER);
1421 if (cookie_be == NULL) {
1422 DEBUG(0,("smbldap_create_page_control: ber_alloc_t returns "
1423 "NULL\n"));
1424 return LDAP_NO_MEMORY;
1425 }
1426
1427 /* construct cookie */
1428 if (*cookie != NULL) {
1429 ber_printf(cookie_be, "{iO}", (ber_int_t) pagesize, *cookie);
1430 ber_bvfree((struct berval *)*cookie); /* don't need it from last time */
1431 *cookie = NULL;
1432 } else {
1433 ber_printf(cookie_be, "{io}", (ber_int_t) pagesize, "", 0);
1434 }
1435 ber_flatten(cookie_be, &cookie_bv);
1436
1437 pr.ldctl_oid = discard_const_p(char, ADS_PAGE_CTL_OID);
1438 pr.ldctl_iscritical = (char) critical;
1439 pr.ldctl_value.bv_len = cookie_bv->bv_len;
1440 pr.ldctl_value.bv_val = cookie_bv->bv_val;
1441
1442 controls[0] = &pr;
1443 controls[1] = NULL;
1444
1445 rc = smbldap_search_ext(ldap_state, base, scope, filter, attrs,
1446 0, controls, NULL, LDAP_NO_LIMIT, res);
1447
1448 ber_free(cookie_be, 1);
1449 ber_bvfree(cookie_bv);
1450
1451 if (rc != 0) {
1452 DEBUG(3,("smbldap_search_paged: smbldap_search_ext(%s) "
1453 "failed with [%s]\n", filter, ldap_err2string(rc)));
1454 goto done;
1455 }
1456
1457 DEBUG(3,("smbldap_search_paged: search was successful\n"));
1458
1459 rc = ldap_parse_result(smbldap_get_ldap(ldap_state), *res, NULL, NULL,
1460 NULL, NULL, &rcontrols, 0);
1461 if (rc != 0) {
1462 DEBUG(3,("smbldap_search_paged: ldap_parse_result failed " \
1463 "with [%s]\n", ldap_err2string(rc)));
1464 goto done;
1465 }
1466
1467 if (rcontrols == NULL)
1468 goto done;
1469
1470 for (i=0; rcontrols[i]; i++) {
1471
1472 if (strcmp(ADS_PAGE_CTL_OID, rcontrols[i]->ldctl_oid) != 0)
1473 continue;
1474
1475 cookie_be = ber_init(&rcontrols[i]->ldctl_value);
1476 ber_scanf(cookie_be,"{iO}", &tmp, &cookie_bv);
1477 /* the berval is the cookie, but must be freed when it is all
1478 done */
1479 if (cookie_bv->bv_len)
1480 *cookie=ber_bvdup(cookie_bv);
1481 else
1482 *cookie=NULL;
1483 ber_bvfree(cookie_bv);
1484 ber_free(cookie_be, 1);
1485 break;
1486 }
1487 ldap_controls_free(rcontrols);
1488 done:
1489 return rc;
1490 }
1491
1492 int smbldap_modify(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[])
1493 {
1494 int rc = LDAP_SERVER_DOWN;
1495 char *utf8_dn;
1496 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1497 size_t converted_size;
1498
1499 SMB_ASSERT(ldap_state);
1500
1501 DEBUG(5,("smbldap_modify: dn => [%s]\n", dn ));
1502
1503 if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1504 return LDAP_NO_MEMORY;
1505 }
1506
1507 setup_ldap_local_alarm(ldap_state, abs_endtime);
1508
1509 while (1) {
1510 char *ld_error = NULL;
1511 int ld_errno;
1512
1513 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1514 if (rc != LDAP_SUCCESS) {
1515 break;
1516 }
1517
1518 rc = ldap_modify_s(smbldap_get_ldap(ldap_state), utf8_dn,
1519 attrs);
1520 if (rc == LDAP_SUCCESS) {
1521 break;
1522 }
1523
1524 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1525
1526 DEBUG(10, ("Failed to modify dn: %s, error: %d (%s) "
1527 "(%s)\n", dn, ld_errno,
1528 ldap_err2string(rc),
1529 ld_error ? ld_error : "unknown"));
1530 SAFE_FREE(ld_error);
1531
1532 if (ld_errno != LDAP_SERVER_DOWN) {
1533 break;
1534 }
1535 ldap_unbind(smbldap_get_ldap(ldap_state));
1536 ldap_state->ldap_struct = NULL;
1537 }
1538
1539 TALLOC_FREE(utf8_dn);
1540 return end_ldap_local_alarm(abs_endtime, rc);
1541 }
1542
1543 int smbldap_add(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[])
1544 {
1545 int rc = LDAP_SERVER_DOWN;
1546 char *utf8_dn;
1547 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1548 size_t converted_size;
1549
1550 SMB_ASSERT(ldap_state);
1551
1552 DEBUG(5,("smbldap_add: dn => [%s]\n", dn ));
1553
1554 if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1555 return LDAP_NO_MEMORY;
1556 }
1557
1558 setup_ldap_local_alarm(ldap_state, abs_endtime);
1559
1560 while (1) {
1561 char *ld_error = NULL;
1562 int ld_errno;
1563
1564 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1565 if (rc != LDAP_SUCCESS) {
1566 break;
1567 }
1568
1569 rc = ldap_add_s(smbldap_get_ldap(ldap_state), utf8_dn, attrs);
1570 if (rc == LDAP_SUCCESS) {
1571 break;
1572 }
1573
1574 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1575
1576 DEBUG(10, ("Failed to add dn: %s, error: %d (%s) "
1577 "(%s)\n", dn, ld_errno,
1578 ldap_err2string(rc),
1579 ld_error ? ld_error : "unknown"));
1580 SAFE_FREE(ld_error);
1581
1582 if (ld_errno != LDAP_SERVER_DOWN) {
1583 break;
1584 }
1585 ldap_unbind(smbldap_get_ldap(ldap_state));
1586 ldap_state->ldap_struct = NULL;
1587 }
1588
1589 TALLOC_FREE(utf8_dn);
1590 return end_ldap_local_alarm(abs_endtime, rc);
1591 }
1592
1593 int smbldap_delete(struct smbldap_state *ldap_state, const char *dn)
1594 {
1595 int rc = LDAP_SERVER_DOWN;
1596 char *utf8_dn;
1597 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1598 size_t converted_size;
1599
1600 SMB_ASSERT(ldap_state);
1601
1602 DEBUG(5,("smbldap_delete: dn => [%s]\n", dn ));
1603
1604 if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1605 return LDAP_NO_MEMORY;
1606 }
1607
1608 setup_ldap_local_alarm(ldap_state, abs_endtime);
1609
1610 while (1) {
1611 char *ld_error = NULL;
1612 int ld_errno;
1613
1614 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1615 if (rc != LDAP_SUCCESS) {
1616 break;
1617 }
1618
1619 rc = ldap_delete_s(smbldap_get_ldap(ldap_state), utf8_dn);
1620 if (rc == LDAP_SUCCESS) {
1621 break;
1622 }
1623
1624 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1625
1626 DEBUG(10, ("Failed to delete dn: %s, error: %d (%s) "
1627 "(%s)\n", dn, ld_errno,
1628 ldap_err2string(rc),
1629 ld_error ? ld_error : "unknown"));
1630 SAFE_FREE(ld_error);
1631
1632 if (ld_errno != LDAP_SERVER_DOWN) {
1633 break;
1634 }
1635 ldap_unbind(smbldap_get_ldap(ldap_state));
1636 ldap_state->ldap_struct = NULL;
1637 }
1638
1639 TALLOC_FREE(utf8_dn);
1640 return end_ldap_local_alarm(abs_endtime, rc);
1641 }
1642
1643 int smbldap_extended_operation(struct smbldap_state *ldap_state,
1644 LDAP_CONST char *reqoid, struct berval *reqdata,
1645 LDAPControl **serverctrls, LDAPControl **clientctrls,
1646 char **retoidp, struct berval **retdatap)
1647 {
1648 int rc = LDAP_SERVER_DOWN;
1649 time_t abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1650
1651 if (!ldap_state)
1652 return (-1);
1653
1654 setup_ldap_local_alarm(ldap_state, abs_endtime);
1655
1656 while (1) {
1657 char *ld_error = NULL;
1658 int ld_errno;
1659
1660 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1661 if (rc != LDAP_SUCCESS) {
1662 break;
1663 }
1664
1665 rc = ldap_extended_operation_s(smbldap_get_ldap(ldap_state),
1666 reqoid,
1667 reqdata, serverctrls,
1668 clientctrls, retoidp, retdatap);
1669 if (rc == LDAP_SUCCESS) {
1670 break;
1671 }
1672
1673 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1674
1675 DEBUG(10, ("Extended operation failed with error: "
1676 "%d (%s) (%s)\n", ld_errno,
1677 ldap_err2string(rc),
1678 ld_error ? ld_error : "unknown"));
1679 SAFE_FREE(ld_error);
1680
1681 if (ld_errno != LDAP_SERVER_DOWN) {
1682 break;
1683 }
1684 ldap_unbind(smbldap_get_ldap(ldap_state));
1685 ldap_state->ldap_struct = NULL;
1686 }
1687
1688 return end_ldap_local_alarm(abs_endtime, rc);
1689 }
1690
1691 /*******************************************************************
1692 run the search by name.
1693 ******************************************************************/
1694 int smbldap_search_suffix (struct smbldap_state *ldap_state,
1695 const char *filter, const char **search_attr,
1696 LDAPMessage ** result)
1697 {
1698 return smbldap_search(ldap_state, lp_ldap_suffix(),
1699 LDAP_SCOPE_SUBTREE,
1700 filter, search_attr, 0, result);
1701 }
1702
1703 static void smbldap_idle_fn(struct tevent_context *tevent_ctx,
1704 struct tevent_timer *te,
1705 struct timeval now_abs,
1706 void *private_data)
1707 {
1708 struct smbldap_state *state = (struct smbldap_state *)private_data;
1709
1710 TALLOC_FREE(state->idle_event);
1711
1712 if (smbldap_get_ldap(state) == NULL) {
1713 DEBUG(10,("ldap connection not connected...\n"));
1714 return;
1715 }
1716
1717 if ((state->last_use+SMBLDAP_IDLE_TIME) > time_mono(NULL)) {
1718 DEBUG(10,("ldap connection not idle...\n"));
1719
1720 /* this needs to be made monotonic clock aware inside tevent: */
1721 state->idle_event = tevent_add_timer(
1722 tevent_ctx, state,
1723 timeval_add(&now_abs, SMBLDAP_IDLE_TIME, 0),
1724 smbldap_idle_fn,
1725 private_data);
1726 return;
1727 }
1728
1729 DEBUG(7,("ldap connection idle...closing connection\n"));
1730 smbldap_close(state);
1731 }
1732
1733 /**********************************************************************
1734 Housekeeping
1735 *********************************************************************/
1736
1737 void smbldap_free_struct(struct smbldap_state **ldap_state)
1738 {
1739 smbldap_close(*ldap_state);
1740
1741 if ((*ldap_state)->bind_secret) {
1742 memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret));
1743 }
1744
1745 SAFE_FREE((*ldap_state)->bind_dn);
1746 BURN_FREE_STR((*ldap_state)->bind_secret);
1747 smbldap_set_bind_callback(*ldap_state, NULL, NULL);
1748
1749 TALLOC_FREE(*ldap_state);
1750
1751 /* No need to free any further, as it is talloc()ed */
1752 }
1753
1754 static int smbldap_state_destructor(struct smbldap_state *state)
1755 {
1756 smbldap_free_struct(&state);
1757 return 0;
1758 }
1759
1760
1761 /**********************************************************************
1762 Initialise the 'general' ldap structures, on which ldap operations may be conducted
1763 *********************************************************************/
1764
1765 NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, struct tevent_context *tevent_ctx,
1766 const char *location,
1767 bool anon,
1768 const char *bind_dn,
1769 const char *bind_secret,
1770 struct smbldap_state **smbldap_state)
1771 {
1772 *smbldap_state = talloc_zero(mem_ctx, struct smbldap_state);
1773 if (!*smbldap_state) {
1774 DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));
1775 return NT_STATUS_NO_MEMORY;
1776 }
1777
1778 if (location) {
1779 (*smbldap_state)->uri = talloc_strdup(mem_ctx, location);
1780 } else {
1781 (*smbldap_state)->uri = "ldap://localhost";
1782 }
1783
1784 (*smbldap_state)->tevent_context = tevent_ctx;
1785
1786 if (bind_dn && bind_secret) {
1787 smbldap_set_creds(*smbldap_state, anon, bind_dn, bind_secret);
1788 }
1789
1790 talloc_set_destructor(*smbldap_state, smbldap_state_destructor);
1791 return NT_STATUS_OK;
1792 }
1793
1794 char *smbldap_talloc_dn(TALLOC_CTX *mem_ctx, LDAP *ld,
1795 LDAPMessage *entry)
1796 {
1797 char *utf8_dn, *unix_dn;
1798 size_t converted_size;
1799
1800 utf8_dn = ldap_get_dn(ld, entry);
1801 if (!utf8_dn) {
1802 DEBUG (5, ("smbldap_talloc_dn: ldap_get_dn failed\n"));
1803 return NULL;
1804 }
1805 if (!pull_utf8_talloc(mem_ctx, &unix_dn, utf8_dn, &converted_size)) {
1806 DEBUG (0, ("smbldap_talloc_dn: String conversion failure utf8 "
1807 "[%s]\n", utf8_dn));
1808 return NULL;
1809 }
1810 ldap_memfree(utf8_dn);
1811 return unix_dn;
1812 }
1813
1814 /*******************************************************************
1815 Check if root-dse has a certain Control or Extension
1816 ********************************************************************/
1817
1818 static bool smbldap_check_root_dse(LDAP *ld, const char **attrs, const char *value)
1819 {
1820 LDAPMessage *msg = NULL;
1821 LDAPMessage *entry = NULL;
1822 char **values = NULL;
1823 int rc, num_result, num_values, i;
1824 bool result = False;
1825
1826 if (!attrs[0]) {
1827 DEBUG(3,("smbldap_check_root_dse: nothing to look for\n"));
1828 return False;
1829 }
1830
1831 if (!strequal(attrs[0], "supportedExtension") &&
1832 !strequal(attrs[0], "supportedControl") &&
1833 !strequal(attrs[0], "namingContexts")) {
1834 DEBUG(3,("smbldap_check_root_dse: no idea what to query root-dse for: %s ?\n", attrs[0]));
1835 return False;
1836 }
1837
1838 rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE,
1839 "(objectclass=*)", discard_const_p(char *, attrs), 0 , &msg);
1840
1841 if (rc != LDAP_SUCCESS) {
1842 DEBUG(3,("smbldap_check_root_dse: Could not search rootDSE\n"));
1843 return False;
1844 }
1845
1846 num_result = ldap_count_entries(ld, msg);
1847
1848 if (num_result != 1) {
1849 DEBUG(3,("smbldap_check_root_dse: Expected one rootDSE, got %d\n", num_result));
1850 goto done;
1851 }
1852
1853 entry = ldap_first_entry(ld, msg);
1854
1855 if (entry == NULL) {
1856 DEBUG(3,("smbldap_check_root_dse: Could not retrieve rootDSE\n"));
1857 goto done;
1858 }
1859
1860 values = ldap_get_values(ld, entry, attrs[0]);
1861
1862 if (values == NULL) {
1863 DEBUG(5,("smbldap_check_root_dse: LDAP Server does not support any %s\n", attrs[0]));
1864 goto done;
1865 }
1866
1867 num_values = ldap_count_values(values);
1868
1869 if (num_values == 0) {
1870 DEBUG(5,("smbldap_check_root_dse: LDAP Server does not have any %s\n", attrs[0]));
1871 goto done;
1872 }
1873
1874 for (i=0; i<num_values; i++) {
1875 if (strcmp(values[i], value) == 0)
1876 result = True;
1877 }
1878
1879
1880 done:
1881 if (values != NULL)
1882 ldap_value_free(values);
1883 if (msg != NULL)
1884 ldap_msgfree(msg);
1885
1886 return result;
1887
1888 }
1889
1890 /*******************************************************************
1891 Check if LDAP-Server supports a certain Control (OID in string format)
1892 ********************************************************************/
1893
1894 bool smbldap_has_control(LDAP *ld, const char *control)
1895 {
1896 const char *attrs[] = { "supportedControl", NULL };
1897 return smbldap_check_root_dse(ld, attrs, control);
1898 }
1899
1900 /*******************************************************************
1901 Check if LDAP-Server supports a certain Extension (OID in string format)
1902 ********************************************************************/
1903
1904 bool smbldap_has_extension(LDAP *ld, const char *extension)
1905 {
1906 const char *attrs[] = { "supportedExtension", NULL };
1907 return smbldap_check_root_dse(ld, attrs, extension);
1908 }
1909
1910 /*******************************************************************
1911 Check if LDAP-Server holds a given namingContext
1912 ********************************************************************/
1913
1914 bool smbldap_has_naming_context(LDAP *ld, const char *naming_context)
1915 {
1916 const char *attrs[] = { "namingContexts", NULL };
1917 return smbldap_check_root_dse(ld, attrs, naming_context);
1918 }
1919
1920 bool smbldap_set_creds(struct smbldap_state *ldap_state, bool anon, const char *dn, const char *secret)
1921 {
1922 ldap_state->anonymous = anon;
1923
1924 /* free any previously set credential */
1925
1926 SAFE_FREE(ldap_state->bind_dn);
1927 smbldap_set_bind_callback(ldap_state, NULL, NULL);
1928
1929 if (ldap_state->bind_secret) {
1930 /* make sure secrets are zeroed out of memory */
1931 memset(ldap_state->bind_secret, '\0', strlen(ldap_state->bind_secret));
1932 SAFE_FREE(ldap_state->bind_secret);
1933 }
1934
1935 if ( ! anon) {
1936 ldap_state->bind_dn = SMB_STRDUP(dn);
1937 ldap_state->bind_secret = SMB_STRDUP(secret);
1938 }
1939
1940 return True;
1941 }
GSS-enabled samba4