source4/libcli/ldap/ldap_client.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP protocol helper functions for SAMBA
   4
   5    Copyright (C) Andrew Tridgell  2004
   6    Copyright (C) Volker Lendecke 2004
   7    Copyright (C) Stefan Metzmacher 2004
   8    Copyright (C) Simo Sorce 2004
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22
  23 */
  24
  25 #include "includes.h"
  26 #include <tevent.h>
  27 #include "lib/socket/socket.h"
  28 #include "lib/tsocket/tsocket.h"
  29 #include "libcli/util/tstream.h"
  30 #include "../lib/util/asn1.h"
  31 #include "../lib/util/dlinklist.h"
  32 #include "libcli/ldap/libcli_ldap.h"
  33 #include "libcli/ldap/ldap_proto.h"
  34 #include "libcli/ldap/ldap_client.h"
  35 #include "libcli/composite/composite.h"
  36 #include "lib/tls/tls.h"
  37 #include "auth/gensec/gensec.h"
  38 #include "system/time.h"
  39 #include "param/param.h"
  40 #include "libcli/resolve/resolve.h"
  41
  42 static void ldap_connection_dead(struct ldap_connection *conn, NTSTATUS status);
  43
  44 static int ldap_connection_destructor(struct ldap_connection *conn)
  45 {
  46         /*
  47          * NT_STATUS_OK means that callbacks of pending requests are not
  48          * triggered
  49          */
  50         ldap_connection_dead(conn, NT_STATUS_OK);
  51         return 0;
  52 }
  53
  54 /**
  55   create a new ldap_connection stucture. The event context is optional
  56 */
  57
  58 _PUBLIC_ struct ldap_connection *ldap4_new_connection(TALLOC_CTX *mem_ctx,
  59                                              struct loadparm_context *lp_ctx,
  60                                              struct tevent_context *ev)
  61 {
  62         struct ldap_connection *conn;
  63
  64         if (ev == NULL) {
  65                 return NULL;
  66         }
  67
  68         conn = talloc_zero(mem_ctx, struct ldap_connection);
  69         if (conn == NULL) {
  70                 return NULL;
  71         }
  72
  73         conn->next_messageid  = 1;
  74         conn->event.event_ctx = ev;
  75
  76         conn->sockets.send_queue = tevent_queue_create(conn,
  77                                         "ldap_connection send_queue");
  78         if (conn->sockets.send_queue == NULL) {
  79                 TALLOC_FREE(conn);
  80                 return NULL;
  81         }
  82
  83         conn->lp_ctx = lp_ctx;
  84
  85         /* set a reasonable request timeout */
  86         conn->timeout = 60;
  87
  88         /* explicitly avoid reconnections by default */
  89         conn->reconnect.max_retries = 0;
  90
  91         talloc_set_destructor(conn, ldap_connection_destructor);
  92         return conn;
  93 }
  94
  95 /*
  96   the connection is dead
  97 */
  98 static void ldap_connection_dead(struct ldap_connection *conn, NTSTATUS status)
  99 {
 100         struct ldap_request *req;
 101
 102         tevent_queue_stop(conn->sockets.send_queue);
 103         TALLOC_FREE(conn->sockets.recv_subreq);
 104         conn->sockets.active = NULL;
 105         TALLOC_FREE(conn->sockets.sasl);
 106         TALLOC_FREE(conn->sockets.tls);
 107         TALLOC_FREE(conn->sockets.raw);
 108
 109         /* return an error for any pending request ... */
 110         while (conn->pending) {
 111                 req = conn->pending;
 112                 DLIST_REMOVE(req->conn->pending, req);
 113                 req->conn = NULL;
 114                 req->state = LDAP_REQUEST_DONE;
 115                 if (NT_STATUS_IS_OK(status)) {
 116                         continue;
 117                 }
 118                 req->status = status;
 119                 if (req->async.fn) {
 120                         req->async.fn(req);
 121                 }
 122         }
 123 }
 124
 125 static void ldap_reconnect(struct ldap_connection *conn);
 126
 127 /*
 128   handle packet errors
 129 */
 130 static void ldap_error_handler(struct ldap_connection *conn, NTSTATUS status)
 131 {
 132         ldap_connection_dead(conn, status);
 133
 134         /* but try to reconnect so that the ldb client can go on */
 135         ldap_reconnect(conn);
 136 }
 137
 138
 139 /*
 140   match up with a pending message, adding to the replies list
 141 */
 142 static void ldap_match_message(struct ldap_connection *conn, struct ldap_message *msg)
 143 {
 144         struct ldap_request *req;
 145         int i;
 146
 147         for (req=conn->pending; req; req=req->next) {
 148                 if (req->messageid == msg->messageid) break;
 149         }
 150         /* match a zero message id to the last request sent.
 151            It seems that servers send 0 if unable to parse */
 152         if (req == NULL && msg->messageid == 0) {
 153                 req = conn->pending;
 154         }
 155         if (req == NULL) {
 156                 DEBUG(0,("ldap: no matching message id for %u\n",
 157                          msg->messageid));
 158                 TALLOC_FREE(msg);
 159                 return;
 160         }
 161
 162         /* Check for undecoded critical extensions */
 163         for (i=0; msg->controls && msg->controls[i]; i++) {
 164                 if (!msg->controls_decoded[i] &&
 165                     msg->controls[i]->critical) {
 166                         TALLOC_FREE(msg);
 167                         req->status = NT_STATUS_LDAP(LDAP_UNAVAILABLE_CRITICAL_EXTENSION);
 168                         req->state = LDAP_REQUEST_DONE;
 169                         DLIST_REMOVE(conn->pending, req);
 170                         if (req->async.fn) {
 171                                 req->async.fn(req);
 172                         }
 173                         return;
 174                 }
 175         }
 176
 177         /* add to the list of replies received */
 178         req->replies = talloc_realloc(req, req->replies,
 179                                       struct ldap_message *, req->num_replies+1);
 180         if (req->replies == NULL) {
 181                 TALLOC_FREE(msg);
 182                 req->status = NT_STATUS_NO_MEMORY;
 183                 req->state = LDAP_REQUEST_DONE;
 184                 DLIST_REMOVE(conn->pending, req);
 185                 if (req->async.fn) {
 186                         req->async.fn(req);
 187                 }
 188                 return;
 189         }
 190
 191         req->replies[req->num_replies] = talloc_steal(req->replies, msg);
 192         req->num_replies++;
 193
 194         if (msg->type != LDAP_TAG_SearchResultEntry &&
 195             msg->type != LDAP_TAG_SearchResultReference) {
 196                 /* currently only search results expect multiple
 197                    replies */
 198                 req->state = LDAP_REQUEST_DONE;
 199                 DLIST_REMOVE(conn->pending, req);
 200         }
 201
 202         if (req->async.fn) {
 203                 req->async.fn(req);
 204         }
 205 }
 206
 207 static void ldap_connection_recv_done(struct tevent_req *subreq);
 208
 209 static void ldap_connection_recv_next(struct ldap_connection *conn)
 210 {
 211         struct tevent_req *subreq = NULL;
 212
 213         if (conn->sockets.recv_subreq != NULL) {
 214                 return;
 215         }
 216
 217         if (conn->sockets.active == NULL) {
 218                 return;
 219         }
 220
 221         if (conn->pending == NULL) {
 222                 return;
 223         }
 224
 225         /*
 226          * The minimum size of a LDAP pdu is 7 bytes
 227          *
 228          * dumpasn1 -hh ldap-unbind-min.dat
 229          *
 230          *     <30 05 02 01 09 42 00>
 231          *    0    5: SEQUENCE {
 232          *     <02 01 09>
 233          *    2    1:   INTEGER 9
 234          *     <42 00>
 235          *    5    0:   [APPLICATION 2]
 236          *          :     Error: Object has zero length.
 237          *          :   }
 238          *
 239          * dumpasn1 -hh ldap-unbind-windows.dat
 240          *
 241          *     <30 84 00 00 00 05 02 01 09 42 00>
 242          *    0    5: SEQUENCE {
 243          *     <02 01 09>
 244          *    6    1:   INTEGER 9
 245          *     <42 00>
 246          *    9    0:   [APPLICATION 2]
 247          *          :     Error: Object has zero length.
 248          *          :   }
 249          *
 250          * This means using an initial read size
 251          * of 7 is ok.
 252          */
 253         subreq = tstream_read_pdu_blob_send(conn,
 254                                             conn->event.event_ctx,
 255                                             conn->sockets.active,
 256                                             7, /* initial_read_size */
 257                                             ldap_full_packet,
 258                                             conn);
 259         if (subreq == NULL) {
 260                 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
 261                 return;
 262         }
 263         tevent_req_set_callback(subreq, ldap_connection_recv_done, conn);
 264         conn->sockets.recv_subreq = subreq;
 265         return;
 266 }
 267
 268 /*
 269   decode/process LDAP data
 270 */
 271 static void ldap_connection_recv_done(struct tevent_req *subreq)
 272 {
 273         NTSTATUS status;
 274         struct ldap_connection *conn =
 275                 tevent_req_callback_data(subreq,
 276                 struct ldap_connection);
 277         struct ldap_message *msg;
 278         struct asn1_data *asn1;
 279         DATA_BLOB blob;
 280
 281         msg = talloc_zero(conn, struct ldap_message);
 282         if (msg == NULL) {
 283                 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
 284                 return;
 285         }
 286
 287         asn1 = asn1_init(conn);
 288         if (asn1 == NULL) {
 289                 TALLOC_FREE(msg);
 290                 ldap_error_handler(conn, NT_STATUS_NO_MEMORY);
 291                 return;
 292         }
 293
 294         conn->sockets.recv_subreq = NULL;
 295
 296         status = tstream_read_pdu_blob_recv(subreq,
 297                                             asn1,
 298                                             &blob);
 299         TALLOC_FREE(subreq);
 300         if (!NT_STATUS_IS_OK(status)) {
 301                 TALLOC_FREE(msg);
 302                 asn1_free(asn1);
 303                 ldap_error_handler(conn, status);
 304                 return;
 305         }
 306
 307         asn1_load_nocopy(asn1, blob.data, blob.length);
 308
 309         status = ldap_decode(asn1, samba_ldap_control_handlers(), msg);
 310         asn1_free(asn1);
 311         if (!NT_STATUS_IS_OK(status)) {
 312                 TALLOC_FREE(msg);
 313                 ldap_error_handler(conn, status);
 314                 return;
 315         }
 316
 317         ldap_match_message(conn, msg);
 318         ldap_connection_recv_next(conn);
 319
 320         return;
 321 }
 322
 323 /*
 324   parse a ldap URL
 325 */
 326 static NTSTATUS ldap_parse_basic_url(TALLOC_CTX *mem_ctx, const char *url,
 327                                      char **host, uint16_t *port, bool *ldaps)
 328 {
 329         int tmp_port = 0;
 330         char protocol[11];
 331         char tmp_host[1025];
 332         int ret;
 333
 334         /* Paranoia check */
 335         SMB_ASSERT(sizeof(protocol)>10 && sizeof(tmp_host)>254);
 336
 337         ret = sscanf(url, "%10[^:]://%254[^:/]:%d", protocol, tmp_host, &tmp_port);
 338         if (ret < 2) {
 339                 return NT_STATUS_INVALID_PARAMETER;
 340         }
 341
 342         if (strequal(protocol, "ldap")) {
 343                 *port = 389;
 344                 *ldaps = false;
 345         } else if (strequal(protocol, "ldaps")) {
 346                 *port = 636;
 347                 *ldaps = true;
 348         } else {
 349                 DEBUG(0, ("unrecognised ldap protocol (%s)!\n", protocol));
 350                 return NT_STATUS_PROTOCOL_UNREACHABLE;
 351         }
 352
 353         if (tmp_port != 0)
 354                 *port = tmp_port;
 355
 356         *host = talloc_strdup(mem_ctx, tmp_host);
 357         NT_STATUS_HAVE_NO_MEMORY(*host);
 358
 359         return NT_STATUS_OK;
 360 }
 361
 362 /*
 363   connect to a ldap server
 364 */
 365
 366 struct ldap_connect_state {
 367         struct composite_context *ctx;
 368         struct ldap_connection *conn;
 369         struct socket_context *sock;
 370         struct tstream_context *raw;
 371         struct tstream_tls_params *tls_params;
 372         struct tstream_context *tls;
 373 };
 374
 375 static void ldap_connect_recv_unix_conn(struct composite_context *ctx);
 376 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx);
 377
 378 _PUBLIC_ struct composite_context *ldap_connect_send(struct ldap_connection *conn,
 379                                             const char *url)
 380 {
 381         struct composite_context *result, *ctx;
 382         struct ldap_connect_state *state;
 383         char protocol[11];
 384         int ret;
 385
 386         result = talloc_zero(conn, struct composite_context);
 387         if (result == NULL) goto failed;
 388         result->state = COMPOSITE_STATE_IN_PROGRESS;
 389         result->async.fn = NULL;
 390         result->event_ctx = conn->event.event_ctx;
 391
 392         state = talloc(result, struct ldap_connect_state);
 393         if (state == NULL) goto failed;
 394         state->ctx = result;
 395         result->private_data = state;
 396
 397         state->conn = conn;
 398
 399         if (conn->reconnect.url == NULL) {
 400                 conn->reconnect.url = talloc_strdup(conn, url);
 401                 if (conn->reconnect.url == NULL) goto failed;
 402         }
 403
 404         /* Paranoia check */
 405         SMB_ASSERT(sizeof(protocol)>10);
 406
 407         ret = sscanf(url, "%10[^:]://", protocol);
 408         if (ret < 1) {
 409                 return NULL;
 410         }
 411
 412         if (strequal(protocol, "ldapi")) {
 413                 struct socket_address *unix_addr;
 414                 char path[1025];
 415                 char *end = NULL;
 416                 NTSTATUS status = socket_create("unix", SOCKET_TYPE_STREAM, &state->sock, 0);
 417                 if (!NT_STATUS_IS_OK(status)) {
 418                         return NULL;
 419                 }
 420                 talloc_steal(state, state->sock);
 421                 SMB_ASSERT(sizeof(protocol)>10);
 422                 SMB_ASSERT(sizeof(path)>1024);
 423
 424                 /* LDAPI connections are to localhost, so give the
 425                  * local host name as the target for gensec's
 426                  * DIGEST-MD5 mechanism */
 427                 conn->host = talloc_asprintf(conn, "%s.%s",
 428                                              lpcfg_netbios_name(conn->lp_ctx),
 429                                              lpcfg_dnsdomain(conn->lp_ctx));
 430                 if (composite_nomem(conn->host, state->ctx)) {
 431                         return result;
 432                 }
 433
 434                 /* The %c specifier doesn't null terminate :-( */
 435                 ZERO_STRUCT(path);
 436                 ret = sscanf(url, "%10[^:]://%1025c", protocol, path);
 437                 if (ret < 2) {
 438                         composite_error(state->ctx, NT_STATUS_INVALID_PARAMETER);
 439                         return result;
 440                 }
 441
 442                 end = rfc1738_unescape(path);
 443                 if (end == NULL) {
 444                         composite_error(state->ctx,
 445                                         NT_STATUS_INVALID_PARAMETER);
 446                         return result;
 447                 }
 448                 unix_addr = socket_address_from_strings(state, state->sock->backend_name,
 449                                                         path, 0);
 450                 if (composite_nomem(unix_addr, result)) {
 451                         return result;
 452                 }
 453
 454                 ctx = socket_connect_send(state->sock, NULL, unix_addr,
 455                                           0, result->event_ctx);
 456                 ctx->async.fn = ldap_connect_recv_unix_conn;
 457                 ctx->async.private_data = state;
 458                 return result;
 459         } else {
 460                 NTSTATUS status = ldap_parse_basic_url(conn, url, &conn->host,
 461                                                           &conn->port, &conn->ldaps);
 462                 if (!NT_STATUS_IS_OK(status)) {
 463                         composite_error(result, status);
 464                         return result;
 465                 }
 466
 467                 if (conn->ldaps) {
 468                         char *ca_file = lpcfg_tls_cafile(state, conn->lp_ctx);
 469                         char *crl_file = lpcfg_tls_crlfile(state, conn->lp_ctx);
 470                         const char *tls_priority = lpcfg_tls_priority(conn->lp_ctx);
 471                         enum tls_verify_peer_state verify_peer =
 472                                 lpcfg_tls_verify_peer(conn->lp_ctx);
 473
 474                         status = tstream_tls_params_client(state,
 475                                                            ca_file,
 476                                                            crl_file,
 477                                                            tls_priority,
 478                                                            verify_peer,
 479                                                            conn->host,
 480                                                            &state->tls_params);
 481                         if (!NT_STATUS_IS_OK(status)) {
 482                                 composite_error(result, status);
 483                                 return result;
 484                         }
 485                 }
 486
 487                 ctx = socket_connect_multi_send(state, conn->host, 1, &conn->port,
 488                                                 lpcfg_resolve_context(conn->lp_ctx),
 489                                                 result->event_ctx);
 490                 if (composite_nomem(ctx, result)) {
 491                         return result;
 492                 }
 493
 494                 ctx->async.fn = ldap_connect_recv_tcp_conn;
 495                 ctx->async.private_data = state;
 496                 return result;
 497         }
 498  failed:
 499         talloc_free(result);
 500         return NULL;
 501 }
 502
 503 static void ldap_connect_got_tls(struct tevent_req *subreq);
 504
 505 static void ldap_connect_got_sock(struct composite_context *ctx,
 506                                   struct ldap_connection *conn)
 507 {
 508         struct ldap_connect_state *state =
 509                 talloc_get_type_abort(ctx->private_data,
 510                 struct ldap_connect_state);
 511         struct tevent_req *subreq = NULL;
 512         int fd;
 513         int ret;
 514
 515         socket_set_flags(state->sock, SOCKET_FLAG_NOCLOSE);
 516         fd = socket_get_fd(state->sock);
 517         TALLOC_FREE(state->sock);
 518
 519         smb_set_close_on_exec(fd);
 520
 521         ret = set_blocking(fd, false);
 522         if (ret == -1) {
 523                 NTSTATUS status = map_nt_error_from_unix_common(errno);
 524                 composite_error(state->ctx, status);
 525                 return;
 526         }
 527
 528         ret = tstream_bsd_existing_socket(state, fd, &state->raw);
 529         if (ret == -1) {
 530                 NTSTATUS status = map_nt_error_from_unix_common(errno);
 531                 composite_error(state->ctx, status);
 532                 return;
 533         }
 534
 535         if (!conn->ldaps) {
 536                 conn->sockets.raw = talloc_move(conn, &state->raw);
 537                 conn->sockets.active = conn->sockets.raw;
 538                 composite_done(state->ctx);
 539                 return;
 540         }
 541
 542         subreq = tstream_tls_connect_send(state, state->ctx->event_ctx,
 543                                           state->raw, state->tls_params);
 544         if (composite_nomem(subreq, state->ctx)) {
 545                 return;
 546         }
 547         tevent_req_set_callback(subreq, ldap_connect_got_tls, state);
 548 }
 549
 550 static void ldap_connect_got_tls(struct tevent_req *subreq)
 551 {
 552         struct ldap_connect_state *state =
 553                 tevent_req_callback_data(subreq,
 554                 struct ldap_connect_state);
 555         int err;
 556         int ret;
 557
 558         ret = tstream_tls_connect_recv(subreq, &err, state, &state->tls);
 559         TALLOC_FREE(subreq);
 560         if (ret == -1) {
 561                 NTSTATUS status = map_nt_error_from_unix_common(err);
 562                 composite_error(state->ctx, status);
 563                 return;
 564         }
 565
 566         talloc_steal(state->tls, state->tls_params);
 567
 568         state->conn->sockets.raw = talloc_move(state->conn, &state->raw);
 569         state->conn->sockets.tls = talloc_move(state->conn->sockets.raw,
 570                                                &state->tls);
 571         state->conn->sockets.active = state->conn->sockets.tls;
 572         composite_done(state->ctx);
 573 }
 574
 575 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx)
 576 {
 577         struct ldap_connect_state *state =
 578                 talloc_get_type_abort(ctx->async.private_data,
 579                 struct ldap_connect_state);
 580         struct ldap_connection *conn = state->conn;
 581         uint16_t port;
 582         NTSTATUS status = socket_connect_multi_recv(ctx, state, &state->sock,
 583                                                        &port);
 584         if (!NT_STATUS_IS_OK(status)) {
 585                 composite_error(state->ctx, status);
 586                 return;
 587         }
 588
 589         ldap_connect_got_sock(state->ctx, conn);
 590 }
 591
 592 static void ldap_connect_recv_unix_conn(struct composite_context *ctx)
 593 {
 594         struct ldap_connect_state *state =
 595                 talloc_get_type_abort(ctx->async.private_data,
 596                 struct ldap_connect_state);
 597         struct ldap_connection *conn = state->conn;
 598
 599         NTSTATUS status = socket_connect_recv(ctx);
 600
 601         if (!NT_STATUS_IS_OK(state->ctx->status)) {
 602                 composite_error(state->ctx, status);
 603                 return;
 604         }
 605
 606         ldap_connect_got_sock(state->ctx, conn);
 607 }
 608
 609 _PUBLIC_ NTSTATUS ldap_connect_recv(struct composite_context *ctx)
 610 {
 611         NTSTATUS status = composite_wait(ctx);
 612         talloc_free(ctx);
 613         return status;
 614 }
 615
 616 _PUBLIC_ NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url)
 617 {
 618         struct composite_context *ctx = ldap_connect_send(conn, url);
 619         return ldap_connect_recv(ctx);
 620 }
 621
 622 /* set reconnect parameters */
 623
 624 _PUBLIC_ void ldap_set_reconn_params(struct ldap_connection *conn, int max_retries)
 625 {
 626         if (conn) {
 627                 conn->reconnect.max_retries = max_retries;
 628                 conn->reconnect.retries = 0;
 629                 conn->reconnect.previous = time_mono(NULL);
 630         }
 631 }
 632
 633 /* Actually this function is NOT ASYNC safe, FIXME? */
 634 static void ldap_reconnect(struct ldap_connection *conn)
 635 {
 636         NTSTATUS status;
 637         time_t now = time_mono(NULL);
 638
 639         /* do we have set up reconnect ? */
 640         if (conn->reconnect.max_retries == 0) return;
 641
 642         /* is the retry time expired ? */
 643         if (now > conn->reconnect.previous + 30) {
 644                 conn->reconnect.retries = 0;
 645                 conn->reconnect.previous = now;
 646         }
 647
 648         /* are we reconnectind too often and too fast? */
 649         if (conn->reconnect.retries > conn->reconnect.max_retries) return;
 650
 651         /* keep track of the number of reconnections */
 652         conn->reconnect.retries++;
 653
 654         /* reconnect */
 655         status = ldap_connect(conn, conn->reconnect.url);
 656         if ( ! NT_STATUS_IS_OK(status)) {
 657                 return;
 658         }
 659
 660         /* rebind */
 661         status = ldap_rebind(conn);
 662         if ( ! NT_STATUS_IS_OK(status)) {
 663                 ldap_connection_dead(conn, status);
 664         }
 665 }
 666
 667 static void ldap_request_destructor_abandon(struct ldap_request *abandon)
 668 {
 669         TALLOC_FREE(abandon);
 670 }
 671
 672 /* destroy an open ldap request */
 673 static int ldap_request_destructor(struct ldap_request *req)
 674 {
 675         if (req->state == LDAP_REQUEST_PENDING) {
 676                 struct ldap_message msg = {
 677                         .type = LDAP_TAG_AbandonRequest,
 678                         .r.AbandonRequest.messageid = req->messageid,
 679                 };
 680                 struct ldap_request *abandon = NULL;
 681
 682                 DLIST_REMOVE(req->conn->pending, req);
 683
 684                 abandon = ldap_request_send(req->conn, &msg);
 685                 if (abandon == NULL) {
 686                         ldap_error_handler(req->conn, NT_STATUS_NO_MEMORY);
 687                         return 0;
 688                 }
 689                 abandon->async.fn = ldap_request_destructor_abandon;
 690                 abandon->async.private_data = NULL;
 691         }
 692
 693         return 0;
 694 }
 695
 696 static void ldap_request_timeout_abandon(struct ldap_request *abandon)
 697 {
 698         struct ldap_request *req =
 699                 talloc_get_type_abort(abandon->async.private_data,
 700                 struct ldap_request);
 701
 702         if (req->state == LDAP_REQUEST_PENDING) {
 703                 DLIST_REMOVE(req->conn->pending, req);
 704         }
 705         req->state = LDAP_REQUEST_DONE;
 706         if (req->async.fn) {
 707                 req->async.fn(req);
 708         }
 709 }
 710
 711 /*
 712   called on timeout of a ldap request
 713 */
 714 static void ldap_request_timeout(struct tevent_context *ev, struct tevent_timer *te,
 715                                       struct timeval t, void *private_data)
 716 {
 717         struct ldap_request *req =
 718                 talloc_get_type_abort(private_data,
 719                 struct ldap_request);
 720
 721         req->status = NT_STATUS_IO_TIMEOUT;
 722         if (req->state == LDAP_REQUEST_PENDING) {
 723                 struct ldap_message msg = {
 724                         .type = LDAP_TAG_AbandonRequest,
 725                         .r.AbandonRequest.messageid = req->messageid,
 726                 };
 727                 struct ldap_request *abandon = NULL;
 728
 729                 abandon = ldap_request_send(req->conn, &msg);
 730                 if (abandon == NULL) {
 731                         ldap_error_handler(req->conn, NT_STATUS_NO_MEMORY);
 732                         return;
 733                 }
 734                 talloc_reparent(req->conn, req, abandon);
 735                 abandon->async.fn = ldap_request_timeout_abandon;
 736                 abandon->async.private_data = req;
 737                 DLIST_REMOVE(req->conn->pending, req);
 738                 return;
 739         }
 740         req->state = LDAP_REQUEST_DONE;
 741         if (req->async.fn) {
 742                 req->async.fn(req);
 743         }
 744 }
 745
 746
 747 /*
 748   called on completion of a failed ldap request
 749 */
 750 static void ldap_request_failed_complete(struct tevent_context *ev, struct tevent_timer *te,
 751                                       struct timeval t, void *private_data)
 752 {
 753         struct ldap_request *req =
 754                 talloc_get_type_abort(private_data,
 755                 struct ldap_request);
 756
 757         if (req->async.fn) {
 758                 req->async.fn(req);
 759         }
 760 }
 761
 762 static void ldap_request_written(struct tevent_req *subreq);
 763
 764 /*
 765   send a ldap message - async interface
 766 */
 767 _PUBLIC_ struct ldap_request *ldap_request_send(struct ldap_connection *conn,
 768                                        struct ldap_message *msg)
 769 {
 770         struct ldap_request *req;
 771         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 772         struct tevent_req *subreq = NULL;
 773
 774         req = talloc_zero(conn, struct ldap_request);
 775         if (req == NULL) return NULL;
 776
 777         if (conn->sockets.active == NULL) {
 778                 status = NT_STATUS_INVALID_CONNECTION;
 779                 goto failed;
 780         }
 781
 782         req->state       = LDAP_REQUEST_SEND;
 783         req->conn        = conn;
 784         req->messageid   = conn->next_messageid++;
 785         if (conn->next_messageid == 0) {
 786                 conn->next_messageid = 1;
 787         }
 788         req->type        = msg->type;
 789         if (req->messageid == -1) {
 790                 goto failed;
 791         }
 792
 793         talloc_set_destructor(req, ldap_request_destructor);
 794
 795         msg->messageid = req->messageid;
 796
 797         if (!ldap_encode(msg, samba_ldap_control_handlers(), &req->data, req)) {
 798                 status = NT_STATUS_INTERNAL_ERROR;
 799                 goto failed;
 800         }
 801
 802         /* put a timeout on the request */
 803         req->time_event = tevent_add_timer(conn->event.event_ctx, req,
 804                                            timeval_current_ofs(conn->timeout, 0),
 805                                            ldap_request_timeout, req);
 806         if (req->time_event == NULL) {
 807                 status = NT_STATUS_NO_MEMORY;
 808                 goto failed;
 809         }
 810
 811         req->write_iov.iov_base = req->data.data;
 812         req->write_iov.iov_len = req->data.length;
 813
 814         subreq = tstream_writev_queue_send(req, conn->event.event_ctx,
 815                                            conn->sockets.active,
 816                                            conn->sockets.send_queue,
 817                                            &req->write_iov, 1);
 818         if (subreq == NULL) {
 819                 status = NT_STATUS_NO_MEMORY;
 820                 goto failed;
 821         }
 822         tevent_req_set_callback(subreq, ldap_request_written, req);
 823
 824         req->state = LDAP_REQUEST_PENDING;
 825         DLIST_ADD(conn->pending, req);
 826
 827         return req;
 828
 829 failed:
 830         req->status = status;
 831         req->state = LDAP_REQUEST_ERROR;
 832         tevent_add_timer(conn->event.event_ctx, req, timeval_zero(),
 833                          ldap_request_failed_complete, req);
 834
 835         return req;
 836 }
 837
 838 static void ldap_request_written(struct tevent_req *subreq)
 839 {
 840         struct ldap_request *req =
 841                 tevent_req_callback_data(subreq,
 842                 struct ldap_request);
 843         int err;
 844         ssize_t ret;
 845
 846         ret = tstream_writev_queue_recv(subreq, &err);
 847         TALLOC_FREE(subreq);
 848         if (ret == -1) {
 849                 NTSTATUS error = map_nt_error_from_unix_common(err);
 850                 ldap_error_handler(req->conn, error);
 851                 return;
 852         }
 853
 854         if (req->type == LDAP_TAG_AbandonRequest ||
 855             req->type == LDAP_TAG_UnbindRequest)
 856         {
 857                 if (req->state == LDAP_REQUEST_PENDING) {
 858                         DLIST_REMOVE(req->conn->pending, req);
 859                 }
 860                 req->state = LDAP_REQUEST_DONE;
 861                 if (req->async.fn) {
 862                         req->async.fn(req);
 863                 }
 864                 return;
 865         }
 866
 867         ldap_connection_recv_next(req->conn);
 868 }
 869
 870
 871 /*
 872   wait for a request to complete
 873   note that this does not destroy the request
 874 */
 875 _PUBLIC_ NTSTATUS ldap_request_wait(struct ldap_request *req)
 876 {
 877         while (req->state < LDAP_REQUEST_DONE) {
 878                 if (tevent_loop_once(req->conn->event.event_ctx) != 0) {
 879                         req->state = LDAP_REQUEST_ERROR;
 880                         req->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 881                         break;
 882                 }
 883         }
 884         return req->status;
 885 }
 886
 887
 888 /*
 889   a mapping of ldap response code to strings
 890 */
 891 static const struct {
 892         enum ldap_result_code code;
 893         const char *str;
 894 } ldap_code_map[] = {
 895 #define _LDAP_MAP_CODE(c) { c, #c }
 896         _LDAP_MAP_CODE(LDAP_SUCCESS),
 897         _LDAP_MAP_CODE(LDAP_OPERATIONS_ERROR),
 898         _LDAP_MAP_CODE(LDAP_PROTOCOL_ERROR),
 899         _LDAP_MAP_CODE(LDAP_TIME_LIMIT_EXCEEDED),
 900         _LDAP_MAP_CODE(LDAP_SIZE_LIMIT_EXCEEDED),
 901         _LDAP_MAP_CODE(LDAP_COMPARE_FALSE),
 902         _LDAP_MAP_CODE(LDAP_COMPARE_TRUE),
 903         _LDAP_MAP_CODE(LDAP_AUTH_METHOD_NOT_SUPPORTED),
 904         _LDAP_MAP_CODE(LDAP_STRONG_AUTH_REQUIRED),
 905         _LDAP_MAP_CODE(LDAP_REFERRAL),
 906         _LDAP_MAP_CODE(LDAP_ADMIN_LIMIT_EXCEEDED),
 907         _LDAP_MAP_CODE(LDAP_UNAVAILABLE_CRITICAL_EXTENSION),
 908         _LDAP_MAP_CODE(LDAP_CONFIDENTIALITY_REQUIRED),
 909         _LDAP_MAP_CODE(LDAP_SASL_BIND_IN_PROGRESS),
 910         _LDAP_MAP_CODE(LDAP_NO_SUCH_ATTRIBUTE),
 911         _LDAP_MAP_CODE(LDAP_UNDEFINED_ATTRIBUTE_TYPE),
 912         _LDAP_MAP_CODE(LDAP_INAPPROPRIATE_MATCHING),
 913         _LDAP_MAP_CODE(LDAP_CONSTRAINT_VIOLATION),
 914         _LDAP_MAP_CODE(LDAP_ATTRIBUTE_OR_VALUE_EXISTS),
 915         _LDAP_MAP_CODE(LDAP_INVALID_ATTRIBUTE_SYNTAX),
 916         _LDAP_MAP_CODE(LDAP_NO_SUCH_OBJECT),
 917         _LDAP_MAP_CODE(LDAP_ALIAS_PROBLEM),
 918         _LDAP_MAP_CODE(LDAP_INVALID_DN_SYNTAX),
 919         _LDAP_MAP_CODE(LDAP_ALIAS_DEREFERENCING_PROBLEM),
 920         _LDAP_MAP_CODE(LDAP_INAPPROPRIATE_AUTHENTICATION),
 921         _LDAP_MAP_CODE(LDAP_INVALID_CREDENTIALS),
 922         _LDAP_MAP_CODE(LDAP_INSUFFICIENT_ACCESS_RIGHTS),
 923         _LDAP_MAP_CODE(LDAP_BUSY),
 924         _LDAP_MAP_CODE(LDAP_UNAVAILABLE),
 925         _LDAP_MAP_CODE(LDAP_UNWILLING_TO_PERFORM),
 926         _LDAP_MAP_CODE(LDAP_LOOP_DETECT),
 927         _LDAP_MAP_CODE(LDAP_NAMING_VIOLATION),
 928         _LDAP_MAP_CODE(LDAP_OBJECT_CLASS_VIOLATION),
 929         _LDAP_MAP_CODE(LDAP_NOT_ALLOWED_ON_NON_LEAF),
 930         _LDAP_MAP_CODE(LDAP_NOT_ALLOWED_ON_RDN),
 931         _LDAP_MAP_CODE(LDAP_ENTRY_ALREADY_EXISTS),
 932         _LDAP_MAP_CODE(LDAP_OBJECT_CLASS_MODS_PROHIBITED),
 933         _LDAP_MAP_CODE(LDAP_AFFECTS_MULTIPLE_DSAS),
 934         _LDAP_MAP_CODE(LDAP_OTHER)
 935 };
 936
 937 /*
 938   used to setup the status code from a ldap response
 939 */
 940 _PUBLIC_ NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r)
 941 {
 942         int i;
 943         const char *codename = "unknown";
 944
 945         if (r->resultcode == LDAP_SUCCESS) {
 946                 return NT_STATUS_OK;
 947         }
 948
 949         if (conn->last_error) {
 950                 talloc_free(conn->last_error);
 951         }
 952
 953         for (i=0;i<ARRAY_SIZE(ldap_code_map);i++) {
 954                 if (r->resultcode == ldap_code_map[i].code) {
 955                         codename = ldap_code_map[i].str;
 956                         break;
 957                 }
 958         }
 959
 960         conn->last_error = talloc_asprintf(conn, "LDAP error %u %s - %s <%s> <%s>",
 961                                            r->resultcode,
 962                                            codename,
 963                                            r->dn?r->dn:"(NULL)",
 964                                            r->errormessage?r->errormessage:"",
 965                                            r->referral?r->referral:"");
 966
 967         return NT_STATUS_LDAP(r->resultcode);
 968 }
 969
 970 /*
 971   return error string representing the last error
 972 */
 973 _PUBLIC_ const char *ldap_errstr(struct ldap_connection *conn,
 974                         TALLOC_CTX *mem_ctx,
 975                         NTSTATUS status)
 976 {
 977         if (NT_STATUS_IS_LDAP(status) && conn->last_error != NULL) {
 978                 return talloc_strdup(mem_ctx, conn->last_error);
 979         }
 980         return talloc_asprintf(mem_ctx, "LDAP client internal error: %s", nt_errstr(status));
 981 }
 982
 983
 984 /*
 985   return the Nth result message, waiting if necessary
 986 */
 987 _PUBLIC_ NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **msg)
 988 {
 989         *msg = NULL;
 990
 991         NT_STATUS_HAVE_NO_MEMORY(req);
 992
 993         while (req->state < LDAP_REQUEST_DONE && n >= req->num_replies) {
 994                 if (tevent_loop_once(req->conn->event.event_ctx) != 0) {
 995                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 996                 }
 997         }
 998
 999         if (n < req->num_replies) {
1000                 *msg = req->replies[n];
1001                 return NT_STATUS_OK;
1002         }
1003
1004         if (!NT_STATUS_IS_OK(req->status)) {
1005                 return req->status;
1006         }
1007
1008         return NT_STATUS_NO_MORE_ENTRIES;
1009 }
1010
1011
1012 /*
1013   return a single result message, checking if it is of the expected LDAP type
1014 */
1015 _PUBLIC_ NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, int type)
1016 {
1017         NTSTATUS status;
1018         status = ldap_result_n(req, 0, msg);
1019         if (!NT_STATUS_IS_OK(status)) {
1020                 return status;
1021         }
1022         if ((*msg)->type != type) {
1023                 *msg = NULL;
1024                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
1025         }
1026         return status;
1027 }
1028
1029 /*
1030   a simple ldap transaction, for single result requests that only need a status code
1031   this relies on single valued requests having the response type == request type + 1
1032 */
1033 _PUBLIC_ NTSTATUS ldap_transaction(struct ldap_connection *conn, struct ldap_message *msg)
1034 {
1035         struct ldap_request *req = ldap_request_send(conn, msg);
1036         struct ldap_message *res;
1037         NTSTATUS status;
1038         status = ldap_result_n(req, 0, &res);
1039         if (!NT_STATUS_IS_OK(status)) {
1040                 talloc_free(req);
1041                 return status;
1042         }
1043         if (res->type != msg->type + 1) {
1044                 talloc_free(req);
1045                 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
1046         }
1047         status = ldap_check_response(conn, &res->r.GeneralResult);
1048         talloc_free(req);
1049         return status;
1050 }