source3/lib/smbldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP protocol helper functions for SAMBA
   4    Copyright (C) Jean François Micouleau       1998
   5    Copyright (C) Gerald Carter                  2001-2003
   6    Copyright (C) Shahms King                    2001
   7    Copyright (C) Andrew Bartlett                2002-2003
   8    Copyright (C) Stefan (metze) Metzmacher      2002-2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22
  23 */
  24
  25 #include "includes.h"
  26 #include "smbldap.h"
  27 #include "../libcli/security/security.h"
  28 #include <tevent.h>
  29 #include "lib/param/loadparm.h"
  30
  31 /* Try not to hit the up or down server forever */
  32
  33 #define SMBLDAP_DONT_PING_TIME 10       /* ping only all 10 seconds */
  34 #define SMBLDAP_NUM_RETRIES 8           /* retry only 8 times */
  35
  36 #define SMBLDAP_IDLE_TIME 150           /* After 2.5 minutes disconnect */
  37
  38 struct smbldap_state {
  39         LDAP *ldap_struct;
  40         pid_t pid;
  41         time_t last_ping; /* monotonic */
  42         /* retrieve-once info */
  43         const char *uri;
  44
  45         /* credentials */
  46         bool anonymous;
  47         char *bind_dn;
  48         char *bind_secret;
  49         smbldap_bind_callback_fn bind_callback;
  50         void *bind_callback_data;
  51
  52         bool paged_results;
  53
  54         unsigned int num_failures;
  55
  56         time_t last_use; /* monotonic */
  57         struct tevent_context *tevent_context;
  58         struct tevent_timer *idle_event;
  59
  60         struct timeval last_rebind; /* monotonic */
  61 };
  62
  63 LDAP *smbldap_get_ldap(struct smbldap_state *state)
  64 {
  65         return state->ldap_struct;
  66 }
  67
  68 bool smbldap_get_paged_results(struct smbldap_state *state)
  69 {
  70         return state->paged_results;
  71 }
  72
  73 void smbldap_set_paged_results(struct smbldap_state *state,
  74                                bool paged_results)
  75 {
  76         state->paged_results = paged_results;
  77 }
  78
  79 void smbldap_set_bind_callback(struct smbldap_state *state,
  80                                smbldap_bind_callback_fn callback,
  81                                void *callback_data)
  82 {
  83         state->bind_callback = callback;
  84         state->bind_callback_data = callback_data;
  85 }
  86 /*******************************************************************
  87  Search an attribute and return the first value found.
  88 ******************************************************************/
  89
  90  bool smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry,
  91                                     const char *attribute, char *value,
  92                                     int max_len)
  93 {
  94         char **values;
  95         size_t size = 0;
  96
  97         if ( !attribute )
  98                 return False;
  99
 100         value[0] = '\0';
 101
 102         if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) {
 103                 DEBUG (10, ("smbldap_get_single_attribute: [%s] = [<does not exist>]\n", attribute));
 104
 105                 return False;
 106         }
 107
 108         if (!convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, max_len, &size)) {
 109                 DEBUG(1, ("smbldap_get_single_attribute: string conversion of [%s] = [%s] failed!\n",
 110                           attribute, values[0]));
 111                 ldap_value_free(values);
 112                 return False;
 113         }
 114
 115         ldap_value_free(values);
 116 #ifdef DEBUG_PASSWORDS
 117         DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n", attribute, value));
 118 #endif
 119         return True;
 120 }
 121
 122  char * smbldap_talloc_single_attribute(LDAP *ldap_struct, LDAPMessage *entry,
 123                                         const char *attribute,
 124                                         TALLOC_CTX *mem_ctx)
 125 {
 126         char **values;
 127         char *result;
 128         size_t converted_size;
 129
 130         if (attribute == NULL) {
 131                 return NULL;
 132         }
 133
 134         values = ldap_get_values(ldap_struct, entry, attribute);
 135
 136         if (values == NULL) {
 137                 DEBUG(10, ("attribute %s does not exist\n", attribute));
 138                 return NULL;
 139         }
 140
 141         if (ldap_count_values(values) != 1) {
 142                 DEBUG(10, ("attribute %s has %d values, expected only one\n",
 143                            attribute, ldap_count_values(values)));
 144                 ldap_value_free(values);
 145                 return NULL;
 146         }
 147
 148         if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
 149                 DEBUG(10, ("pull_utf8_talloc failed\n"));
 150                 ldap_value_free(values);
 151                 return NULL;
 152         }
 153
 154         ldap_value_free(values);
 155
 156 #ifdef DEBUG_PASSWORDS
 157         DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
 158                      attribute, result));
 159 #endif
 160         return result;
 161 }
 162
 163  char * smbldap_talloc_first_attribute(LDAP *ldap_struct, LDAPMessage *entry,
 164                                        const char *attribute,
 165                                        TALLOC_CTX *mem_ctx)
 166 {
 167         char **values;
 168         char *result;
 169         size_t converted_size;
 170
 171         if (attribute == NULL) {
 172                 return NULL;
 173         }
 174
 175         values = ldap_get_values(ldap_struct, entry, attribute);
 176
 177         if (values == NULL) {
 178                 DEBUG(10, ("attribute %s does not exist\n", attribute));
 179                 return NULL;
 180         }
 181
 182         if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
 183                 DEBUG(10, ("pull_utf8_talloc failed\n"));
 184                 ldap_value_free(values);
 185                 return NULL;
 186         }
 187
 188         ldap_value_free(values);
 189
 190 #ifdef DEBUG_PASSWORDS
 191         DEBUG (100, ("smbldap_get_first_attribute: [%s] = [%s]\n",
 192                      attribute, result));
 193 #endif
 194         return result;
 195 }
 196
 197  char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
 198                                           const char *attribute,
 199                                           TALLOC_CTX *mem_ctx)
 200 {
 201         char **values;
 202         char *result;
 203         size_t converted_size;
 204         int i, num_values;
 205
 206         if (attribute == NULL) {
 207                 return NULL;
 208         }
 209
 210         values = ldap_get_values(ldap_struct, entry, attribute);
 211
 212         if (values == NULL) {
 213                 DEBUG(10, ("attribute %s does not exist\n", attribute));
 214                 return NULL;
 215         }
 216
 217         if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
 218                 DEBUG(10, ("pull_utf8_talloc failed\n"));
 219                 ldap_value_free(values);
 220                 return NULL;
 221         }
 222
 223         num_values = ldap_count_values(values);
 224
 225         for (i=1; i<num_values; i++) {
 226                 char *tmp;
 227
 228                 if (!pull_utf8_talloc(mem_ctx, &tmp, values[i],
 229                                       &converted_size)) {
 230                         DEBUG(10, ("pull_utf8_talloc failed\n"));
 231                         TALLOC_FREE(result);
 232                         ldap_value_free(values);
 233                         return NULL;
 234                 }
 235
 236                 if (strcasecmp_m(tmp, result) < 0) {
 237                         TALLOC_FREE(result);
 238                         result = tmp;
 239                 } else {
 240                         TALLOC_FREE(tmp);
 241                 }
 242         }
 243
 244         ldap_value_free(values);
 245
 246 #ifdef DEBUG_PASSWORDS
 247         DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
 248                      attribute, result));
 249 #endif
 250         return result;
 251 }
 252
 253  bool smbldap_talloc_single_blob(TALLOC_CTX *mem_ctx, LDAP *ld,
 254                                  LDAPMessage *msg, const char *attrib,
 255                                  DATA_BLOB *blob)
 256 {
 257         struct berval **values;
 258
 259         values = ldap_get_values_len(ld, msg, attrib);
 260         if (!values) {
 261                 return false;
 262         }
 263
 264         if (ldap_count_values_len(values) != 1) {
 265                 DEBUG(10, ("Expected one value for %s, got %d\n", attrib,
 266                            ldap_count_values_len(values)));
 267                 return false;
 268         }
 269
 270         *blob = data_blob_talloc(mem_ctx, values[0]->bv_val,
 271                                  values[0]->bv_len);
 272         ldap_value_free_len(values);
 273
 274         return (blob->data != NULL);
 275 }
 276
 277  bool smbldap_pull_sid(LDAP *ld, LDAPMessage *msg, const char *attrib,
 278                        struct dom_sid *sid)
 279 {
 280         DATA_BLOB blob;
 281         bool ret;
 282
 283         if (!smbldap_talloc_single_blob(talloc_tos(), ld, msg, attrib,
 284                                         &blob)) {
 285                 return false;
 286         }
 287         ret = sid_parse(blob.data, blob.length, sid);
 288         TALLOC_FREE(blob.data);
 289         return ret;
 290 }
 291
 292  static int ldapmsg_destructor(LDAPMessage **result) {
 293         ldap_msgfree(*result);
 294         return 0;
 295 }
 296
 297  void smbldap_talloc_autofree_ldapmsg(TALLOC_CTX *mem_ctx, LDAPMessage *result)
 298 {
 299         LDAPMessage **handle;
 300
 301         if (result == NULL) {
 302                 return;
 303         }
 304
 305         handle = talloc(mem_ctx, LDAPMessage *);
 306         SMB_ASSERT(handle != NULL);
 307
 308         *handle = result;
 309         talloc_set_destructor(handle, ldapmsg_destructor);
 310 }
 311
 312  static int ldapmod_destructor(LDAPMod ***mod) {
 313         ldap_mods_free(*mod, True);
 314         return 0;
 315 }
 316
 317  void smbldap_talloc_autofree_ldapmod(TALLOC_CTX *mem_ctx, LDAPMod **mod)
 318 {
 319         LDAPMod ***handle;
 320
 321         if (mod == NULL) {
 322                 return;
 323         }
 324
 325         handle = talloc(mem_ctx, LDAPMod **);
 326         SMB_ASSERT(handle != NULL);
 327
 328         *handle = mod;
 329         talloc_set_destructor(handle, ldapmod_destructor);
 330 }
 331
 332 /************************************************************************
 333  Routine to manage the LDAPMod structure array
 334  manage memory used by the array, by each struct, and values
 335  ***********************************************************************/
 336
 337 static void smbldap_set_mod_internal(LDAPMod *** modlist, int modop, const char *attribute, const char *value, const DATA_BLOB *blob)
 338 {
 339         LDAPMod **mods;
 340         int i;
 341         int j;
 342
 343         mods = *modlist;
 344
 345         /* sanity checks on the mod values */
 346
 347         if (attribute == NULL || *attribute == '\0') {
 348                 return;
 349         }
 350
 351 #if 0   /* commented out after discussion with abartlet.  Do not re-enable.
 352            left here so other do not re-add similar code   --jerry */
 353         if (value == NULL || *value == '\0')
 354                 return;
 355 #endif
 356
 357         if (mods == NULL) {
 358                 mods = SMB_MALLOC_P(LDAPMod *);
 359                 if (mods == NULL) {
 360                         smb_panic("smbldap_set_mod: out of memory!");
 361                         /* notreached. */
 362                 }
 363                 mods[0] = NULL;
 364         }
 365
 366         for (i = 0; mods[i] != NULL; ++i) {
 367                 if (mods[i]->mod_op == modop && strequal(mods[i]->mod_type, attribute))
 368                         break;
 369         }
 370
 371         if (mods[i] == NULL) {
 372                 mods = SMB_REALLOC_ARRAY (mods, LDAPMod *, i + 2);
 373                 if (mods == NULL) {
 374                         smb_panic("smbldap_set_mod: out of memory!");
 375                         /* notreached. */
 376                 }
 377                 mods[i] = SMB_MALLOC_P(LDAPMod);
 378                 if (mods[i] == NULL) {
 379                         smb_panic("smbldap_set_mod: out of memory!");
 380                         /* notreached. */
 381                 }
 382                 mods[i]->mod_op = modop;
 383                 mods[i]->mod_values = NULL;
 384                 mods[i]->mod_type = SMB_STRDUP(attribute);
 385                 mods[i + 1] = NULL;
 386         }
 387
 388         if (blob && (modop & LDAP_MOD_BVALUES)) {
 389                 j = 0;
 390                 if (mods[i]->mod_bvalues != NULL) {
 391                         for (; mods[i]->mod_bvalues[j] != NULL; j++);
 392                 }
 393                 mods[i]->mod_bvalues = SMB_REALLOC_ARRAY(mods[i]->mod_bvalues, struct berval *, j + 2);
 394
 395                 if (mods[i]->mod_bvalues == NULL) {
 396                         smb_panic("smbldap_set_mod: out of memory!");
 397                         /* notreached. */
 398                 }
 399
 400                 mods[i]->mod_bvalues[j] = SMB_MALLOC_P(struct berval);
 401                 SMB_ASSERT(mods[i]->mod_bvalues[j] != NULL);
 402
 403                 mods[i]->mod_bvalues[j]->bv_val = (char *)smb_memdup(blob->data, blob->length);
 404                 SMB_ASSERT(mods[i]->mod_bvalues[j]->bv_val != NULL);
 405                 mods[i]->mod_bvalues[j]->bv_len = blob->length;
 406
 407                 mods[i]->mod_bvalues[j + 1] = NULL;
 408         } else if (value != NULL) {
 409                 char *utf8_value = NULL;
 410                 size_t converted_size;
 411
 412                 j = 0;
 413                 if (mods[i]->mod_values != NULL) {
 414                         for (; mods[i]->mod_values[j] != NULL; j++);
 415                 }
 416                 mods[i]->mod_values = SMB_REALLOC_ARRAY(mods[i]->mod_values, char *, j + 2);
 417
 418                 if (mods[i]->mod_values == NULL) {
 419                         smb_panic("smbldap_set_mod: out of memory!");
 420                         /* notreached. */
 421                 }
 422
 423                 if (!push_utf8_talloc(talloc_tos(), &utf8_value, value, &converted_size)) {
 424                         smb_panic("smbldap_set_mod: String conversion failure!");
 425                         /* notreached. */
 426                 }
 427
 428                 mods[i]->mod_values[j] = SMB_STRDUP(utf8_value);
 429                 TALLOC_FREE(utf8_value);
 430                 SMB_ASSERT(mods[i]->mod_values[j] != NULL);
 431
 432                 mods[i]->mod_values[j + 1] = NULL;
 433         }
 434         *modlist = mods;
 435 }
 436
 437  void smbldap_set_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value)
 438 {
 439         smbldap_set_mod_internal(modlist, modop, attribute, value, NULL);
 440 }
 441
 442  void smbldap_set_mod_blob(LDAPMod *** modlist, int modop, const char *attribute, const DATA_BLOB *value)
 443 {
 444         smbldap_set_mod_internal(modlist, modop | LDAP_MOD_BVALUES, attribute, NULL, value);
 445 }
 446
 447 /**********************************************************************
 448   Set attribute to newval in LDAP, regardless of what value the
 449   attribute had in LDAP before.
 450 *********************************************************************/
 451
 452 static void smbldap_make_mod_internal(LDAP *ldap_struct, LDAPMessage *existing,
 453                                       LDAPMod ***mods,
 454                                       const char *attribute, int op,
 455                                       const char *newval,
 456                                       const DATA_BLOB *newblob)
 457 {
 458         char oldval[2048]; /* current largest allowed value is mungeddial */
 459         bool existed;
 460         DATA_BLOB oldblob = data_blob_null;
 461
 462         if (existing != NULL) {
 463                 if (op & LDAP_MOD_BVALUES) {
 464                         existed = smbldap_talloc_single_blob(talloc_tos(), ldap_struct, existing, attribute, &oldblob);
 465                 } else {
 466                         existed = smbldap_get_single_attribute(ldap_struct, existing, attribute, oldval, sizeof(oldval));
 467                 }
 468         } else {
 469                 existed = False;
 470                 *oldval = '\0';
 471         }
 472
 473         if (existed) {
 474                 bool equal = false;
 475                 if (op & LDAP_MOD_BVALUES) {
 476                         equal = (newblob && (data_blob_cmp(&oldblob, newblob) == 0));
 477                 } else {
 478                         /* all of our string attributes are case insensitive */
 479                         equal = (newval && (strcasecmp_m(oldval, newval) == 0));
 480                 }
 481
 482                 if (equal) {
 483                         /* Believe it or not, but LDAP will deny a delete and
 484                            an add at the same time if the values are the
 485                            same... */
 486                         DEBUG(10,("smbldap_make_mod: attribute |%s| not changed.\n", attribute));
 487                         return;
 488                 }
 489
 490                 /* There has been no value before, so don't delete it.
 491                  * Here's a possible race: We might end up with
 492                  * duplicate attributes */
 493                 /* By deleting exactly the value we found in the entry this
 494                  * should be race-free in the sense that the LDAP-Server will
 495                  * deny the complete operation if somebody changed the
 496                  * attribute behind our back. */
 497                 /* This will also allow modifying single valued attributes
 498                  * in Novell NDS. In NDS you have to first remove attribute and then
 499                  * you could add new value */
 500
 501                 if (op & LDAP_MOD_BVALUES) {
 502                         DEBUG(10,("smbldap_make_mod: deleting attribute |%s| blob\n", attribute));
 503                         smbldap_set_mod_blob(mods, LDAP_MOD_DELETE, attribute, &oldblob);
 504                 } else {
 505                         DEBUG(10,("smbldap_make_mod: deleting attribute |%s| values |%s|\n", attribute, oldval));
 506                         smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, oldval);
 507                 }
 508         }
 509
 510         /* Regardless of the real operation (add or modify)
 511            we add the new value here. We rely on deleting
 512            the old value, should it exist. */
 513
 514         if (op & LDAP_MOD_BVALUES) {
 515                 if (newblob && newblob->length) {
 516                         DEBUG(10,("smbldap_make_mod: adding attribute |%s| blob\n", attribute));
 517                         smbldap_set_mod_blob(mods, LDAP_MOD_ADD, attribute, newblob);
 518                 }
 519         } else {
 520                 if ((newval != NULL) && (strlen(newval) > 0)) {
 521                         DEBUG(10,("smbldap_make_mod: adding attribute |%s| value |%s|\n", attribute, newval));
 522                         smbldap_set_mod(mods, LDAP_MOD_ADD, attribute, newval);
 523                 }
 524         }
 525 }
 526
 527  void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing,
 528                       LDAPMod ***mods,
 529                       const char *attribute, const char *newval)
 530 {
 531         smbldap_make_mod_internal(ldap_struct, existing, mods, attribute,
 532                                   0, newval, NULL);
 533 }
 534
 535  void smbldap_make_mod_blob(LDAP *ldap_struct, LDAPMessage *existing,
 536                             LDAPMod ***mods,
 537                             const char *attribute, const DATA_BLOB *newblob)
 538 {
 539         smbldap_make_mod_internal(ldap_struct, existing, mods, attribute,
 540                                   LDAP_MOD_BVALUES, NULL, newblob);
 541 }
 542
 543 /**********************************************************************
 544  Some varients of the LDAP rebind code do not pass in the third 'arg'
 545  pointer to a void*, so we try and work around it by assuming that the
 546  value of the 'LDAP *' pointer is the same as the one we had passed in
 547  **********************************************************************/
 548
 549 struct smbldap_state_lookup {
 550         LDAP *ld;
 551         struct smbldap_state *smbldap_state;
 552         struct smbldap_state_lookup *prev, *next;
 553 };
 554
 555 static struct smbldap_state_lookup *smbldap_state_lookup_list;
 556
 557 static struct smbldap_state *smbldap_find_state(LDAP *ld)
 558 {
 559         struct smbldap_state_lookup *t;
 560
 561         for (t = smbldap_state_lookup_list; t; t = t->next) {
 562                 if (t->ld == ld) {
 563                         return t->smbldap_state;
 564                 }
 565         }
 566         return NULL;
 567 }
 568
 569 static void smbldap_delete_state(struct smbldap_state *smbldap_state)
 570 {
 571         struct smbldap_state_lookup *t;
 572
 573         for (t = smbldap_state_lookup_list; t; t = t->next) {
 574                 if (t->smbldap_state == smbldap_state) {
 575                         DLIST_REMOVE(smbldap_state_lookup_list, t);
 576                         SAFE_FREE(t);
 577                         return;
 578                 }
 579         }
 580 }
 581
 582 static void smbldap_store_state(LDAP *ld, struct smbldap_state *smbldap_state)
 583 {
 584         struct smbldap_state *tmp_ldap_state;
 585         struct smbldap_state_lookup *t;
 586
 587         if ((tmp_ldap_state = smbldap_find_state(ld))) {
 588                 SMB_ASSERT(tmp_ldap_state == smbldap_state);
 589                 return;
 590         }
 591
 592         t = SMB_XMALLOC_P(struct smbldap_state_lookup);
 593         ZERO_STRUCTP(t);
 594
 595         DLIST_ADD_END(smbldap_state_lookup_list, t);
 596         t->ld = ld;
 597         t->smbldap_state = smbldap_state;
 598 }
 599
 600 /********************************************************************
 601  start TLS on an existing LDAP connection
 602 *******************************************************************/
 603
 604 int smbldap_start_tls(LDAP *ldap_struct, int version)
 605 {
 606 #ifdef LDAP_OPT_X_TLS
 607         int rc;
 608 #endif
 609
 610         if (lp_ldap_ssl() != LDAP_SSL_START_TLS) {
 611                 return LDAP_SUCCESS;
 612         }
 613
 614 #ifdef LDAP_OPT_X_TLS
 615         if (version != LDAP_VERSION3) {
 616                 DEBUG(0, ("Need LDAPv3 for Start TLS\n"));
 617                 return LDAP_OPERATIONS_ERROR;
 618         }
 619
 620         if ((rc = ldap_start_tls_s (ldap_struct, NULL, NULL)) != LDAP_SUCCESS)  {
 621                 DEBUG(0,("Failed to issue the StartTLS instruction: %s\n",
 622                          ldap_err2string(rc)));
 623                 return rc;
 624         }
 625
 626         DEBUG (3, ("StartTLS issued: using a TLS connection\n"));
 627         return LDAP_SUCCESS;
 628 #else
 629         DEBUG(0,("StartTLS not supported by LDAP client libraries!\n"));
 630         return LDAP_OPERATIONS_ERROR;
 631 #endif
 632 }
 633
 634 /********************************************************************
 635  setup a connection to the LDAP server based on a uri
 636 *******************************************************************/
 637
 638 static int smb_ldap_setup_conn(LDAP **ldap_struct, const char *uri)
 639 {
 640         int rc;
 641
 642         DEBUG(10, ("smb_ldap_setup_connection: %s\n", uri));
 643
 644 #ifdef HAVE_LDAP_INITIALIZE
 645
 646         rc = ldap_initialize(ldap_struct, uri);
 647         if (rc) {
 648                 DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc)));
 649                 return rc;
 650         }
 651
 652         if (lp_ldap_follow_referral() != Auto) {
 653                 rc = ldap_set_option(*ldap_struct, LDAP_OPT_REFERRALS,
 654                      lp_ldap_follow_referral() ? LDAP_OPT_ON : LDAP_OPT_OFF);
 655                 if (rc != LDAP_SUCCESS)
 656                         DEBUG(0, ("Failed to set LDAP_OPT_REFERRALS: %s\n",
 657                                 ldap_err2string(rc)));
 658         }
 659
 660         return LDAP_SUCCESS;
 661 #else
 662
 663         /* Parse the string manually */
 664
 665         {
 666                 int port = 0;
 667                 fstring protocol;
 668                 fstring host;
 669                 SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254);
 670
 671
 672                 /* skip leading "URL:" (if any) */
 673                 if ( strnequal( uri, "URL:", 4 ) ) {
 674                         uri += 4;
 675                 }
 676
 677                 sscanf(uri, "%10[^:]://%254[^:/]:%d", protocol, host, &port);
 678
 679                 if (port == 0) {
 680                         if (strequal(protocol, "ldap")) {
 681                                 port = LDAP_PORT;
 682                         } else if (strequal(protocol, "ldaps")) {
 683                                 port = LDAPS_PORT;
 684                         } else {
 685                                 DEBUG(0, ("unrecognised protocol (%s)!\n", protocol));
 686                         }
 687                 }
 688
 689                 if ((*ldap_struct = ldap_init(host, port)) == NULL)     {
 690                         DEBUG(0, ("ldap_init failed !\n"));
 691                         return LDAP_OPERATIONS_ERROR;
 692                 }
 693
 694                 if (strequal(protocol, "ldaps")) {
 695 #ifdef LDAP_OPT_X_TLS
 696                         int tls = LDAP_OPT_X_TLS_HARD;
 697                         if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
 698                         {
 699                                 DEBUG(0, ("Failed to setup a TLS session\n"));
 700                         }
 701
 702                         DEBUG(3,("LDAPS option set...!\n"));
 703 #else
 704                         DEBUG(0,("smbldap_open_connection: Secure connection not supported by LDAP client libraries!\n"));
 705                         return LDAP_OPERATIONS_ERROR;
 706 #endif /* LDAP_OPT_X_TLS */
 707                 }
 708         }
 709 #endif /* HAVE_LDAP_INITIALIZE */
 710
 711         /* now set connection timeout */
 712 #ifdef LDAP_X_OPT_CONNECT_TIMEOUT /* Netscape */
 713         {
 714                 int ct = lp_ldap_connection_timeout()*1000;
 715                 rc = ldap_set_option(*ldap_struct, LDAP_X_OPT_CONNECT_TIMEOUT, &ct);
 716                 if (rc != LDAP_SUCCESS) {
 717                         DEBUG(0,("Failed to setup an ldap connection timeout %d: %s\n",
 718                                 ct, ldap_err2string(rc)));
 719                 }
 720         }
 721 #elif defined (LDAP_OPT_NETWORK_TIMEOUT) /* OpenLDAP */
 722         {
 723                 struct timeval ct;
 724                 ct.tv_usec = 0;
 725                 ct.tv_sec = lp_ldap_connection_timeout();
 726                 rc = ldap_set_option(*ldap_struct, LDAP_OPT_NETWORK_TIMEOUT, &ct);
 727                 if (rc != LDAP_SUCCESS) {
 728                         DEBUG(0,("Failed to setup an ldap connection timeout %d: %s\n",
 729                                 (int)ct.tv_sec, ldap_err2string(rc)));
 730                 }
 731         }
 732 #endif
 733
 734         return LDAP_SUCCESS;
 735 }
 736
 737 /********************************************************************
 738  try to upgrade to Version 3 LDAP if not already, in either case return current
 739  version
 740  *******************************************************************/
 741
 742 static int smb_ldap_upgrade_conn(LDAP *ldap_struct, int *new_version)
 743 {
 744         int version;
 745         int rc;
 746
 747         /* assume the worst */
 748         *new_version = LDAP_VERSION2;
 749
 750         rc = ldap_get_option(ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
 751         if (rc) {
 752                 return rc;
 753         }
 754
 755         if (version == LDAP_VERSION3) {
 756                 *new_version = LDAP_VERSION3;
 757                 return LDAP_SUCCESS;
 758         }
 759
 760         /* try upgrade */
 761         version = LDAP_VERSION3;
 762         rc = ldap_set_option (ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
 763         if (rc) {
 764                 return rc;
 765         }
 766
 767         *new_version = LDAP_VERSION3;
 768         return LDAP_SUCCESS;
 769 }
 770
 771 /*******************************************************************
 772  open a connection to the ldap server (just until the bind)
 773  ******************************************************************/
 774
 775 int smbldap_setup_full_conn(LDAP **ldap_struct, const char *uri)
 776 {
 777         int rc, version;
 778
 779         rc = smb_ldap_setup_conn(ldap_struct, uri);
 780         if (rc) {
 781                 return rc;
 782         }
 783
 784         rc = smb_ldap_upgrade_conn(*ldap_struct, &version);
 785         if (rc) {
 786                 return rc;
 787         }
 788
 789         rc = smbldap_start_tls(*ldap_struct, version);
 790         if (rc) {
 791                 return rc;
 792         }
 793
 794         return LDAP_SUCCESS;
 795 }
 796
 797 /*******************************************************************
 798  open a connection to the ldap server.
 799 ******************************************************************/
 800 static int smbldap_open_connection (struct smbldap_state *ldap_state)
 801
 802 {
 803         int rc = LDAP_SUCCESS;
 804         int version;
 805         int deref;
 806         LDAP **ldap_struct = &ldap_state->ldap_struct;
 807
 808         rc = smb_ldap_setup_conn(ldap_struct, ldap_state->uri);
 809         if (rc) {
 810                 return rc;
 811         }
 812
 813         /* Store the LDAP pointer in a lookup list */
 814
 815         smbldap_store_state(*ldap_struct, ldap_state);
 816
 817         /* Upgrade to LDAPv3 if possible */
 818
 819         rc = smb_ldap_upgrade_conn(*ldap_struct, &version);
 820         if (rc) {
 821                 return rc;
 822         }
 823
 824         /* Start TLS if required */
 825
 826         rc = smbldap_start_tls(*ldap_struct, version);
 827         if (rc) {
 828                 return rc;
 829         }
 830
 831         /* Set alias dereferencing method */
 832         deref = lp_ldap_deref();
 833         if (deref != -1) {
 834                 if (ldap_set_option (*ldap_struct, LDAP_OPT_DEREF, &deref) != LDAP_OPT_SUCCESS) {
 835                         DEBUG(1,("smbldap_open_connection: Failed to set dereferencing method: %d\n", deref));
 836                 } else {
 837                         DEBUG(5,("Set dereferencing method: %d\n", deref));
 838                 }
 839         }
 840
 841         DEBUG(2, ("smbldap_open_connection: connection opened\n"));
 842         return rc;
 843 }
 844
 845 /*******************************************************************
 846  a rebind function for authenticated referrals
 847  This version takes a void* that we can shove useful stuff in :-)
 848 ******************************************************************/
 849 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
 850 #else
 851 static int rebindproc_with_state  (LDAP * ld, char **whop, char **credp,
 852                                    int *methodp, int freeit, void *arg)
 853 {
 854         struct smbldap_state *ldap_state = arg;
 855         struct timespec ts;
 856
 857         /** @TODO Should we be doing something to check what servers we rebind to?
 858             Could we get a referral to a machine that we don't want to give our
 859             username and password to? */
 860
 861         if (freeit) {
 862                 SAFE_FREE(*whop);
 863                 if (*credp) {
 864                         memset(*credp, '\0', strlen(*credp));
 865                 }
 866                 SAFE_FREE(*credp);
 867         } else {
 868                 DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",
 869                           ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
 870
 871                 if (ldap_state->anonymous) {
 872                         *whop = NULL;
 873                         *credp = NULL;
 874                 } else {
 875                         *whop = SMB_STRDUP(ldap_state->bind_dn);
 876                         if (!*whop) {
 877                                 return LDAP_NO_MEMORY;
 878                         }
 879                         *credp = SMB_STRDUP(ldap_state->bind_secret);
 880                         if (!*credp) {
 881                                 SAFE_FREE(*whop);
 882                                 return LDAP_NO_MEMORY;
 883                         }
 884                 }
 885                 *methodp = LDAP_AUTH_SIMPLE;
 886         }
 887
 888         clock_gettime_mono(&ts);
 889         ldap_state->last_rebind = convert_timespec_to_timeval(ts);
 890
 891         return 0;
 892 }
 893 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
 894
 895 /*******************************************************************
 896  a rebind function for authenticated referrals
 897  This version takes a void* that we can shove useful stuff in :-)
 898  and actually does the connection.
 899 ******************************************************************/
 900 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
 901 static int rebindproc_connect_with_state (LDAP *ldap_struct,
 902                                           LDAP_CONST char *url,
 903                                           ber_tag_t request,
 904                                           ber_int_t msgid, void *arg)
 905 {
 906         struct smbldap_state *ldap_state =
 907                 (struct smbldap_state *)arg;
 908         int rc;
 909         struct timespec ts;
 910         int version;
 911
 912         DEBUG(5,("rebindproc_connect_with_state: Rebinding to %s as \"%s\"\n",
 913                  url, ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
 914
 915         /* call START_TLS again (ldaps:// is handled by the OpenLDAP library
 916          * itself) before rebinding to another LDAP server to avoid to expose
 917          * our credentials. At least *try* to secure the connection - Guenther */
 918
 919         smb_ldap_upgrade_conn(ldap_struct, &version);
 920         smbldap_start_tls(ldap_struct, version);
 921
 922         /** @TODO Should we be doing something to check what servers we rebind to?
 923             Could we get a referral to a machine that we don't want to give our
 924             username and password to? */
 925
 926         rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
 927
 928         /* only set the last rebind timestamp when we did rebind after a
 929          * non-read LDAP operation. That way we avoid the replication sleep
 930          * after a simple redirected search operation - Guenther */
 931
 932         switch (request) {
 933
 934                 case LDAP_REQ_MODIFY:
 935                 case LDAP_REQ_ADD:
 936                 case LDAP_REQ_DELETE:
 937                 case LDAP_REQ_MODDN:
 938                 case LDAP_REQ_EXTENDED:
 939                         DEBUG(10,("rebindproc_connect_with_state: "
 940                                 "setting last_rebind timestamp "
 941                                 "(req: 0x%02x)\n", (unsigned int)request));
 942                         clock_gettime_mono(&ts);
 943                         ldap_state->last_rebind = convert_timespec_to_timeval(ts);
 944                         break;
 945                 default:
 946                         ZERO_STRUCT(ldap_state->last_rebind);
 947                         break;
 948         }
 949
 950         return rc;
 951 }
 952 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
 953
 954 /*******************************************************************
 955  Add a rebind function for authenticated referrals
 956 ******************************************************************/
 957 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
 958 #else
 959 # if LDAP_SET_REBIND_PROC_ARGS == 2
 960 static int rebindproc (LDAP *ldap_struct, char **whop, char **credp,
 961                        int *method, int freeit )
 962 {
 963         struct smbldap_state *ldap_state = smbldap_find_state(ldap_struct);
 964
 965         return rebindproc_with_state(ldap_struct, whop, credp,
 966                                      method, freeit, ldap_state);
 967 }
 968 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
 969 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
 970
 971 /*******************************************************************
 972  a rebind function for authenticated referrals
 973  this also does the connection, but no void*.
 974 ******************************************************************/
 975 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
 976 # if LDAP_SET_REBIND_PROC_ARGS == 2
 977 static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request,
 978                                ber_int_t msgid)
 979 {
 980         struct smbldap_state *ldap_state = smbldap_find_state(ld);
 981
 982         return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid,
 983                                              ldap_state);
 984 }
 985 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
 986 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
 987
 988 /*******************************************************************
 989  connect to the ldap server under system privilege.
 990 ******************************************************************/
 991 static int smbldap_connect_system(struct smbldap_state *ldap_state)
 992 {
 993         LDAP *ldap_struct = smbldap_get_ldap(ldap_state);
 994         int rc;
 995         int version;
 996
 997         /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite
 998            (OpenLDAP) doesn't seem to support it */
 999
1000         DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n",
1001                   ldap_state->uri, ldap_state->bind_dn));
1002
1003 #ifdef HAVE_LDAP_SET_REBIND_PROC
1004 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
1005 # if LDAP_SET_REBIND_PROC_ARGS == 2
1006         ldap_set_rebind_proc(ldap_struct, &rebindproc_connect);
1007 # endif
1008 # if LDAP_SET_REBIND_PROC_ARGS == 3
1009         ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state);
1010 # endif
1011 #else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
1012 # if LDAP_SET_REBIND_PROC_ARGS == 2
1013         ldap_set_rebind_proc(ldap_struct, &rebindproc);
1014 # endif
1015 # if LDAP_SET_REBIND_PROC_ARGS == 3
1016         ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state);
1017 # endif
1018 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
1019 #endif
1020
1021         /* When there is an alternative bind callback is set,
1022            attempt to use it to perform the bind */
1023         if (ldap_state->bind_callback != NULL) {
1024                 /* We have to allow bind callback to be run under become_root/unbecome_root
1025                    to make sure within smbd the callback has proper write access to its resources,
1026                    like credential cache. This is similar to passdb case where this callback is supposed
1027                    to be used. When used outside smbd, become_root()/unbecome_root() are no-op.
1028                 */
1029                 become_root();
1030                 rc = ldap_state->bind_callback(ldap_struct, ldap_state, ldap_state->bind_callback_data);
1031                 unbecome_root();
1032         } else {
1033                 rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
1034         }
1035
1036         if (rc != LDAP_SUCCESS) {
1037                 char *ld_error = NULL;
1038                 ldap_get_option(smbldap_get_ldap(ldap_state),
1039                                 LDAP_OPT_ERROR_STRING,
1040                                 &ld_error);
1041                 DEBUG(ldap_state->num_failures ? 2 : 0,
1042                       ("failed to bind to server %s with dn=\"%s\" Error: %s\n\t%s\n",
1043                                ldap_state->uri,
1044                                ldap_state->bind_dn ? ldap_state->bind_dn : "[Anonymous bind]",
1045                                ldap_err2string(rc),
1046                                ld_error ? ld_error : "(unknown)"));
1047                 SAFE_FREE(ld_error);
1048                 ldap_state->num_failures++;
1049                 goto done;
1050         }
1051
1052         ldap_state->num_failures = 0;
1053         ldap_state->paged_results = False;
1054
1055         ldap_get_option(smbldap_get_ldap(ldap_state),
1056                         LDAP_OPT_PROTOCOL_VERSION, &version);
1057
1058         if (smbldap_has_control(smbldap_get_ldap(ldap_state), ADS_PAGE_CTL_OID)
1059             && version == 3) {
1060                 ldap_state->paged_results = True;
1061         }
1062
1063         DEBUG(3, ("ldap_connect_system: successful connection to the LDAP server\n"));
1064         DEBUGADD(10, ("ldap_connect_system: LDAP server %s support paged results\n",
1065                 ldap_state->paged_results ? "does" : "does not"));
1066 done:
1067         if (rc != 0) {
1068                 ldap_unbind(ldap_struct);
1069                 ldap_state->ldap_struct = NULL;
1070         }
1071         return rc;
1072 }
1073
1074 static void smbldap_idle_fn(struct tevent_context *tevent_ctx,
1075                             struct tevent_timer *te,
1076                             struct timeval now_abs,
1077                             void *private_data);
1078
1079 /**********************************************************************
1080  Connect to LDAP server (called before every ldap operation)
1081 *********************************************************************/
1082 static int smbldap_open(struct smbldap_state *ldap_state)
1083 {
1084         int rc, opt_rc;
1085         bool reopen = False;
1086         SMB_ASSERT(ldap_state);
1087
1088         if ((smbldap_get_ldap(ldap_state) != NULL) &&
1089             ((ldap_state->last_ping + SMBLDAP_DONT_PING_TIME) <
1090              time_mono(NULL))) {
1091
1092 #ifdef HAVE_UNIXSOCKET
1093                 struct sockaddr_un addr;
1094 #else
1095                 struct sockaddr_storage addr;
1096 #endif
1097                 socklen_t len = sizeof(addr);
1098                 int sd;
1099
1100                 opt_rc = ldap_get_option(smbldap_get_ldap(ldap_state),
1101                                          LDAP_OPT_DESC, &sd);
1102                 if (opt_rc == 0 && (getpeername(sd, (struct sockaddr *) &addr, &len)) < 0 )
1103                         reopen = True;
1104
1105 #ifdef HAVE_UNIXSOCKET
1106                 if (opt_rc == 0 && addr.sun_family == AF_UNIX)
1107                         reopen = True;
1108 #endif
1109                 if (reopen) {
1110                         /* the other end has died. reopen. */
1111                         ldap_unbind(smbldap_get_ldap(ldap_state));
1112                         ldap_state->ldap_struct = NULL;
1113                         ldap_state->last_ping = (time_t)0;
1114                 } else {
1115                         ldap_state->last_ping = time_mono(NULL);
1116                 }
1117         }
1118
1119         if (smbldap_get_ldap(ldap_state) != NULL) {
1120                 DEBUG(11,("smbldap_open: already connected to the LDAP server\n"));
1121                 return LDAP_SUCCESS;
1122         }
1123
1124         if ((rc = smbldap_open_connection(ldap_state))) {
1125                 return rc;
1126         }
1127
1128         if ((rc = smbldap_connect_system(ldap_state))) {
1129                 return rc;
1130         }
1131
1132
1133         ldap_state->last_ping = time_mono(NULL);
1134         ldap_state->pid = getpid();
1135
1136         TALLOC_FREE(ldap_state->idle_event);
1137
1138         if (ldap_state->tevent_context != NULL) {
1139                 ldap_state->idle_event = tevent_add_timer(
1140                         ldap_state->tevent_context, ldap_state,
1141                         timeval_current_ofs(SMBLDAP_IDLE_TIME, 0),
1142                         smbldap_idle_fn, ldap_state);
1143         }
1144
1145         DEBUG(4,("The LDAP server is successfully connected\n"));
1146
1147         return LDAP_SUCCESS;
1148 }
1149
1150 /**********************************************************************
1151 Disconnect from LDAP server
1152 *********************************************************************/
1153 static NTSTATUS smbldap_close(struct smbldap_state *ldap_state)
1154 {
1155         if (!ldap_state)
1156                 return NT_STATUS_INVALID_PARAMETER;
1157
1158         if (smbldap_get_ldap(ldap_state) != NULL) {
1159                 ldap_unbind(smbldap_get_ldap(ldap_state));
1160                 ldap_state->ldap_struct = NULL;
1161         }
1162
1163         smbldap_delete_state(ldap_state);
1164
1165         TALLOC_FREE(ldap_state->idle_event);
1166
1167         DEBUG(5,("The connection to the LDAP server was closed\n"));
1168         /* maybe free the results here --metze */
1169
1170         return NT_STATUS_OK;
1171 }
1172
1173 static SIG_ATOMIC_T got_alarm;
1174
1175 static void gotalarm_sig(int dummy)
1176 {
1177         got_alarm = 1;
1178 }
1179
1180 static time_t calc_ldap_abs_endtime(int ldap_to)
1181 {
1182         if (ldap_to == 0) {
1183                 /* No timeout - don't
1184                    return a value for
1185                    the alarm. */
1186                 return (time_t)0;
1187         }
1188
1189         /* Make the alarm time one second beyond
1190            the timout we're setting for the
1191            remote search timeout, to allow that
1192            to fire in preference. */
1193
1194         return time_mono(NULL)+ldap_to+1;
1195 }
1196
1197 static int end_ldap_local_alarm(time_t absolute_endtime, int rc)
1198 {
1199         if (absolute_endtime) {
1200                 alarm(0);
1201                 CatchSignal(SIGALRM, SIG_IGN);
1202                 if (got_alarm) {
1203                         /* Client timeout error code. */
1204                         got_alarm = 0;
1205                         return LDAP_TIMEOUT;
1206                 }
1207         }
1208         return rc;
1209 }
1210
1211 static void setup_ldap_local_alarm(struct smbldap_state *ldap_state, time_t absolute_endtime)
1212 {
1213         time_t now = time_mono(NULL);
1214
1215         if (absolute_endtime) {
1216                 got_alarm = 0;
1217                 CatchSignal(SIGALRM, gotalarm_sig);
1218                 alarm(absolute_endtime - now);
1219         }
1220
1221         if (ldap_state->pid != getpid()) {
1222                 smbldap_close(ldap_state);
1223         }
1224 }
1225
1226 static void get_ldap_errs(struct smbldap_state *ldap_state, char **pp_ld_error, int *p_ld_errno)
1227 {
1228         ldap_get_option(smbldap_get_ldap(ldap_state),
1229                         LDAP_OPT_ERROR_NUMBER, p_ld_errno);
1230
1231         ldap_get_option(smbldap_get_ldap(ldap_state),
1232                         LDAP_OPT_ERROR_STRING, pp_ld_error);
1233 }
1234
1235 static int get_cached_ldap_connect(struct smbldap_state *ldap_state, time_t abs_endtime)
1236 {
1237         int attempts = 0;
1238
1239         while (1) {
1240                 int rc;
1241                 time_t now;
1242
1243                 now = time_mono(NULL);
1244                 ldap_state->last_use = now;
1245
1246                 if (abs_endtime && now > abs_endtime) {
1247                         smbldap_close(ldap_state);
1248                         return LDAP_TIMEOUT;
1249                 }
1250
1251                 rc = smbldap_open(ldap_state);
1252
1253                 if (rc == LDAP_SUCCESS) {
1254                         return LDAP_SUCCESS;
1255                 }
1256
1257                 attempts++;
1258                 DEBUG(1, ("Connection to LDAP server failed for the "
1259                         "%d try!\n", attempts));
1260
1261                 if (rc == LDAP_INSUFFICIENT_ACCESS) {
1262                         /* The fact that we are non-root or any other
1263                          * access-denied condition will not change in the next
1264                          * round of trying */
1265                         return rc;
1266                 }
1267
1268                 if (got_alarm) {
1269                         smbldap_close(ldap_state);
1270                         return LDAP_TIMEOUT;
1271                 }
1272
1273                 smb_msleep(1000);
1274
1275                 if (got_alarm) {
1276                         smbldap_close(ldap_state);
1277                         return LDAP_TIMEOUT;
1278                 }
1279         }
1280 }
1281
1282 /*********************************************************************
1283  ********************************************************************/
1284
1285 static int smbldap_search_ext(struct smbldap_state *ldap_state,
1286                               const char *base, int scope, const char *filter,
1287                               const char *attrs[], int attrsonly,
1288                               LDAPControl **sctrls, LDAPControl **cctrls,
1289                               int sizelimit, LDAPMessage **res)
1290 {
1291         int             rc = LDAP_SERVER_DOWN;
1292         char           *utf8_filter;
1293         int             to = lp_ldap_timeout();
1294         time_t          abs_endtime = calc_ldap_abs_endtime(to);
1295         struct          timeval timeout;
1296         struct          timeval *timeout_ptr = NULL;
1297         size_t          converted_size;
1298
1299         SMB_ASSERT(ldap_state);
1300
1301         DEBUG(5,("smbldap_search_ext: base => [%s], filter => [%s], "
1302                  "scope => [%d]\n", base, filter, scope));
1303
1304         if (ldap_state->last_rebind.tv_sec > 0) {
1305                 struct timeval  tval;
1306                 struct timespec ts;
1307                 int64_t tdiff = 0;
1308                 int             sleep_time = 0;
1309
1310                 clock_gettime_mono(&ts);
1311                 tval = convert_timespec_to_timeval(ts);
1312
1313                 tdiff = usec_time_diff(&tval, &ldap_state->last_rebind);
1314                 tdiff /= 1000; /* Convert to milliseconds. */
1315
1316                 sleep_time = lp_ldap_replication_sleep()-(int)tdiff;
1317                 sleep_time = MIN(sleep_time, MAX_LDAP_REPLICATION_SLEEP_TIME);
1318
1319                 if (sleep_time > 0) {
1320                         /* we wait for the LDAP replication */
1321                         DEBUG(5,("smbldap_search_ext: waiting %d milliseconds "
1322                                  "for LDAP replication.\n",sleep_time));
1323                         smb_msleep(sleep_time);
1324                         DEBUG(5,("smbldap_search_ext: go on!\n"));
1325                 }
1326                 ZERO_STRUCT(ldap_state->last_rebind);
1327         }
1328
1329         if (!push_utf8_talloc(talloc_tos(), &utf8_filter, filter, &converted_size)) {
1330                 return LDAP_NO_MEMORY;
1331         }
1332
1333         /* Setup remote timeout for the ldap_search_ext_s call. */
1334         if (to) {
1335                 timeout.tv_sec = to;
1336                 timeout.tv_usec = 0;
1337                 timeout_ptr = &timeout;
1338         }
1339
1340         setup_ldap_local_alarm(ldap_state, abs_endtime);
1341
1342         while (1) {
1343                 char *ld_error = NULL;
1344                 int ld_errno;
1345
1346                 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1347                 if (rc != LDAP_SUCCESS) {
1348                         break;
1349                 }
1350
1351                 rc = ldap_search_ext_s(smbldap_get_ldap(ldap_state),
1352                                        base, scope,
1353                                        utf8_filter,
1354                                        discard_const_p(char *, attrs),
1355                                        attrsonly, sctrls, cctrls, timeout_ptr,
1356                                        sizelimit, res);
1357                 if (rc == LDAP_SUCCESS) {
1358                         break;
1359                 }
1360
1361                 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1362
1363                 DEBUG(10, ("Failed search for base: %s, error: %d (%s) "
1364                            "(%s)\n", base, ld_errno,
1365                            ldap_err2string(rc),
1366                            ld_error ? ld_error : "unknown"));
1367                 SAFE_FREE(ld_error);
1368
1369                 if (ld_errno != LDAP_SERVER_DOWN) {
1370                         break;
1371                 }
1372                 ldap_unbind(smbldap_get_ldap(ldap_state));
1373                 ldap_state->ldap_struct = NULL;
1374         }
1375
1376         TALLOC_FREE(utf8_filter);
1377         return end_ldap_local_alarm(abs_endtime, rc);
1378 }
1379
1380 int smbldap_search(struct smbldap_state *ldap_state,
1381                    const char *base, int scope, const char *filter,
1382                    const char *attrs[], int attrsonly,
1383                    LDAPMessage **res)
1384 {
1385         return smbldap_search_ext(ldap_state, base, scope, filter, attrs,
1386                                   attrsonly, NULL, NULL, LDAP_NO_LIMIT, res);
1387 }
1388
1389 int smbldap_search_paged(struct smbldap_state *ldap_state,
1390                          const char *base, int scope, const char *filter,
1391                          const char **attrs, int attrsonly, int pagesize,
1392                          LDAPMessage **res, void **cookie)
1393 {
1394         LDAPControl     pr;
1395         LDAPControl     **rcontrols;
1396         LDAPControl     *controls[2] = { NULL, NULL};
1397         BerElement      *cookie_be = NULL;
1398         struct berval   *cookie_bv = NULL;
1399         int             tmp = 0, i, rc;
1400         bool            critical = True;
1401
1402         *res = NULL;
1403
1404         DEBUG(3,("smbldap_search_paged: base => [%s], filter => [%s],"
1405                  "scope => [%d], pagesize => [%d]\n",
1406                  base, filter, scope, pagesize));
1407
1408         cookie_be = ber_alloc_t(LBER_USE_DER);
1409         if (cookie_be == NULL) {
1410                 DEBUG(0,("smbldap_create_page_control: ber_alloc_t returns "
1411                          "NULL\n"));
1412                 return LDAP_NO_MEMORY;
1413         }
1414
1415         /* construct cookie */
1416         if (*cookie != NULL) {
1417                 ber_printf(cookie_be, "{iO}", (ber_int_t) pagesize, *cookie);
1418                 ber_bvfree((struct berval *)*cookie); /* don't need it from last time */
1419                 *cookie = NULL;
1420         } else {
1421                 ber_printf(cookie_be, "{io}", (ber_int_t) pagesize, "", 0);
1422         }
1423         ber_flatten(cookie_be, &cookie_bv);
1424
1425         pr.ldctl_oid = discard_const_p(char, ADS_PAGE_CTL_OID);
1426         pr.ldctl_iscritical = (char) critical;
1427         pr.ldctl_value.bv_len = cookie_bv->bv_len;
1428         pr.ldctl_value.bv_val = cookie_bv->bv_val;
1429
1430         controls[0] = &pr;
1431         controls[1] = NULL;
1432
1433         rc = smbldap_search_ext(ldap_state, base, scope, filter, attrs,
1434                                  0, controls, NULL, LDAP_NO_LIMIT, res);
1435
1436         ber_free(cookie_be, 1);
1437         ber_bvfree(cookie_bv);
1438
1439         if (rc != 0) {
1440                 DEBUG(3,("smbldap_search_paged: smbldap_search_ext(%s) "
1441                          "failed with [%s]\n", filter, ldap_err2string(rc)));
1442                 goto done;
1443         }
1444
1445         DEBUG(3,("smbldap_search_paged: search was successful\n"));
1446
1447         rc = ldap_parse_result(smbldap_get_ldap(ldap_state), *res, NULL, NULL,
1448                                NULL, NULL, &rcontrols,  0);
1449         if (rc != 0) {
1450                 DEBUG(3,("smbldap_search_paged: ldap_parse_result failed " \
1451                          "with [%s]\n", ldap_err2string(rc)));
1452                 goto done;
1453         }
1454
1455         if (rcontrols == NULL)
1456                 goto done;
1457
1458         for (i=0; rcontrols[i]; i++) {
1459
1460                 if (strcmp(ADS_PAGE_CTL_OID, rcontrols[i]->ldctl_oid) != 0)
1461                         continue;
1462
1463                 cookie_be = ber_init(&rcontrols[i]->ldctl_value);
1464                 ber_scanf(cookie_be,"{iO}", &tmp, &cookie_bv);
1465                 /* the berval is the cookie, but must be freed when it is all
1466                    done */
1467                 if (cookie_bv->bv_len)
1468                         *cookie=ber_bvdup(cookie_bv);
1469                 else
1470                         *cookie=NULL;
1471                 ber_bvfree(cookie_bv);
1472                 ber_free(cookie_be, 1);
1473                 break;
1474         }
1475         ldap_controls_free(rcontrols);
1476 done:
1477         return rc;
1478 }
1479
1480 int smbldap_modify(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[])
1481 {
1482         int             rc = LDAP_SERVER_DOWN;
1483         char           *utf8_dn;
1484         time_t          abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1485         size_t          converted_size;
1486
1487         SMB_ASSERT(ldap_state);
1488
1489         DEBUG(5,("smbldap_modify: dn => [%s]\n", dn ));
1490
1491         if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1492                 return LDAP_NO_MEMORY;
1493         }
1494
1495         setup_ldap_local_alarm(ldap_state, abs_endtime);
1496
1497         while (1) {
1498                 char *ld_error = NULL;
1499                 int ld_errno;
1500
1501                 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1502                 if (rc != LDAP_SUCCESS) {
1503                         break;
1504                 }
1505
1506                 rc = ldap_modify_s(smbldap_get_ldap(ldap_state), utf8_dn,
1507                                    attrs);
1508                 if (rc == LDAP_SUCCESS) {
1509                         break;
1510                 }
1511
1512                 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1513
1514                 DEBUG(10, ("Failed to modify dn: %s, error: %d (%s) "
1515                            "(%s)\n", dn, ld_errno,
1516                            ldap_err2string(rc),
1517                            ld_error ? ld_error : "unknown"));
1518                 SAFE_FREE(ld_error);
1519
1520                 if (ld_errno != LDAP_SERVER_DOWN) {
1521                         break;
1522                 }
1523                 ldap_unbind(smbldap_get_ldap(ldap_state));
1524                 ldap_state->ldap_struct = NULL;
1525         }
1526
1527         TALLOC_FREE(utf8_dn);
1528         return end_ldap_local_alarm(abs_endtime, rc);
1529 }
1530
1531 int smbldap_add(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[])
1532 {
1533         int             rc = LDAP_SERVER_DOWN;
1534         char           *utf8_dn;
1535         time_t          abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1536         size_t          converted_size;
1537
1538         SMB_ASSERT(ldap_state);
1539
1540         DEBUG(5,("smbldap_add: dn => [%s]\n", dn ));
1541
1542         if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1543                 return LDAP_NO_MEMORY;
1544         }
1545
1546         setup_ldap_local_alarm(ldap_state, abs_endtime);
1547
1548         while (1) {
1549                 char *ld_error = NULL;
1550                 int ld_errno;
1551
1552                 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1553                 if (rc != LDAP_SUCCESS) {
1554                         break;
1555                 }
1556
1557                 rc = ldap_add_s(smbldap_get_ldap(ldap_state), utf8_dn, attrs);
1558                 if (rc == LDAP_SUCCESS) {
1559                         break;
1560                 }
1561
1562                 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1563
1564                 DEBUG(10, ("Failed to add dn: %s, error: %d (%s) "
1565                            "(%s)\n", dn, ld_errno,
1566                            ldap_err2string(rc),
1567                            ld_error ? ld_error : "unknown"));
1568                 SAFE_FREE(ld_error);
1569
1570                 if (ld_errno != LDAP_SERVER_DOWN) {
1571                         break;
1572                 }
1573                 ldap_unbind(smbldap_get_ldap(ldap_state));
1574                 ldap_state->ldap_struct = NULL;
1575         }
1576
1577         TALLOC_FREE(utf8_dn);
1578         return end_ldap_local_alarm(abs_endtime, rc);
1579 }
1580
1581 int smbldap_delete(struct smbldap_state *ldap_state, const char *dn)
1582 {
1583         int             rc = LDAP_SERVER_DOWN;
1584         char           *utf8_dn;
1585         time_t          abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1586         size_t          converted_size;
1587
1588         SMB_ASSERT(ldap_state);
1589
1590         DEBUG(5,("smbldap_delete: dn => [%s]\n", dn ));
1591
1592         if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1593                 return LDAP_NO_MEMORY;
1594         }
1595
1596         setup_ldap_local_alarm(ldap_state, abs_endtime);
1597
1598         while (1) {
1599                 char *ld_error = NULL;
1600                 int ld_errno;
1601
1602                 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1603                 if (rc != LDAP_SUCCESS) {
1604                         break;
1605                 }
1606
1607                 rc = ldap_delete_s(smbldap_get_ldap(ldap_state), utf8_dn);
1608                 if (rc == LDAP_SUCCESS) {
1609                         break;
1610                 }
1611
1612                 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1613
1614                 DEBUG(10, ("Failed to delete dn: %s, error: %d (%s) "
1615                            "(%s)\n", dn, ld_errno,
1616                            ldap_err2string(rc),
1617                            ld_error ? ld_error : "unknown"));
1618                 SAFE_FREE(ld_error);
1619
1620                 if (ld_errno != LDAP_SERVER_DOWN) {
1621                         break;
1622                 }
1623                 ldap_unbind(smbldap_get_ldap(ldap_state));
1624                 ldap_state->ldap_struct = NULL;
1625         }
1626
1627         TALLOC_FREE(utf8_dn);
1628         return end_ldap_local_alarm(abs_endtime, rc);
1629 }
1630
1631 int smbldap_extended_operation(struct smbldap_state *ldap_state,
1632                                LDAP_CONST char *reqoid, struct berval *reqdata,
1633                                LDAPControl **serverctrls, LDAPControl **clientctrls,
1634                                char **retoidp, struct berval **retdatap)
1635 {
1636         int             rc = LDAP_SERVER_DOWN;
1637         time_t          abs_endtime = calc_ldap_abs_endtime(lp_ldap_timeout());
1638
1639         if (!ldap_state)
1640                 return (-1);
1641
1642         setup_ldap_local_alarm(ldap_state, abs_endtime);
1643
1644         while (1) {
1645                 char *ld_error = NULL;
1646                 int ld_errno;
1647
1648                 rc = get_cached_ldap_connect(ldap_state, abs_endtime);
1649                 if (rc != LDAP_SUCCESS) {
1650                         break;
1651                 }
1652
1653                 rc = ldap_extended_operation_s(smbldap_get_ldap(ldap_state),
1654                                                reqoid,
1655                                                reqdata, serverctrls,
1656                                                clientctrls, retoidp, retdatap);
1657                 if (rc == LDAP_SUCCESS) {
1658                         break;
1659                 }
1660
1661                 get_ldap_errs(ldap_state, &ld_error, &ld_errno);
1662
1663                 DEBUG(10, ("Extended operation failed with error: "
1664                            "%d (%s) (%s)\n", ld_errno,
1665                            ldap_err2string(rc),
1666                            ld_error ? ld_error : "unknown"));
1667                 SAFE_FREE(ld_error);
1668
1669                 if (ld_errno != LDAP_SERVER_DOWN) {
1670                         break;
1671                 }
1672                 ldap_unbind(smbldap_get_ldap(ldap_state));
1673                 ldap_state->ldap_struct = NULL;
1674         }
1675
1676         return end_ldap_local_alarm(abs_endtime, rc);
1677 }
1678
1679 /*******************************************************************
1680  run the search by name.
1681 ******************************************************************/
1682 int smbldap_search_suffix (struct smbldap_state *ldap_state,
1683                            const char *filter, const char **search_attr,
1684                            LDAPMessage ** result)
1685 {
1686         return smbldap_search(ldap_state, lp_ldap_suffix(talloc_tos()),
1687                               LDAP_SCOPE_SUBTREE,
1688                               filter, search_attr, 0, result);
1689 }
1690
1691 static void smbldap_idle_fn(struct tevent_context *tevent_ctx,
1692                             struct tevent_timer *te,
1693                             struct timeval now_abs,
1694                             void *private_data)
1695 {
1696         struct smbldap_state *state = (struct smbldap_state *)private_data;
1697
1698         TALLOC_FREE(state->idle_event);
1699
1700         if (smbldap_get_ldap(state) == NULL) {
1701                 DEBUG(10,("ldap connection not connected...\n"));
1702                 return;
1703         }
1704
1705         if ((state->last_use+SMBLDAP_IDLE_TIME) > time_mono(NULL)) {
1706                 DEBUG(10,("ldap connection not idle...\n"));
1707
1708                 /* this needs to be made monotonic clock aware inside tevent: */
1709                 state->idle_event = tevent_add_timer(
1710                         tevent_ctx, state,
1711                         timeval_add(&now_abs, SMBLDAP_IDLE_TIME, 0),
1712                         smbldap_idle_fn,
1713                         private_data);
1714                 return;
1715         }
1716
1717         DEBUG(7,("ldap connection idle...closing connection\n"));
1718         smbldap_close(state);
1719 }
1720
1721 /**********************************************************************
1722  Housekeeping
1723  *********************************************************************/
1724
1725 void smbldap_free_struct(struct smbldap_state **ldap_state)
1726 {
1727         smbldap_close(*ldap_state);
1728
1729         if ((*ldap_state)->bind_secret) {
1730                 memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret));
1731         }
1732
1733         SAFE_FREE((*ldap_state)->bind_dn);
1734         SAFE_FREE((*ldap_state)->bind_secret);
1735         smbldap_set_bind_callback(*ldap_state, NULL, NULL);
1736
1737         TALLOC_FREE(*ldap_state);
1738
1739         /* No need to free any further, as it is talloc()ed */
1740 }
1741
1742 static int smbldap_state_destructor(struct smbldap_state *state)
1743 {
1744         smbldap_free_struct(&state);
1745         return 0;
1746 }
1747
1748
1749 /**********************************************************************
1750  Intitalise the 'general' ldap structures, on which ldap operations may be conducted
1751  *********************************************************************/
1752
1753 NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, struct tevent_context *tevent_ctx,
1754                       const char *location,
1755                       bool anon,
1756                       const char *bind_dn,
1757                       const char *bind_secret,
1758                       struct smbldap_state **smbldap_state)
1759 {
1760         *smbldap_state = talloc_zero(mem_ctx, struct smbldap_state);
1761         if (!*smbldap_state) {
1762                 DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));
1763                 return NT_STATUS_NO_MEMORY;
1764         }
1765
1766         if (location) {
1767                 (*smbldap_state)->uri = talloc_strdup(mem_ctx, location);
1768         } else {
1769                 (*smbldap_state)->uri = "ldap://localhost";
1770         }
1771
1772         (*smbldap_state)->tevent_context = tevent_ctx;
1773
1774         if (bind_dn && bind_secret) {
1775                 smbldap_set_creds(*smbldap_state, anon, bind_dn, bind_secret);
1776         }
1777
1778         talloc_set_destructor(*smbldap_state, smbldap_state_destructor);
1779         return NT_STATUS_OK;
1780 }
1781
1782  char *smbldap_talloc_dn(TALLOC_CTX *mem_ctx, LDAP *ld,
1783                          LDAPMessage *entry)
1784 {
1785         char *utf8_dn, *unix_dn;
1786         size_t converted_size;
1787
1788         utf8_dn = ldap_get_dn(ld, entry);
1789         if (!utf8_dn) {
1790                 DEBUG (5, ("smbldap_talloc_dn: ldap_get_dn failed\n"));
1791                 return NULL;
1792         }
1793         if (!pull_utf8_talloc(mem_ctx, &unix_dn, utf8_dn, &converted_size)) {
1794                 DEBUG (0, ("smbldap_talloc_dn: String conversion failure utf8 "
1795                            "[%s]\n", utf8_dn));
1796                 return NULL;
1797         }
1798         ldap_memfree(utf8_dn);
1799         return unix_dn;
1800 }
1801
1802 /*******************************************************************
1803  Check if root-dse has a certain Control or Extension
1804 ********************************************************************/
1805
1806 static bool smbldap_check_root_dse(LDAP *ld, const char **attrs, const char *value)
1807 {
1808         LDAPMessage *msg = NULL;
1809         LDAPMessage *entry = NULL;
1810         char **values = NULL;
1811         int rc, num_result, num_values, i;
1812         bool result = False;
1813
1814         if (!attrs[0]) {
1815                 DEBUG(3,("smbldap_check_root_dse: nothing to look for\n"));
1816                 return False;
1817         }
1818
1819         if (!strequal(attrs[0], "supportedExtension") &&
1820             !strequal(attrs[0], "supportedControl") &&
1821             !strequal(attrs[0], "namingContexts")) {
1822                 DEBUG(3,("smbldap_check_root_dse: no idea what to query root-dse for: %s ?\n", attrs[0]));
1823                 return False;
1824         }
1825
1826         rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE,
1827                            "(objectclass=*)", discard_const_p(char *, attrs), 0 , &msg);
1828
1829         if (rc != LDAP_SUCCESS) {
1830                 DEBUG(3,("smbldap_check_root_dse: Could not search rootDSE\n"));
1831                 return False;
1832         }
1833
1834         num_result = ldap_count_entries(ld, msg);
1835
1836         if (num_result != 1) {
1837                 DEBUG(3,("smbldap_check_root_dse: Expected one rootDSE, got %d\n", num_result));
1838                 goto done;
1839         }
1840
1841         entry = ldap_first_entry(ld, msg);
1842
1843         if (entry == NULL) {
1844                 DEBUG(3,("smbldap_check_root_dse: Could not retrieve rootDSE\n"));
1845                 goto done;
1846         }
1847
1848         values = ldap_get_values(ld, entry, attrs[0]);
1849
1850         if (values == NULL) {
1851                 DEBUG(5,("smbldap_check_root_dse: LDAP Server does not support any %s\n", attrs[0]));
1852                 goto done;
1853         }
1854
1855         num_values = ldap_count_values(values);
1856
1857         if (num_values == 0) {
1858                 DEBUG(5,("smbldap_check_root_dse: LDAP Server does not have any %s\n", attrs[0]));
1859                 goto done;
1860         }
1861
1862         for (i=0; i<num_values; i++) {
1863                 if (strcmp(values[i], value) == 0)
1864                         result = True;
1865         }
1866
1867
1868  done:
1869         if (values != NULL)
1870                 ldap_value_free(values);
1871         if (msg != NULL)
1872                 ldap_msgfree(msg);
1873
1874         return result;
1875
1876 }
1877
1878 /*******************************************************************
1879  Check if LDAP-Server supports a certain Control (OID in string format)
1880 ********************************************************************/
1881
1882 bool smbldap_has_control(LDAP *ld, const char *control)
1883 {
1884         const char *attrs[] = { "supportedControl", NULL };
1885         return smbldap_check_root_dse(ld, attrs, control);
1886 }
1887
1888 /*******************************************************************
1889  Check if LDAP-Server supports a certain Extension (OID in string format)
1890 ********************************************************************/
1891
1892 bool smbldap_has_extension(LDAP *ld, const char *extension)
1893 {
1894         const char *attrs[] = { "supportedExtension", NULL };
1895         return smbldap_check_root_dse(ld, attrs, extension);
1896 }
1897
1898 /*******************************************************************
1899  Check if LDAP-Server holds a given namingContext
1900 ********************************************************************/
1901
1902 bool smbldap_has_naming_context(LDAP *ld, const char *naming_context)
1903 {
1904         const char *attrs[] = { "namingContexts", NULL };
1905         return smbldap_check_root_dse(ld, attrs, naming_context);
1906 }
1907
1908 bool smbldap_set_creds(struct smbldap_state *ldap_state, bool anon, const char *dn, const char *secret)
1909 {
1910         ldap_state->anonymous = anon;
1911
1912         /* free any previously set credential */
1913
1914         SAFE_FREE(ldap_state->bind_dn);
1915         smbldap_set_bind_callback(ldap_state, NULL, NULL);
1916
1917         if (ldap_state->bind_secret) {
1918                 /* make sure secrets are zeroed out of memory */
1919                 memset(ldap_state->bind_secret, '\0', strlen(ldap_state->bind_secret));
1920                 SAFE_FREE(ldap_state->bind_secret);
1921         }
1922
1923         if ( ! anon) {
1924                 ldap_state->bind_dn = SMB_STRDUP(dn);
1925                 ldap_state->bind_secret = SMB_STRDUP(secret);
1926         }
1927
1928         return True;
1929 }