From db644a3a24c123a964129d41934365d8eb2174c7 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>

Date: Thu, 30 Jul 2020 12:59:01 +0200

Subject: [PATCH 1/7] ldap: add support for cldap and udp connections

Reviewed-by: Sumit Bose <sbose@redhat.com>

(cherry picked from commit 414593cca65ed09fe4659e2786370a4553664cd0)

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/util/sss_ldap.c    | 28 ++++++++++++++++++++-----

 src/util/sss_sockets.c | 47 ++++++++++++++++++++++++++++--------------

 src/util/sss_sockets.h |  1 +

 3 files changed, 56 insertions(+), 20 deletions(-)

diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c

index 652b08ea7..71fa21f4a 100644

--- a/src/util/sss_ldap.c

+++ b/src/util/sss_ldap.c

@@ -116,6 +116,7 @@ struct sss_ldap_init_state {

     LDAP *ldap;

     int sd;

     const char *uri;

+    bool use_udp;

 };

 static int sss_ldap_init_state_destructor(void *data)

@@ -159,11 +160,13 @@ struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,

     state->ldap = NULL;

     state->sd = -1;

     state->uri = uri;

+    state->use_udp = strncmp(uri, "cldap", 5) == 0 ? true : false;

 #ifdef HAVE_LDAP_INIT_FD

     struct tevent_req *subreq;

-    subreq = sssd_async_socket_init_send(state, ev, addr, addr_len, timeout);

+    subreq = sssd_async_socket_init_send(state, ev, state->use_udp, addr,

+                                         addr_len, timeout);

     if (subreq == NULL) {

         ret = ENOMEM;

         DEBUG(SSSDBG_CRIT_FAILURE, "sssd_async_socket_init_send failed.\n");

@@ -246,14 +249,29 @@ static void sss_ldap_init_sys_connect_done(struct tevent_req *subreq)

         goto fail;

     }

-    ret = unset_fcntl_flags(state->sd, O_NONBLOCK);

-    if (ret != EOK) {

-        goto fail;

+    /* openldap < 2.5 does not correctly handle O_NONBLOCK during starttls for

+     * ldaps, so we need to remove the flag here. This is fine since I/O events

+     * are handled via tevent so we only read when there is data available.

+     *

+     * We need to keep O_NONBLOCK due to a bug in openldap to correctly perform

+     * a parallel CLDAP pings without timeout. See:

+     * https://bugs.openldap.org/show_bug.cgi?id=9328

+     *

+     * @todo remove this when the bug is fixed and we can put a hard requirement

+     * on newer openldap.

+     */

+    if (!state->use_udp) {

+        ret = unset_fcntl_flags(state->sd, O_NONBLOCK);

+        if (ret != EOK) {

+            goto fail;

+        }

     }

     /* Initialize LDAP handler */

-    lret = ldap_init_fd(state->sd, LDAP_PROTO_TCP, state->uri, &state->ldap);

+    lret = ldap_init_fd(state->sd,

+                        state->use_udp ? LDAP_PROTO_UDP : LDAP_PROTO_TCP,

+                        state->uri, &state->ldap);

     if (lret != LDAP_SUCCESS) {

         DEBUG(SSSDBG_CRIT_FAILURE,

               "ldap_init_fd failed: %s. [%d][%s]\n",

diff --git a/src/util/sss_sockets.c b/src/util/sss_sockets.c

index 6f2b71bc8..733360f3b 100644

--- a/src/util/sss_sockets.c

+++ b/src/util/sss_sockets.c

@@ -80,6 +80,18 @@ static errno_t set_fd_common_opts(int fd, int timeout)

     int ret;

     struct timeval tv;

     unsigned int milli;

+    int type;

+    socklen_t optlen = sizeof(int);

+

+    /* Get protocol type. */

+    ret = getsockopt(fd, SOL_SOCKET, SO_TYPE, &type, &optlen);

+    if (ret != 0) {

+        ret = errno;

+        DEBUG(SSSDBG_FUNC_DATA, "Unable to get socket type [%d]: %s.\n",

+              ret, strerror(ret));

+        /* Assume TCP. */

+        type = SOCK_STREAM;

+    }

     /* SO_KEEPALIVE and TCP_NODELAY are set by OpenLDAP client libraries but

      * failures are ignored.*/

@@ -91,12 +103,14 @@ static errno_t set_fd_common_opts(int fd, int timeout)

                   strerror(ret));

     }

-    ret = setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &dummy, sizeof(dummy));

-    if (ret != 0) {

-        ret = errno;

-        DEBUG(SSSDBG_FUNC_DATA,

-              "setsockopt TCP_NODELAY failed.[%d][%s].\n", ret,

-                  strerror(ret));

+    if (type == SOCK_STREAM) {

+        ret = setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &dummy, sizeof(dummy));

+        if (ret != 0) {

+            ret = errno;

+            DEBUG(SSSDBG_FUNC_DATA,

+                "setsockopt TCP_NODELAY failed.[%d][%s].\n", ret,

+                    strerror(ret));

+        }

     }

     if (timeout > 0) {

@@ -119,14 +133,16 @@ static errno_t set_fd_common_opts(int fd, int timeout)

                   strerror(ret));

         }

-        milli = timeout * 1000; /* timeout in milliseconds */

-        ret = setsockopt(fd, IPPROTO_TCP, TCP_USER_TIMEOUT, &milli,

-                         sizeof(milli));

-        if (ret != 0) {

-            ret = errno;

-            DEBUG(SSSDBG_FUNC_DATA,

-                  "setsockopt TCP_USER_TIMEOUT failed.[%d][%s].\n", ret,

-                  strerror(ret));

+        if (type == SOCK_STREAM) {

+            milli = timeout * 1000; /* timeout in milliseconds */

+            ret = setsockopt(fd, IPPROTO_TCP, TCP_USER_TIMEOUT, &milli,

+                            sizeof(milli));

+            if (ret != 0) {

+                ret = errno;

+                DEBUG(SSSDBG_FUNC_DATA,

+                    "setsockopt TCP_USER_TIMEOUT failed.[%d][%s].\n", ret,

+                    strerror(ret));

+            }

         }

     }

@@ -271,6 +287,7 @@ static void sssd_async_socket_init_done(struct tevent_req *subreq);

 struct tevent_req *sssd_async_socket_init_send(TALLOC_CTX *mem_ctx,

                                                struct tevent_context *ev,

+                                               bool use_udp,

                                                struct sockaddr_storage *addr,

                                                socklen_t addr_len, int timeout)

 {

@@ -289,7 +306,7 @@ struct tevent_req *sssd_async_socket_init_send(TALLOC_CTX *mem_ctx,

     talloc_set_destructor((TALLOC_CTX *)state,

                           sssd_async_socket_state_destructor);

-    state->sd = socket(addr->ss_family, SOCK_STREAM, 0);

+    state->sd = socket(addr->ss_family, use_udp ? SOCK_DGRAM : SOCK_STREAM, 0);

     if (state->sd == -1) {

         ret = errno;

         DEBUG(SSSDBG_CRIT_FAILURE,

diff --git a/src/util/sss_sockets.h b/src/util/sss_sockets.h

index ccb05cb84..2758e6ed1 100644

--- a/src/util/sss_sockets.h

+++ b/src/util/sss_sockets.h

@@ -32,6 +32,7 @@ int sssd_async_connect_recv(struct tevent_req *req);

 struct tevent_req *sssd_async_socket_init_send(TALLOC_CTX *mem_ctx,

                                                struct tevent_context *ev,

+                                               bool use_udp,

                                                struct sockaddr_storage *addr,

                                                socklen_t addr_len, int timeout);

 int sssd_async_socket_init_recv(struct tevent_req *req, int *sd);

-- 

2.26.3

From 3efae1df18f4bfe7782025a14bcfbb5965496b32 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>

Date: Thu, 30 Jul 2020 13:30:50 +0200

Subject: [PATCH 2/7] ad: use cldap for site and forrest discover (perform

 CLDAP ping)

All Windows clients uses CLDAP (UDP) for LDAP ping. Even though AD

also supports LDAP ping over TCP IPA does not therefore it is crusial

for us to perform the ping over CLDAP protocol.

Resolves:

https://github.com/SSSD/sssd/issues/5215

Reviewed-by: Sumit Bose <sbose@redhat.com>

(cherry picked from commit 8265674a055e5cdb57acebad72d935356408540a)

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/providers/ad/ad_init.c                | 6 +-----

 src/providers/ad/ad_srv.c                 | 9 +++------

 src/providers/ad/ad_srv.h                 | 3 +--

 src/providers/ad/ad_subdomains.c          | 2 +-

 src/providers/ipa/ipa_subdomains_server.c | 2 +-

 5 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c

index fb24a28e1..5abd28b7c 100644

--- a/src/providers/ad/ad_init.c

+++ b/src/providers/ad/ad_init.c

@@ -187,14 +187,11 @@ static errno_t ad_init_srv_plugin(struct be_ctx *be_ctx,

     const char *ad_site_override;

     bool sites_enabled;

     errno_t ret;

-    bool ad_use_ldaps;

     hostname = dp_opt_get_string(ad_options->basic, AD_HOSTNAME);

     ad_domain = dp_opt_get_string(ad_options->basic, AD_DOMAIN);

     ad_site_override = dp_opt_get_string(ad_options->basic, AD_SITE);

     sites_enabled = dp_opt_get_bool(ad_options->basic, AD_ENABLE_DNS_SITES);

-    ad_use_ldaps = dp_opt_get_bool(ad_options->basic, AD_USE_LDAPS);

-

     if (!sites_enabled) {

         ret = be_fo_set_dns_srv_lookup_plugin(be_ctx, hostname);

@@ -210,8 +207,7 @@ static errno_t ad_init_srv_plugin(struct be_ctx *be_ctx,

     srv_ctx = ad_srv_plugin_ctx_init(be_ctx, be_ctx, be_ctx->be_res,

                                      default_host_dbs, ad_options->id,

                                      hostname, ad_domain,

-                                     ad_site_override,

-                                     ad_use_ldaps);

+                                     ad_site_override);

     if (srv_ctx == NULL) {

         DEBUG(SSSDBG_FATAL_FAILURE, "Out of memory?\n");

         return ENOMEM;

diff --git a/src/providers/ad/ad_srv.c b/src/providers/ad/ad_srv.c

index ca15d3715..55e8f63f7 100644

--- a/src/providers/ad/ad_srv.c

+++ b/src/providers/ad/ad_srv.c

@@ -335,9 +335,9 @@ static errno_t ad_get_client_site_next_dc(struct tevent_req *req)

                                     state->be_res->resolv,

                                     state->be_res->family_order,

                                     state->host_db,

-                                    state->ad_use_ldaps ? "ldaps" : "ldap",

+                                    "cldap",

                                     state->dc.host,

-                                    state->ad_use_ldaps ? 636 : state->dc.port,

+                                    state->dc.port,

                                     false);

     if (subreq == NULL) {

         ret = ENOMEM;

@@ -497,7 +497,6 @@ struct ad_srv_plugin_ctx {

     const char *ad_domain;

     const char *ad_site_override;

     const char *current_site;

-    bool ad_use_ldaps;

 };

 struct ad_srv_plugin_ctx *

@@ -508,8 +507,7 @@ ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx,

                        struct sdap_options *opts,

                        const char *hostname,

                        const char *ad_domain,

-                       const char *ad_site_override,

-                       bool ad_use_ldaps)

+                       const char *ad_site_override)

 {

     struct ad_srv_plugin_ctx *ctx = NULL;

     errno_t ret;

@@ -523,7 +521,6 @@ ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx,

     ctx->be_res = be_res;

     ctx->host_dbs = host_dbs;

     ctx->opts = opts;

-    ctx->ad_use_ldaps = ad_use_ldaps;

     ctx->hostname = talloc_strdup(ctx, hostname);

     if (ctx->hostname == NULL) {

diff --git a/src/providers/ad/ad_srv.h b/src/providers/ad/ad_srv.h

index 8e410ec26..e553d594d 100644

--- a/src/providers/ad/ad_srv.h

+++ b/src/providers/ad/ad_srv.h

@@ -31,8 +31,7 @@ ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx,

                        struct sdap_options *opts,

                        const char *hostname,

                        const char *ad_domain,

-                       const char *ad_site_override,

-                       bool ad_use_ldaps);

+                       const char *ad_site_override);

 struct tevent_req *ad_srv_plugin_send(TALLOC_CTX *mem_ctx,

                                        struct tevent_context *ev,

diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c

index 16aecbc64..9b32196b7 100644

--- a/src/providers/ad/ad_subdomains.c

+++ b/src/providers/ad/ad_subdomains.c

@@ -411,7 +411,7 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,

                                      ad_id_ctx->ad_options->id,

                                      hostname,

                                      ad_domain,

-                                     ad_site_override, ad_use_ldaps);

+                                     ad_site_override);

     if (srv_ctx == NULL) {

         DEBUG(SSSDBG_FATAL_FAILURE, "Out of memory?\n");

         return ENOMEM;

diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c

index e2037b59d..f0d8a6a20 100644

--- a/src/providers/ipa/ipa_subdomains_server.c

+++ b/src/providers/ipa/ipa_subdomains_server.c

@@ -344,7 +344,7 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,

                                      ad_id_ctx->ad_options->id,

                                      id_ctx->server_mode->hostname,

                                      ad_domain,

-                                     ad_site_override, false);

+                                     ad_site_override);

     if (srv_ctx == NULL) {

         DEBUG(SSSDBG_FATAL_FAILURE, "Out of memory?\n");

         return ENOMEM;

-- 

2.26.3

From 7e856adefeaa377a50b40d397684e48ba82aa055 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>

Date: Tue, 11 Aug 2020 13:27:42 +0200

Subject: [PATCH 3/7] ad: connect to the first available server for cldap ping

Resolves:

https://github.com/SSSD/sssd/issues/3743

Reviewed-by: Sumit Bose <sbose@redhat.com>

(cherry picked from commit 1889ca60a9c642f0cca60b20a5b94de7a66924f6)

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 Makefile.am                      |   5 +-

 src/providers/ad/ad_cldap_ping.c | 586 +++++++++++++++++++++++++++++++

 src/providers/ad/ad_srv.c        | 434 +----------------------

 src/providers/ad/ad_srv.h        |  14 +

 4 files changed, 613 insertions(+), 426 deletions(-)

 create mode 100644 src/providers/ad/ad_cldap_ping.c

diff --git a/Makefile.am b/Makefile.am

index b9ca9a7c6..17e20f1cb 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -4202,7 +4202,9 @@ libsss_ipa_la_SOURCES = \

     src/providers/ad/ad_pac.c \

     src/providers/ad/ad_pac_common.c \

     src/providers/ad/ad_srv.c \

-    src/providers/ad/ad_domain_info.c

+    src/providers/ad/ad_domain_info.c \

+    src/providers/ad/ad_cldap_ping.c \

+    $(NULL)

 libsss_ipa_la_CFLAGS = \

     $(AM_CFLAGS) \

     $(OPENLDAP_CFLAGS) \

@@ -4269,6 +4271,7 @@ libsss_ad_la_SOURCES = \

     src/providers/ad/ad_subdomains.c \

     src/providers/ad/ad_domain_info.c \

     src/providers/ad/ad_refresh.c \

+    src/providers/ad/ad_cldap_ping.c \

     $(NULL)

diff --git a/src/providers/ad/ad_cldap_ping.c b/src/providers/ad/ad_cldap_ping.c

new file mode 100644

index 000000000..5fc1a4d20

--- /dev/null

+++ b/src/providers/ad/ad_cldap_ping.c

@@ -0,0 +1,586 @@

+/*

+    Authors:

+        Pavel Březina <pbrezina@redhat.com>

+

+    Copyright (C) 2020 Red Hat

+

+    This program is free software; you can redistribute it and/or modify

+    it under the terms of the GNU General Public License as published by

+    the Free Software Foundation; either version 3 of the License, or

+    (at your option) any later version.

+

+    This program is distributed in the hope that it will be useful,

+    but WITHOUT ANY WARRANTY; without even the implied warranty of

+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+    GNU General Public License for more details.

+

+    You should have received a copy of the GNU General Public License

+    along with this program.  If not, see <http://www.gnu.org/licenses/>.

+*/

+

+#include <string.h>

+#include <talloc.h>

+#include <tevent.h>

+#include <ndr.h>

+#include <ndr/ndr_nbt.h>

+

+#include "util/util.h"

+#include "util/sss_ldap.h"

+#include "resolv/async_resolv.h"

+#include "providers/backend.h"

+#include "providers/ad/ad_srv.h"

+#include "providers/ad/ad_common.h"

+#include "providers/fail_over.h"

+#include "providers/fail_over_srv.h"

+#include "providers/ldap/sdap.h"

+#include "providers/ldap/sdap_async.h"

+#include "db/sysdb.h"

+

+struct ad_cldap_ping_dc_state {

+    struct tevent_context *ev;

+    struct sdap_options *opts;

+    struct fo_server_info *dc;

+    struct sdap_handle *sh;

+    const char *ad_domain;

+

+    char *site;

+    char *forest;

+};

+

+static void ad_cldap_ping_dc_connect_done(struct tevent_req *subreq);

+static void ad_cldap_ping_dc_done(struct tevent_req *subreq);

+

+static struct tevent_req *ad_cldap_ping_dc_send(TALLOC_CTX *mem_ctx,

+                                                struct tevent_context *ev,

+                                                struct sdap_options *opts,

+                                                struct be_resolv_ctx *be_res,

+                                                enum host_database *host_db,

+                                                struct fo_server_info *dc,

+                                                const char *ad_domain)

+{

+    struct ad_cldap_ping_dc_state *state;

+    struct tevent_req *subreq;

+    struct tevent_req *req;

+    errno_t ret;

+

+    req = tevent_req_create(mem_ctx, &state,

+                            struct ad_cldap_ping_dc_state);

+    if (req == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");

+        return NULL;

+    }

+

+    state->ev = ev;

+    state->opts = opts;

+    state->dc = dc;

+    state->ad_domain = ad_domain;

+

+    subreq = sdap_connect_host_send(state, ev, opts, be_res->resolv,

+                                    be_res->family_order, host_db, "cldap",

+                                    dc->host, dc->port, false);

+    if (subreq == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    tevent_req_set_callback(subreq, ad_cldap_ping_dc_connect_done, req);

+

+    return req;

+

+done:

+    tevent_req_error(req, ret);

+    tevent_req_post(req, ev);

+

+    return req;

+}

+

+static void ad_cldap_ping_dc_connect_done(struct tevent_req *subreq)

+{

+    static const char *attrs[] = {AD_AT_NETLOGON, NULL};

+    struct ad_cldap_ping_dc_state *state;

+    struct tevent_req *req;

+    char *ntver;

+    char *filter;

+    int timeout;

+    errno_t ret;

+

+    req = tevent_req_callback_data(subreq, struct tevent_req);

+    state = tevent_req_data(req, struct ad_cldap_ping_dc_state);

+

+    ret = sdap_connect_host_recv(state, subreq, &state->sh);

+    talloc_zfree(subreq);

+    if (ret != EOK) {

+        goto done;

+    }

+

+    ntver = sss_ldap_encode_ndr_uint32(state, NETLOGON_NT_VERSION_5EX |

+                                       NETLOGON_NT_VERSION_WITH_CLOSEST_SITE);

+    if (ntver == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    filter = talloc_asprintf(state, "(&(%s=%s)(%s=%s))", AD_AT_DNS_DOMAIN,

+                             state->ad_domain, AD_AT_NT_VERSION, ntver);

+    if (filter == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);

+    subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh, "",

+                                   LDAP_SCOPE_BASE, filter, attrs, NULL,

+                                   0, timeout, false);

+    if (subreq == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    tevent_req_set_callback(subreq, ad_cldap_ping_dc_done, req);

+

+    ret = EOK;

+

+done:

+    if (ret != EOK) {

+        tevent_req_error(req, ret);

+    }

+}

+

+static void ad_cldap_ping_dc_done(struct tevent_req *subreq)

+{

+    struct ad_cldap_ping_dc_state *state;

+    struct tevent_req *req;

+    struct sysdb_attrs **reply;

+    size_t reply_count;

+    errno_t ret;

+

+    req = tevent_req_callback_data(subreq, struct tevent_req);

+    state = tevent_req_data(req, struct ad_cldap_ping_dc_state);

+

+    ret = sdap_get_generic_recv(subreq, state, &reply_count, &reply);

+

+    talloc_zfree(subreq);

+    talloc_zfree(state->sh);

+

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE, "%s:%d: unable to get netlogon information\n",

+              state->dc->host, state->dc->port);

+        goto done;

+    }

+

+    if (reply_count == 0) {

+        DEBUG(SSSDBG_OP_FAILURE, "%s:%d: no netlogon information available\n",

+              state->dc->host, state->dc->port);

+        ret = ENOENT;

+        goto done;

+    }

+

+    ret = netlogon_get_domain_info(state, reply[0], true, NULL, &state->site,

+                                   &state->forest);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "%s:%d: unable to retrieve site name [%d]: %s\n",

+              state->dc->host, state->dc->port, ret, sss_strerror(ret));

+        ret = ENOENT;

+        goto done;

+    }

+

+    DEBUG(SSSDBG_TRACE_FUNC, "%s:%d: found site (%s) and forest (%s)\n",

+          state->dc->host, state->dc->port, state->site, state->forest);

+

+    ret = EOK;

+

+done:

+    if (ret != EOK) {

+        tevent_req_error(req, ret);

+        return;

+    }

+

+    tevent_req_done(req);

+}

+

+static errno_t ad_cldap_ping_dc_recv(TALLOC_CTX *mem_ctx,

+                                     struct tevent_req *req,

+                                     const char **_site,

+                                     const char **_forest)

+{

+    struct ad_cldap_ping_dc_state *state = NULL;

+    state = tevent_req_data(req, struct ad_cldap_ping_dc_state);

+

+    TEVENT_REQ_RETURN_ON_ERROR(req);

+

+    *_site = talloc_steal(mem_ctx, state->site);

+    *_forest = talloc_steal(mem_ctx, state->forest);

+

+    return EOK;

+}

+

+struct ad_cldap_ping_parallel_state {

+    struct tevent_context *ev;

+    struct sdap_options *opts;

+    struct be_resolv_ctx *be_res;

+    enum host_database *host_db;

+    const char *ad_domain;

+    struct fo_server_info *dc_list;

+    size_t dc_count;

+

+    TALLOC_CTX *reqs_ctx;

+    struct tevent_timer *te;

+    int active_requests;

+    size_t next_dc;

+    int batch;

+

+    const char *site;

+    const char *forest;

+};

+

+static void ad_cldap_ping_parallel_batch(struct tevent_context *ev,

+                                         struct tevent_timer *te,

+                                         struct timeval tv,

+                                         void *data);

+static void ad_cldap_ping_parallel_done(struct tevent_req *subreq);

+

+static struct tevent_req *

+ad_cldap_ping_parallel_send(TALLOC_CTX *mem_ctx,

+                            struct tevent_context *ev,

+                            struct sdap_options *opts,

+                            struct be_resolv_ctx *be_res,

+                            enum host_database *host_db,

+                            struct fo_server_info *dc_list,

+                            size_t dc_count,

+                            const char *ad_domain)

+{

+    struct ad_cldap_ping_parallel_state *state;

+    struct tevent_req *req;

+    struct timeval tv = {0, 0};

+    errno_t ret;

+

+    req = tevent_req_create(mem_ctx, &state,

+                            struct ad_cldap_ping_parallel_state);

+    if (req == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");

+        return NULL;

+    }

+

+    state->ev = ev;

+    state->opts = opts;

+    state->be_res = be_res;

+    state->host_db = host_db;

+    state->ad_domain = ad_domain;

+    state->dc_list = dc_list;

+    state->dc_count = dc_count;

+

+    state->reqs_ctx = talloc_new(state);

+    if (state->reqs_ctx == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    state->next_dc = 0;

+    state->batch = 1;

+    ad_cldap_ping_parallel_batch(ev, NULL, tv, req);

+

+    return req;

+

+done:

+    tevent_req_error(req, ret);

+    tevent_req_post(req, ev);

+

+    return req;

+}

+

+static void ad_cldap_ping_parallel_batch(struct tevent_context *ev,

+                                         struct tevent_timer *te,

+                                         struct timeval tv,

+                                         void *data)

+{

+    struct ad_cldap_ping_parallel_state *state;

+    struct tevent_req *req;

+    struct tevent_req *subreq;

+    uint32_t delay;

+    size_t limit;

+    size_t i;

+

+    req = talloc_get_type(data, struct tevent_req);

+    state = tevent_req_data(req, struct ad_cldap_ping_parallel_state);

+

+    state->te = NULL;

+

+    /* Issue three batches in total to avoid pinging too many domain controllers

+     * if not necessary. The first batch (5 pings) is issued immediately and we

+     * will wait 400ms for it to finish. If we don't get a reply in time we

+     * issue next batch (5 pings) and wait 200ms. If we still have no reply,

+     * we contact remaining domain controllers.

+     *

+     * This follows algorithm described at section 5.4.5.3 of MS-DISO:

+     * https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/WinArchive/%5bMS-DISO%5d.pdf

+     */

+    switch (state->batch) {

+        case 1:

+        case 2:

+            limit = MIN(state->dc_count, 5 + state->next_dc);

+            delay = 400000 / state->batch;

+            break;

+        default:

+            limit = state->dc_count;

+            delay = 0;

+    }

+

+    for (i = state->next_dc; i < limit; i++) {

+        DEBUG(SSSDBG_TRACE_ALL, "Batch %d: %s:%d\n", state->batch,

+              state->dc_list[i].host, state->dc_list[i].port);

+    }

+

+    for (; state->next_dc < limit; state->next_dc++) {

+        subreq = ad_cldap_ping_dc_send(state->reqs_ctx, ev, state->opts,

+                                       state->be_res, state->host_db,

+                                       &state->dc_list[state->next_dc],

+                                       state->ad_domain);

+        if (subreq == NULL) {

+            DEBUG(SSSDBG_OP_FAILURE, "Unable to create new ping request\n");

+            goto fail;

+        }

+

+        state->active_requests++;

+        tevent_req_set_callback(subreq, ad_cldap_ping_parallel_done, req);

+    }

+

+    state->batch++;

+    if (delay > 0) {

+        tv = tevent_timeval_current_ofs(0, delay);

+        state->te = tevent_add_timer(ev, state->reqs_ctx, tv,

+                                     ad_cldap_ping_parallel_batch, req);