?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
8322 nl: misleading-indentation
[unleashed/tickless.git] / usr / src / cmd / sendmail / libsm / ldap.c
blob7ee57fcbb689b645b2f89e6bab5b7b4cd90946cc
1 /*
2 * Copyright (c) 2001-2009 Sendmail, Inc. and its suppliers.
3 * All rights reserved.
4 *
5 * By using this file, you agree to the terms and conditions set
6 * forth in the LICENSE file which can be found at the top level of
7 * the sendmail distribution.
8 */
9
10 /* some "deprecated" calls are used, e.g., ldap_get_values() */
11 #define LDAP_DEPRECATED 1
12
13 #include <sm/gen.h>
14 SM_RCSID("@(#)$Id: ldap.c,v 1.83 2009/06/19 22:02:26 guenther Exp $")
15
16 #if LDAPMAP
17 # include <sys/types.h>
18 # include <errno.h>
19 # include <setjmp.h>
20 # include <stdlib.h>
21 # include <unistd.h>
22
23 # include <sm/bitops.h>
24 # include <sm/clock.h>
25 # include <sm/conf.h>
26 # include <sm/debug.h>
27 # include <sm/errstring.h>
28 # include <sm/ldap.h>
29 # include <sm/string.h>
30 # ifdef EX_OK
31 # undef EX_OK /* for SVr4.2 SMP */
32 # endif /* EX_OK */
33 # include <sm/sysexits.h>
34
35 SM_DEBUG_T SmLDAPTrace = SM_DEBUG_INITIALIZER("sm_trace_ldap",
36 "@(#)$Debug: sm_trace_ldap - trace LDAP operations $");
37
38 static void ldaptimeout __P((int));
39 static bool sm_ldap_has_objectclass __P((SM_LDAP_STRUCT *, LDAPMessage *, char *));
40 static SM_LDAP_RECURSE_ENTRY *sm_ldap_add_recurse __P((SM_LDAP_RECURSE_LIST **, char *, int, SM_RPOOL_T *));
41
42 /*
43 ** SM_LDAP_CLEAR -- set default values for SM_LDAP_STRUCT
44 **
45 ** Parameters:
46 ** lmap -- pointer to SM_LDAP_STRUCT to clear
47 **
48 ** Returns:
49 ** None.
50 **
51 */
52
53 #if _FFR_LDAP_VERSION
54 # if defined(LDAP_VERSION_MAX) && _FFR_LDAP_VERSION > LDAP_VERSION_MAX
55 ERROR FFR_LDAP_VERSION > _LDAP_VERSION_MAX
56 # endif /* defined(LDAP_VERSION_MAX) && _FFR_LDAP_VERSION > LDAP_VERSION_MAX */
57 # if defined(LDAP_VERSION_MIN) && _FFR_LDAP_VERSION < LDAP_VERSION_MIN
58 ERROR FFR_LDAP_VERSION < _LDAP_VERSION_MIN
59 # endif /* defined(LDAP_VERSION_MIN) && _FFR_LDAP_VERSION < LDAP_VERSION_MIN */
60 # define SM_LDAP_VERSION_DEFAULT _FFR_LDAP_VERSION
61 #else /* _FFR_LDAP_VERSION */
62 # define SM_LDAP_VERSION_DEFAULT 0
63 #endif /* _FFR_LDAP_VERSION */
64
65 void
66 sm_ldap_clear(lmap)
67 SM_LDAP_STRUCT *lmap;
68 {
69 if (lmap == NULL)
70 return;
71
72 lmap->ldap_host = NULL;
73 lmap->ldap_port = LDAP_PORT;
74 lmap->ldap_uri = NULL;
75 lmap->ldap_version = SM_LDAP_VERSION_DEFAULT;
76 lmap->ldap_deref = LDAP_DEREF_NEVER;
77 lmap->ldap_timelimit = LDAP_NO_LIMIT;
78 lmap->ldap_sizelimit = LDAP_NO_LIMIT;
79 # ifdef LDAP_REFERRALS
80 lmap->ldap_options = LDAP_OPT_REFERRALS;
81 # else /* LDAP_REFERRALS */
82 lmap->ldap_options = 0;
83 # endif /* LDAP_REFERRALS */
84 lmap->ldap_attrsep = '\0';
85 lmap->ldap_binddn = NULL;
86 lmap->ldap_secret = NULL;
87 lmap->ldap_method = LDAP_AUTH_SIMPLE;
88 lmap->ldap_base = NULL;
89 lmap->ldap_scope = LDAP_SCOPE_SUBTREE;
90 lmap->ldap_attrsonly = LDAPMAP_FALSE;
91 lmap->ldap_timeout.tv_sec = 0;
92 lmap->ldap_timeout.tv_usec = 0;
93 lmap->ldap_ld = NULL;
94 lmap->ldap_filter = NULL;
95 lmap->ldap_attr[0] = NULL;
96 lmap->ldap_attr_type[0] = SM_LDAP_ATTR_NONE;
97 lmap->ldap_attr_needobjclass[0] = NULL;
98 lmap->ldap_res = NULL;
99 lmap->ldap_next = NULL;
100 lmap->ldap_pid = 0;
101 lmap->ldap_multi_args = false;
102 }
103
104 /*
105 ** SM_LDAP_START -- actually connect to an LDAP server
106 **
107 ** Parameters:
108 ** name -- name of map for debug output.
109 ** lmap -- the LDAP map being opened.
110 **
111 ** Returns:
112 ** true if connection is successful, false otherwise.
113 **
114 ** Side Effects:
115 ** Populates lmap->ldap_ld.
116 */
117
118 static jmp_buf LDAPTimeout;
119
120 #define SM_LDAP_SETTIMEOUT(to) \
121 do \
122 { \
123 if (to != 0) \
124 { \
125 if (setjmp(LDAPTimeout) != 0) \
126 { \
127 errno = ETIMEDOUT; \
128 return false; \
129 } \
130 ev = sm_setevent(to, ldaptimeout, 0); \
131 } \
132 } while (0)
133
134 #define SM_LDAP_CLEARTIMEOUT() \
135 do \
136 { \
137 if (ev != NULL) \
138 sm_clrevent(ev); \
139 } while (0)
140
141 bool
142 sm_ldap_start(name, lmap)
143 char *name;
144 SM_LDAP_STRUCT *lmap;
145 {
146 int bind_result;
147 int save_errno = 0;
148 char *id;
149 SM_EVENT *ev = NULL;
150 LDAP *ld = NULL;
151
152 if (sm_debug_active(&SmLDAPTrace, 2))
153 sm_dprintf("ldapmap_start(%s)\n", name == NULL ? "" : name);
154
155 if (lmap->ldap_host != NULL)
156 id = lmap->ldap_host;
157 else if (lmap->ldap_uri != NULL)
158 id = lmap->ldap_uri;
159 else
160 id = "localhost";
161
162 if (sm_debug_active(&SmLDAPTrace, 9))
163 {
164 /* Don't print a port number for LDAP URIs */
165 if (lmap->ldap_uri != NULL)
166 sm_dprintf("ldapmap_start(%s)\n", id);
167 else
168 sm_dprintf("ldapmap_start(%s, %d)\n", id,
169 lmap->ldap_port);
170 }
171
172 if (lmap->ldap_uri != NULL)
173 {
174 #if SM_CONF_LDAP_INITIALIZE
175 /* LDAP server supports URIs so use them directly */
176 save_errno = ldap_initialize(&ld, lmap->ldap_uri);
177 #else /* SM_CONF_LDAP_INITIALIZE */
178 int err;
179 LDAPURLDesc *ludp = NULL;
180
181 /* Blast apart URL and use the ldap_init/ldap_open below */
182 err = ldap_url_parse(lmap->ldap_uri, &ludp);
183 if (err != 0)
184 {
185 errno = err + E_LDAPURLBASE;
186 return false;
187 }
188 lmap->ldap_host = sm_strdup_x(ludp->lud_host);
189 if (lmap->ldap_host == NULL)
190 {
191 save_errno = errno;
192 ldap_free_urldesc(ludp);
193 errno = save_errno;
194 return false;
195 }
196 lmap->ldap_port = ludp->lud_port;
197 ldap_free_urldesc(ludp);
198 #endif /* SM_CONF_LDAP_INITIALIZE */
199 }
200
201 if (ld == NULL)
202 {
203 # if USE_LDAP_INIT
204 ld = ldap_init(lmap->ldap_host, lmap->ldap_port);
205 save_errno = errno;
206 # else /* USE_LDAP_INIT */
207 /*
208 ** If using ldap_open(), the actual connection to the server
209 ** happens now so we need the timeout here. For ldap_init(),
210 ** the connection happens at bind time.
211 */
212
213 SM_LDAP_SETTIMEOUT(lmap->ldap_timeout.tv_sec);
214 ld = ldap_open(lmap->ldap_host, lmap->ldap_port);
215 save_errno = errno;
216
217 /* clear the event if it has not sprung */
218 SM_LDAP_CLEARTIMEOUT();
219 # endif /* USE_LDAP_INIT */
220 }
221
222 errno = save_errno;
223 if (ld == NULL)
224 return false;
225
226 sm_ldap_setopts(ld, lmap);
227
228 # if USE_LDAP_INIT
229 /*
230 ** If using ldap_init(), the actual connection to the server
231 ** happens at ldap_bind_s() so we need the timeout here.
232 */
233
234 SM_LDAP_SETTIMEOUT(lmap->ldap_timeout.tv_sec);
235 # endif /* USE_LDAP_INIT */
236
237 # ifdef LDAP_AUTH_KRBV4
238 if (lmap->ldap_method == LDAP_AUTH_KRBV4 &&
239 lmap->ldap_secret != NULL)
240 {
241 /*
242 ** Need to put ticket in environment here instead of
243 ** during parseargs as there may be different tickets
244 ** for different LDAP connections.
245 */
246
247 (void) putenv(lmap->ldap_secret);
248 }
249 # endif /* LDAP_AUTH_KRBV4 */
250
251 bind_result = ldap_bind_s(ld, lmap->ldap_binddn,
252 lmap->ldap_secret, lmap->ldap_method);
253
254 # if USE_LDAP_INIT
255 /* clear the event if it has not sprung */
256 SM_LDAP_CLEARTIMEOUT();
257 # endif /* USE_LDAP_INIT */
258
259 if (bind_result != LDAP_SUCCESS)
260 {
261 errno = bind_result + E_LDAPBASE;
262 return false;
263 }
264
265 /* Save PID to make sure only this PID closes the LDAP connection */
266 lmap->ldap_pid = getpid();
267 lmap->ldap_ld = ld;
268 return true;
269 }
270
271 /* ARGSUSED */
272 static void
273 ldaptimeout(unused)
274 int unused;
275 {
276 /*
277 ** NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER. DO NOT ADD
278 ** ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
279 ** DOING.
280 */
281
282 errno = ETIMEDOUT;
283 longjmp(LDAPTimeout, 1);
284 }
285
286 /*
287 ** SM_LDAP_SEARCH_M -- initiate multi-key LDAP search
288 **
289 ** Initiate an LDAP search, return the msgid.
290 ** The calling function must collect the results.
291 **
292 ** Parameters:
293 ** lmap -- LDAP map information
294 ** argv -- key vector of substitutions in LDAP filter
295 ** NOTE: argv must have SM_LDAP_ARGS elements to prevent
296 ** out of bound array references
297 **
298 ** Returns:
299 ** <0 on failure (SM_LDAP_ERR*), msgid on success
300 **
301 */
302
303 int
304 sm_ldap_search_m(lmap, argv)
305 SM_LDAP_STRUCT *lmap;
306 char **argv;
307 {
308 int msgid;
309 char *fp, *p, *q;
310 char filter[LDAPMAP_MAX_FILTER + 1];
311
312 SM_REQUIRE(lmap != NULL);
313 SM_REQUIRE(argv != NULL);
314 SM_REQUIRE(argv[0] != NULL);
315
316 memset(filter, '\0', sizeof filter);
317 fp = filter;
318 p = lmap->ldap_filter;
319 while ((q = strchr(p, '%')) != NULL)
320 {
321 char *key;
322
323 if (lmap->ldap_multi_args)
324 {
325 #if SM_LDAP_ARGS < 10
326 # ERROR _SM_LDAP_ARGS must be 10
327 #endif /* SM_LDAP_ARGS < 10 */
328 if (q[1] == 's')
329 key = argv[0];
330 else if (q[1] >= '0' && q[1] <= '9')
331 {
332 key = argv[q[1] - '0'];
333 if (key == NULL)
334 {
335 # if SM_LDAP_ERROR_ON_MISSING_ARGS
336 return SM_LDAP_ERR_ARG_MISS;
337 # else /* SM_LDAP_ERROR_ON_MISSING_ARGS */
338 key = "";
339 # endif /* SM_LDAP_ERROR_ON_MISSING_ARGS */
340 }
341 }
342 else
343 key = NULL;
344 }
345 else
346 key = argv[0];
347
348 if (q[1] == 's')
349 {
350 (void) sm_snprintf(fp, SPACELEFT(filter, fp),
351 "%.*s%s", (int) (q - p), p, key);
352 fp += strlen(fp);
353 p = q + 2;
354 }
355 else if (q[1] == '0' ||
356 (lmap->ldap_multi_args && q[1] >= '0' && q[1] <= '9'))
357 {
358 char *k = key;
359
360 (void) sm_snprintf(fp, SPACELEFT(filter, fp),
361 "%.*s", (int) (q - p), p);
362 fp += strlen(fp);
363 p = q + 2;
364
365 /* Properly escape LDAP special characters */
366 while (SPACELEFT(filter, fp) > 0 &&
367 *k != '\0')
368 {
369 if (*k == '*' || *k == '(' ||
370 *k == ')' || *k == '\\')
371 {
372 (void) sm_strlcat(fp,
373 (*k == '*' ? "\\2A" :
374 (*k == '(' ? "\\28" :
375 (*k == ')' ? "\\29" :
376 (*k == '\\' ? "\\5C" :
377 "\00")))),
378 SPACELEFT(filter, fp));
379 fp += strlen(fp);
380 k++;
381 }
382 else
383 *fp++ = *k++;
384 }
385 }
386 else
387 {
388 (void) sm_snprintf(fp, SPACELEFT(filter, fp),
389 "%.*s", (int) (q - p + 1), p);
390 p = q + (q[1] == '%' ? 2 : 1);
391 fp += strlen(fp);
392 }
393 }
394 (void) sm_strlcpy(fp, p, SPACELEFT(filter, fp));
395 if (sm_debug_active(&SmLDAPTrace, 20))
396 sm_dprintf("ldap search filter=%s\n", filter);
397
398 lmap->ldap_res = NULL;
399 msgid = ldap_search(lmap->ldap_ld, lmap->ldap_base,
400 lmap->ldap_scope, filter,
401 (lmap->ldap_attr[0] == NULL ? NULL :
402 lmap->ldap_attr),
403 lmap->ldap_attrsonly);
404 return msgid;
405 }
406
407 /*
408 ** SM_LDAP_SEARCH -- initiate LDAP search
409 **
410 ** Initiate an LDAP search, return the msgid.
411 ** The calling function must collect the results.
412 ** Note this is just a wrapper into sm_ldap_search_m()
413 **
414 ** Parameters:
415 ** lmap -- LDAP map information
416 ** key -- key to substitute in LDAP filter
417 **
418 ** Returns:
419 ** <0 on failure, msgid on success
420 **
421 */
422
423 int
424 sm_ldap_search(lmap, key)
425 SM_LDAP_STRUCT *lmap;
426 char *key;
427 {
428 char *argv[SM_LDAP_ARGS];
429
430 memset(argv, '\0', sizeof argv);
431 argv[0] = key;
432 return sm_ldap_search_m(lmap, argv);
433 }
434
435 /*
436 ** SM_LDAP_HAS_OBJECTCLASS -- determine if an LDAP entry is part of a
437 ** particular objectClass
438 **
439 ** Parameters:
440 ** lmap -- pointer to SM_LDAP_STRUCT in use
441 ** entry -- current LDAP entry struct
442 ** ocvalue -- particular objectclass in question.
443 ** may be of form (fee|foo|fum) meaning
444 ** any entry can be part of either fee,
445 ** foo or fum objectclass
446 **
447 ** Returns:
448 ** true if item has that objectClass
449 */
450
451 static bool
452 sm_ldap_has_objectclass(lmap, entry, ocvalue)
453 SM_LDAP_STRUCT *lmap;
454 LDAPMessage *entry;
455 char *ocvalue;
456 {
457 char **vals = NULL;
458 int i;
459
460 if (ocvalue == NULL)
461 return false;
462
463 vals = ldap_get_values(lmap->ldap_ld, entry, "objectClass");
464 if (vals == NULL)
465 return false;
466
467 for (i = 0; vals[i] != NULL; i++)
468 {
469 char *p;
470 char *q;
471
472 p = q = ocvalue;
473 while (*p != '\0')
474 {
475 while (*p != '\0' && *p != '|')
476 p++;
477
478 if ((p - q) == strlen(vals[i]) &&
479 sm_strncasecmp(vals[i], q, p - q) == 0)
480 {
481 ldap_value_free(vals);
482 return true;
483 }
484
485 while (*p == '|')
486 p++;
487 q = p;
488 }
489 }
490
491 ldap_value_free(vals);
492 return false;
493 }
494
495 /*
496 ** SM_LDAP_RESULTS -- return results from an LDAP lookup in result
497 **
498 ** Parameters:
499 ** lmap -- pointer to SM_LDAP_STRUCT in use
500 ** msgid -- msgid returned by sm_ldap_search()
501 ** flags -- flags for the lookup
502 ** delim -- delimiter for result concatenation
503 ** rpool -- memory pool for storage
504 ** result -- return string
505 ** recurse -- recursion list
506 **
507 ** Returns:
508 ** status (sysexit)
509 */
510
511 # define SM_LDAP_ERROR_CLEANUP() \
512 { \
513 if (lmap->ldap_res != NULL) \
514 { \
515 ldap_msgfree(lmap->ldap_res); \
516 lmap->ldap_res = NULL; \
517 } \
518 (void) ldap_abandon(lmap->ldap_ld, msgid); \
519 }
520
521 static SM_LDAP_RECURSE_ENTRY *
522 sm_ldap_add_recurse(top, item, type, rpool)
523 SM_LDAP_RECURSE_LIST **top;
524 char *item;
525 int type;
526 SM_RPOOL_T *rpool;
527 {
528 int n;
529 int m;
530 int p;
531 int insertat;
532 int moveb;
533 int oldsizeb;
534 int rc;
535 SM_LDAP_RECURSE_ENTRY *newe;
536 SM_LDAP_RECURSE_ENTRY **olddata;
537
538 /*
539 ** This code will maintain a list of
540 ** SM_LDAP_RECURSE_ENTRY structures
541 ** in ascending order.
542 */
543
544 if (*top == NULL)
545 {
546 /* Allocate an initial SM_LDAP_RECURSE_LIST struct */
547 *top = sm_rpool_malloc_x(rpool, sizeof **top);
548 (*top)->lrl_cnt = 0;
549 (*top)->lrl_size = 0;
550 (*top)->lrl_data = NULL;
551 }
552
553 if ((*top)->lrl_cnt >= (*top)->lrl_size)
554 {
555 /* Grow the list of SM_LDAP_RECURSE_ENTRY ptrs */
556 olddata = (*top)->lrl_data;
557 if ((*top)->lrl_size == 0)
558 {
559 oldsizeb = 0;
560 (*top)->lrl_size = 256;
561 }
562 else
563 {
564 oldsizeb = (*top)->lrl_size * sizeof *((*top)->lrl_data);
565 (*top)->lrl_size *= 2;
566 }
567 (*top)->lrl_data = sm_rpool_malloc_x(rpool,
568 (*top)->lrl_size * sizeof *((*top)->lrl_data));
569 if (oldsizeb > 0)
570 memcpy((*top)->lrl_data, olddata, oldsizeb);
571 }
572
573 /*
574 ** Binary search/insert item:type into list.
575 ** Return current entry pointer if already exists.
576 */
577
578 n = 0;
579 m = (*top)->lrl_cnt - 1;
580 if (m < 0)
581 insertat = 0;
582 else
583 insertat = -1;
584
585 while (insertat == -1)
586 {
587 p = (m + n) / 2;
588
589 rc = sm_strcasecmp(item, (*top)->lrl_data[p]->lr_search);
590 if (rc == 0)
591 rc = type - (*top)->lrl_data[p]->lr_type;
592
593 if (rc < 0)
594 m = p - 1;
595 else if (rc > 0)
596 n = p + 1;
597 else
598 return (*top)->lrl_data[p];
599
600 if (m == -1)
601 insertat = 0;
602 else if (n >= (*top)->lrl_cnt)
603 insertat = (*top)->lrl_cnt;
604 else if (m < n)
605 insertat = m + 1;
606 }
607
608 /*
609 ** Not found in list, make room
610 ** at insert point and add it.
611 */
612
613 newe = sm_rpool_malloc_x(rpool, sizeof *newe);
614 if (newe != NULL)
615 {
616 moveb = ((*top)->lrl_cnt - insertat) * sizeof *((*top)->lrl_data);
617 if (moveb > 0)
618 memmove(&((*top)->lrl_data[insertat + 1]),
619 &((*top)->lrl_data[insertat]),
620 moveb);
621
622 newe->lr_search = sm_rpool_strdup_x(rpool, item);
623 newe->lr_type = type;
624 newe->lr_ludp = NULL;
625 newe->lr_attrs = NULL;
626 newe->lr_done = false;
627
628 ((*top)->lrl_data)[insertat] = newe;
629 (*top)->lrl_cnt++;
630 }
631 return newe;
632 }
633
634 int
635 sm_ldap_results(lmap, msgid, flags, delim, rpool, result,
636 resultln, resultsz, recurse)
637 SM_LDAP_STRUCT *lmap;
638 int msgid;
639 int flags;
640 int delim;
641 SM_RPOOL_T *rpool;
642 char **result;
643 int *resultln;
644 int *resultsz;
645 SM_LDAP_RECURSE_LIST *recurse;
646 {
647 bool toplevel;
648 int i;
649 int statp;
650 int vsize;
651 int ret;
652 int save_errno;
653 char *p;
654 SM_LDAP_RECURSE_ENTRY *rl;
655
656 /* Are we the top top level of the search? */
657 toplevel = (recurse == NULL);
658
659 /* Get results */
660 statp = EX_NOTFOUND;
661 while ((ret = ldap_result(lmap->ldap_ld, msgid, 0,
662 (lmap->ldap_timeout.tv_sec == 0 ? NULL :
663 &(lmap->ldap_timeout)),
664 &(lmap->ldap_res))) == LDAP_RES_SEARCH_ENTRY)
665 {
666 LDAPMessage *entry;
667
668 /* If we don't want multiple values and we have one, break */
669 if ((char) delim == '\0' &&
670 !bitset(SM_LDAP_SINGLEMATCH, flags) &&
671 *result != NULL)
672 break;
673
674 /* Cycle through all entries */
675 for (entry = ldap_first_entry(lmap->ldap_ld, lmap->ldap_res);
676 entry != NULL;
677 entry = ldap_next_entry(lmap->ldap_ld, lmap->ldap_res))
678 {
679 BerElement *ber;
680 char *attr;
681 char **vals = NULL;
682 char *dn;
683
684 /*
685 ** If matching only and found an entry,
686 ** no need to spin through attributes
687 */
688
689 if (bitset(SM_LDAP_MATCHONLY, flags))
690 {
691 statp = EX_OK;
692 continue;
693 }
694
695 #if _FFR_LDAP_SINGLEDN
696 if (bitset(SM_LDAP_SINGLEDN, flags) && *result != NULL)
697 {
698 /* only wanted one match */
699 SM_LDAP_ERROR_CLEANUP();
700 errno = ENOENT;
701 return EX_NOTFOUND;
702 }
703 #endif /* _FFR_LDAP_SINGLEDN */
704
705 /* record completed DN's to prevent loops */
706 dn = ldap_get_dn(lmap->ldap_ld, entry);
707 if (dn == NULL)
708 {
709 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
710 save_errno += E_LDAPBASE;
711 SM_LDAP_ERROR_CLEANUP();
712 errno = save_errno;
713 return EX_TEMPFAIL;
714 }
715
716 rl = sm_ldap_add_recurse(&recurse, dn,
717 SM_LDAP_ATTR_DN,
718 rpool);
719
720 if (rl == NULL)
721 {
722 ldap_memfree(dn);
723 SM_LDAP_ERROR_CLEANUP();
724 errno = ENOMEM;
725 return EX_OSERR;
726 }
727 else if (rl->lr_done)
728 {
729 /* already on list, skip it */
730 ldap_memfree(dn);
731 continue;
732 }
733 ldap_memfree(dn);
734
735 # if !defined(LDAP_VERSION_MAX) && !defined(LDAP_OPT_SIZELIMIT)
736 /*
737 ** Reset value to prevent lingering
738 ** LDAP_DECODING_ERROR due to
739 ** OpenLDAP 1.X's hack (see below)
740 */
741
742 lmap->ldap_ld->ld_errno = LDAP_SUCCESS;
743 # endif /* !defined(LDAP_VERSION_MAX) !defined(LDAP_OPT_SIZELIMIT) */
744
745 for (attr = ldap_first_attribute(lmap->ldap_ld, entry,
746 &ber);
747 attr != NULL;
748 attr = ldap_next_attribute(lmap->ldap_ld, entry,
749 ber))
750 {
751 char *tmp, *vp_tmp;
752 int type;
753 char *needobjclass = NULL;
754
755 type = SM_LDAP_ATTR_NONE;
756 for (i = 0; lmap->ldap_attr[i] != NULL; i++)
757 {
758 if (sm_strcasecmp(lmap->ldap_attr[i],
759 attr) == 0)
760 {
761 type = lmap->ldap_attr_type[i];
762 needobjclass = lmap->ldap_attr_needobjclass[i];
763 break;
764 }
765 }
766
767 if (bitset(SM_LDAP_USE_ALLATTR, flags) &&
768 type == SM_LDAP_ATTR_NONE)
769 {
770 /* URL lookups specify attrs to use */
771 type = SM_LDAP_ATTR_NORMAL;
772 needobjclass = NULL;
773 }
774
775 if (type == SM_LDAP_ATTR_NONE)
776 {
777 /* attribute not requested */
778 ldap_memfree(attr);
779 SM_LDAP_ERROR_CLEANUP();
780 errno = EFAULT;
781 return EX_SOFTWARE;
782 }
783
784 /*
785 ** For recursion on a particular attribute,
786 ** we may need to see if this entry is
787 ** part of a particular objectclass.
788 ** Also, ignore objectClass attribute.
789 ** Otherwise we just ignore this attribute.
790 */
791
792 if (type == SM_LDAP_ATTR_OBJCLASS ||
793 (needobjclass != NULL &&
794 !sm_ldap_has_objectclass(lmap, entry,
795 needobjclass)))
796 {
797 ldap_memfree(attr);
798 continue;
799 }
800
801 if (lmap->ldap_attrsonly == LDAPMAP_FALSE)
802 {
803 vals = ldap_get_values(lmap->ldap_ld,
804 entry,
805 attr);
806 if (vals == NULL)
807 {
808 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
809 if (save_errno == LDAP_SUCCESS)
810 {
811 ldap_memfree(attr);
812 continue;
813 }
814
815 /* Must be an error */
816 save_errno += E_LDAPBASE;
817 ldap_memfree(attr);
818 SM_LDAP_ERROR_CLEANUP();
819 errno = save_errno;
820 return EX_TEMPFAIL;
821 }
822 }
823
824 statp = EX_OK;
825
826 # if !defined(LDAP_VERSION_MAX) && !defined(LDAP_OPT_SIZELIMIT)
827 /*
828 ** Reset value to prevent lingering
829 ** LDAP_DECODING_ERROR due to
830 ** OpenLDAP 1.X's hack (see below)
831 */
832
833 lmap->ldap_ld->ld_errno = LDAP_SUCCESS;
834 # endif /* !defined(LDAP_VERSION_MAX) !defined(LDAP_OPT_SIZELIMIT) */
835
836 /*
837 ** If matching only,
838 ** no need to spin through entries
839 */
840
841 if (bitset(SM_LDAP_MATCHONLY, flags))
842 {
843 if (lmap->ldap_attrsonly == LDAPMAP_FALSE)
844 ldap_value_free(vals);
845 ldap_memfree(attr);
846 continue;
847 }
848
849 /*
850 ** If we don't want multiple values,
851 ** return first found.
852 */
853
854 if ((char) delim == '\0')
855 {
856 if (*result != NULL)
857 {
858 /* already have a value */
859 if (bitset(SM_LDAP_SINGLEMATCH,
860 flags))
861 {
862 /* only wanted one match */
863 SM_LDAP_ERROR_CLEANUP();
864 errno = ENOENT;
865 return EX_NOTFOUND;
866 }
867 break;
868 }
869
870 if (lmap->ldap_attrsonly == LDAPMAP_TRUE)
871 {
872 *result = sm_rpool_strdup_x(rpool,
873 attr);
874 ldap_memfree(attr);
875 break;
876 }
877
878 if (vals[0] == NULL)
879 {
880 ldap_value_free(vals);
881 ldap_memfree(attr);
882 continue;
883 }
884
885 vsize = strlen(vals[0]) + 1;
886 if (lmap->ldap_attrsep != '\0')
887 vsize += strlen(attr) + 1;
888 *result = sm_rpool_malloc_x(rpool,
889 vsize);
890 if (lmap->ldap_attrsep != '\0')
891 sm_snprintf(*result, vsize,
892 "%s%c%s",
893 attr,
894 lmap->ldap_attrsep,
895 vals[0]);
896 else
897 sm_strlcpy(*result, vals[0],
898 vsize);
899 ldap_value_free(vals);
900 ldap_memfree(attr);
901 break;
902 }
903
904 /* attributes only */
905 if (lmap->ldap_attrsonly == LDAPMAP_TRUE)
906 {
907 if (*result == NULL)
908 *result = sm_rpool_strdup_x(rpool,
909 attr);
910 else
911 {
912 if (bitset(SM_LDAP_SINGLEMATCH,
913 flags) &&
914 *result != NULL)
915 {
916 /* only wanted one match */
917 SM_LDAP_ERROR_CLEANUP();
918 errno = ENOENT;
919 return EX_NOTFOUND;
920 }
921
922 vsize = strlen(*result) +
923 strlen(attr) + 2;
924 tmp = sm_rpool_malloc_x(rpool,
925 vsize);
926 (void) sm_snprintf(tmp,
927 vsize, "%s%c%s",
928 *result, (char) delim,
929 attr);
930 *result = tmp;
931 }
932 ldap_memfree(attr);
933 continue;
934 }
935
936 /*
937 ** If there is more than one, munge then
938 ** into a map_coldelim separated string.
939 ** If we are recursing we may have an entry
940 ** with no 'normal' values to put in the
941 ** string.
942 ** This is not an error.
943 */
944
945 if (type == SM_LDAP_ATTR_NORMAL &&
946 bitset(SM_LDAP_SINGLEMATCH, flags) &&
947 *result != NULL)
948 {
949 /* only wanted one match */
950 SM_LDAP_ERROR_CLEANUP();
951 errno = ENOENT;
952 return EX_NOTFOUND;
953 }
954
955 vsize = 0;
956 for (i = 0; vals[i] != NULL; i++)
957 {
958 if (type == SM_LDAP_ATTR_DN ||
959 type == SM_LDAP_ATTR_FILTER ||
960 type == SM_LDAP_ATTR_URL)
961 {
962 /* add to recursion */
963 if (sm_ldap_add_recurse(&recurse,
964 vals[i],
965 type,
966 rpool) == NULL)
967 {
968 SM_LDAP_ERROR_CLEANUP();
969 errno = ENOMEM;
970 return EX_OSERR;
971 }
972 continue;
973 }
974
975 vsize += strlen(vals[i]) + 1;
976 if (lmap->ldap_attrsep != '\0')
977 vsize += strlen(attr) + 1;
978 }
979
980 /*
981 ** Create/Append to string any normal
982 ** attribute values. Otherwise, just free
983 ** memory and move on to the next
984 ** attribute in this entry.
985 */
986
987 if (type == SM_LDAP_ATTR_NORMAL && vsize > 0)
988 {
989 char *pe;
990
991 /* Grow result string if needed */
992 if ((*resultln + vsize) >= *resultsz)
993 {
994 while ((*resultln + vsize) >= *resultsz)
995 {
996 if (*resultsz == 0)
997 *resultsz = 1024;
998 else
999 *resultsz *= 2;
1000 }
1001
1002 vp_tmp = sm_rpool_malloc_x(rpool, *resultsz);
1003 *vp_tmp = '\0';
1004
1005 if (*result != NULL)
1006 sm_strlcpy(vp_tmp,
1007 *result,
1008 *resultsz);
1009 *result = vp_tmp;
1010 }
1011
1012 p = *result + *resultln;
1013 pe = *result + *resultsz;
1014
1015 for (i = 0; vals[i] != NULL; i++)
1016 {
1017 if (*resultln > 0 &&
1018 p < pe)
1019 *p++ = (char) delim;
1020
1021 if (lmap->ldap_attrsep != '\0')
1022 {
1023 p += sm_strlcpy(p, attr,
1024 pe - p);
1025 if (p < pe)
1026 *p++ = lmap->ldap_attrsep;
1027 }
1028
1029 p += sm_strlcpy(p, vals[i],
1030 pe - p);
1031 *resultln = p - (*result);
1032 if (p >= pe)
1033 {
1034 /* Internal error: buffer too small for LDAP values */
1035 SM_LDAP_ERROR_CLEANUP();
1036 errno = ENOMEM;
1037 return EX_OSERR;
1038 }
1039 }
1040 }
1041
1042 ldap_value_free(vals);
1043 ldap_memfree(attr);
1044 }
1045 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1046
1047 /*
1048 ** We check save_errno != LDAP_DECODING_ERROR since
1049 ** OpenLDAP 1.X has a very ugly *undocumented*
1050 ** hack of returning this error code from
1051 ** ldap_next_attribute() if the library freed the
1052 ** ber attribute. See:
1053 ** http://www.openldap.org/lists/openldap-devel/9901/msg00064.html
1054 */
1055
1056 if (save_errno != LDAP_SUCCESS &&
1057 save_errno != LDAP_DECODING_ERROR)
1058 {
1059 /* Must be an error */
1060 save_errno += E_LDAPBASE;
1061 SM_LDAP_ERROR_CLEANUP();
1062 errno = save_errno;
1063 return EX_TEMPFAIL;
1064 }
1065
1066 /* mark this DN as done */
1067 rl->lr_done = true;
1068 if (rl->lr_ludp != NULL)
1069 {
1070 ldap_free_urldesc(rl->lr_ludp);
1071 rl->lr_ludp = NULL;
1072 }
1073 if (rl->lr_attrs != NULL)
1074 {
1075 free(rl->lr_attrs);
1076 rl->lr_attrs = NULL;
1077 }
1078
1079 /* We don't want multiple values and we have one */
1080 if ((char) delim == '\0' &&
1081 !bitset(SM_LDAP_SINGLEMATCH, flags) &&
1082 *result != NULL)
1083 break;
1084 }
1085 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1086 if (save_errno != LDAP_SUCCESS &&
1087 save_errno != LDAP_DECODING_ERROR)
1088 {
1089 /* Must be an error */
1090 save_errno += E_LDAPBASE;
1091 SM_LDAP_ERROR_CLEANUP();
1092 errno = save_errno;
1093 return EX_TEMPFAIL;
1094 }
1095 ldap_msgfree(lmap->ldap_res);
1096 lmap->ldap_res = NULL;
1097 }
1098
1099 if (ret == 0)
1100 save_errno = ETIMEDOUT;
1101 else
1102 {
1103 int rc;
1104
1105 /*
1106 ** We may have gotten an LDAP_RES_SEARCH_RESULT response
1107 ** with an error inside it, so we have to extract that
1108 ** with ldap_parse_result(). This can happen when talking
1109 ** to an LDAP proxy whose backend has gone down.
1110 */
1111
1112 save_errno = ldap_parse_result(lmap->ldap_ld, lmap->ldap_res,
1113 &rc, NULL, NULL, NULL, NULL, 0);
1114 if (save_errno == LDAP_SUCCESS)
1115 save_errno = rc;
1116 }
1117 if (save_errno != LDAP_SUCCESS)
1118 {
1119 statp = EX_TEMPFAIL;
1120 switch (save_errno)
1121 {
1122 #ifdef LDAP_SERVER_DOWN
1123 case LDAP_SERVER_DOWN:
1124 #endif /* LDAP_SERVER_DOWN */
1125 case LDAP_TIMEOUT:
1126 case ETIMEDOUT:
1127 case LDAP_UNAVAILABLE:
1128
1129 /*
1130 ** server disappeared,
1131 ** try reopen on next search
1132 */
1133
1134 statp = EX_RESTART;
1135 break;
1136 }
1137 if (ret != 0)
1138 save_errno += E_LDAPBASE;
1139 SM_LDAP_ERROR_CLEANUP();
1140 errno = save_errno;
1141 return statp;
1142 }
1143
1144 if (lmap->ldap_res != NULL)
1145 {
1146 ldap_msgfree(lmap->ldap_res);
1147 lmap->ldap_res = NULL;
1148 }
1149
1150 if (toplevel)
1151 {
1152 int rlidx;
1153
1154 /*
1155 ** Spin through the built-up recurse list at the top
1156 ** of the recursion. Since new items are added at the
1157 ** end of the shared list, we actually only ever get
1158 ** one level of recursion before things pop back to the
1159 ** top. Any items added to the list during that recursion
1160 ** will be expanded by the top level.
1161 */
1162
1163 for (rlidx = 0; recurse != NULL && rlidx < recurse->lrl_cnt;
1164 rlidx++)
1165 {
1166 int newflags;
1167 int sid;
1168 int status;
1169
1170 rl = recurse->lrl_data[rlidx];
1171
1172 newflags = flags;
1173 if (rl->lr_done)
1174 {
1175 /* already expanded */
1176 continue;
1177 }
1178
1179 if (rl->lr_type == SM_LDAP_ATTR_DN)
1180 {
1181 /* do DN search */
1182 sid = ldap_search(lmap->ldap_ld,
1183 rl->lr_search,
1184 lmap->ldap_scope,
1185 "(objectClass=*)",
1186 (lmap->ldap_attr[0] == NULL ?
1187 NULL : lmap->ldap_attr),
1188 lmap->ldap_attrsonly);
1189 }
1190 else if (rl->lr_type == SM_LDAP_ATTR_FILTER)
1191 {
1192 /* do new search */
1193 sid = ldap_search(lmap->ldap_ld,
1194 lmap->ldap_base,
1195 lmap->ldap_scope,
1196 rl->lr_search,
1197 (lmap->ldap_attr[0] == NULL ?
1198 NULL : lmap->ldap_attr),
1199 lmap->ldap_attrsonly);
1200 }
1201 else if (rl->lr_type == SM_LDAP_ATTR_URL)
1202 {
1203 /* Parse URL */
1204 sid = ldap_url_parse(rl->lr_search,
1205 &rl->lr_ludp);
1206
1207 if (sid != 0)
1208 {
1209 errno = sid + E_LDAPURLBASE;
1210 return EX_TEMPFAIL;
1211 }
1212
1213 /* We need to add objectClass */
1214 if (rl->lr_ludp->lud_attrs != NULL)
1215 {
1216 int attrnum = 0;
1217
1218 while (rl->lr_ludp->lud_attrs[attrnum] != NULL)
1219 {
1220 if (strcasecmp(rl->lr_ludp->lud_attrs[attrnum],
1221 "objectClass") == 0)
1222 {
1223 /* already requested */
1224 attrnum = -1;
1225 break;
1226 }
1227 attrnum++;
1228 }
1229
1230 if (attrnum >= 0)
1231 {
1232 int i;
1233
1234 rl->lr_attrs = (char **)malloc(sizeof(char *) * (attrnum + 2));
1235 if (rl->lr_attrs == NULL)
1236 {
1237 save_errno = errno;
1238 ldap_free_urldesc(rl->lr_ludp);
1239 errno = save_errno;
1240 return EX_TEMPFAIL;
1241 }
1242 for (i = 0 ; i < attrnum; i++)
1243 {
1244 rl->lr_attrs[i] = rl->lr_ludp->lud_attrs[i];
1245 }
1246 rl->lr_attrs[i++] = "objectClass";
1247 rl->lr_attrs[i++] = NULL;
1248 }
1249 }
1250
1251 /*
1252 ** Use the existing connection
1253 ** for this search. It really
1254 ** should use lud_scheme://lud_host:lud_port/
1255 ** instead but that would require
1256 ** opening a new connection.
1257 ** This should be fixed ASAP.
1258 */
1259
1260 sid = ldap_search(lmap->ldap_ld,
1261 rl->lr_ludp->lud_dn,
1262 rl->lr_ludp->lud_scope,
1263 rl->lr_ludp->lud_filter,
1264 rl->lr_attrs,
1265 lmap->ldap_attrsonly);
1266
1267 /* Use the attributes specified by URL */
1268 newflags |= SM_LDAP_USE_ALLATTR;
1269 }
1270 else
1271 {
1272 /* unknown or illegal attribute type */
1273 errno = EFAULT;
1274 return EX_SOFTWARE;
1275 }
1276
1277 /* Collect results */
1278 if (sid == -1)
1279 {
1280 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1281 statp = EX_TEMPFAIL;
1282 switch (save_errno)
1283 {
1284 #ifdef LDAP_SERVER_DOWN
1285 case LDAP_SERVER_DOWN:
1286 #endif /* LDAP_SERVER_DOWN */
1287 case LDAP_TIMEOUT:
1288 case ETIMEDOUT:
1289 case LDAP_UNAVAILABLE:
1290
1291 /*
1292 ** server disappeared,
1293 ** try reopen on next search
1294 */
1295
1296 statp = EX_RESTART;
1297 break;
1298 }
1299 errno = save_errno + E_LDAPBASE;
1300 return statp;
1301 }
1302
1303 status = sm_ldap_results(lmap, sid, newflags, delim,
1304 rpool, result, resultln,
1305 resultsz, recurse);
1306 save_errno = errno;
1307 if (status != EX_OK && status != EX_NOTFOUND)
1308 {
1309 errno = save_errno;
1310 return status;
1311 }
1312
1313 /* Mark as done */
1314 rl->lr_done = true;
1315 if (rl->lr_ludp != NULL)
1316 {
1317 ldap_free_urldesc(rl->lr_ludp);
1318 rl->lr_ludp = NULL;
1319 }
1320 if (rl->lr_attrs != NULL)
1321 {
1322 free(rl->lr_attrs);
1323 rl->lr_attrs = NULL;
1324 }
1325
1326 /* Reset rlidx as new items may have been added */
1327 rlidx = -1;
1328 }
1329 }
1330 return statp;
1331 }
1332
1333 /*
1334 ** SM_LDAP_CLOSE -- close LDAP connection
1335 **
1336 ** Parameters:
1337 ** lmap -- LDAP map information
1338 **
1339 ** Returns:
1340 ** None.
1341 **
1342 */
1343
1344 void
1345 sm_ldap_close(lmap)
1346 SM_LDAP_STRUCT *lmap;
1347 {
1348 if (lmap->ldap_ld == NULL)
1349 return;
1350
1351 if (lmap->ldap_pid == getpid())
1352 ldap_unbind(lmap->ldap_ld);
1353 lmap->ldap_ld = NULL;
1354 lmap->ldap_pid = 0;
1355 }
1356
1357 /*
1358 ** SM_LDAP_SETOPTS -- set LDAP options
1359 **
1360 ** Parameters:
1361 ** ld -- LDAP session handle
1362 ** lmap -- LDAP map information
1363 **
1364 ** Returns:
1365 ** None.
1366 **
1367 */
1368
1369 void
1370 sm_ldap_setopts(ld, lmap)
1371 LDAP *ld;
1372 SM_LDAP_STRUCT *lmap;
1373 {
1374 # if USE_LDAP_SET_OPTION
1375 if (lmap->ldap_version != 0)
1376 {
1377 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION,
1378 &lmap->ldap_version);
1379 }
1380 ldap_set_option(ld, LDAP_OPT_DEREF, &lmap->ldap_deref);
1381 if (bitset(LDAP_OPT_REFERRALS, lmap->ldap_options))
1382 ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON);
1383 else
1384 ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
1385 ldap_set_option(ld, LDAP_OPT_SIZELIMIT, &lmap->ldap_sizelimit);
1386 ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &lmap->ldap_timelimit);
1387 # if _FFR_LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT)
1388 if (lmap->ldap_networktmo > 0)
1389 {
1390 struct timeval tmo;
1391
1392 tmo.tv_sec = lmap->ldap_networktmo;
1393 tmo.tv_usec = 0;
1394 ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tmo);
1395 }
1396 # endif /* _FFR_LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT) */
1397 # ifdef LDAP_OPT_RESTART
1398 ldap_set_option(ld, LDAP_OPT_RESTART, LDAP_OPT_ON);
1399 # endif /* LDAP_OPT_RESTART */
1400 # else /* USE_LDAP_SET_OPTION */
1401 /* From here on in we can use ldap internal timelimits */
1402 ld->ld_deref = lmap->ldap_deref;
1403 ld->ld_options = lmap->ldap_options;
1404 ld->ld_sizelimit = lmap->ldap_sizelimit;
1405 ld->ld_timelimit = lmap->ldap_timelimit;
1406 # endif /* USE_LDAP_SET_OPTION */
1407 }
1408
1409 /*
1410 ** SM_LDAP_GETERRNO -- get ldap errno value
1411 **
1412 ** Parameters:
1413 ** ld -- LDAP session handle
1414 **
1415 ** Returns:
1416 ** LDAP errno.
1417 **
1418 */
1419
1420 int
1421 sm_ldap_geterrno(ld)
1422 LDAP *ld;
1423 {
1424 int err = LDAP_SUCCESS;
1425
1426 # if defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3
1427 (void) ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &err);
1428 # else /* defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3 */
1429 # ifdef LDAP_OPT_SIZELIMIT
1430 err = ldap_get_lderrno(ld, NULL, NULL);
1431 # else /* LDAP_OPT_SIZELIMIT */
1432 err = ld->ld_errno;
1433
1434 /*
1435 ** Reset value to prevent lingering LDAP_DECODING_ERROR due to
1436 ** OpenLDAP 1.X's hack (see above)
1437 */
1438
1439 ld->ld_errno = LDAP_SUCCESS;
1440 # endif /* LDAP_OPT_SIZELIMIT */
1441 # endif /* defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3 */
1442 return err;
1443 }
1444 # endif /* LDAPMAP */
unleashed repo fork