Add a call to PQsetNoticeProcessor() to catch PostgreSQL "notices" and
[exim.git] / src / src / lookups / ldap.c
CommitLineData
765b530f 1/* $Cambridge: exim/src/src/lookups/ldap.c,v 1.11 2006/06/27 13:39:01 ph10 Exp $ */
0756eb3c
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
d7d7b7b9 7/* Copyright (c) University of Cambridge 1995 - 2006 */
0756eb3c
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Many thanks to Stuart Lynne for contributing the original code for this
11driver. Further contibutions from Michael Haardt, Brian Candler, Barry
12Pederson, Peter Savitch and Christian Kellner. Particular thanks to Brian for
13researching how to handle the different kinds of error. */
14
15
16#include "../exim.h"
17#include "lf_functions.h"
18#include "ldap.h"
19
20
21/* We can't just compile this code and allow the library mechanism to omit the
22functions if they are not wanted, because we need to have the LDAP headers
23available for compiling. Therefore, compile these functions only if LOOKUP_LDAP
24is defined. However, some compilers don't like compiling empty modules, so keep
25them happy with a dummy when skipping the rest. Make it reference itself to
26stop picky compilers complaining that it is unused, and put in a dummy argument
27to stop even pickier compilers complaining about infinite loops. */
28
29#ifndef LOOKUP_LDAP
30static void dummy(int x) { dummy(x-1); }
31#else
32
33
765b530f
PH
34/* Include LDAP headers. The code below uses some "old" LDAP interfaces that
35are deprecated in OpenLDAP. I don't know their status in other LDAP
36implementations. LDAP_DEPRECATED causes their prototypes to be defined in
37ldap.h. */
38
39#define LDAP_DEPRECATED 1
0756eb3c
PH
40
41#include <lber.h>
42#include <ldap.h>
43
44
45/* Annoyingly, the different LDAP libraries handle errors in different ways,
46and some other things too. There doesn't seem to be an automatic way of
47distinguishing between them. Local/Makefile should contain a setting of
48LDAP_LIB_TYPE, which in turn causes appropriate macros to be defined for the
49different kinds. Those that matter are:
50
51LDAP_LIB_NETSCAPE
52LDAP_LIB_SOLARIS with synonym LDAP_LIB_SOLARIS7
53LDAP_LIB_OPENLDAP2
54
55These others may be defined, but are in fact the default, so are not tested:
56
57LDAP_LIB_UMICHIGAN
58LDAP_LIB_OPENLDAP1
59*/
60
61#if defined(LDAP_LIB_SOLARIS7) && ! defined(LDAP_LIB_SOLARIS)
62#define LDAP_LIB_SOLARIS
63#endif
64
65
66/* Just in case LDAP_NO_LIMIT is not defined by some of these libraries. */
67
68#ifndef LDAP_NO_LIMIT
69#define LDAP_NO_LIMIT 0
70#endif
71
72
73/* Just in case LDAP_DEREF_NEVER is not defined */
74
75#ifndef LDAP_DEREF_NEVER
76#define LDAP_DEREF_NEVER 0
77#endif
78
79
0756eb3c
PH
80/* Four types of LDAP search are implemented */
81
82#define SEARCH_LDAP_MULTIPLE 0 /* Get attributes from multiple entries */
83#define SEARCH_LDAP_SINGLE 1 /* Get attributes from one entry only */
84#define SEARCH_LDAP_DN 2 /* Get just the DN from one entry */
85#define SEARCH_LDAP_AUTH 3 /* Just checking for authentication */
86
87/* In all 4 cases, the DN is left in $ldap_dn (which post-dates the
88SEARCH_LDAP_DN lookup). */
89
90
91/* Structure and anchor for caching connections. */
92
93typedef struct ldap_connection {
94 struct ldap_connection *next;
95 uschar *host;
96 uschar *user;
97 uschar *password;
98 BOOL bound;
99 int port;
100 LDAP *ld;
101} LDAP_CONNECTION;
102
103static LDAP_CONNECTION *ldap_connections = NULL;
104
105
106
107/*************************************************
108* Internal search function *
109*************************************************/
110
111/* This is the function that actually does the work. It is called (indirectly
112via control_ldap_search) from eldap_find(), eldapauth_find(), eldapdn_find(),
113and eldapm_find(), with a difference in the "search_type" argument.
114
115The case of eldapauth_find() is special in that all it does is do
116authentication, returning OK or FAIL as appropriate. This isn't used as a
117lookup. Instead, it is called from expand.c as an expansion condition test.
118
119The DN from a successful lookup is placed in $ldap_dn. This feature postdates
120the provision of the SEARCH_LDAP_DN facility for returning just the DN as the
121data.
122
123Arguments:
124 ldap_url the URL to be looked up
125 server server host name, when URL contains none
126 s_port server port, used when URL contains no name
127 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
128 SEARCH_LDAP_SINGLE allows values from one entry only
129 SEARCH_LDAP_DN gets the DN from one entry
130 res set to point at the result (not used for ldapauth)
131 errmsg set to point a message if result is not OK
132 defer_break set TRUE if no more servers to be tried after a DEFER
133 user user name for authentication, or NULL
134 password password for authentication, or NULL
135 sizelimit max number of entries returned, or 0 for no limit
136 timelimit max time to wait, or 0 for no limit
d00328e2 137 tcplimit max time for network activity, e.g. connect, or 0 for OS default
0756eb3c
PH
138 deference the dereference option, which is one of
139 LDAP_DEREF_{NEVER,SEARCHING,FINDING,ALWAYS}
140
141Returns: OK or FAIL or DEFER
142 FAIL is given only if a lookup was performed successfully, but
143 returned no data.
144*/
145
146static int
147perform_ldap_search(uschar *ldap_url, uschar *server, int s_port, int search_type,
148 uschar **res, uschar **errmsg, BOOL *defer_break, uschar *user, uschar *password,
149 int sizelimit, int timelimit, int tcplimit, int dereference)
150{
151LDAPURLDesc *ludp = NULL;
152LDAPMessage *result = NULL;
153BerElement *ber;
154LDAP_CONNECTION *lcp;
155
156struct timeval timeout;
157struct timeval *timeoutptr = NULL;
158
159uschar *attr;
160uschar **attrp;
161uschar *data = NULL;
162uschar *dn = NULL;
163uschar *host;
164uschar **values;
165uschar **firstval;
166uschar porttext[16];
167
168uschar *error1 = NULL; /* string representation of errcode (static) */
169uschar *error2 = NULL; /* error message from the server */
170uschar *matched = NULL; /* partially matched DN */
171
172int attr_count = 0;
173int error_yield = DEFER;
174int msgid;
d38f8232 175int rc, ldap_rc, ldap_parse_rc;
0756eb3c
PH
176int port;
177int ptr = 0;
178int rescount = 0;
179int size = 0;
180BOOL attribute_found = FALSE;
181BOOL ldapi = FALSE;
182
183DEBUG(D_lookup)
184 debug_printf("perform_ldap_search: ldap%s URL = \"%s\" server=%s port=%d "
185 "sizelimit=%d timelimit=%d tcplimit=%d\n",
186 (search_type == SEARCH_LDAP_MULTIPLE)? "m" :
187 (search_type == SEARCH_LDAP_DN)? "dn" :
188 (search_type == SEARCH_LDAP_AUTH)? "auth" : "",
189 ldap_url, server, s_port, sizelimit, timelimit, tcplimit);
190
191/* Check if LDAP thinks the URL is a valid LDAP URL. We assume that if the LDAP
192library that is in use doesn't recognize, say, "ldapi", it will barf here. */
193
194if (!ldap_is_ldap_url(CS ldap_url))
195 {
196 *errmsg = string_sprintf("ldap_is_ldap_url: not an LDAP url \"%s\"\n",
197 ldap_url);
198 goto RETURN_ERROR_BREAK;
199 }
200
201/* Parse the URL */
202
203if ((rc = ldap_url_parse(CS ldap_url, &ludp)) != 0)
204 {
205 *errmsg = string_sprintf("ldap_url_parse: (error %d) parsing \"%s\"\n", rc,
206 ldap_url);
207 goto RETURN_ERROR_BREAK;
208 }
209
210/* If the host name is empty, take it from the separate argument, if one is
211given. OpenLDAP 2.0.6 sets an unset hostname to "" rather than empty, but
212expects NULL later in ldap_init() to mean "default", annoyingly. In OpenLDAP
2132.0.11 this has changed (it uses NULL). */
214
215if ((ludp->lud_host == NULL || ludp->lud_host[0] == 0) && server != NULL)
216 {
217 host = server;
218 port = s_port;
219 }
220else
221 {
222 host = US ludp->lud_host;
223 if (host != NULL && host[0] == 0) host = NULL;
224 port = ludp->lud_port;
225 }
226
227DEBUG(D_lookup) debug_printf("after ldap_url_parse: host=%s port=%d\n",
228 host, port);
229
230if (port == 0) port = LDAP_PORT; /* Default if none given */
231sprintf(CS porttext, ":%d", port); /* For messages */
232
233/* If the "host name" is actually a path, we are going to connect using a Unix
234socket, regardless of whether "ldapi" was actually specified or not. This means
235that a Unix socket can be declared in eldap_default_servers, and "traditional"
236LDAP queries using just "ldap" can be used ("ldaps" is similarly overridden).
237The path may start with "/" or it may already be escaped as "%2F" if it was
238actually declared that way in eldap_default_servers. (I did it that way the
239first time.) If the host name is not a path, the use of "ldapi" causes an
240error, except in the default case. (But lud_scheme doesn't seem to exist in
241older libraries.) */
242
243if (host != NULL)
244 {
245 if ((host[0] == '/' || Ustrncmp(host, "%2F", 3) == 0))
246 {
247 ldapi = TRUE;
248 porttext[0] = 0; /* Remove port from messages */
249 }
250
251 #if defined LDAP_LIB_OPENLDAP2
252 else if (strncmp(ludp->lud_scheme, "ldapi", 5) == 0)
253 {
254 *errmsg = string_sprintf("ldapi requires an absolute path (\"%s\" given)",
255 host);
256 goto RETURN_ERROR;
257 }
258 #endif
259 }
260
261/* Count the attributes; we need this later to tell us how to format results */
262
263for (attrp = USS ludp->lud_attrs; attrp != NULL && *attrp != NULL; attrp++)
264 attr_count++;
265
266/* See if we can find a cached connection to this host. The port is not
267relevant for ldapi. The host name pointer is set to NULL if no host was given
268(implying the library default), rather than to the empty string. Note that in
269this case, there is no difference between ldap and ldapi. */
270
271for (lcp = ldap_connections; lcp != NULL; lcp = lcp->next)
272 {
273 if ((host == NULL) != (lcp->host == NULL) ||
274 (host != NULL && strcmpic(lcp->host, host) != 0))
275 continue;
276 if (ldapi || port == lcp->port) break;
277 }
278
d00328e2
PH
279/* Use this network timeout in any requests. */
280
281if (tcplimit > 0)
282 {
283 timeout.tv_sec = tcplimit;
284 timeout.tv_usec = 0;
285 timeoutptr = &timeout;
286 }
287
0756eb3c
PH
288/* If no cached connection found, we must open a connection to the server. If
289the server name is actually an absolute path, we set ldapi=TRUE above. This
290requests connection via a Unix socket. However, as far as I know, only OpenLDAP
291supports the use of sockets, and the use of ldap_initialize(). */
292
293if (lcp == NULL)
294 {
295 LDAP *ld;
296
297
298 /* --------------------------- OpenLDAP ------------------------ */
299
300 /* There seems to be a preference under OpenLDAP for ldap_initialize()
301 instead of ldap_init(), though I have as yet been unable to find
302 documentation that says this. (OpenLDAP documentation is sparse to
303 non-existent). So we handle OpenLDAP differently here. Also, support for
304 ldapi seems to be OpenLDAP-only at present. */
305
306 #ifdef LDAP_LIB_OPENLDAP2
307
308 /* We now need an empty string for the default host. Get some store in which
309 to build a URL for ldap_initialize(). In the ldapi case, it can't be bigger
310 than (9 + 3*Ustrlen(shost)), whereas in the other cases it can't be bigger
311 than the host name + "ldaps:///" plus : and a port number, say 20 + the
312 length of the host name. What we get should accommodate both, easily. */
313
314 uschar *shost = (host == NULL)? US"" : host;
315 uschar *init_url = store_get(20 + 3 * Ustrlen(shost));
316 uschar *init_ptr;
317
318 /* Handle connection via Unix socket ("ldapi"). We build a basic LDAP URI to
319 contain the path name, with slashes escaped as %2F. */
320
321 if (ldapi)
322 {
323 int ch;
324 init_ptr = init_url + 8;
325 Ustrcpy(init_url, "ldapi://");
326 while ((ch = *shost++) != 0)
327 {
328 if (ch == '/')
329 {
330 Ustrncpy(init_ptr, "%2F", 3);
331 init_ptr += 3;
332 }
333 else *init_ptr++ = ch;
334 }
335 *init_ptr = 0;
336 }
337
338 /* This is not an ldapi call. Just build a URI with the protocol type, host
339 name, and port. */
340
341 else
342 {
343 init_ptr = Ustrchr(ldap_url, '/');
344 Ustrncpy(init_url, ldap_url, init_ptr - ldap_url);
345 init_ptr = init_url + (init_ptr - ldap_url);
346 sprintf(CS init_ptr, "//%s:%d/", shost, port);
347 }
348
349 /* Call ldap_initialize() and check the result */
350
351 DEBUG(D_lookup) debug_printf("ldap_initialize with URL %s\n", init_url);
352 rc = ldap_initialize(&ld, CS init_url);
353 if (rc != LDAP_SUCCESS)
354 {
355 *errmsg = string_sprintf("ldap_initialize: (error %d) URL \"%s\"\n",
356 rc, init_url);
357 goto RETURN_ERROR;
358 }
359 store_reset(init_url); /* Might as well save memory when we can */
360
361
362 /* ------------------------- Not OpenLDAP ---------------------- */
363
364 /* For libraries other than OpenLDAP, use ldap_init(). */
365
366 #else /* LDAP_LIB_OPENLDAP2 */
367 ld = ldap_init(CS host, port);
368 #endif /* LDAP_LIB_OPENLDAP2 */
369
370 /* -------------------------------------------------------------- */
371
372
373 /* Handle failure to initialize */
374
375 if (ld == NULL)
376 {
377 *errmsg = string_sprintf("failed to initialize for LDAP server %s%s - %s",
378 host, porttext, strerror(errno));
379 goto RETURN_ERROR;
380 }
381
382 /* Set the TCP connect time limit if available. This is something that is
383 in Netscape SDK v4.1; I don't know about other libraries. */
384
385 #ifdef LDAP_X_OPT_CONNECT_TIMEOUT
7c7ad977
PH
386 if (tcplimit > 0)
387 {
994a09e9 388 int timeout1000 = tcplimit*1000;
7c7ad977
PH
389 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&timeout1000);
390 }
994a09e9
PH
391 else
392 {
393 int notimeout = LDAP_X_IO_TIMEOUT_NO_TIMEOUT;
394 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&notimeout);
395 }
0756eb3c
PH
396 #endif
397
7c7ad977
PH
398 /* Set the TCP connect timeout. This works with OpenLDAP 2.2.14. */
399
400 #ifdef LDAP_OPT_NETWORK_TIMEOUT
401 if (tcplimit > 0)
402 ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *)timeoutptr);
8e669ac1 403 #endif
7c7ad977 404
0756eb3c
PH
405 /* I could not get TLS to work until I set the version to 3. That version
406 seems to be the default nowadays. The RFC is dated 1997, so I would hope
407 that all the LDAP libraries support it. Therefore, if eldap_version hasn't
408 been set, go for v3 if we can. */
409
410 if (eldap_version < 0)
411 {
412 #ifdef LDAP_VERSION3
413 eldap_version = LDAP_VERSION3;
414 #else
415 eldap_version = 2;
416 #endif
417 }
418
419 #ifdef LDAP_OPT_PROTOCOL_VERSION
420 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, (void *)&eldap_version);
421 #endif
422
423 DEBUG(D_lookup) debug_printf("initialized for LDAP (v%d) server %s%s\n",
424 eldap_version, host, porttext);
425
426 /* If not using ldapi and TLS is available, set appropriate TLS options: hard
427 for "ldaps" and soft otherwise. */
428
429 #ifdef LDAP_OPT_X_TLS
430 if (!ldapi)
431 {
432 int tls_option;
433 if (strncmp(ludp->lud_scheme, "ldaps", 5) == 0)
434 {
435 tls_option = LDAP_OPT_X_TLS_HARD;
436 DEBUG(D_lookup) debug_printf("LDAP_OPT_X_TLS_HARD set\n");
437 }
438 else
439 {
440 tls_option = LDAP_OPT_X_TLS_TRY;
441 DEBUG(D_lookup) debug_printf("LDAP_OPT_X_TLS_TRY set\n");
442 }
443 ldap_set_option(ld, LDAP_OPT_X_TLS, (void *)&tls_option);
444 }
445 #endif /* LDAP_OPT_X_TLS */
446
447 /* Now add this connection to the chain of cached connections */
448
449 lcp = store_get(sizeof(LDAP_CONNECTION));
450 lcp->host = (host == NULL)? NULL : string_copy(host);
451 lcp->bound = FALSE;
452 lcp->user = NULL;
453 lcp->password = NULL;
454 lcp->port = port;
455 lcp->ld = ld;
456 lcp->next = ldap_connections;
457 ldap_connections = lcp;
458 }
459
460/* Found cached connection */
461
462else
463 {
464 DEBUG(D_lookup)
465 debug_printf("re-using cached connection to LDAP server %s%s\n",
466 host, porttext);
467 }
468
469/* Bind with the user/password supplied, or an anonymous bind if these values
470are NULL, unless a cached connection is already bound with the same values. */
471
472if (!lcp->bound ||
473 (lcp->user == NULL && user != NULL) ||
474 (lcp->user != NULL && user == NULL) ||
475 (lcp->user != NULL && user != NULL && Ustrcmp(lcp->user, user) != 0) ||
476 (lcp->password == NULL && password != NULL) ||
477 (lcp->password != NULL && password == NULL) ||
478 (lcp->password != NULL && password != NULL &&
479 Ustrcmp(lcp->password, password) != 0))
480 {
481 DEBUG(D_lookup) debug_printf("%sbinding with user=%s password=%s\n",
482 (lcp->bound)? "re-" : "", user, password);
7c7ad977
PH
483 if ((msgid = ldap_bind(lcp->ld, CS user, CS password, LDAP_AUTH_SIMPLE))
484 == -1)
0756eb3c 485 {
7c7ad977 486 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
d00328e2 487 "%s%s - ldap_bind() returned -1", host, porttext);
7c7ad977
PH
488 goto RETURN_ERROR;
489 }
0756eb3c 490
7c7ad977
PH
491 if ((rc = ldap_result( lcp->ld, msgid, 1, timeoutptr, &result )) <= 0)
492 {
493 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
8e669ac1 494 "%s%s - LDAP error: %s", host, porttext,
7c7ad977
PH
495 rc == -1 ? "result retrieval failed" : "timeout" );
496 result = NULL;
497 goto RETURN_ERROR;
498 }
499
500 rc = ldap_result2error( lcp->ld, result, 0 );
501
502 /* Invalid credentials when just checking credentials returns FAIL. This
503 stops any further servers being tried. */
0756eb3c 504
7c7ad977
PH
505 if (search_type == SEARCH_LDAP_AUTH && rc == LDAP_INVALID_CREDENTIALS)
506 {
507 DEBUG(D_lookup)
508 debug_printf("Invalid credentials: ldapauth returns FAIL\n");
509 error_yield = FAIL;
510 goto RETURN_ERROR_NOMSG;
511 }
0756eb3c 512
7c7ad977
PH
513 /* Otherwise we have a problem that doesn't stop further servers from being
514 tried. */
515
516 if (rc != LDAP_SUCCESS)
517 {
0756eb3c
PH
518 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
519 "%s%s - LDAP error %d: %s", host, porttext, rc, ldap_err2string(rc));
520 goto RETURN_ERROR;
521 }
522
523 /* Successful bind */
524
525 lcp->bound = TRUE;
526 lcp->user = (user == NULL)? NULL : string_copy(user);
527 lcp->password = (password == NULL)? NULL : string_copy(password);
7c7ad977
PH
528
529 ldap_msgfree(result);
530 result = NULL;
0756eb3c
PH
531 }
532
533/* If we are just checking credentials, return OK. */
534
535if (search_type == SEARCH_LDAP_AUTH)
536 {
537 DEBUG(D_lookup) debug_printf("Bind succeeded: ldapauth returns OK\n");
538 goto RETURN_OK;
539 }
540
541/* Before doing the search, set the time and size limits (if given). Here again
542the different implementations of LDAP have chosen to do things differently. */
543
544#if defined(LDAP_OPT_SIZELIMIT)
545ldap_set_option(lcp->ld, LDAP_OPT_SIZELIMIT, (void *)&sizelimit);
546ldap_set_option(lcp->ld, LDAP_OPT_TIMELIMIT, (void *)&timelimit);
547#else
548lcp->ld->ld_sizelimit = sizelimit;
549lcp->ld->ld_timelimit = timelimit;
550#endif
551
552/* Similarly for dereferencing aliases. Don't know if this is possible on
553an LDAP library without LDAP_OPT_DEREF. */
554
555#if defined(LDAP_OPT_DEREF)
556ldap_set_option(lcp->ld, LDAP_OPT_DEREF, (void *)&dereference);
557#endif
558
559/* Start the search on the server. */
560
561DEBUG(D_lookup) debug_printf("Start search\n");
562
563msgid = ldap_search(lcp->ld, ludp->lud_dn, ludp->lud_scope, ludp->lud_filter,
564 ludp->lud_attrs, 0);
565
566if (msgid == -1)
567 {
3ca0ba97
PH
568 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
569 int err;
570 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
8e669ac1 571 *errmsg = string_sprintf("ldap_search failed: %d, %s", err,
3ca0ba97 572 ldap_err2string(err));
8e669ac1
PH
573
574 #else
3ca0ba97
PH
575 *errmsg = string_sprintf("ldap_search failed");
576 #endif
8e669ac1 577
0756eb3c
PH
578 goto RETURN_ERROR;
579 }
580
581/* Loop to pick up results as they come in, setting a timeout if one was
582given. */
583
0756eb3c
PH
584while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
585 LDAP_RES_SEARCH_ENTRY)
586 {
587 LDAPMessage *e;
588
589 DEBUG(D_lookup) debug_printf("ldap_result loop\n");
590
591 for(e = ldap_first_entry(lcp->ld, result);
592 e != NULL;
593 e = ldap_next_entry(lcp->ld, e))
594 {
595 uschar *new_dn;
596 BOOL insert_space = FALSE;
597
598 DEBUG(D_lookup) debug_printf("LDAP entry loop\n");
599
600 rescount++; /* Count results */
601
602 /* Results for multiple entries values are separated by newlines. */
603
604 if (data != NULL) data = string_cat(data, &size, &ptr, US"\n", 1);
605
606 /* Get the DN from the last result. */
607
608 new_dn = US ldap_get_dn(lcp->ld, e);
609 if (new_dn != NULL)
610 {
611 if (dn != NULL)
612 {
613 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
614 ldap_memfree(dn);
615 #else /* OPENLDAP 1, UMich, Solaris */
616 free(dn);
617 #endif
618 }
619 /* Save for later */
620 dn = new_dn;
621 }
622
623 /* If the data we want is actually the DN rather than any attribute values,
624 (an "ldapdn" search) add it to the data string. If there are multiple
625 entries, the DNs will be concatenated, but we test for this case below, as
626 for SEARCH_LDAP_SINGLE, and give an error. */
627
628 if (search_type == SEARCH_LDAP_DN) /* Do not amalgamate these into one */
629 { /* condition, because of the else */
630 if (new_dn != NULL) /* below, that's for the first only */
631 {
632 data = string_cat(data, &size, &ptr, new_dn, Ustrlen(new_dn));
633 data[ptr] = 0;
634 attribute_found = TRUE;
635 }
636 }
637
638 /* Otherwise, loop through the entry, grabbing attribute values. If there's
639 only one attribute being retrieved, no attribute name is given, and the
640 result is not quoted. Multiple values are separated by (comma, space).
641 If more than one attribute is being retrieved, the data is given as a
642 sequence of name=value pairs, with the value always in quotes. If there are
643 multiple values, they are given within the quotes, comma separated. */
644
645 else for (attr = US ldap_first_attribute(lcp->ld, e, &ber);
646 attr != NULL;
647 attr = US ldap_next_attribute(lcp->ld, e, ber))
648 {
649 if (attr[0] != 0)
650 {
651 /* Get array of values for this attribute. */
652
653 if ((firstval = values = USS ldap_get_values(lcp->ld, e, CS attr))
654 != NULL)
655 {
656 if (attr_count != 1)
657 {
658 if (insert_space)
659 data = string_cat(data, &size, &ptr, US" ", 1);
660 else
661 insert_space = TRUE;
662 data = string_cat(data, &size, &ptr, attr, Ustrlen(attr));
663 data = string_cat(data, &size, &ptr, US"=\"", 2);
664 }
665
666 while (*values != NULL)
667 {
668 uschar *value = *values;
669 int len = Ustrlen(value);
670
671 DEBUG(D_lookup) debug_printf("LDAP attr loop %s:%s\n", attr, value);
672
673 if (values != firstval)
674 data = string_cat(data, &size, &ptr, US", ", 2);
675
676 /* For multiple attributes, the data is in quotes. We must escape
677 internal quotes, backslashes, newlines. */
678
679 if (attr_count != 1)
680 {
681 int j;
682 for (j = 0; j < len; j++)
683 {
684 if (value[j] == '\n')
685 data = string_cat(data, &size, &ptr, US"\\n", 2);
686 else
687 {
688 if (value[j] == '\"' || value[j] == '\\')
689 data = string_cat(data, &size, &ptr, US"\\", 1);
690 data = string_cat(data, &size, &ptr, value+j, 1);
691 }
692 }
693 }
694
695 /* For single attributes, copy the value verbatim */
696
697 else data = string_cat(data, &size, &ptr, value, len);
698
699 /* Move on to the next value */
700
701 values++;
702 attribute_found = TRUE;
703 }
704
705 /* Closing quote at the end of the data for a named attribute. */
706
707 if (attr_count != 1)
708 data = string_cat(data, &size, &ptr, US"\"", 1);
709
710 /* Free the values */
711
712 ldap_value_free(CSS firstval);
713 }
714 }
715
716 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
717
718 /* Netscape and OpenLDAP2 LDAP's attrs are dynamically allocated and need
719 to be freed. UMich LDAP stores them in static storage and does not require
720 this. */
721
722 ldap_memfree(attr);
723 #endif
724 } /* End "for" loop for extracting attributes from an entry */
725 } /* End "for" loop for extracting entries from a result */
726
727 /* Free the result */
728
729 ldap_msgfree(result);
730 result = NULL;
731 } /* End "while" loop for multiple results */
732
733/* Terminate the dynamic string that we have built and reclaim unused store */
734
735if (data != NULL)
736 {
737 data[ptr] = 0;
738 store_reset(data + ptr + 1);
739 }
740
741/* Copy the last dn into eldap_dn */
742
743if (dn != NULL)
744 {
745 eldap_dn = string_copy(dn);
746 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
747 ldap_memfree(dn);
748 #else /* OPENLDAP 1, UMich, Solaris */
749 free(dn);
750 #endif
751 }
752
753DEBUG(D_lookup) debug_printf("search ended by ldap_result yielding %d\n",rc);
754
755if (rc == 0)
756 {
757 *errmsg = US"ldap_result timed out";
758 goto RETURN_ERROR;
759 }
760
761/* A return code of -1 seems to mean "ldap_result failed internally or couldn't
762provide you with a message". Other error states seem to exist where
763ldap_result() didn't give us any message from the server at all, leaving result
764set to NULL. Apparently, "the error parameters of the LDAP session handle will
765be set accordingly". That's the best we can do to retrieve an error status; we
766can't use functions like ldap_result2error because they parse a message from
767the server, which we didn't get.
768
769Annoyingly, the different implementations of LDAP have gone for different
770methods of handling error codes and generating error messages. */
771
772if (rc == -1 || result == NULL)
773 {
774 int err;
775 DEBUG(D_lookup) debug_printf("ldap_result failed\n");
776
777 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
778 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
779 *errmsg = string_sprintf("ldap_result failed: %d, %s",
780 err, ldap_err2string(err));
781
782 #elif defined LDAP_LIB_NETSCAPE
783 /* Dubious (surely 'matched' is spurious here?) */
784 (void)ldap_get_lderrno(lcp->ld, &matched, &error1);
785 *errmsg = string_sprintf("ldap_result failed: %s (%s)", error1, matched);
786
787 #else /* UMich LDAP aka OpenLDAP 1.x */
788 *errmsg = string_sprintf("ldap_result failed: %d, %s",
789 lcp->ld->ld_errno, ldap_err2string(lcp->ld->ld_errno));
790 #endif
791
792 goto RETURN_ERROR;
793 }
794
795/* A return code that isn't -1 doesn't necessarily mean there were no problems
8e669ac1
PH
796with the search. The message must be an LDAP_RES_SEARCH_RESULT or
797LDAP_RES_SEARCH_REFERENCE or else it's something we can't handle. Some versions
798of LDAP do not define LDAP_RES_SEARCH_REFERENCE (LDAP v1 is one, it seems). So
3295e65b
PH
799we don't provide that functionality when we can't. :-) */
800
8e669ac1 801if (rc != LDAP_RES_SEARCH_RESULT
3295e65b
PH
802#ifdef LDAP_RES_SEARCH_REFERENCE
803 && rc != LDAP_RES_SEARCH_REFERENCE
8e669ac1 804#endif
3295e65b 805 )
0756eb3c
PH
806 {
807 *errmsg = string_sprintf("ldap_result returned unexpected code %d", rc);
808 goto RETURN_ERROR;
809 }
810
811/* We have a result message from the server. This doesn't yet mean all is well.
812We need to parse the message to find out exactly what's happened. */
813
d38f8232
PH
814#if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
815 ldap_rc = rc;
8e669ac1 816 ldap_parse_rc = ldap_parse_result(lcp->ld, result, &rc, CSS &matched,
d38f8232
PH
817 CSS &error2, NULL, NULL, 0);
818 DEBUG(D_lookup) debug_printf("ldap_parse_result: %d\n", ldap_parse_rc);
8e669ac1 819 if (ldap_parse_rc < 0 &&
3295e65b 820 (ldap_parse_rc != LDAP_NO_RESULTS_RETURNED
8e669ac1 821 #ifdef LDAP_RES_SEARCH_REFERENCE
3295e65b 822 || ldap_rc != LDAP_RES_SEARCH_REFERENCE
8e669ac1 823 #endif
3295e65b 824 ))
0756eb3c 825 {
d38f8232 826 *errmsg = string_sprintf("ldap_parse_result failed %d", ldap_parse_rc);
0756eb3c
PH
827 goto RETURN_ERROR;
828 }
829 error1 = US ldap_err2string(rc);
830
831#elif defined LDAP_LIB_NETSCAPE
832 /* Dubious (it doesn't reference 'result' at all!) */
833 rc = ldap_get_lderrno(lcp->ld, &matched, &error1);
834
835#else /* UMich LDAP aka OpenLDAP 1.x */
836 rc = ldap_result2error(lcp->ld, result, 0);
837 error1 = ldap_err2string(rc);
838 error2 = lcp->ld->ld_error;
839 matched = lcp->ld->ld_matched;
840#endif
841
842/* Process the status as follows:
843
844 (1) If we get LDAP_SIZELIMIT_EXCEEDED, just carry on, to return the
845 truncated result list.
846
847 (2) The range of errors defined by LDAP_NAME_ERROR generally mean "that
848 object does not, or cannot, exist in the database". For those cases we
849 fail the lookup.
850
851 (3) All other non-successes here are treated as some kind of problem with
852 the lookup, so return DEFER (which is the default in error_yield).
853*/
854
855DEBUG(D_lookup) debug_printf("ldap_parse_result yielded %d: %s\n",
856 rc, ldap_err2string(rc));
857
858if (rc != LDAP_SUCCESS && rc != LDAP_SIZELIMIT_EXCEEDED)
859 {
860 *errmsg = string_sprintf("LDAP search failed - error %d: %s%s%s%s%s",
861 rc,
862 (error1 != NULL)? error1 : US"",
863 (error2 != NULL && error2[0] != 0)? US"/" : US"",
864 (error2 != NULL)? error2 : US"",
865 (matched != NULL && matched[0] != 0)? US"/" : US"",
866 (matched != NULL)? matched : US"");
867
868 #if defined LDAP_NAME_ERROR
869 if (LDAP_NAME_ERROR(rc))
870 #elif defined NAME_ERROR /* OPENLDAP1 calls it this */
871 if (NAME_ERROR(rc))
872 #else
873 if (rc == LDAP_NO_SUCH_OBJECT)
874 #endif
875
876 {
877 DEBUG(D_lookup) debug_printf("lookup failure forced\n");
878 error_yield = FAIL;
879 }
880 goto RETURN_ERROR;
881 }
882
883/* The search succeeded. Check if we have too many results */
884
885if (search_type != SEARCH_LDAP_MULTIPLE && rescount > 1)
886 {
887 *errmsg = string_sprintf("LDAP search: more than one entry (%d) was returned "
888 "(filter not specific enough?)", rescount);
889 goto RETURN_ERROR_BREAK;
890 }
891
892/* Check if we have too few (zero) entries */
893
894if (rescount < 1)
895 {
896 *errmsg = string_sprintf("LDAP search: no results");
897 error_yield = FAIL;
898 goto RETURN_ERROR_BREAK;
899 }
900
901/* If an entry was found, but it had no attributes, we behave as if no entries
902were found, that is, the lookup failed. */
903
904if (!attribute_found)
905 {
906 *errmsg = US"LDAP search: found no attributes";
907 error_yield = FAIL;
908 goto RETURN_ERROR;
909 }
910
911/* Otherwise, it's all worked */
912
913DEBUG(D_lookup) debug_printf("LDAP search: returning: %s\n", data);
914*res = data;
915
916RETURN_OK:
917if (result != NULL) ldap_msgfree(result);
918ldap_free_urldesc(ludp);
919return OK;
920
921/* Error returns */
922
923RETURN_ERROR_BREAK:
924*defer_break = TRUE;
925
926RETURN_ERROR:
927DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
928
929RETURN_ERROR_NOMSG:
930if (result != NULL) ldap_msgfree(result);
931if (ludp != NULL) ldap_free_urldesc(ludp);
932
933#if defined LDAP_LIB_OPENLDAP2
934 if (error2 != NULL) ldap_memfree(error2);
935 if (matched != NULL) ldap_memfree(matched);
936#endif
937
938return error_yield;
939}
940
941
942
943/*************************************************
944* Internal search control function *
945*************************************************/
946
947/* This function is called from eldap_find(), eldapauth_find(), eldapdn_find(),
948and eldapm_find() with a difference in the "search_type" argument. It controls
949calls to perform_ldap_search() which actually does the work. We call that
950repeatedly for certain types of defer in the case when the URL contains no host
951name and eldap_default_servers is set to a list of servers to try. This gives
952more control than just passing over a list of hosts to ldap_open() because it
953handles other kinds of defer as well as just a failure to open. Note that the
954URL is defined to contain either zero or one "hostport" only.
955
956Parameter data in addition to the URL can be passed as preceding text in the
957string, as items of the form XXX=yyy. The URL itself can be detected because it
958must begin "ldapx://", where x is empty, s, or i.
959
960Arguments:
961 ldap_url the URL to be looked up, optionally preceded by other parameter
962 settings
963 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
964 SEARCH_LDAP_SINGLE allows values from one entry only
965 SEARCH_LDAP_DN gets the DN from one entry
966 res set to point at the result
967 errmsg set to point a message if result is not OK
968
969Returns: OK or FAIL or DEFER
970*/
971
972static int
973control_ldap_search(uschar *ldap_url, int search_type, uschar **res,
974 uschar **errmsg)
975{
976BOOL defer_break = FALSE;
977int timelimit = LDAP_NO_LIMIT;
978int sizelimit = LDAP_NO_LIMIT;
7c7ad977 979int tcplimit = 0;
0756eb3c
PH
980int dereference = LDAP_DEREF_NEVER;
981int sep = 0;
982uschar *url = ldap_url;
983uschar *p;
984uschar *user = NULL;
985uschar *password = NULL;
986uschar *server, *list;
987uschar buffer[512];
988
989while (isspace(*url)) url++;
990
991/* Until the string begins "ldap", search for the other parameter settings that
992are recognized. They are of the form NAME=VALUE, with the value being
993optionally double-quoted. There must still be a space after it, however. No
994NAME has the value "ldap". */
995
996while (strncmpic(url, US"ldap", 4) != 0)
997 {
998 uschar *name = url;
999 while (*url != 0 && *url != '=') url++;
1000 if (*url == '=')
1001 {
1002 int namelen;
1003 uschar *value;
1004 namelen = ++url - name;
1005 value = string_dequote(&url);
1006 if (isspace(*url))
1007 {
1008 if (strncmpic(name, US"USER=", namelen) == 0) user = value;
1009 else if (strncmpic(name, US"PASS=", namelen) == 0) password = value;
1010 else if (strncmpic(name, US"SIZE=", namelen) == 0) sizelimit = Uatoi(value);
1011 else if (strncmpic(name, US"TIME=", namelen) == 0) timelimit = Uatoi(value);
7c7ad977
PH
1012 else if (strncmpic(name, US"CONNECT=", namelen) == 0) tcplimit = Uatoi(value);
1013 else if (strncmpic(name, US"NETTIME=", namelen) == 0) tcplimit = Uatoi(value);
0756eb3c
PH
1014
1015 /* Don't know if all LDAP libraries have LDAP_OPT_DEREF */
1016
1017 #ifdef LDAP_OPT_DEREF
1018 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1019 {
1020 if (strcmpic(value, US"never") == 0) dereference = LDAP_DEREF_NEVER;
1021 else if (strcmpic(value, US"searching") == 0)
1022 dereference = LDAP_DEREF_SEARCHING;
1023 else if (strcmpic(value, US"finding") == 0)
1024 dereference = LDAP_DEREF_FINDING;
1025 if (strcmpic(value, US"always") == 0) dereference = LDAP_DEREF_ALWAYS;
1026 }
1027 #else
1028 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1029 {
1030 *errmsg = string_sprintf("LDAP_OP_DEREF not defined in this LDAP "
1031 "library - cannot use \"dereference\"");
1032 DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
1033 return DEFER;
1034 }
1035
1036 #endif
1037
1038 else
1039 {
1040 *errmsg =
1041 string_sprintf("unknown parameter \"%.*s\" precedes LDAP URL",
1042 namelen, name);
1043 DEBUG(D_lookup) debug_printf("LDAP query error: %s\n", *errmsg);
1044 return DEFER;
1045 }
1046 while (isspace(*url)) url++;
1047 continue;
1048 }
1049 }
1050 *errmsg = US"malformed parameter setting precedes LDAP URL";
1051 DEBUG(D_lookup) debug_printf("LDAP query error: %s\n", *errmsg);
1052 return DEFER;
1053 }
1054
1055/* If user is set, de-URL-quote it. Some LDAP libraries do this for themselves,
1056but it seems that not all behave like this. The DN for the user is often the
1057result of ${quote_ldap_dn:...} quoting, which does apply URL quoting, because
1058that is needed when the DN is used as a base DN in a query. Sigh. This is all
1059far too complicated. */
1060
1061if (user != NULL)
1062 {
1063 uschar *s;
1064 uschar *t = user;
1065 for (s = user; *s != 0; s++)
1066 {
1067 int c, d;
1068 if (*s == '%' && isxdigit(c=s[1]) && isxdigit(d=s[2]))
1069 {
1070 c = tolower(c);
1071 d = tolower(d);
1072 *t++ =
1073 (((c >= 'a')? (10 + c - 'a') : c - '0') << 4) |
1074 ((d >= 'a')? (10 + d - 'a') : d - '0');
1075 s += 2;
1076 }
1077 else *t++ = *s;
1078 }
1079 *t = 0;
1080 }
1081
1082DEBUG(D_lookup)
1083 debug_printf("LDAP parameters: user=%s pass=%s size=%d time=%d connect=%d "
1084 "dereference=%d\n", user, password, sizelimit, timelimit, tcplimit,
1085 dereference);
1086
1087/* If the request is just to check authentication, some credentials must
1088be given. The password must not be empty because LDAP binds with an empty
1089password are considered anonymous, and will succeed on most installations. */
1090
1091if (search_type == SEARCH_LDAP_AUTH)
1092 {
1093 if (user == NULL || password == NULL)
1094 {
1095 *errmsg = US"ldapauth lookups must specify the username and password";
1096 return DEFER;
1097 }
1098 if (password[0] == 0)
1099 {
1100 DEBUG(D_lookup) debug_printf("Empty password: ldapauth returns FAIL\n");
1101 return FAIL;
1102 }
1103 }
1104
1105/* Check for valid ldap url starters */
1106
1107p = url + 4;
1108if (tolower(*p) == 's' || tolower(*p) == 'i') p++;
1109if (Ustrncmp(p, "://", 3) != 0)
1110 {
1111 *errmsg = string_sprintf("LDAP URL does not start with \"ldap://\", "
1112 "\"ldaps://\", or \"ldapi://\" (it starts with \"%.16s...\")", url);
1113 DEBUG(D_lookup) debug_printf("LDAP query error: %s\n", *errmsg);
1114 return DEFER;
1115 }
1116
1117/* No default servers, or URL contains a server name: just one attempt */
1118
1119if (eldap_default_servers == NULL || p[3] != '/')
1120 {
1121 return perform_ldap_search(url, NULL, 0, search_type, res, errmsg,
1122 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference);
1123 }
1124
1125/* Loop through the default servers until OK or FAIL */
1126
1127list = eldap_default_servers;
1128while ((server = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
1129 {
1130 int rc;
1131 int port = 0;
1132 uschar *colon = Ustrchr(server, ':');
1133 if (colon != NULL)
1134 {
1135 *colon = 0;
1136 port = Uatoi(colon+1);
1137 }
1138 rc = perform_ldap_search(url, server, port, search_type, res, errmsg,
1139 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference);
1140 if (rc != DEFER || defer_break) return rc;
1141 }
1142
1143return DEFER;
1144}
1145
1146
1147
1148/*************************************************
1149* Find entry point *
1150*************************************************/
1151
1152/* See local README for interface description. The different kinds of search
1153are handled by a common function, with a flag to differentiate between them.
1154The handle and filename arguments are not used. */
1155
1156int
1157eldap_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1158 uschar **result, uschar **errmsg, BOOL *do_cache)
1159{
1160/* Keep picky compilers happy */
1161do_cache = do_cache;
1162return(control_ldap_search(ldap_url, SEARCH_LDAP_SINGLE, result, errmsg));
1163}
1164
1165int
1166eldapm_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1167 uschar **result, uschar **errmsg, BOOL *do_cache)
1168{
1169/* Keep picky compilers happy */
1170do_cache = do_cache;
1171return(control_ldap_search(ldap_url, SEARCH_LDAP_MULTIPLE, result, errmsg));
1172}
1173
1174int
1175eldapdn_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1176 uschar **result, uschar **errmsg, BOOL *do_cache)
1177{
1178/* Keep picky compilers happy */
1179do_cache = do_cache;
1180return(control_ldap_search(ldap_url, SEARCH_LDAP_DN, result, errmsg));
1181}
1182
1183int
1184eldapauth_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1185 uschar **result, uschar **errmsg, BOOL *do_cache)
1186{
1187/* Keep picky compilers happy */
1188do_cache = do_cache;
1189return(control_ldap_search(ldap_url, SEARCH_LDAP_AUTH, result, errmsg));
1190}
1191
1192
1193
1194/*************************************************
1195* Open entry point *
1196*************************************************/
1197
1198/* See local README for interface description. */
1199
1200void *
1201eldap_open(uschar *filename, uschar **errmsg)
1202{
1203return (void *)(1); /* Just return something non-null */
1204}
1205
1206
1207
1208/*************************************************
1209* Tidy entry point *
1210*************************************************/
1211
1212/* See local README for interface description.
1213Make sure that eldap_dn does not refer to reclaimed or worse, freed store */
1214
1215void
1216eldap_tidy(void)
1217{
1218LDAP_CONNECTION *lcp = NULL;
1219eldap_dn = NULL;
1220
1221while ((lcp = ldap_connections) != NULL)
1222 {
1223 DEBUG(D_lookup) debug_printf("unbind LDAP connection to %s:%d\n", lcp->host,
1224 lcp->port);
1225 ldap_unbind(lcp->ld);
1226 ldap_connections = lcp->next;
1227 }
1228}
1229
1230
1231
1232/*************************************************
1233* Quote entry point *
1234*************************************************/
1235
1236/* LDAP quoting is unbelievably messy. For a start, two different levels of
1237quoting have to be done: LDAP quoting, and URL quoting. The current
1238specification is the result of a suggestion by Brian Candler. It recognizes
1239two separate cases:
1240
1241(1) For text that appears in a search filter, the following escapes are
1242 required (see RFC 2254):
1243
1244 * -> \2A
1245 ( -> \28
1246 ) -> \29
1247 \ -> \5C
1248 NULL -> \00
1249
1250 Then the entire filter text must be URL-escaped. This kind of quoting is
1251 implemented by ${quote_ldap:....}. Note that we can never have a NULL
1252 in the input string, because that's a terminator.
1253
1254(2) For a DN that is part of a URL (i.e. the base DN), the characters
1255
1256 , + " \ < > ;
1257
1258 must be quoted by backslashing. See RFC 2253. Leading and trailing spaces
1259 must be escaped, as must a leading #. Then the string must be URL-quoted.
1260 This type of quoting is implemented by ${quote_ldap_dn:....}.
1261
1262For URL quoting, the only characters that need not be quoted are the
1263alphamerics and
1264
1265 ! $ ' ( ) * + - . _
1266
1267All the others must be hexified and preceded by %. This includes the
1268backslashes used for LDAP quoting.
1269
1270For a DN that is given in the USER parameter for authentication, we need the
1271same initial quoting as (2) but in this case, the result must NOT be
1272URL-escaped, because it isn't a URL. The way this is handled is by
1273de-URL-quoting the text when processing the USER parameter in
1274control_ldap_search() above. That means that the same quote operator can be
1275used. This has the additional advantage that spaces in the DN won't cause
1276parsing problems. For example:
1277
1278 USER=cn=${quote_ldap_dn:$1},%20dc=example,%20dc=com
1279
1280should be safe if there are spaces in $1.
1281
1282
1283Arguments:
1284 s the string to be quoted
1285 opt additional option text or NULL if none
1286 only "dn" is recognized
1287
1288Returns: the processed string or NULL for a bad option
1289*/
1290
1291
1292
1293/* The characters in this string, together with alphanumerics, never need
1294quoting in any way. */
1295
1296#define ALWAYS_LITERAL "!$'-._"
1297
1298/* The special characters in this string do not need to be URL-quoted. The set
1299is a bit larger than the general literals. */
1300
1301#define URL_NONQUOTE ALWAYS_LITERAL "()*+"
1302
1303/* The following macros define the characters that are quoted by quote_ldap and
1304quote_ldap_dn, respectively. */
1305
1306#define LDAP_QUOTE "*()\\"
1307#define LDAP_DN_QUOTE ",+\"\\<>;"
1308
1309
1310
1311uschar *
1312eldap_quote(uschar *s, uschar *opt)
1313{
1314register int c;
1315int count = 0;
1316int len = 0;
1317BOOL dn = FALSE;
1318uschar *t = s;
1319uschar *quoted;
1320
1321/* Test for a DN quotation. */
1322
1323if (opt != NULL)
1324 {
1325 if (Ustrcmp(opt, "dn") != 0) return NULL; /* No others recognized */
1326 dn = TRUE;
1327 }
1328
1329/* Compute how much extra store we need for the string. This doesn't have to be
1330exact as long as it isn't an underestimate. The worst case is the addition of 5
1331extra bytes for a single character. This occurs for certain characters in DNs,
1332where, for example, < turns into %5C%3C. For simplicity, we just add 5 for each
1333possibly escaped character. The really fast way would be just to test for
1334non-alphanumerics, but it is probably better to spot a few others that are
1335never escaped, because if there are no specials at all, we can avoid copying
1336the string. */
1337
1338while ((c = *t++) != 0)
1339 {
1340 len++;
1341 if (!isalnum(c) && Ustrchr(ALWAYS_LITERAL, c) == NULL) count += 5;
1342 }
1343if (count == 0) return s;
1344
1345/* Get sufficient store to hold the quoted string */
1346
1347t = quoted = store_get(len + count + 1);
1348
1349/* Handle plain quote_ldap */
1350
1351if (!dn)
1352 {
1353 while ((c = *s++) != 0)
1354 {
1355 if (!isalnum(c))
1356 {
1357 if (Ustrchr(LDAP_QUOTE, c) != NULL)
1358 {
1359 sprintf(CS t, "%%5C%02X", c); /* e.g. * => %5C2A */
1360 t += 5;
1361 continue;
1362 }
1363 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1364 {
1365 sprintf(CS t, "%%%02X", c);
1366 t += 3;
1367 continue;
1368 }
1369 }
1370 *t++ = c; /* unquoted character */
1371 }
1372 }
1373
1374/* Handle quote_ldap_dn */
1375
1376else
1377 {
1378 uschar *ss = s + len;
1379
1380 /* Find the last char before any trailing spaces */
1381
1382 while (ss > s && ss[-1] == ' ') ss--;
1383
1384 /* Quote leading spaces and sharps */
1385
1386 for (; s < ss; s++)
1387 {
1388 if (*s != ' ' && *s != '#') break;
1389 sprintf(CS t, "%%5C%%%02X", *s);
1390 t += 6;
1391 }
1392
1393 /* Handle the rest of the string, up to the trailing spaces */
1394
1395 while (s < ss)
1396 {
1397 c = *s++;
1398 if (!isalnum(c))
1399 {
1400 if (Ustrchr(LDAP_DN_QUOTE, c) != NULL)
1401 {
1402 Ustrncpy(t, "%5C", 3); /* insert \ where needed */
1403 t += 3; /* fall through to check URL */
1404 }
1405 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1406 {
1407 sprintf(CS t, "%%%02X", c);
1408 t += 3;
1409 continue;
1410 }
1411 }
1412 *t++ = c; /* unquoted character, or non-URL quoted after %5C */
1413 }
1414
1415 /* Handle the trailing spaces */
1416
1417 while (*ss++ != 0)
1418 {
1419 Ustrncpy(t, "%5C%20", 6);
1420 t += 6;
1421 }
1422 }
1423
1424/* Terminate the new string and return */
1425
1426*t = 0;
1427return quoted;
1428}
1429
1430#endif /* LOOKUP_LDAP */
1431
1432/* End of lookups/ldap.c */