Copyright updates:
[exim.git] / src / src / lookups / ldap.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
1e1ddfac 6/* Copyright (c) The Exim Maintainers 2020 */
0756eb3c
PH
7/* See the file NOTICE for conditions of use and distribution. */
8
9/* Many thanks to Stuart Lynne for contributing the original code for this
4c04137d 10driver. Further contributions from Michael Haardt, Brian Candler, Barry
0756eb3c
PH
11Pederson, Peter Savitch and Christian Kellner. Particular thanks to Brian for
12researching how to handle the different kinds of error. */
13
14
15#include "../exim.h"
16#include "lf_functions.h"
0756eb3c
PH
17
18
765b530f
PH
19/* Include LDAP headers. The code below uses some "old" LDAP interfaces that
20are deprecated in OpenLDAP. I don't know their status in other LDAP
21implementations. LDAP_DEPRECATED causes their prototypes to be defined in
22ldap.h. */
23
24#define LDAP_DEPRECATED 1
0756eb3c
PH
25
26#include <lber.h>
27#include <ldap.h>
28
29
30/* Annoyingly, the different LDAP libraries handle errors in different ways,
31and some other things too. There doesn't seem to be an automatic way of
32distinguishing between them. Local/Makefile should contain a setting of
33LDAP_LIB_TYPE, which in turn causes appropriate macros to be defined for the
34different kinds. Those that matter are:
35
36LDAP_LIB_NETSCAPE
37LDAP_LIB_SOLARIS with synonym LDAP_LIB_SOLARIS7
38LDAP_LIB_OPENLDAP2
39
40These others may be defined, but are in fact the default, so are not tested:
41
42LDAP_LIB_UMICHIGAN
43LDAP_LIB_OPENLDAP1
44*/
45
46#if defined(LDAP_LIB_SOLARIS7) && ! defined(LDAP_LIB_SOLARIS)
47#define LDAP_LIB_SOLARIS
48#endif
49
50
51/* Just in case LDAP_NO_LIMIT is not defined by some of these libraries. */
52
53#ifndef LDAP_NO_LIMIT
54#define LDAP_NO_LIMIT 0
55#endif
56
57
58/* Just in case LDAP_DEREF_NEVER is not defined */
59
60#ifndef LDAP_DEREF_NEVER
61#define LDAP_DEREF_NEVER 0
62#endif
63
64
0756eb3c
PH
65/* Four types of LDAP search are implemented */
66
67#define SEARCH_LDAP_MULTIPLE 0 /* Get attributes from multiple entries */
68#define SEARCH_LDAP_SINGLE 1 /* Get attributes from one entry only */
69#define SEARCH_LDAP_DN 2 /* Get just the DN from one entry */
70#define SEARCH_LDAP_AUTH 3 /* Just checking for authentication */
71
72/* In all 4 cases, the DN is left in $ldap_dn (which post-dates the
73SEARCH_LDAP_DN lookup). */
74
75
76/* Structure and anchor for caching connections. */
77
78typedef struct ldap_connection {
79 struct ldap_connection *next;
80 uschar *host;
81 uschar *user;
82 uschar *password;
83 BOOL bound;
84 int port;
a30a8861 85 BOOL is_start_tls_called;
0756eb3c
PH
86 LDAP *ld;
87} LDAP_CONNECTION;
88
89static LDAP_CONNECTION *ldap_connections = NULL;
90
91
92
93/*************************************************
94* Internal search function *
95*************************************************/
96
97/* This is the function that actually does the work. It is called (indirectly
98via control_ldap_search) from eldap_find(), eldapauth_find(), eldapdn_find(),
99and eldapm_find(), with a difference in the "search_type" argument.
100
101The case of eldapauth_find() is special in that all it does is do
102authentication, returning OK or FAIL as appropriate. This isn't used as a
103lookup. Instead, it is called from expand.c as an expansion condition test.
104
105The DN from a successful lookup is placed in $ldap_dn. This feature postdates
106the provision of the SEARCH_LDAP_DN facility for returning just the DN as the
107data.
108
109Arguments:
110 ldap_url the URL to be looked up
111 server server host name, when URL contains none
112 s_port server port, used when URL contains no name
113 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
114 SEARCH_LDAP_SINGLE allows values from one entry only
115 SEARCH_LDAP_DN gets the DN from one entry
116 res set to point at the result (not used for ldapauth)
117 errmsg set to point a message if result is not OK
118 defer_break set TRUE if no more servers to be tried after a DEFER
119 user user name for authentication, or NULL
120 password password for authentication, or NULL
121 sizelimit max number of entries returned, or 0 for no limit
122 timelimit max time to wait, or 0 for no limit
d00328e2 123 tcplimit max time for network activity, e.g. connect, or 0 for OS default
0756eb3c
PH
124 deference the dereference option, which is one of
125 LDAP_DEREF_{NEVER,SEARCHING,FINDING,ALWAYS}
6ec97b1b 126 referrals the referral option, which is LDAP_OPT_ON or LDAP_OPT_OFF
0756eb3c
PH
127
128Returns: OK or FAIL or DEFER
129 FAIL is given only if a lookup was performed successfully, but
130 returned no data.
131*/
132
133static int
55414b25
JH
134perform_ldap_search(const uschar *ldap_url, uschar *server, int s_port,
135 int search_type, uschar **res, uschar **errmsg, BOOL *defer_break,
136 uschar *user, uschar *password, int sizelimit, int timelimit, int tcplimit,
137 int dereference, void *referrals)
0756eb3c
PH
138{
139LDAPURLDesc *ludp = NULL;
140LDAPMessage *result = NULL;
141BerElement *ber;
142LDAP_CONNECTION *lcp;
143
144struct timeval timeout;
145struct timeval *timeoutptr = NULL;
146
acec9514 147gstring * data = NULL;
0756eb3c
PH
148uschar *dn = NULL;
149uschar *host;
150uschar **values;
151uschar **firstval;
152uschar porttext[16];
153
154uschar *error1 = NULL; /* string representation of errcode (static) */
155uschar *error2 = NULL; /* error message from the server */
156uschar *matched = NULL; /* partially matched DN */
157
9494140a 158int attrs_requested = 0;
0756eb3c
PH
159int error_yield = DEFER;
160int msgid;
d38f8232 161int rc, ldap_rc, ldap_parse_rc;
0756eb3c 162int port;
0756eb3c 163int rescount = 0;
0756eb3c
PH
164BOOL attribute_found = FALSE;
165BOOL ldapi = FALSE;
166
42c7f0b4
JH
167DEBUG(D_lookup) debug_printf_indent("perform_ldap_search:"
168 " ldap%s URL = \"%s\" server=%s port=%d "
0756eb3c 169 "sizelimit=%d timelimit=%d tcplimit=%d\n",
d9cb3c45
JH
170 search_type == SEARCH_LDAP_MULTIPLE ? "m" :
171 search_type == SEARCH_LDAP_DN ? "dn" :
172 search_type == SEARCH_LDAP_AUTH ? "auth" : "",
0756eb3c
PH
173 ldap_url, server, s_port, sizelimit, timelimit, tcplimit);
174
175/* Check if LDAP thinks the URL is a valid LDAP URL. We assume that if the LDAP
176library that is in use doesn't recognize, say, "ldapi", it will barf here. */
177
178if (!ldap_is_ldap_url(CS ldap_url))
179 {
180 *errmsg = string_sprintf("ldap_is_ldap_url: not an LDAP url \"%s\"\n",
181 ldap_url);
182 goto RETURN_ERROR_BREAK;
183 }
184
185/* Parse the URL */
186
187if ((rc = ldap_url_parse(CS ldap_url, &ludp)) != 0)
188 {
189 *errmsg = string_sprintf("ldap_url_parse: (error %d) parsing \"%s\"\n", rc,
190 ldap_url);
191 goto RETURN_ERROR_BREAK;
192 }
193
194/* If the host name is empty, take it from the separate argument, if one is
195given. OpenLDAP 2.0.6 sets an unset hostname to "" rather than empty, but
196expects NULL later in ldap_init() to mean "default", annoyingly. In OpenLDAP
1972.0.11 this has changed (it uses NULL). */
198
d9cb3c45 199if ((!ludp->lud_host || !ludp->lud_host[0]) && server)
0756eb3c
PH
200 {
201 host = server;
202 port = s_port;
203 }
204else
205 {
206 host = US ludp->lud_host;
d9cb3c45 207 if (host && !host[0]) host = NULL;
0756eb3c
PH
208 port = ludp->lud_port;
209 }
210
42c7f0b4 211DEBUG(D_lookup) debug_printf_indent("after ldap_url_parse: host=%s port=%d\n",
0756eb3c
PH
212 host, port);
213
214if (port == 0) port = LDAP_PORT; /* Default if none given */
215sprintf(CS porttext, ":%d", port); /* For messages */
216
217/* If the "host name" is actually a path, we are going to connect using a Unix
218socket, regardless of whether "ldapi" was actually specified or not. This means
219that a Unix socket can be declared in eldap_default_servers, and "traditional"
220LDAP queries using just "ldap" can be used ("ldaps" is similarly overridden).
221The path may start with "/" or it may already be escaped as "%2F" if it was
222actually declared that way in eldap_default_servers. (I did it that way the
223first time.) If the host name is not a path, the use of "ldapi" causes an
224error, except in the default case. (But lud_scheme doesn't seem to exist in
225older libraries.) */
226
d9cb3c45 227if (host)
0756eb3c
PH
228 {
229 if ((host[0] == '/' || Ustrncmp(host, "%2F", 3) == 0))
230 {
231 ldapi = TRUE;
232 porttext[0] = 0; /* Remove port from messages */
233 }
234
d9cb3c45 235#if defined LDAP_LIB_OPENLDAP2
0756eb3c
PH
236 else if (strncmp(ludp->lud_scheme, "ldapi", 5) == 0)
237 {
238 *errmsg = string_sprintf("ldapi requires an absolute path (\"%s\" given)",
239 host);
240 goto RETURN_ERROR;
241 }
d9cb3c45 242#endif
0756eb3c
PH
243 }
244
245/* Count the attributes; we need this later to tell us how to format results */
246
d7978c0f 247for (uschar ** attrp = USS ludp->lud_attrs; attrp && *attrp; attrp++)
9494140a 248 attrs_requested++;
0756eb3c
PH
249
250/* See if we can find a cached connection to this host. The port is not
251relevant for ldapi. The host name pointer is set to NULL if no host was given
252(implying the library default), rather than to the empty string. Note that in
253this case, there is no difference between ldap and ldapi. */
254
d9cb3c45 255for (lcp = ldap_connections; lcp; lcp = lcp->next)
0756eb3c
PH
256 {
257 if ((host == NULL) != (lcp->host == NULL) ||
258 (host != NULL && strcmpic(lcp->host, host) != 0))
259 continue;
260 if (ldapi || port == lcp->port) break;
261 }
262
d00328e2
PH
263/* Use this network timeout in any requests. */
264
265if (tcplimit > 0)
266 {
267 timeout.tv_sec = tcplimit;
268 timeout.tv_usec = 0;
269 timeoutptr = &timeout;
270 }
271
0756eb3c
PH
272/* If no cached connection found, we must open a connection to the server. If
273the server name is actually an absolute path, we set ldapi=TRUE above. This
274requests connection via a Unix socket. However, as far as I know, only OpenLDAP
275supports the use of sockets, and the use of ldap_initialize(). */
276
d9cb3c45 277if (!lcp)
0756eb3c
PH
278 {
279 LDAP *ld;
280
d9cb3c45 281#ifdef LDAP_OPT_X_TLS_NEWCTX
5428a946
TL
282 int am_server = 0;
283 LDAP *ldsetctx;
d9cb3c45 284#else
5428a946 285 LDAP *ldsetctx = NULL;
d9cb3c45 286#endif
5428a946 287
0756eb3c
PH
288
289 /* --------------------------- OpenLDAP ------------------------ */
290
291 /* There seems to be a preference under OpenLDAP for ldap_initialize()
292 instead of ldap_init(), though I have as yet been unable to find
293 documentation that says this. (OpenLDAP documentation is sparse to
294 non-existent). So we handle OpenLDAP differently here. Also, support for
295 ldapi seems to be OpenLDAP-only at present. */
296
d9cb3c45 297#ifdef LDAP_LIB_OPENLDAP2
0756eb3c
PH
298
299 /* We now need an empty string for the default host. Get some store in which
300 to build a URL for ldap_initialize(). In the ldapi case, it can't be bigger
301 than (9 + 3*Ustrlen(shost)), whereas in the other cases it can't be bigger
302 than the host name + "ldaps:///" plus : and a port number, say 20 + the
303 length of the host name. What we get should accommodate both, easily. */
304
f3ebb786
JH
305 uschar * shost = host ? host : US"";
306 rmark reset_point = store_mark();
307 gstring * g;
0756eb3c
PH
308
309 /* Handle connection via Unix socket ("ldapi"). We build a basic LDAP URI to
310 contain the path name, with slashes escaped as %2F. */
311
312 if (ldapi)
313 {
f3ebb786
JH
314 g = string_catn(NULL, US"ldapi://", 8);
315 for (uschar ch; (ch = *shost); shost++)
316 g = ch == '/' ? string_catn(g, US"%2F", 3) : string_catn(g, shost, 1);
0756eb3c
PH
317 }
318
319 /* This is not an ldapi call. Just build a URI with the protocol type, host
320 name, and port. */
321
322 else
323 {
f3ebb786
JH
324 uschar * init_ptr = Ustrchr(ldap_url, '/');
325 g = string_catn(NULL, ldap_url, init_ptr - ldap_url);
326 g = string_fmt_append(g, "//%s:%d/", shost, port);
0756eb3c 327 }
f3ebb786 328 string_from_gstring(g);
0756eb3c
PH
329
330 /* Call ldap_initialize() and check the result */
331
f3ebb786
JH
332 DEBUG(D_lookup) debug_printf_indent("ldap_initialize with URL %s\n", g->s);
333 if ((rc = ldap_initialize(&ld, CS g->s)) != LDAP_SUCCESS)
0756eb3c
PH
334 {
335 *errmsg = string_sprintf("ldap_initialize: (error %d) URL \"%s\"\n",
f3ebb786 336 rc, g->s);
0756eb3c
PH
337 goto RETURN_ERROR;
338 }
f3ebb786 339 store_reset(reset_point); /* Might as well save memory when we can */
0756eb3c
PH
340
341
342 /* ------------------------- Not OpenLDAP ---------------------- */
343
344 /* For libraries other than OpenLDAP, use ldap_init(). */
345
d9cb3c45 346#else /* LDAP_LIB_OPENLDAP2 */
0756eb3c 347 ld = ldap_init(CS host, port);
d9cb3c45 348#endif /* LDAP_LIB_OPENLDAP2 */
0756eb3c
PH
349
350 /* -------------------------------------------------------------- */
351
352
353 /* Handle failure to initialize */
354
d9cb3c45 355 if (!ld)
0756eb3c
PH
356 {
357 *errmsg = string_sprintf("failed to initialize for LDAP server %s%s - %s",
358 host, porttext, strerror(errno));
359 goto RETURN_ERROR;
360 }
361
d9cb3c45 362#ifdef LDAP_OPT_X_TLS_NEWCTX
5428a946 363 ldsetctx = ld;
d9cb3c45 364#endif
5428a946 365
0756eb3c
PH
366 /* Set the TCP connect time limit if available. This is something that is
367 in Netscape SDK v4.1; I don't know about other libraries. */
368
d9cb3c45 369#ifdef LDAP_X_OPT_CONNECT_TIMEOUT
7c7ad977
PH
370 if (tcplimit > 0)
371 {
994a09e9 372 int timeout1000 = tcplimit*1000;
7c7ad977
PH
373 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&timeout1000);
374 }
994a09e9
PH
375 else
376 {
377 int notimeout = LDAP_X_IO_TIMEOUT_NO_TIMEOUT;
378 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&notimeout);
379 }
d9cb3c45 380#endif
0756eb3c 381
7c7ad977
PH
382 /* Set the TCP connect timeout. This works with OpenLDAP 2.2.14. */
383
d9cb3c45 384#ifdef LDAP_OPT_NETWORK_TIMEOUT
7c7ad977
PH
385 if (tcplimit > 0)
386 ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *)timeoutptr);
d9cb3c45 387#endif
7c7ad977 388
0756eb3c
PH
389 /* I could not get TLS to work until I set the version to 3. That version
390 seems to be the default nowadays. The RFC is dated 1997, so I would hope
391 that all the LDAP libraries support it. Therefore, if eldap_version hasn't
392 been set, go for v3 if we can. */
393
394 if (eldap_version < 0)
395 {
d9cb3c45 396#ifdef LDAP_VERSION3
0756eb3c 397 eldap_version = LDAP_VERSION3;
d9cb3c45 398#else
0756eb3c 399 eldap_version = 2;
d9cb3c45 400#endif
0756eb3c
PH
401 }
402
d9cb3c45 403#ifdef LDAP_OPT_PROTOCOL_VERSION
0756eb3c 404 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, (void *)&eldap_version);
d9cb3c45 405#endif
0756eb3c 406
42c7f0b4 407 DEBUG(D_lookup) debug_printf_indent("initialized for LDAP (v%d) server %s%s\n",
0756eb3c
PH
408 eldap_version, host, porttext);
409
410 /* If not using ldapi and TLS is available, set appropriate TLS options: hard
411 for "ldaps" and soft otherwise. */
412
d9cb3c45 413#ifdef LDAP_OPT_X_TLS
0756eb3c
PH
414 if (!ldapi)
415 {
416 int tls_option;
d9cb3c45
JH
417# ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
418 if (eldap_require_cert)
33382dd9 419 {
d9cb3c45
JH
420 tls_option =
421 Ustrcmp(eldap_require_cert, "hard") == 0 ? LDAP_OPT_X_TLS_HARD
422 : Ustrcmp(eldap_require_cert, "demand") == 0 ? LDAP_OPT_X_TLS_DEMAND
423 : Ustrcmp(eldap_require_cert, "allow") == 0 ? LDAP_OPT_X_TLS_ALLOW
424 : Ustrcmp(eldap_require_cert, "try") == 0 ? LDAP_OPT_X_TLS_TRY
425 : LDAP_OPT_X_TLS_NEVER;
426
42c7f0b4
JH
427 DEBUG(D_lookup) debug_printf_indent(
428 "Require certificate overrides LDAP_OPT_X_TLS option (%d)\n",
429 tls_option);
33382dd9
TL
430 }
431 else
d9cb3c45 432# endif /* LDAP_OPT_X_TLS_REQUIRE_CERT */
0756eb3c
PH
433 if (strncmp(ludp->lud_scheme, "ldaps", 5) == 0)
434 {
435 tls_option = LDAP_OPT_X_TLS_HARD;
33382dd9 436 DEBUG(D_lookup)
42c7f0b4 437 debug_printf_indent("LDAP_OPT_X_TLS_HARD set due to ldaps:// URI\n");
0756eb3c
PH
438 }
439 else
440 {
441 tls_option = LDAP_OPT_X_TLS_TRY;
33382dd9 442 DEBUG(D_lookup)
42c7f0b4 443 debug_printf_indent("LDAP_OPT_X_TLS_TRY set due to ldap:// URI\n");
0756eb3c
PH
444 }
445 ldap_set_option(ld, LDAP_OPT_X_TLS, (void *)&tls_option);
446 }
d9cb3c45 447#endif /* LDAP_OPT_X_TLS */
0756eb3c 448
d9cb3c45
JH
449#ifdef LDAP_OPT_X_TLS_CACERTFILE
450 if (eldap_ca_cert_file)
5428a946 451 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CACERTFILE, eldap_ca_cert_file);
d9cb3c45
JH
452#endif
453#ifdef LDAP_OPT_X_TLS_CACERTDIR
454 if (eldap_ca_cert_dir)
5428a946 455 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CACERTDIR, eldap_ca_cert_dir);
d9cb3c45
JH
456#endif
457#ifdef LDAP_OPT_X_TLS_CERTFILE
458 if (eldap_cert_file)
5428a946 459 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CERTFILE, eldap_cert_file);
d9cb3c45
JH
460#endif
461#ifdef LDAP_OPT_X_TLS_KEYFILE
462 if (eldap_cert_key)
5428a946 463 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_KEYFILE, eldap_cert_key);
d9cb3c45
JH
464#endif
465#ifdef LDAP_OPT_X_TLS_CIPHER_SUITE
466 if (eldap_cipher_suite)
5428a946 467 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CIPHER_SUITE, eldap_cipher_suite);
d9cb3c45
JH
468#endif
469#ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
470 if (eldap_require_cert)
bc19a55b 471 {
d9cb3c45
JH
472 int cert_option =
473 Ustrcmp(eldap_require_cert, "hard") == 0 ? LDAP_OPT_X_TLS_HARD
474 : Ustrcmp(eldap_require_cert, "demand") == 0 ? LDAP_OPT_X_TLS_DEMAND
475 : Ustrcmp(eldap_require_cert, "allow") == 0 ? LDAP_OPT_X_TLS_ALLOW
476 : Ustrcmp(eldap_require_cert, "try") == 0 ? LDAP_OPT_X_TLS_TRY
477 : LDAP_OPT_X_TLS_NEVER;
478
5428a946
TL
479 /* This ldap handle is set at compile time based on client libs. Older
480 * versions want it to be global and newer versions can force a reload
481 * of the TLS context (to reload these settings we are changing from the
482 * default that loaded at instantiation). */
483 rc = ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option);
484 if (rc)
5428a946 485 DEBUG(D_lookup)
42c7f0b4 486 debug_printf_indent("Unable to set TLS require cert_option(%d) globally: %s\n",
5428a946 487 cert_option, ldap_err2string(rc));
5428a946 488 }
d9cb3c45
JH
489#endif
490#ifdef LDAP_OPT_X_TLS_NEWCTX
491 if ((rc = ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_NEWCTX, &am_server)))
5428a946 492 DEBUG(D_lookup)
42c7f0b4 493 debug_printf_indent("Unable to reload TLS context %d: %s\n",
5428a946 494 rc, ldap_err2string(rc));
bc19a55b
PP
495 #endif
496
0756eb3c
PH
497 /* Now add this connection to the chain of cached connections */
498
f3ebb786
JH
499 lcp = store_get(sizeof(LDAP_CONNECTION), FALSE);
500 lcp->host = host ? string_copy(host) : NULL;
0756eb3c
PH
501 lcp->bound = FALSE;
502 lcp->user = NULL;
503 lcp->password = NULL;
504 lcp->port = port;
505 lcp->ld = ld;
506 lcp->next = ldap_connections;
a30a8861 507 lcp->is_start_tls_called = FALSE;
0756eb3c
PH
508 ldap_connections = lcp;
509 }
510
511/* Found cached connection */
512
513else
0756eb3c 514 DEBUG(D_lookup)
42c7f0b4 515 debug_printf_indent("re-using cached connection to LDAP server %s%s\n",
0756eb3c 516 host, porttext);
0756eb3c
PH
517
518/* Bind with the user/password supplied, or an anonymous bind if these values
519are NULL, unless a cached connection is already bound with the same values. */
520
d9cb3c45
JH
521if ( !lcp->bound
522 || !lcp->user && user
523 || lcp->user && !user
524 || lcp->user && user && Ustrcmp(lcp->user, user) != 0
525 || !lcp->password && password
526 || lcp->password && !password
527 || lcp->password && password && Ustrcmp(lcp->password, password) != 0
528 )
0756eb3c 529 {
42c7f0b4 530 DEBUG(D_lookup) debug_printf_indent("%sbinding with user=%s password=%s\n",
d9cb3c45
JH
531 lcp->bound ? "re-" : "", user, password);
532
b738dd0f 533 if (eldap_start_tls && !lcp->is_start_tls_called && !ldapi)
bc19a55b 534 {
d13cdd30
PP
535#if defined(LDAP_OPT_X_TLS) && !defined(LDAP_LIB_SOLARIS)
536 /* The Oracle LDAP libraries (LDAP_LIB_TYPE=SOLARIS) don't support this.
537 * Note: moreover, they appear to now define LDAP_OPT_X_TLS and still not
538 * export an ldap_start_tls_s symbol.
539 */
540 if ( (rc = ldap_start_tls_s(lcp->ld, NULL, NULL)) != LDAP_SUCCESS)
541 {
542 *errmsg = string_sprintf("failed to initiate TLS processing on an "
543 "LDAP session to server %s%s - ldap_start_tls_s() returned %d:"
544 " %s", host, porttext, rc, ldap_err2string(rc));
545 goto RETURN_ERROR;
546 }
a30a8861 547 lcp->is_start_tls_called = TRUE;
d13cdd30 548#else
42c7f0b4 549 DEBUG(D_lookup) debug_printf_indent("TLS initiation not supported with this Exim"
d9cb3c45 550 " and your LDAP library.\n");
867fcbf5 551#endif
d13cdd30 552 }
7c7ad977
PH
553 if ((msgid = ldap_bind(lcp->ld, CS user, CS password, LDAP_AUTH_SIMPLE))
554 == -1)
0756eb3c 555 {
7c7ad977 556 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
d00328e2 557 "%s%s - ldap_bind() returned -1", host, porttext);
7c7ad977
PH
558 goto RETURN_ERROR;
559 }
0756eb3c 560
d9cb3c45 561 if ((rc = ldap_result(lcp->ld, msgid, 1, timeoutptr, &result)) <= 0)
7c7ad977
PH
562 {
563 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
8e669ac1 564 "%s%s - LDAP error: %s", host, porttext,
7c7ad977
PH
565 rc == -1 ? "result retrieval failed" : "timeout" );
566 result = NULL;
567 goto RETURN_ERROR;
568 }
569
d9cb3c45 570 rc = ldap_result2error(lcp->ld, result, 0);
7c7ad977
PH
571
572 /* Invalid credentials when just checking credentials returns FAIL. This
573 stops any further servers being tried. */
0756eb3c 574
7c7ad977
PH
575 if (search_type == SEARCH_LDAP_AUTH && rc == LDAP_INVALID_CREDENTIALS)
576 {
577 DEBUG(D_lookup)
42c7f0b4 578 debug_printf_indent("Invalid credentials: ldapauth returns FAIL\n");
7c7ad977
PH
579 error_yield = FAIL;
580 goto RETURN_ERROR_NOMSG;
581 }
0756eb3c 582
7c7ad977
PH
583 /* Otherwise we have a problem that doesn't stop further servers from being
584 tried. */
585
586 if (rc != LDAP_SUCCESS)
587 {
0756eb3c
PH
588 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
589 "%s%s - LDAP error %d: %s", host, porttext, rc, ldap_err2string(rc));
590 goto RETURN_ERROR;
591 }
592
593 /* Successful bind */
594
595 lcp->bound = TRUE;
d9cb3c45
JH
596 lcp->user = !user ? NULL : string_copy(user);
597 lcp->password = !password ? NULL : string_copy(password);
7c7ad977
PH
598
599 ldap_msgfree(result);
600 result = NULL;
0756eb3c
PH
601 }
602
603/* If we are just checking credentials, return OK. */
604
605if (search_type == SEARCH_LDAP_AUTH)
606 {
42c7f0b4 607 DEBUG(D_lookup) debug_printf_indent("Bind succeeded: ldapauth returns OK\n");
0756eb3c
PH
608 goto RETURN_OK;
609 }
610
611/* Before doing the search, set the time and size limits (if given). Here again
612the different implementations of LDAP have chosen to do things differently. */
613
614#if defined(LDAP_OPT_SIZELIMIT)
615ldap_set_option(lcp->ld, LDAP_OPT_SIZELIMIT, (void *)&sizelimit);
616ldap_set_option(lcp->ld, LDAP_OPT_TIMELIMIT, (void *)&timelimit);
617#else
618lcp->ld->ld_sizelimit = sizelimit;
619lcp->ld->ld_timelimit = timelimit;
620#endif
621
622/* Similarly for dereferencing aliases. Don't know if this is possible on
623an LDAP library without LDAP_OPT_DEREF. */
624
625#if defined(LDAP_OPT_DEREF)
626ldap_set_option(lcp->ld, LDAP_OPT_DEREF, (void *)&dereference);
627#endif
628
6ec97b1b
PH
629/* Similarly for the referral setting; should the library follow referrals that
630the LDAP server returns? The conditional is just in case someone uses a library
631without it. */
632
633#if defined(LDAP_OPT_REFERRALS)
634ldap_set_option(lcp->ld, LDAP_OPT_REFERRALS, referrals);
635#endif
636
0756eb3c
PH
637/* Start the search on the server. */
638
42c7f0b4 639DEBUG(D_lookup) debug_printf_indent("Start search\n");
0756eb3c
PH
640
641msgid = ldap_search(lcp->ld, ludp->lud_dn, ludp->lud_scope, ludp->lud_filter,
642 ludp->lud_attrs, 0);
643
644if (msgid == -1)
645 {
d9cb3c45 646#if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
3ca0ba97
PH
647 int err;
648 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
8e669ac1 649 *errmsg = string_sprintf("ldap_search failed: %d, %s", err,
3ca0ba97 650 ldap_err2string(err));
d9cb3c45 651#else
3ca0ba97 652 *errmsg = string_sprintf("ldap_search failed");
d9cb3c45 653#endif
8e669ac1 654
0756eb3c
PH
655 goto RETURN_ERROR;
656 }
657
658/* Loop to pick up results as they come in, setting a timeout if one was
659given. */
660
0756eb3c
PH
661while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
662 LDAP_RES_SEARCH_ENTRY)
663 {
664 LDAPMessage *e;
bb4fd71d
HSHR
665 int valuecount; /* We can see an attr spread across several
666 entries. If B is derived from A and we request
667 A and the directory contains both, A and B,
668 then we get two entries, one for A and one for B.
669 Here we just count the values per entry */
0756eb3c 670
42c7f0b4 671 DEBUG(D_lookup) debug_printf_indent("LDAP result loop\n");
0756eb3c 672
bb4fd71d 673 for(e = ldap_first_entry(lcp->ld, result), valuecount = 0;
acec9514 674 e;
0756eb3c
PH
675 e = ldap_next_entry(lcp->ld, e))
676 {
677 uschar *new_dn;
678 BOOL insert_space = FALSE;
679
42c7f0b4 680 DEBUG(D_lookup) debug_printf_indent("LDAP entry loop\n");
0756eb3c
PH
681
682 rescount++; /* Count results */
683
684 /* Results for multiple entries values are separated by newlines. */
685
acec9514 686 if (data) data = string_catn(data, US"\n", 1);
0756eb3c
PH
687
688 /* Get the DN from the last result. */
689
d9cb3c45 690 if ((new_dn = US ldap_get_dn(lcp->ld, e)))
0756eb3c 691 {
d9cb3c45 692 if (dn)
0756eb3c 693 {
d9cb3c45 694#if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
0756eb3c 695 ldap_memfree(dn);
d9cb3c45 696#else /* OPENLDAP 1, UMich, Solaris */
0756eb3c 697 free(dn);
d9cb3c45 698#endif
0756eb3c
PH
699 }
700 /* Save for later */
701 dn = new_dn;
702 }
703
704 /* If the data we want is actually the DN rather than any attribute values,
705 (an "ldapdn" search) add it to the data string. If there are multiple
706 entries, the DNs will be concatenated, but we test for this case below, as
707 for SEARCH_LDAP_SINGLE, and give an error. */
708
d9cb3c45
JH
709 if (search_type == SEARCH_LDAP_DN) /* Do not amalgamate these into one */
710 { /* condition, because of the else */
711 if (new_dn) /* below, that's for the first only */
0756eb3c 712 {
acec9514
JH
713 data = string_cat(data, new_dn);
714 (void) string_from_gstring(data);
0756eb3c
PH
715 attribute_found = TRUE;
716 }
717 }
718
719 /* Otherwise, loop through the entry, grabbing attribute values. If there's
720 only one attribute being retrieved, no attribute name is given, and the
3a2ac12b 721 result is not quoted. Multiple values are separated by (comma).
0756eb3c 722 If more than one attribute is being retrieved, the data is given as a
3a2ac12b
HSHR
723 sequence of name=value pairs, separated by (space), with the value always in quotes.
724 If there are multiple values, they are given within the quotes, comma separated. */
0756eb3c 725
d7978c0f 726 else for (uschar * attr = US ldap_first_attribute(lcp->ld, e, &ber);
acec9514 727 attr; attr = US ldap_next_attribute(lcp->ld, e, ber))
0756eb3c 728 {
42c7f0b4 729 DEBUG(D_lookup) debug_printf_indent("LDAP attr loop\n");
bb4fd71d
HSHR
730
731 /* In case of attrs_requested == 1 we just count the values, in all other cases
732 (0, >1) we count the values per attribute */
733 if (attrs_requested != 1) valuecount = 0;
734
0756eb3c
PH
735 if (attr[0] != 0)
736 {
737 /* Get array of values for this attribute. */
738
acec9514 739 if ((firstval = values = USS ldap_get_values(lcp->ld, e, CS attr)))
0756eb3c 740 {
9494140a 741 if (attrs_requested != 1)
0756eb3c
PH
742 {
743 if (insert_space)
acec9514 744 data = string_catn(data, US" ", 1);
0756eb3c
PH
745 else
746 insert_space = TRUE;
acec9514
JH
747 data = string_cat(data, attr);
748 data = string_catn(data, US"=\"", 2);
0756eb3c
PH
749 }
750
acec9514 751 while (*values)
0756eb3c
PH
752 {
753 uschar *value = *values;
754 int len = Ustrlen(value);
bb4fd71d 755 ++valuecount;
0756eb3c 756
42c7f0b4 757 DEBUG(D_lookup) debug_printf_indent("LDAP value loop %s:%s\n", attr, value);
694678d0 758
734e448e
HSHR
759 /* In case we requested one attribute only but got several times
760 into that attr loop, we need to append the additional values.
761 (This may happen if you derive attributeTypes B and C from A and
762 then query for A.) In all other cases we detect the different
763 attribute and append only every non first value. */
0756eb3c 764
bb4fd71d 765 if (data && valuecount > 1)
acec9514 766 data = string_catn(data, US",", 1);
0756eb3c
PH
767
768 /* For multiple attributes, the data is in quotes. We must escape
7bba24eb 769 internal quotes, backslashes, newlines, and must double commas. */
0756eb3c 770
9494140a 771 if (attrs_requested != 1)
d7978c0f 772 for (int j = 0; j < len; j++)
0756eb3c
PH
773 {
774 if (value[j] == '\n')
acec9514 775 data = string_catn(data, US"\\n", 2);
7bba24eb 776 else if (value[j] == ',')
acec9514 777 data = string_catn(data, US",,", 2);
0756eb3c
PH
778 else
779 {
780 if (value[j] == '\"' || value[j] == '\\')
acec9514
JH
781 data = string_catn(data, US"\\", 1);
782 data = string_catn(data, value+j, 1);
0756eb3c
PH
783 }
784 }
0756eb3c 785
7bba24eb
JH
786 /* For single attributes, just double commas */
787
788 else
d7978c0f 789 for (int j = 0; j < len; j++)
7bba24eb 790 if (value[j] == ',')
acec9514 791 data = string_catn(data, US",,", 2);
7bba24eb 792 else
acec9514 793 data = string_catn(data, value+j, 1);
0756eb3c 794
0756eb3c
PH
795
796 /* Move on to the next value */
797
798 values++;
799 attribute_found = TRUE;
800 }
801
802 /* Closing quote at the end of the data for a named attribute. */
803
9494140a 804 if (attrs_requested != 1)
acec9514 805 data = string_catn(data, US"\"", 1);
0756eb3c
PH
806
807 /* Free the values */
808
809 ldap_value_free(CSS firstval);
810 }
811 }
812
d9cb3c45 813#if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
0756eb3c
PH
814
815 /* Netscape and OpenLDAP2 LDAP's attrs are dynamically allocated and need
816 to be freed. UMich LDAP stores them in static storage and does not require
817 this. */
818
819 ldap_memfree(attr);
d9cb3c45 820#endif
0756eb3c
PH
821 } /* End "for" loop for extracting attributes from an entry */
822 } /* End "for" loop for extracting entries from a result */
823
824 /* Free the result */
825
826 ldap_msgfree(result);
827 result = NULL;
828 } /* End "while" loop for multiple results */
829
fc8cd529
JH
830/* Terminate the dynamic string that we have built and reclaim unused store.
831In the odd case of a single attribute with zero-length value, allocate
832an empty string. */
0756eb3c 833
fc8cd529
JH
834if (!data) data = string_get(1);
835(void) string_from_gstring(data);
e59797e3 836gstring_release_unused(data);
0756eb3c
PH
837
838/* Copy the last dn into eldap_dn */
839
acec9514 840if (dn)
0756eb3c
PH
841 {
842 eldap_dn = string_copy(dn);
d9cb3c45 843#if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
0756eb3c 844 ldap_memfree(dn);
d9cb3c45 845#else /* OPENLDAP 1, UMich, Solaris */
0756eb3c 846 free(dn);
d9cb3c45 847#endif
0756eb3c
PH
848 }
849
42c7f0b4 850DEBUG(D_lookup) debug_printf_indent("search ended by ldap_result yielding %d\n",rc);
0756eb3c
PH
851
852if (rc == 0)
853 {
854 *errmsg = US"ldap_result timed out";
855 goto RETURN_ERROR;
856 }
857
858/* A return code of -1 seems to mean "ldap_result failed internally or couldn't
859provide you with a message". Other error states seem to exist where
860ldap_result() didn't give us any message from the server at all, leaving result
861set to NULL. Apparently, "the error parameters of the LDAP session handle will
862be set accordingly". That's the best we can do to retrieve an error status; we
863can't use functions like ldap_result2error because they parse a message from
864the server, which we didn't get.
865
866Annoyingly, the different implementations of LDAP have gone for different
867methods of handling error codes and generating error messages. */
868
d9cb3c45 869if (rc == -1 || !result)
0756eb3c
PH
870 {
871 int err;
42c7f0b4 872 DEBUG(D_lookup) debug_printf_indent("ldap_result failed\n");
0756eb3c 873
d9cb3c45 874#if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
0756eb3c
PH
875 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
876 *errmsg = string_sprintf("ldap_result failed: %d, %s",
877 err, ldap_err2string(err));
878
d9cb3c45 879#elif defined LDAP_LIB_NETSCAPE
0756eb3c
PH
880 /* Dubious (surely 'matched' is spurious here?) */
881 (void)ldap_get_lderrno(lcp->ld, &matched, &error1);
882 *errmsg = string_sprintf("ldap_result failed: %s (%s)", error1, matched);
883
d9cb3c45 884#else /* UMich LDAP aka OpenLDAP 1.x */
0756eb3c
PH
885 *errmsg = string_sprintf("ldap_result failed: %d, %s",
886 lcp->ld->ld_errno, ldap_err2string(lcp->ld->ld_errno));
d9cb3c45 887#endif
0756eb3c
PH
888
889 goto RETURN_ERROR;
890 }
891
892/* A return code that isn't -1 doesn't necessarily mean there were no problems
8e669ac1
PH
893with the search. The message must be an LDAP_RES_SEARCH_RESULT or
894LDAP_RES_SEARCH_REFERENCE or else it's something we can't handle. Some versions
895of LDAP do not define LDAP_RES_SEARCH_REFERENCE (LDAP v1 is one, it seems). So
3295e65b
PH
896we don't provide that functionality when we can't. :-) */
897
8e669ac1 898if (rc != LDAP_RES_SEARCH_RESULT
3295e65b
PH
899#ifdef LDAP_RES_SEARCH_REFERENCE
900 && rc != LDAP_RES_SEARCH_REFERENCE
8e669ac1 901#endif
3295e65b 902 )
0756eb3c
PH
903 {
904 *errmsg = string_sprintf("ldap_result returned unexpected code %d", rc);
905 goto RETURN_ERROR;
906 }
907
908/* We have a result message from the server. This doesn't yet mean all is well.
909We need to parse the message to find out exactly what's happened. */
910
d38f8232
PH
911#if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
912 ldap_rc = rc;
8e669ac1 913 ldap_parse_rc = ldap_parse_result(lcp->ld, result, &rc, CSS &matched,
d38f8232 914 CSS &error2, NULL, NULL, 0);
42c7f0b4 915 DEBUG(D_lookup) debug_printf_indent("ldap_parse_result: %d\n", ldap_parse_rc);
8e669ac1 916 if (ldap_parse_rc < 0 &&
3295e65b 917 (ldap_parse_rc != LDAP_NO_RESULTS_RETURNED
8e669ac1 918 #ifdef LDAP_RES_SEARCH_REFERENCE
3295e65b 919 || ldap_rc != LDAP_RES_SEARCH_REFERENCE
8e669ac1 920 #endif
3295e65b 921 ))
0756eb3c 922 {
d38f8232 923 *errmsg = string_sprintf("ldap_parse_result failed %d", ldap_parse_rc);
0756eb3c
PH
924 goto RETURN_ERROR;
925 }
926 error1 = US ldap_err2string(rc);
927
928#elif defined LDAP_LIB_NETSCAPE
929 /* Dubious (it doesn't reference 'result' at all!) */
930 rc = ldap_get_lderrno(lcp->ld, &matched, &error1);
931
932#else /* UMich LDAP aka OpenLDAP 1.x */
933 rc = ldap_result2error(lcp->ld, result, 0);
934 error1 = ldap_err2string(rc);
935 error2 = lcp->ld->ld_error;
936 matched = lcp->ld->ld_matched;
937#endif
938
939/* Process the status as follows:
940
941 (1) If we get LDAP_SIZELIMIT_EXCEEDED, just carry on, to return the
942 truncated result list.
943
21eb6e72
PH
944 (2) If we get LDAP_RES_SEARCH_REFERENCE, also just carry on. This was a
945 submitted patch that is reported to "do the right thing" with Solaris
946 LDAP libraries. (The problem it addresses apparently does not occur with
947 Open LDAP.)
948
949 (3) The range of errors defined by LDAP_NAME_ERROR generally mean "that
0756eb3c
PH
950 object does not, or cannot, exist in the database". For those cases we
951 fail the lookup.
952
21eb6e72 953 (4) All other non-successes here are treated as some kind of problem with
0756eb3c
PH
954 the lookup, so return DEFER (which is the default in error_yield).
955*/
956
42c7f0b4 957DEBUG(D_lookup) debug_printf_indent("ldap_parse_result yielded %d: %s\n",
0756eb3c
PH
958 rc, ldap_err2string(rc));
959
21eb6e72
PH
960if (rc != LDAP_SUCCESS && rc != LDAP_SIZELIMIT_EXCEEDED
961 #ifdef LDAP_RES_SEARCH_REFERENCE
962 && rc != LDAP_RES_SEARCH_REFERENCE
963 #endif
964 )
0756eb3c
PH
965 {
966 *errmsg = string_sprintf("LDAP search failed - error %d: %s%s%s%s%s",
967 rc,
d9cb3c45
JH
968 error1 ? error1 : US"",
969 error2 && error2[0] ? US"/" : US"",
970 error2 ? error2 : US"",
971 matched && matched[0] ? US"/" : US"",
972 matched ? matched : US"");
0756eb3c 973
d9cb3c45 974#if defined LDAP_NAME_ERROR
0756eb3c 975 if (LDAP_NAME_ERROR(rc))
d9cb3c45 976#elif defined NAME_ERROR /* OPENLDAP1 calls it this */
0756eb3c 977 if (NAME_ERROR(rc))
d9cb3c45 978#else
0756eb3c 979 if (rc == LDAP_NO_SUCH_OBJECT)
d9cb3c45 980#endif
0756eb3c
PH
981
982 {
42c7f0b4 983 DEBUG(D_lookup) debug_printf_indent("lookup failure forced\n");
0756eb3c
PH
984 error_yield = FAIL;
985 }
986 goto RETURN_ERROR;
987 }
988
989/* The search succeeded. Check if we have too many results */
990
991if (search_type != SEARCH_LDAP_MULTIPLE && rescount > 1)
992 {
993 *errmsg = string_sprintf("LDAP search: more than one entry (%d) was returned "
994 "(filter not specific enough?)", rescount);
995 goto RETURN_ERROR_BREAK;
996 }
997
998/* Check if we have too few (zero) entries */
999
1000if (rescount < 1)
1001 {
f3ebb786 1002 *errmsg = US"LDAP search: no results";
0756eb3c
PH
1003 error_yield = FAIL;
1004 goto RETURN_ERROR_BREAK;
1005 }
1006
1007/* If an entry was found, but it had no attributes, we behave as if no entries
1008were found, that is, the lookup failed. */
1009
1010if (!attribute_found)
1011 {
1012 *errmsg = US"LDAP search: found no attributes";
1013 error_yield = FAIL;
1014 goto RETURN_ERROR;
1015 }
1016
1017/* Otherwise, it's all worked */
1018
42c7f0b4 1019DEBUG(D_lookup) debug_printf_indent("LDAP search: returning: %s\n", data->s);
acec9514 1020*res = data->s;
0756eb3c
PH
1021
1022RETURN_OK:
d9cb3c45 1023if (result) ldap_msgfree(result);
0756eb3c
PH
1024ldap_free_urldesc(ludp);
1025return OK;
1026
1027/* Error returns */
1028
1029RETURN_ERROR_BREAK:
1030*defer_break = TRUE;
1031
1032RETURN_ERROR:
42c7f0b4 1033DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
0756eb3c
PH
1034
1035RETURN_ERROR_NOMSG:
d9cb3c45
JH
1036if (result) ldap_msgfree(result);
1037if (ludp) ldap_free_urldesc(ludp);
0756eb3c
PH
1038
1039#if defined LDAP_LIB_OPENLDAP2
d9cb3c45
JH
1040 if (error2) ldap_memfree(error2);
1041 if (matched) ldap_memfree(matched);
0756eb3c
PH
1042#endif
1043
1044return error_yield;
1045}
1046
1047
1048
1049/*************************************************
1050* Internal search control function *
1051*************************************************/
1052
1053/* This function is called from eldap_find(), eldapauth_find(), eldapdn_find(),
1054and eldapm_find() with a difference in the "search_type" argument. It controls
1055calls to perform_ldap_search() which actually does the work. We call that
1056repeatedly for certain types of defer in the case when the URL contains no host
1057name and eldap_default_servers is set to a list of servers to try. This gives
1058more control than just passing over a list of hosts to ldap_open() because it
1059handles other kinds of defer as well as just a failure to open. Note that the
1060URL is defined to contain either zero or one "hostport" only.
1061
1062Parameter data in addition to the URL can be passed as preceding text in the
1063string, as items of the form XXX=yyy. The URL itself can be detected because it
1064must begin "ldapx://", where x is empty, s, or i.
1065
1066Arguments:
1067 ldap_url the URL to be looked up, optionally preceded by other parameter
1068 settings
1069 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
1070 SEARCH_LDAP_SINGLE allows values from one entry only
1071 SEARCH_LDAP_DN gets the DN from one entry
1072 res set to point at the result
1073 errmsg set to point a message if result is not OK
1074
1075Returns: OK or FAIL or DEFER
1076*/
1077
1078static int
55414b25 1079control_ldap_search(const uschar *ldap_url, int search_type, uschar **res,
0756eb3c
PH
1080 uschar **errmsg)
1081{
1082BOOL defer_break = FALSE;
1083int timelimit = LDAP_NO_LIMIT;
1084int sizelimit = LDAP_NO_LIMIT;
7c7ad977 1085int tcplimit = 0;
0756eb3c 1086int sep = 0;
6ec97b1b
PH
1087int dereference = LDAP_DEREF_NEVER;
1088void* referrals = LDAP_OPT_ON;
55414b25
JH
1089const uschar *url = ldap_url;
1090const uschar *p;
0756eb3c
PH
1091uschar *user = NULL;
1092uschar *password = NULL;
deae092e 1093uschar *local_servers = NULL;
55414b25
JH
1094uschar *server;
1095const uschar *list;
0756eb3c
PH
1096uschar buffer[512];
1097
1098while (isspace(*url)) url++;
1099
1100/* Until the string begins "ldap", search for the other parameter settings that
1101are recognized. They are of the form NAME=VALUE, with the value being
1102optionally double-quoted. There must still be a space after it, however. No
1103NAME has the value "ldap". */
1104
1105while (strncmpic(url, US"ldap", 4) != 0)
1106 {
55414b25 1107 const uschar *name = url;
870ce70e 1108 while (*url && *url != '=') url++;
0756eb3c
PH
1109 if (*url == '=')
1110 {
1111 int namelen;
1112 uschar *value;
1113 namelen = ++url - name;
1114 value = string_dequote(&url);
1115 if (isspace(*url))
1116 {
1117 if (strncmpic(name, US"USER=", namelen) == 0) user = value;
1118 else if (strncmpic(name, US"PASS=", namelen) == 0) password = value;
1119 else if (strncmpic(name, US"SIZE=", namelen) == 0) sizelimit = Uatoi(value);
1120 else if (strncmpic(name, US"TIME=", namelen) == 0) timelimit = Uatoi(value);
7c7ad977
PH
1121 else if (strncmpic(name, US"CONNECT=", namelen) == 0) tcplimit = Uatoi(value);
1122 else if (strncmpic(name, US"NETTIME=", namelen) == 0) tcplimit = Uatoi(value);
deae092e 1123 else if (strncmpic(name, US"SERVERS=", namelen) == 0) local_servers = value;
0756eb3c
PH
1124
1125 /* Don't know if all LDAP libraries have LDAP_OPT_DEREF */
1126
1127 #ifdef LDAP_OPT_DEREF
1128 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1129 {
1130 if (strcmpic(value, US"never") == 0) dereference = LDAP_DEREF_NEVER;
1131 else if (strcmpic(value, US"searching") == 0)
1132 dereference = LDAP_DEREF_SEARCHING;
1133 else if (strcmpic(value, US"finding") == 0)
1134 dereference = LDAP_DEREF_FINDING;
1135 if (strcmpic(value, US"always") == 0) dereference = LDAP_DEREF_ALWAYS;
1136 }
1137 #else
1138 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1139 {
1140 *errmsg = string_sprintf("LDAP_OP_DEREF not defined in this LDAP "
1141 "library - cannot use \"dereference\"");
42c7f0b4 1142 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
0756eb3c
PH
1143 return DEFER;
1144 }
6ec97b1b 1145 #endif
0756eb3c 1146
6ec97b1b
PH
1147 #ifdef LDAP_OPT_REFERRALS
1148 else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
1149 {
1150 if (strcmpic(value, US"follow") == 0) referrals = LDAP_OPT_ON;
1151 else if (strcmpic(value, US"nofollow") == 0) referrals = LDAP_OPT_OFF;
1152 else
1153 {
f3ebb786 1154 *errmsg = US"LDAP option REFERRALS is not \"follow\" or \"nofollow\"";
42c7f0b4 1155 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
6ec97b1b
PH
1156 return DEFER;
1157 }
1158 }
1159 #else
1160 else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
1161 {
1162 *errmsg = string_sprintf("LDAP_OP_REFERRALS not defined in this LDAP "
1163 "library - cannot use \"referrals\"");
42c7f0b4 1164 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
6ec97b1b
PH
1165 return DEFER;
1166 }
0756eb3c
PH
1167 #endif
1168
1169 else
1170 {
1171 *errmsg =
1172 string_sprintf("unknown parameter \"%.*s\" precedes LDAP URL",
1173 namelen, name);
42c7f0b4 1174 DEBUG(D_lookup) debug_printf_indent("LDAP query error: %s\n", *errmsg);
0756eb3c
PH
1175 return DEFER;
1176 }
1177 while (isspace(*url)) url++;
1178 continue;
1179 }
1180 }
1181 *errmsg = US"malformed parameter setting precedes LDAP URL";
42c7f0b4 1182 DEBUG(D_lookup) debug_printf_indent("LDAP query error: %s\n", *errmsg);
0756eb3c
PH
1183 return DEFER;
1184 }
1185
1186/* If user is set, de-URL-quote it. Some LDAP libraries do this for themselves,
1187but it seems that not all behave like this. The DN for the user is often the
1188result of ${quote_ldap_dn:...} quoting, which does apply URL quoting, because
1189that is needed when the DN is used as a base DN in a query. Sigh. This is all
1190far too complicated. */
1191
870ce70e 1192if (user)
0756eb3c 1193 {
0756eb3c 1194 uschar *t = user;
d7978c0f 1195 for (uschar * s = user; *s != 0; s++)
0756eb3c
PH
1196 {
1197 int c, d;
1198 if (*s == '%' && isxdigit(c=s[1]) && isxdigit(d=s[2]))
1199 {
1200 c = tolower(c);
1201 d = tolower(d);
1202 *t++ =
1203 (((c >= 'a')? (10 + c - 'a') : c - '0') << 4) |
1204 ((d >= 'a')? (10 + d - 'a') : d - '0');
1205 s += 2;
1206 }
1207 else *t++ = *s;
1208 }
1209 *t = 0;
1210 }
1211
1212DEBUG(D_lookup)
42c7f0b4 1213 debug_printf_indent("LDAP parameters: user=%s pass=%s size=%d time=%d connect=%d "
6ec97b1b 1214 "dereference=%d referrals=%s\n", user, password, sizelimit, timelimit,
870ce70e 1215 tcplimit, dereference, referrals == LDAP_OPT_ON ? "on" : "off");
0756eb3c
PH
1216
1217/* If the request is just to check authentication, some credentials must
1218be given. The password must not be empty because LDAP binds with an empty
1219password are considered anonymous, and will succeed on most installations. */
1220
1221if (search_type == SEARCH_LDAP_AUTH)
1222 {
870ce70e 1223 if (!user || !password)
0756eb3c
PH
1224 {
1225 *errmsg = US"ldapauth lookups must specify the username and password";
1226 return DEFER;
1227 }
870ce70e 1228 if (!*password)
0756eb3c 1229 {
42c7f0b4 1230 DEBUG(D_lookup) debug_printf_indent("Empty password: ldapauth returns FAIL\n");
0756eb3c
PH
1231 return FAIL;
1232 }
1233 }
1234
1235/* Check for valid ldap url starters */
1236
1237p = url + 4;
1238if (tolower(*p) == 's' || tolower(*p) == 'i') p++;
1239if (Ustrncmp(p, "://", 3) != 0)
1240 {
1241 *errmsg = string_sprintf("LDAP URL does not start with \"ldap://\", "
1242 "\"ldaps://\", or \"ldapi://\" (it starts with \"%.16s...\")", url);
42c7f0b4 1243 DEBUG(D_lookup) debug_printf_indent("LDAP query error: %s\n", *errmsg);
0756eb3c
PH
1244 return DEFER;
1245 }
1246
1247/* No default servers, or URL contains a server name: just one attempt */
1248
870ce70e 1249if (!eldap_default_servers && !local_servers || p[3] != '/')
0756eb3c 1250 return perform_ldap_search(url, NULL, 0, search_type, res, errmsg,
6ec97b1b
PH
1251 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference,
1252 referrals);
0756eb3c 1253
deae092e
HS
1254/* Loop through the default servers until OK or FAIL. Use local_servers list
1255 * if defined in the lookup, otherwise use the global default list */
870ce70e
JH
1256list = !local_servers ? eldap_default_servers : local_servers;
1257while ((server = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
0756eb3c
PH
1258 {
1259 int rc;
1260 int port = 0;
1261 uschar *colon = Ustrchr(server, ':');
870ce70e 1262 if (colon)
0756eb3c
PH
1263 {
1264 *colon = 0;
1265 port = Uatoi(colon+1);
1266 }
1267 rc = perform_ldap_search(url, server, port, search_type, res, errmsg,
6ec97b1b
PH
1268 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference,
1269 referrals);
0756eb3c
PH
1270 if (rc != DEFER || defer_break) return rc;
1271 }
1272
1273return DEFER;
1274}
1275
1276
1277
1278/*************************************************
1279* Find entry point *
1280*************************************************/
1281
1282/* See local README for interface description. The different kinds of search
1283are handled by a common function, with a flag to differentiate between them.
1284The handle and filename arguments are not used. */
1285
e6d225ae 1286static int
d447dbd1 1287eldap_find(void * handle, const uschar * filename, const uschar * ldap_url,
67a57a5a
JH
1288 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
1289 const uschar * opts)
0756eb3c
PH
1290{
1291/* Keep picky compilers happy */
1292do_cache = do_cache;
1293return(control_ldap_search(ldap_url, SEARCH_LDAP_SINGLE, result, errmsg));
1294}
1295
e6d225ae 1296static int
d447dbd1 1297eldapm_find(void * handle, const uschar * filename, const uschar * ldap_url,
67a57a5a
JH
1298 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
1299 const uschar * opts)
0756eb3c
PH
1300{
1301/* Keep picky compilers happy */
1302do_cache = do_cache;
1303return(control_ldap_search(ldap_url, SEARCH_LDAP_MULTIPLE, result, errmsg));
1304}
1305
e6d225ae 1306static int
d447dbd1 1307eldapdn_find(void * handle, const uschar * filename, const uschar * ldap_url,
67a57a5a
JH
1308 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
1309 const uschar * opts)
0756eb3c
PH
1310{
1311/* Keep picky compilers happy */
1312do_cache = do_cache;
1313return(control_ldap_search(ldap_url, SEARCH_LDAP_DN, result, errmsg));
1314}
1315
1316int
d447dbd1
JH
1317eldapauth_find(void * handle, const uschar * filename, const uschar * ldap_url,
1318 int length, uschar ** result, uschar ** errmsg, uint * do_cache)
0756eb3c
PH
1319{
1320/* Keep picky compilers happy */
1321do_cache = do_cache;
1322return(control_ldap_search(ldap_url, SEARCH_LDAP_AUTH, result, errmsg));
1323}
1324
1325
1326
1327/*************************************************
1328* Open entry point *
1329*************************************************/
1330
1331/* See local README for interface description. */
1332
e6d225ae 1333static void *
d447dbd1 1334eldap_open(const uschar * filename, uschar ** errmsg)
0756eb3c
PH
1335{
1336return (void *)(1); /* Just return something non-null */
1337}
1338
1339
1340
1341/*************************************************
1342* Tidy entry point *
1343*************************************************/
1344
1345/* See local README for interface description.
1346Make sure that eldap_dn does not refer to reclaimed or worse, freed store */
1347
e6d225ae 1348static void
0756eb3c
PH
1349eldap_tidy(void)
1350{
1351LDAP_CONNECTION *lcp = NULL;
1352eldap_dn = NULL;
1353
1354while ((lcp = ldap_connections) != NULL)
1355 {
42c7f0b4 1356 DEBUG(D_lookup) debug_printf_indent("unbind LDAP connection to %s:%d\n", lcp->host,
0756eb3c 1357 lcp->port);
ff2c417d
TL
1358 if(lcp->bound == TRUE)
1359 ldap_unbind(lcp->ld);
0756eb3c
PH
1360 ldap_connections = lcp->next;
1361 }
1362}
1363
1364
1365
1366/*************************************************
1367* Quote entry point *
1368*************************************************/
1369
1370/* LDAP quoting is unbelievably messy. For a start, two different levels of
1371quoting have to be done: LDAP quoting, and URL quoting. The current
1372specification is the result of a suggestion by Brian Candler. It recognizes
1373two separate cases:
1374
1375(1) For text that appears in a search filter, the following escapes are
1376 required (see RFC 2254):
1377
1378 * -> \2A
1379 ( -> \28
1380 ) -> \29
1381 \ -> \5C
1382 NULL -> \00
1383
1384 Then the entire filter text must be URL-escaped. This kind of quoting is
1385 implemented by ${quote_ldap:....}. Note that we can never have a NULL
1386 in the input string, because that's a terminator.
1387
1388(2) For a DN that is part of a URL (i.e. the base DN), the characters
1389
1390 , + " \ < > ;
1391
1392 must be quoted by backslashing. See RFC 2253. Leading and trailing spaces
1393 must be escaped, as must a leading #. Then the string must be URL-quoted.
1394 This type of quoting is implemented by ${quote_ldap_dn:....}.
1395
1396For URL quoting, the only characters that need not be quoted are the
1397alphamerics and
1398
1399 ! $ ' ( ) * + - . _
1400
1401All the others must be hexified and preceded by %. This includes the
1402backslashes used for LDAP quoting.
1403
1404For a DN that is given in the USER parameter for authentication, we need the
1405same initial quoting as (2) but in this case, the result must NOT be
1406URL-escaped, because it isn't a URL. The way this is handled is by
1407de-URL-quoting the text when processing the USER parameter in
1408control_ldap_search() above. That means that the same quote operator can be
1409used. This has the additional advantage that spaces in the DN won't cause
1410parsing problems. For example:
1411
1412 USER=cn=${quote_ldap_dn:$1},%20dc=example,%20dc=com
1413
1414should be safe if there are spaces in $1.
1415
1416
1417Arguments:
1418 s the string to be quoted
1419 opt additional option text or NULL if none
1420 only "dn" is recognized
1421
1422Returns: the processed string or NULL for a bad option
1423*/
1424
1425
1426
1427/* The characters in this string, together with alphanumerics, never need
1428quoting in any way. */
1429
1430#define ALWAYS_LITERAL "!$'-._"
1431
1432/* The special characters in this string do not need to be URL-quoted. The set
1433is a bit larger than the general literals. */
1434
1435#define URL_NONQUOTE ALWAYS_LITERAL "()*+"
1436
1437/* The following macros define the characters that are quoted by quote_ldap and
1438quote_ldap_dn, respectively. */
1439
1440#define LDAP_QUOTE "*()\\"
1441#define LDAP_DN_QUOTE ",+\"\\<>;"
1442
1443
1444
e6d225ae 1445static uschar *
0756eb3c
PH
1446eldap_quote(uschar *s, uschar *opt)
1447{
1448register int c;
1449int count = 0;
1450int len = 0;
1451BOOL dn = FALSE;
1452uschar *t = s;
1453uschar *quoted;
1454
1455/* Test for a DN quotation. */
1456
1457if (opt != NULL)
1458 {
1459 if (Ustrcmp(opt, "dn") != 0) return NULL; /* No others recognized */
1460 dn = TRUE;
1461 }
1462
1463/* Compute how much extra store we need for the string. This doesn't have to be
1464exact as long as it isn't an underestimate. The worst case is the addition of 5
1465extra bytes for a single character. This occurs for certain characters in DNs,
1466where, for example, < turns into %5C%3C. For simplicity, we just add 5 for each
1467possibly escaped character. The really fast way would be just to test for
1468non-alphanumerics, but it is probably better to spot a few others that are
1469never escaped, because if there are no specials at all, we can avoid copying
1470the string. */
1471
1472while ((c = *t++) != 0)
1473 {
1474 len++;
1475 if (!isalnum(c) && Ustrchr(ALWAYS_LITERAL, c) == NULL) count += 5;
1476 }
1477if (count == 0) return s;
1478
1479/* Get sufficient store to hold the quoted string */
1480
f3ebb786 1481t = quoted = store_get(len + count + 1, is_tainted(s));
0756eb3c
PH
1482
1483/* Handle plain quote_ldap */
1484
1485if (!dn)
1486 {
1487 while ((c = *s++) != 0)
1488 {
1489 if (!isalnum(c))
1490 {
1491 if (Ustrchr(LDAP_QUOTE, c) != NULL)
1492 {
1493 sprintf(CS t, "%%5C%02X", c); /* e.g. * => %5C2A */
1494 t += 5;
1495 continue;
1496 }
1497 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1498 {
1499 sprintf(CS t, "%%%02X", c);
1500 t += 3;
1501 continue;
1502 }
1503 }
1504 *t++ = c; /* unquoted character */
1505 }
1506 }
1507
1508/* Handle quote_ldap_dn */
1509
1510else
1511 {
1512 uschar *ss = s + len;
1513
1514 /* Find the last char before any trailing spaces */
1515
1516 while (ss > s && ss[-1] == ' ') ss--;
1517
1518 /* Quote leading spaces and sharps */
1519
1520 for (; s < ss; s++)
1521 {
1522 if (*s != ' ' && *s != '#') break;
1523 sprintf(CS t, "%%5C%%%02X", *s);
1524 t += 6;
1525 }
1526
1527 /* Handle the rest of the string, up to the trailing spaces */
1528
1529 while (s < ss)
1530 {
1531 c = *s++;
1532 if (!isalnum(c))
1533 {
1534 if (Ustrchr(LDAP_DN_QUOTE, c) != NULL)
1535 {
f3ebb786 1536 Ustrncpy(t, US"%5C", 3); /* insert \ where needed */
0756eb3c
PH
1537 t += 3; /* fall through to check URL */
1538 }
1539 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1540 {
1541 sprintf(CS t, "%%%02X", c);
1542 t += 3;
1543 continue;
1544 }
1545 }
1546 *t++ = c; /* unquoted character, or non-URL quoted after %5C */
1547 }
1548
1549 /* Handle the trailing spaces */
1550
1551 while (*ss++ != 0)
1552 {
f3ebb786 1553 Ustrncpy(t, US"%5C%20", 6);
0756eb3c
PH
1554 t += 6;
1555 }
1556 }
1557
1558/* Terminate the new string and return */
1559
1560*t = 0;
1561return quoted;
1562}
1563
6545de78
PP
1564
1565
1566/*************************************************
1567* Version reporting entry point *
1568*************************************************/
1569
1570/* See local README for interface description. */
1571
1572#include "../version.h"
1573
1574void
1575ldap_version_report(FILE *f)
1576{
1577#ifdef DYNLOOKUP
1578fprintf(f, "Library version: LDAP: Exim version %s\n", EXIM_VERSION_STR);
1579#endif
1580}
1581
1582
e6d225ae 1583static lookup_info ldap_lookup_info = {
9f400174
JH
1584 .name = US"ldap", /* lookup name */
1585 .type = lookup_querystyle, /* query-style lookup */
1586 .open = eldap_open, /* open function */
1587 .check = NULL, /* check function */
1588 .find = eldap_find, /* find function */
1589 .close = NULL, /* no close function */
1590 .tidy = eldap_tidy, /* tidy function */
1591 .quote = eldap_quote, /* quoting function */
1592 .version_report = ldap_version_report /* version reporting */
e6d225ae
DW
1593};
1594
1595static lookup_info ldapdn_lookup_info = {
9f400174
JH
1596 .name = US"ldapdn", /* lookup name */
1597 .type = lookup_querystyle, /* query-style lookup */
1598 .open = eldap_open, /* sic */ /* open function */
1599 .check = NULL, /* check function */
1600 .find = eldapdn_find, /* find function */
1601 .close = NULL, /* no close function */
1602 .tidy = eldap_tidy, /* sic */ /* tidy function */
1603 .quote = eldap_quote, /* sic */ /* quoting function */
1604 .version_report = NULL /* no version reporting (redundant) */
e6d225ae
DW
1605};
1606
1607static lookup_info ldapm_lookup_info = {
9f400174
JH
1608 .name = US"ldapm", /* lookup name */
1609 .type = lookup_querystyle, /* query-style lookup */
1610 .open = eldap_open, /* sic */ /* open function */
1611 .check = NULL, /* check function */
1612 .find = eldapm_find, /* find function */
1613 .close = NULL, /* no close function */
1614 .tidy = eldap_tidy, /* sic */ /* tidy function */
1615 .quote = eldap_quote, /* sic */ /* quoting function */
1616 .version_report = NULL /* no version reporting (redundant) */
e6d225ae
DW
1617};
1618
1619#ifdef DYNLOOKUP
1620#define ldap_lookup_module_info _lookup_module_info
1621#endif
1622
1623static lookup_info *_lookup_list[] = { &ldap_lookup_info, &ldapdn_lookup_info, &ldapm_lookup_info };
1624lookup_module_info ldap_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 3 };
0756eb3c
PH
1625
1626/* End of lookups/ldap.c */