Fix eximon continuous updating with timestamped log-files.
[exim.git] / src / src / lookups / ldap.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
c4ceed07 5/* Copyright (c) University of Cambridge 1995 - 2012 */
0756eb3c
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Many thanks to Stuart Lynne for contributing the original code for this
9driver. Further contibutions from Michael Haardt, Brian Candler, Barry
10Pederson, Peter Savitch and Christian Kellner. Particular thanks to Brian for
11researching how to handle the different kinds of error. */
12
13
14#include "../exim.h"
15#include "lf_functions.h"
0756eb3c
PH
16
17
765b530f
PH
18/* Include LDAP headers. The code below uses some "old" LDAP interfaces that
19are deprecated in OpenLDAP. I don't know their status in other LDAP
20implementations. LDAP_DEPRECATED causes their prototypes to be defined in
21ldap.h. */
22
23#define LDAP_DEPRECATED 1
0756eb3c
PH
24
25#include <lber.h>
26#include <ldap.h>
27
28
29/* Annoyingly, the different LDAP libraries handle errors in different ways,
30and some other things too. There doesn't seem to be an automatic way of
31distinguishing between them. Local/Makefile should contain a setting of
32LDAP_LIB_TYPE, which in turn causes appropriate macros to be defined for the
33different kinds. Those that matter are:
34
35LDAP_LIB_NETSCAPE
36LDAP_LIB_SOLARIS with synonym LDAP_LIB_SOLARIS7
37LDAP_LIB_OPENLDAP2
38
39These others may be defined, but are in fact the default, so are not tested:
40
41LDAP_LIB_UMICHIGAN
42LDAP_LIB_OPENLDAP1
43*/
44
45#if defined(LDAP_LIB_SOLARIS7) && ! defined(LDAP_LIB_SOLARIS)
46#define LDAP_LIB_SOLARIS
47#endif
48
49
50/* Just in case LDAP_NO_LIMIT is not defined by some of these libraries. */
51
52#ifndef LDAP_NO_LIMIT
53#define LDAP_NO_LIMIT 0
54#endif
55
56
57/* Just in case LDAP_DEREF_NEVER is not defined */
58
59#ifndef LDAP_DEREF_NEVER
60#define LDAP_DEREF_NEVER 0
61#endif
62
63
0756eb3c
PH
64/* Four types of LDAP search are implemented */
65
66#define SEARCH_LDAP_MULTIPLE 0 /* Get attributes from multiple entries */
67#define SEARCH_LDAP_SINGLE 1 /* Get attributes from one entry only */
68#define SEARCH_LDAP_DN 2 /* Get just the DN from one entry */
69#define SEARCH_LDAP_AUTH 3 /* Just checking for authentication */
70
71/* In all 4 cases, the DN is left in $ldap_dn (which post-dates the
72SEARCH_LDAP_DN lookup). */
73
74
75/* Structure and anchor for caching connections. */
76
77typedef struct ldap_connection {
78 struct ldap_connection *next;
79 uschar *host;
80 uschar *user;
81 uschar *password;
82 BOOL bound;
83 int port;
84 LDAP *ld;
85} LDAP_CONNECTION;
86
87static LDAP_CONNECTION *ldap_connections = NULL;
88
89
90
91/*************************************************
92* Internal search function *
93*************************************************/
94
95/* This is the function that actually does the work. It is called (indirectly
96via control_ldap_search) from eldap_find(), eldapauth_find(), eldapdn_find(),
97and eldapm_find(), with a difference in the "search_type" argument.
98
99The case of eldapauth_find() is special in that all it does is do
100authentication, returning OK or FAIL as appropriate. This isn't used as a
101lookup. Instead, it is called from expand.c as an expansion condition test.
102
103The DN from a successful lookup is placed in $ldap_dn. This feature postdates
104the provision of the SEARCH_LDAP_DN facility for returning just the DN as the
105data.
106
107Arguments:
108 ldap_url the URL to be looked up
109 server server host name, when URL contains none
110 s_port server port, used when URL contains no name
111 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
112 SEARCH_LDAP_SINGLE allows values from one entry only
113 SEARCH_LDAP_DN gets the DN from one entry
114 res set to point at the result (not used for ldapauth)
115 errmsg set to point a message if result is not OK
116 defer_break set TRUE if no more servers to be tried after a DEFER
117 user user name for authentication, or NULL
118 password password for authentication, or NULL
119 sizelimit max number of entries returned, or 0 for no limit
120 timelimit max time to wait, or 0 for no limit
d00328e2 121 tcplimit max time for network activity, e.g. connect, or 0 for OS default
0756eb3c
PH
122 deference the dereference option, which is one of
123 LDAP_DEREF_{NEVER,SEARCHING,FINDING,ALWAYS}
6ec97b1b 124 referrals the referral option, which is LDAP_OPT_ON or LDAP_OPT_OFF
0756eb3c
PH
125
126Returns: OK or FAIL or DEFER
127 FAIL is given only if a lookup was performed successfully, but
128 returned no data.
129*/
130
131static int
132perform_ldap_search(uschar *ldap_url, uschar *server, int s_port, int search_type,
133 uschar **res, uschar **errmsg, BOOL *defer_break, uschar *user, uschar *password,
6ec97b1b 134 int sizelimit, int timelimit, int tcplimit, int dereference, void *referrals)
0756eb3c
PH
135{
136LDAPURLDesc *ludp = NULL;
137LDAPMessage *result = NULL;
138BerElement *ber;
139LDAP_CONNECTION *lcp;
140
141struct timeval timeout;
142struct timeval *timeoutptr = NULL;
143
144uschar *attr;
145uschar **attrp;
146uschar *data = NULL;
147uschar *dn = NULL;
148uschar *host;
149uschar **values;
150uschar **firstval;
151uschar porttext[16];
152
153uschar *error1 = NULL; /* string representation of errcode (static) */
154uschar *error2 = NULL; /* error message from the server */
155uschar *matched = NULL; /* partially matched DN */
156
157int attr_count = 0;
158int error_yield = DEFER;
159int msgid;
d38f8232 160int rc, ldap_rc, ldap_parse_rc;
0756eb3c
PH
161int port;
162int ptr = 0;
163int rescount = 0;
164int size = 0;
165BOOL attribute_found = FALSE;
166BOOL ldapi = FALSE;
167
168DEBUG(D_lookup)
169 debug_printf("perform_ldap_search: ldap%s URL = \"%s\" server=%s port=%d "
170 "sizelimit=%d timelimit=%d tcplimit=%d\n",
171 (search_type == SEARCH_LDAP_MULTIPLE)? "m" :
172 (search_type == SEARCH_LDAP_DN)? "dn" :
173 (search_type == SEARCH_LDAP_AUTH)? "auth" : "",
174 ldap_url, server, s_port, sizelimit, timelimit, tcplimit);
175
176/* Check if LDAP thinks the URL is a valid LDAP URL. We assume that if the LDAP
177library that is in use doesn't recognize, say, "ldapi", it will barf here. */
178
179if (!ldap_is_ldap_url(CS ldap_url))
180 {
181 *errmsg = string_sprintf("ldap_is_ldap_url: not an LDAP url \"%s\"\n",
182 ldap_url);
183 goto RETURN_ERROR_BREAK;
184 }
185
186/* Parse the URL */
187
188if ((rc = ldap_url_parse(CS ldap_url, &ludp)) != 0)
189 {
190 *errmsg = string_sprintf("ldap_url_parse: (error %d) parsing \"%s\"\n", rc,
191 ldap_url);
192 goto RETURN_ERROR_BREAK;
193 }
194
195/* If the host name is empty, take it from the separate argument, if one is
196given. OpenLDAP 2.0.6 sets an unset hostname to "" rather than empty, but
197expects NULL later in ldap_init() to mean "default", annoyingly. In OpenLDAP
1982.0.11 this has changed (it uses NULL). */
199
200if ((ludp->lud_host == NULL || ludp->lud_host[0] == 0) && server != NULL)
201 {
202 host = server;
203 port = s_port;
204 }
205else
206 {
207 host = US ludp->lud_host;
208 if (host != NULL && host[0] == 0) host = NULL;
209 port = ludp->lud_port;
210 }
211
212DEBUG(D_lookup) debug_printf("after ldap_url_parse: host=%s port=%d\n",
213 host, port);
214
215if (port == 0) port = LDAP_PORT; /* Default if none given */
216sprintf(CS porttext, ":%d", port); /* For messages */
217
218/* If the "host name" is actually a path, we are going to connect using a Unix
219socket, regardless of whether "ldapi" was actually specified or not. This means
220that a Unix socket can be declared in eldap_default_servers, and "traditional"
221LDAP queries using just "ldap" can be used ("ldaps" is similarly overridden).
222The path may start with "/" or it may already be escaped as "%2F" if it was
223actually declared that way in eldap_default_servers. (I did it that way the
224first time.) If the host name is not a path, the use of "ldapi" causes an
225error, except in the default case. (But lud_scheme doesn't seem to exist in
226older libraries.) */
227
228if (host != NULL)
229 {
230 if ((host[0] == '/' || Ustrncmp(host, "%2F", 3) == 0))
231 {
232 ldapi = TRUE;
233 porttext[0] = 0; /* Remove port from messages */
234 }
235
236 #if defined LDAP_LIB_OPENLDAP2
237 else if (strncmp(ludp->lud_scheme, "ldapi", 5) == 0)
238 {
239 *errmsg = string_sprintf("ldapi requires an absolute path (\"%s\" given)",
240 host);
241 goto RETURN_ERROR;
242 }
243 #endif
244 }
245
246/* Count the attributes; we need this later to tell us how to format results */
247
248for (attrp = USS ludp->lud_attrs; attrp != NULL && *attrp != NULL; attrp++)
249 attr_count++;
250
251/* See if we can find a cached connection to this host. The port is not
252relevant for ldapi. The host name pointer is set to NULL if no host was given
253(implying the library default), rather than to the empty string. Note that in
254this case, there is no difference between ldap and ldapi. */
255
256for (lcp = ldap_connections; lcp != NULL; lcp = lcp->next)
257 {
258 if ((host == NULL) != (lcp->host == NULL) ||
259 (host != NULL && strcmpic(lcp->host, host) != 0))
260 continue;
261 if (ldapi || port == lcp->port) break;
262 }
263
d00328e2
PH
264/* Use this network timeout in any requests. */
265
266if (tcplimit > 0)
267 {
268 timeout.tv_sec = tcplimit;
269 timeout.tv_usec = 0;
270 timeoutptr = &timeout;
271 }
272
0756eb3c
PH
273/* If no cached connection found, we must open a connection to the server. If
274the server name is actually an absolute path, we set ldapi=TRUE above. This
275requests connection via a Unix socket. However, as far as I know, only OpenLDAP
276supports the use of sockets, and the use of ldap_initialize(). */
277
278if (lcp == NULL)
279 {
280 LDAP *ld;
281
282
283 /* --------------------------- OpenLDAP ------------------------ */
284
285 /* There seems to be a preference under OpenLDAP for ldap_initialize()
286 instead of ldap_init(), though I have as yet been unable to find
287 documentation that says this. (OpenLDAP documentation is sparse to
288 non-existent). So we handle OpenLDAP differently here. Also, support for
289 ldapi seems to be OpenLDAP-only at present. */
290
291 #ifdef LDAP_LIB_OPENLDAP2
292
293 /* We now need an empty string for the default host. Get some store in which
294 to build a URL for ldap_initialize(). In the ldapi case, it can't be bigger
295 than (9 + 3*Ustrlen(shost)), whereas in the other cases it can't be bigger
296 than the host name + "ldaps:///" plus : and a port number, say 20 + the
297 length of the host name. What we get should accommodate both, easily. */
298
299 uschar *shost = (host == NULL)? US"" : host;
300 uschar *init_url = store_get(20 + 3 * Ustrlen(shost));
301 uschar *init_ptr;
302
303 /* Handle connection via Unix socket ("ldapi"). We build a basic LDAP URI to
304 contain the path name, with slashes escaped as %2F. */
305
306 if (ldapi)
307 {
308 int ch;
309 init_ptr = init_url + 8;
310 Ustrcpy(init_url, "ldapi://");
311 while ((ch = *shost++) != 0)
312 {
313 if (ch == '/')
314 {
315 Ustrncpy(init_ptr, "%2F", 3);
316 init_ptr += 3;
317 }
318 else *init_ptr++ = ch;
319 }
320 *init_ptr = 0;
321 }
322
323 /* This is not an ldapi call. Just build a URI with the protocol type, host
324 name, and port. */
325
326 else
327 {
328 init_ptr = Ustrchr(ldap_url, '/');
329 Ustrncpy(init_url, ldap_url, init_ptr - ldap_url);
330 init_ptr = init_url + (init_ptr - ldap_url);
331 sprintf(CS init_ptr, "//%s:%d/", shost, port);
332 }
333
334 /* Call ldap_initialize() and check the result */
335
336 DEBUG(D_lookup) debug_printf("ldap_initialize with URL %s\n", init_url);
337 rc = ldap_initialize(&ld, CS init_url);
338 if (rc != LDAP_SUCCESS)
339 {
340 *errmsg = string_sprintf("ldap_initialize: (error %d) URL \"%s\"\n",
341 rc, init_url);
342 goto RETURN_ERROR;
343 }
344 store_reset(init_url); /* Might as well save memory when we can */
345
346
347 /* ------------------------- Not OpenLDAP ---------------------- */
348
349 /* For libraries other than OpenLDAP, use ldap_init(). */
350
351 #else /* LDAP_LIB_OPENLDAP2 */
352 ld = ldap_init(CS host, port);
353 #endif /* LDAP_LIB_OPENLDAP2 */
354
355 /* -------------------------------------------------------------- */
356
357
358 /* Handle failure to initialize */
359
360 if (ld == NULL)
361 {
362 *errmsg = string_sprintf("failed to initialize for LDAP server %s%s - %s",
363 host, porttext, strerror(errno));
364 goto RETURN_ERROR;
365 }
366
367 /* Set the TCP connect time limit if available. This is something that is
368 in Netscape SDK v4.1; I don't know about other libraries. */
369
370 #ifdef LDAP_X_OPT_CONNECT_TIMEOUT
7c7ad977
PH
371 if (tcplimit > 0)
372 {
994a09e9 373 int timeout1000 = tcplimit*1000;
7c7ad977
PH
374 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&timeout1000);
375 }
994a09e9
PH
376 else
377 {
378 int notimeout = LDAP_X_IO_TIMEOUT_NO_TIMEOUT;
379 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&notimeout);
380 }
0756eb3c
PH
381 #endif
382
7c7ad977
PH
383 /* Set the TCP connect timeout. This works with OpenLDAP 2.2.14. */
384
385 #ifdef LDAP_OPT_NETWORK_TIMEOUT
386 if (tcplimit > 0)
387 ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *)timeoutptr);
8e669ac1 388 #endif
7c7ad977 389
0756eb3c
PH
390 /* I could not get TLS to work until I set the version to 3. That version
391 seems to be the default nowadays. The RFC is dated 1997, so I would hope
392 that all the LDAP libraries support it. Therefore, if eldap_version hasn't
393 been set, go for v3 if we can. */
394
395 if (eldap_version < 0)
396 {
397 #ifdef LDAP_VERSION3
398 eldap_version = LDAP_VERSION3;
399 #else
400 eldap_version = 2;
401 #endif
402 }
403
404 #ifdef LDAP_OPT_PROTOCOL_VERSION
405 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, (void *)&eldap_version);
406 #endif
407
408 DEBUG(D_lookup) debug_printf("initialized for LDAP (v%d) server %s%s\n",
409 eldap_version, host, porttext);
410
411 /* If not using ldapi and TLS is available, set appropriate TLS options: hard
412 for "ldaps" and soft otherwise. */
413
414 #ifdef LDAP_OPT_X_TLS
415 if (!ldapi)
416 {
417 int tls_option;
418 if (strncmp(ludp->lud_scheme, "ldaps", 5) == 0)
419 {
420 tls_option = LDAP_OPT_X_TLS_HARD;
421 DEBUG(D_lookup) debug_printf("LDAP_OPT_X_TLS_HARD set\n");
422 }
423 else
424 {
425 tls_option = LDAP_OPT_X_TLS_TRY;
426 DEBUG(D_lookup) debug_printf("LDAP_OPT_X_TLS_TRY set\n");
427 }
428 ldap_set_option(ld, LDAP_OPT_X_TLS, (void *)&tls_option);
429 }
430 #endif /* LDAP_OPT_X_TLS */
431
bc19a55b
PP
432 #ifdef LDAP_OPT_X_TLS_CACERTFILE
433 if (eldap_ca_cert_file != NULL)
434 {
435 ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE, eldap_ca_cert_file);
436 }
437 #endif
438 #ifdef LDAP_OPT_X_TLS_CACERTDIR
439 if (eldap_ca_cert_dir != NULL)
440 {
441 ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, eldap_ca_cert_dir);
442 }
443 #endif
444 #ifdef LDAP_OPT_X_TLS_CERTFILE
445 if (eldap_cert_file != NULL)
446 {
447 ldap_set_option(ld, LDAP_OPT_X_TLS_CERTFILE, eldap_cert_file);
448 }
449 #endif
450 #ifdef LDAP_OPT_X_TLS_KEYFILE
451 if (eldap_cert_key != NULL)
452 {
453 ldap_set_option(ld, LDAP_OPT_X_TLS_KEYFILE, eldap_cert_key);
454 }
455 #endif
456 #ifdef LDAP_OPT_X_TLS_CIPHER_SUITE
457 if (eldap_cipher_suite != NULL)
458 {
459 ldap_set_option(ld, LDAP_OPT_X_TLS_CIPHER_SUITE, eldap_cipher_suite);
460 }
461 #endif
462 #ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
463 if (eldap_require_cert != NULL)
464 {
465 int cert_option = LDAP_OPT_X_TLS_NEVER;
466 if (Ustrcmp(eldap_require_cert, "hard") == 0)
467 {
468 cert_option = LDAP_OPT_X_TLS_HARD;
469 }
470 else if (Ustrcmp(eldap_require_cert, "demand") == 0)
471 {
472 cert_option = LDAP_OPT_X_TLS_DEMAND;
473 }
474 else if (Ustrcmp(eldap_require_cert, "allow") == 0)
475 {
476 cert_option = LDAP_OPT_X_TLS_ALLOW;
477 }
478 else if (Ustrcmp(eldap_require_cert, "try") == 0)
479 {
480 cert_option = LDAP_OPT_X_TLS_TRY;
481 }
10906672 482 ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option);
bc19a55b
PP
483 }
484 #endif
485
0756eb3c
PH
486 /* Now add this connection to the chain of cached connections */
487
488 lcp = store_get(sizeof(LDAP_CONNECTION));
489 lcp->host = (host == NULL)? NULL : string_copy(host);
490 lcp->bound = FALSE;
491 lcp->user = NULL;
492 lcp->password = NULL;
493 lcp->port = port;
494 lcp->ld = ld;
495 lcp->next = ldap_connections;
496 ldap_connections = lcp;
497 }
498
499/* Found cached connection */
500
501else
502 {
503 DEBUG(D_lookup)
504 debug_printf("re-using cached connection to LDAP server %s%s\n",
505 host, porttext);
506 }
507
508/* Bind with the user/password supplied, or an anonymous bind if these values
509are NULL, unless a cached connection is already bound with the same values. */
510
511if (!lcp->bound ||
512 (lcp->user == NULL && user != NULL) ||
513 (lcp->user != NULL && user == NULL) ||
514 (lcp->user != NULL && user != NULL && Ustrcmp(lcp->user, user) != 0) ||
515 (lcp->password == NULL && password != NULL) ||
516 (lcp->password != NULL && password == NULL) ||
517 (lcp->password != NULL && password != NULL &&
518 Ustrcmp(lcp->password, password) != 0))
519 {
520 DEBUG(D_lookup) debug_printf("%sbinding with user=%s password=%s\n",
521 (lcp->bound)? "re-" : "", user, password);
867fcbf5
PP
522#ifdef LDAP_OPT_X_TLS
523 /* The Oracle LDAP libraries (LDAP_LIB_TYPE=SOLARIS) don't support this: */
bc19a55b
PP
524 if (eldap_start_tls)
525 {
e74376d8
PP
526 if ( (rc = ldap_start_tls_s(lcp->ld, NULL, NULL)) != LDAP_SUCCESS) {
527 *errmsg = string_sprintf("failed to initiate TLS processing on an "
528 "LDAP session to server %s%s - ldap_start_tls_s() returned %d:"
529 " %s", host, porttext, rc, ldap_err2string(rc));
530 goto RETURN_ERROR;
531 }
bc19a55b 532 }
867fcbf5 533#endif
7c7ad977
PH
534 if ((msgid = ldap_bind(lcp->ld, CS user, CS password, LDAP_AUTH_SIMPLE))
535 == -1)
0756eb3c 536 {
7c7ad977 537 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
d00328e2 538 "%s%s - ldap_bind() returned -1", host, porttext);
7c7ad977
PH
539 goto RETURN_ERROR;
540 }
0756eb3c 541
7c7ad977
PH
542 if ((rc = ldap_result( lcp->ld, msgid, 1, timeoutptr, &result )) <= 0)
543 {
544 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
8e669ac1 545 "%s%s - LDAP error: %s", host, porttext,
7c7ad977
PH
546 rc == -1 ? "result retrieval failed" : "timeout" );
547 result = NULL;
548 goto RETURN_ERROR;
549 }
550
551 rc = ldap_result2error( lcp->ld, result, 0 );
552
553 /* Invalid credentials when just checking credentials returns FAIL. This
554 stops any further servers being tried. */
0756eb3c 555
7c7ad977
PH
556 if (search_type == SEARCH_LDAP_AUTH && rc == LDAP_INVALID_CREDENTIALS)
557 {
558 DEBUG(D_lookup)
559 debug_printf("Invalid credentials: ldapauth returns FAIL\n");
560 error_yield = FAIL;
561 goto RETURN_ERROR_NOMSG;
562 }
0756eb3c 563
7c7ad977
PH
564 /* Otherwise we have a problem that doesn't stop further servers from being
565 tried. */
566
567 if (rc != LDAP_SUCCESS)
568 {
0756eb3c
PH
569 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
570 "%s%s - LDAP error %d: %s", host, porttext, rc, ldap_err2string(rc));
571 goto RETURN_ERROR;
572 }
573
574 /* Successful bind */
575
576 lcp->bound = TRUE;
577 lcp->user = (user == NULL)? NULL : string_copy(user);
578 lcp->password = (password == NULL)? NULL : string_copy(password);
7c7ad977
PH
579
580 ldap_msgfree(result);
581 result = NULL;
0756eb3c
PH
582 }
583
584/* If we are just checking credentials, return OK. */
585
586if (search_type == SEARCH_LDAP_AUTH)
587 {
588 DEBUG(D_lookup) debug_printf("Bind succeeded: ldapauth returns OK\n");
589 goto RETURN_OK;
590 }
591
592/* Before doing the search, set the time and size limits (if given). Here again
593the different implementations of LDAP have chosen to do things differently. */
594
595#if defined(LDAP_OPT_SIZELIMIT)
596ldap_set_option(lcp->ld, LDAP_OPT_SIZELIMIT, (void *)&sizelimit);
597ldap_set_option(lcp->ld, LDAP_OPT_TIMELIMIT, (void *)&timelimit);
598#else
599lcp->ld->ld_sizelimit = sizelimit;
600lcp->ld->ld_timelimit = timelimit;
601#endif
602
603/* Similarly for dereferencing aliases. Don't know if this is possible on
604an LDAP library without LDAP_OPT_DEREF. */
605
606#if defined(LDAP_OPT_DEREF)
607ldap_set_option(lcp->ld, LDAP_OPT_DEREF, (void *)&dereference);
608#endif
609
6ec97b1b
PH
610/* Similarly for the referral setting; should the library follow referrals that
611the LDAP server returns? The conditional is just in case someone uses a library
612without it. */
613
614#if defined(LDAP_OPT_REFERRALS)
615ldap_set_option(lcp->ld, LDAP_OPT_REFERRALS, referrals);
616#endif
617
0756eb3c
PH
618/* Start the search on the server. */
619
620DEBUG(D_lookup) debug_printf("Start search\n");
621
622msgid = ldap_search(lcp->ld, ludp->lud_dn, ludp->lud_scope, ludp->lud_filter,
623 ludp->lud_attrs, 0);
624
625if (msgid == -1)
626 {
3ca0ba97
PH
627 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
628 int err;
629 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
8e669ac1 630 *errmsg = string_sprintf("ldap_search failed: %d, %s", err,
3ca0ba97 631 ldap_err2string(err));
8e669ac1
PH
632
633 #else
3ca0ba97
PH
634 *errmsg = string_sprintf("ldap_search failed");
635 #endif
8e669ac1 636
0756eb3c
PH
637 goto RETURN_ERROR;
638 }
639
640/* Loop to pick up results as they come in, setting a timeout if one was
641given. */
642
0756eb3c
PH
643while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
644 LDAP_RES_SEARCH_ENTRY)
645 {
646 LDAPMessage *e;
647
648 DEBUG(D_lookup) debug_printf("ldap_result loop\n");
649
650 for(e = ldap_first_entry(lcp->ld, result);
651 e != NULL;
652 e = ldap_next_entry(lcp->ld, e))
653 {
654 uschar *new_dn;
655 BOOL insert_space = FALSE;
656
657 DEBUG(D_lookup) debug_printf("LDAP entry loop\n");
658
659 rescount++; /* Count results */
660
661 /* Results for multiple entries values are separated by newlines. */
662
663 if (data != NULL) data = string_cat(data, &size, &ptr, US"\n", 1);
664
665 /* Get the DN from the last result. */
666
667 new_dn = US ldap_get_dn(lcp->ld, e);
668 if (new_dn != NULL)
669 {
670 if (dn != NULL)
671 {
672 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
673 ldap_memfree(dn);
674 #else /* OPENLDAP 1, UMich, Solaris */
675 free(dn);
676 #endif
677 }
678 /* Save for later */
679 dn = new_dn;
680 }
681
682 /* If the data we want is actually the DN rather than any attribute values,
683 (an "ldapdn" search) add it to the data string. If there are multiple
684 entries, the DNs will be concatenated, but we test for this case below, as
685 for SEARCH_LDAP_SINGLE, and give an error. */
686
687 if (search_type == SEARCH_LDAP_DN) /* Do not amalgamate these into one */
688 { /* condition, because of the else */
689 if (new_dn != NULL) /* below, that's for the first only */
690 {
691 data = string_cat(data, &size, &ptr, new_dn, Ustrlen(new_dn));
692 data[ptr] = 0;
693 attribute_found = TRUE;
694 }
695 }
696
697 /* Otherwise, loop through the entry, grabbing attribute values. If there's
698 only one attribute being retrieved, no attribute name is given, and the
699 result is not quoted. Multiple values are separated by (comma, space).
700 If more than one attribute is being retrieved, the data is given as a
701 sequence of name=value pairs, with the value always in quotes. If there are
702 multiple values, they are given within the quotes, comma separated. */
703
704 else for (attr = US ldap_first_attribute(lcp->ld, e, &ber);
705 attr != NULL;
706 attr = US ldap_next_attribute(lcp->ld, e, ber))
707 {
708 if (attr[0] != 0)
709 {
710 /* Get array of values for this attribute. */
711
712 if ((firstval = values = USS ldap_get_values(lcp->ld, e, CS attr))
713 != NULL)
714 {
715 if (attr_count != 1)
716 {
717 if (insert_space)
718 data = string_cat(data, &size, &ptr, US" ", 1);
719 else
720 insert_space = TRUE;
721 data = string_cat(data, &size, &ptr, attr, Ustrlen(attr));
722 data = string_cat(data, &size, &ptr, US"=\"", 2);
723 }
724
725 while (*values != NULL)
726 {
727 uschar *value = *values;
728 int len = Ustrlen(value);
729
730 DEBUG(D_lookup) debug_printf("LDAP attr loop %s:%s\n", attr, value);
731
732 if (values != firstval)
7bba24eb 733 data = string_cat(data, &size, &ptr, US",", 1);
0756eb3c
PH
734
735 /* For multiple attributes, the data is in quotes. We must escape
7bba24eb 736 internal quotes, backslashes, newlines, and must double commas. */
0756eb3c
PH
737
738 if (attr_count != 1)
739 {
740 int j;
741 for (j = 0; j < len; j++)
742 {
743 if (value[j] == '\n')
744 data = string_cat(data, &size, &ptr, US"\\n", 2);
7bba24eb
JH
745 else if (value[j] == ',')
746 data = string_cat(data, &size, &ptr, US",,", 2);
0756eb3c
PH
747 else
748 {
749 if (value[j] == '\"' || value[j] == '\\')
750 data = string_cat(data, &size, &ptr, US"\\", 1);
751 data = string_cat(data, &size, &ptr, value+j, 1);
752 }
753 }
754 }
755
7bba24eb
JH
756 /* For single attributes, just double commas */
757
758 else
759 {
760 int j;
761 for (j = 0; j < len; j++)
762 {
763 if (value[j] == ',')
764 data = string_cat(data, &size, &ptr, US",,", 2);
765 else
766 data = string_cat(data, &size, &ptr, value+j, 1);
767 }
768 }
0756eb3c 769
0756eb3c
PH
770
771 /* Move on to the next value */
772
773 values++;
774 attribute_found = TRUE;
775 }
776
777 /* Closing quote at the end of the data for a named attribute. */
778
779 if (attr_count != 1)
780 data = string_cat(data, &size, &ptr, US"\"", 1);
781
782 /* Free the values */
783
784 ldap_value_free(CSS firstval);
785 }
786 }
787
788 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
789
790 /* Netscape and OpenLDAP2 LDAP's attrs are dynamically allocated and need
791 to be freed. UMich LDAP stores them in static storage and does not require
792 this. */
793
794 ldap_memfree(attr);
795 #endif
796 } /* End "for" loop for extracting attributes from an entry */
797 } /* End "for" loop for extracting entries from a result */
798
799 /* Free the result */
800
801 ldap_msgfree(result);
802 result = NULL;
803 } /* End "while" loop for multiple results */
804
805/* Terminate the dynamic string that we have built and reclaim unused store */
806
807if (data != NULL)
808 {
809 data[ptr] = 0;
810 store_reset(data + ptr + 1);
811 }
812
813/* Copy the last dn into eldap_dn */
814
815if (dn != NULL)
816 {
817 eldap_dn = string_copy(dn);
818 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
819 ldap_memfree(dn);
820 #else /* OPENLDAP 1, UMich, Solaris */
821 free(dn);
822 #endif
823 }
824
825DEBUG(D_lookup) debug_printf("search ended by ldap_result yielding %d\n",rc);
826
827if (rc == 0)
828 {
829 *errmsg = US"ldap_result timed out";
830 goto RETURN_ERROR;
831 }
832
833/* A return code of -1 seems to mean "ldap_result failed internally or couldn't
834provide you with a message". Other error states seem to exist where
835ldap_result() didn't give us any message from the server at all, leaving result
836set to NULL. Apparently, "the error parameters of the LDAP session handle will
837be set accordingly". That's the best we can do to retrieve an error status; we
838can't use functions like ldap_result2error because they parse a message from
839the server, which we didn't get.
840
841Annoyingly, the different implementations of LDAP have gone for different
842methods of handling error codes and generating error messages. */
843
844if (rc == -1 || result == NULL)
845 {
846 int err;
847 DEBUG(D_lookup) debug_printf("ldap_result failed\n");
848
849 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
850 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
851 *errmsg = string_sprintf("ldap_result failed: %d, %s",
852 err, ldap_err2string(err));
853
854 #elif defined LDAP_LIB_NETSCAPE
855 /* Dubious (surely 'matched' is spurious here?) */
856 (void)ldap_get_lderrno(lcp->ld, &matched, &error1);
857 *errmsg = string_sprintf("ldap_result failed: %s (%s)", error1, matched);
858
859 #else /* UMich LDAP aka OpenLDAP 1.x */
860 *errmsg = string_sprintf("ldap_result failed: %d, %s",
861 lcp->ld->ld_errno, ldap_err2string(lcp->ld->ld_errno));
862 #endif
863
864 goto RETURN_ERROR;
865 }
866
867/* A return code that isn't -1 doesn't necessarily mean there were no problems
8e669ac1
PH
868with the search. The message must be an LDAP_RES_SEARCH_RESULT or
869LDAP_RES_SEARCH_REFERENCE or else it's something we can't handle. Some versions
870of LDAP do not define LDAP_RES_SEARCH_REFERENCE (LDAP v1 is one, it seems). So
3295e65b
PH
871we don't provide that functionality when we can't. :-) */
872
8e669ac1 873if (rc != LDAP_RES_SEARCH_RESULT
3295e65b
PH
874#ifdef LDAP_RES_SEARCH_REFERENCE
875 && rc != LDAP_RES_SEARCH_REFERENCE
8e669ac1 876#endif
3295e65b 877 )
0756eb3c
PH
878 {
879 *errmsg = string_sprintf("ldap_result returned unexpected code %d", rc);
880 goto RETURN_ERROR;
881 }
882
883/* We have a result message from the server. This doesn't yet mean all is well.
884We need to parse the message to find out exactly what's happened. */
885
d38f8232
PH
886#if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
887 ldap_rc = rc;
8e669ac1 888 ldap_parse_rc = ldap_parse_result(lcp->ld, result, &rc, CSS &matched,
d38f8232
PH
889 CSS &error2, NULL, NULL, 0);
890 DEBUG(D_lookup) debug_printf("ldap_parse_result: %d\n", ldap_parse_rc);
8e669ac1 891 if (ldap_parse_rc < 0 &&
3295e65b 892 (ldap_parse_rc != LDAP_NO_RESULTS_RETURNED
8e669ac1 893 #ifdef LDAP_RES_SEARCH_REFERENCE
3295e65b 894 || ldap_rc != LDAP_RES_SEARCH_REFERENCE
8e669ac1 895 #endif
3295e65b 896 ))
0756eb3c 897 {
d38f8232 898 *errmsg = string_sprintf("ldap_parse_result failed %d", ldap_parse_rc);
0756eb3c
PH
899 goto RETURN_ERROR;
900 }
901 error1 = US ldap_err2string(rc);
902
903#elif defined LDAP_LIB_NETSCAPE
904 /* Dubious (it doesn't reference 'result' at all!) */
905 rc = ldap_get_lderrno(lcp->ld, &matched, &error1);
906
907#else /* UMich LDAP aka OpenLDAP 1.x */
908 rc = ldap_result2error(lcp->ld, result, 0);
909 error1 = ldap_err2string(rc);
910 error2 = lcp->ld->ld_error;
911 matched = lcp->ld->ld_matched;
912#endif
913
914/* Process the status as follows:
915
916 (1) If we get LDAP_SIZELIMIT_EXCEEDED, just carry on, to return the
917 truncated result list.
918
21eb6e72
PH
919 (2) If we get LDAP_RES_SEARCH_REFERENCE, also just carry on. This was a
920 submitted patch that is reported to "do the right thing" with Solaris
921 LDAP libraries. (The problem it addresses apparently does not occur with
922 Open LDAP.)
923
924 (3) The range of errors defined by LDAP_NAME_ERROR generally mean "that
0756eb3c
PH
925 object does not, or cannot, exist in the database". For those cases we
926 fail the lookup.
927
21eb6e72 928 (4) All other non-successes here are treated as some kind of problem with
0756eb3c
PH
929 the lookup, so return DEFER (which is the default in error_yield).
930*/
931
932DEBUG(D_lookup) debug_printf("ldap_parse_result yielded %d: %s\n",
933 rc, ldap_err2string(rc));
934
21eb6e72
PH
935if (rc != LDAP_SUCCESS && rc != LDAP_SIZELIMIT_EXCEEDED
936 #ifdef LDAP_RES_SEARCH_REFERENCE
937 && rc != LDAP_RES_SEARCH_REFERENCE
938 #endif
939 )
0756eb3c
PH
940 {
941 *errmsg = string_sprintf("LDAP search failed - error %d: %s%s%s%s%s",
942 rc,
943 (error1 != NULL)? error1 : US"",
944 (error2 != NULL && error2[0] != 0)? US"/" : US"",
945 (error2 != NULL)? error2 : US"",
946 (matched != NULL && matched[0] != 0)? US"/" : US"",
947 (matched != NULL)? matched : US"");
948
949 #if defined LDAP_NAME_ERROR
950 if (LDAP_NAME_ERROR(rc))
951 #elif defined NAME_ERROR /* OPENLDAP1 calls it this */
952 if (NAME_ERROR(rc))
953 #else
954 if (rc == LDAP_NO_SUCH_OBJECT)
955 #endif
956
957 {
958 DEBUG(D_lookup) debug_printf("lookup failure forced\n");
959 error_yield = FAIL;
960 }
961 goto RETURN_ERROR;
962 }
963
964/* The search succeeded. Check if we have too many results */
965
966if (search_type != SEARCH_LDAP_MULTIPLE && rescount > 1)
967 {
968 *errmsg = string_sprintf("LDAP search: more than one entry (%d) was returned "
969 "(filter not specific enough?)", rescount);
970 goto RETURN_ERROR_BREAK;
971 }
972
973/* Check if we have too few (zero) entries */
974
975if (rescount < 1)
976 {
977 *errmsg = string_sprintf("LDAP search: no results");
978 error_yield = FAIL;
979 goto RETURN_ERROR_BREAK;
980 }
981
982/* If an entry was found, but it had no attributes, we behave as if no entries
983were found, that is, the lookup failed. */
984
985if (!attribute_found)
986 {
987 *errmsg = US"LDAP search: found no attributes";
988 error_yield = FAIL;
989 goto RETURN_ERROR;
990 }
991
992/* Otherwise, it's all worked */
993
994DEBUG(D_lookup) debug_printf("LDAP search: returning: %s\n", data);
995*res = data;
996
997RETURN_OK:
998if (result != NULL) ldap_msgfree(result);
999ldap_free_urldesc(ludp);
1000return OK;
1001
1002/* Error returns */
1003
1004RETURN_ERROR_BREAK:
1005*defer_break = TRUE;
1006
1007RETURN_ERROR:
1008DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
1009
1010RETURN_ERROR_NOMSG:
1011if (result != NULL) ldap_msgfree(result);
1012if (ludp != NULL) ldap_free_urldesc(ludp);
1013
1014#if defined LDAP_LIB_OPENLDAP2
1015 if (error2 != NULL) ldap_memfree(error2);
1016 if (matched != NULL) ldap_memfree(matched);
1017#endif
1018
1019return error_yield;
1020}
1021
1022
1023
1024/*************************************************
1025* Internal search control function *
1026*************************************************/
1027
1028/* This function is called from eldap_find(), eldapauth_find(), eldapdn_find(),
1029and eldapm_find() with a difference in the "search_type" argument. It controls
1030calls to perform_ldap_search() which actually does the work. We call that
1031repeatedly for certain types of defer in the case when the URL contains no host
1032name and eldap_default_servers is set to a list of servers to try. This gives
1033more control than just passing over a list of hosts to ldap_open() because it
1034handles other kinds of defer as well as just a failure to open. Note that the
1035URL is defined to contain either zero or one "hostport" only.
1036
1037Parameter data in addition to the URL can be passed as preceding text in the
1038string, as items of the form XXX=yyy. The URL itself can be detected because it
1039must begin "ldapx://", where x is empty, s, or i.
1040
1041Arguments:
1042 ldap_url the URL to be looked up, optionally preceded by other parameter
1043 settings
1044 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
1045 SEARCH_LDAP_SINGLE allows values from one entry only
1046 SEARCH_LDAP_DN gets the DN from one entry
1047 res set to point at the result
1048 errmsg set to point a message if result is not OK
1049
1050Returns: OK or FAIL or DEFER
1051*/
1052
1053static int
1054control_ldap_search(uschar *ldap_url, int search_type, uschar **res,
1055 uschar **errmsg)
1056{
1057BOOL defer_break = FALSE;
1058int timelimit = LDAP_NO_LIMIT;
1059int sizelimit = LDAP_NO_LIMIT;
7c7ad977 1060int tcplimit = 0;
0756eb3c 1061int sep = 0;
6ec97b1b
PH
1062int dereference = LDAP_DEREF_NEVER;
1063void* referrals = LDAP_OPT_ON;
0756eb3c
PH
1064uschar *url = ldap_url;
1065uschar *p;
1066uschar *user = NULL;
1067uschar *password = NULL;
1068uschar *server, *list;
1069uschar buffer[512];
1070
1071while (isspace(*url)) url++;
1072
1073/* Until the string begins "ldap", search for the other parameter settings that
1074are recognized. They are of the form NAME=VALUE, with the value being
1075optionally double-quoted. There must still be a space after it, however. No
1076NAME has the value "ldap". */
1077
1078while (strncmpic(url, US"ldap", 4) != 0)
1079 {
1080 uschar *name = url;
1081 while (*url != 0 && *url != '=') url++;
1082 if (*url == '=')
1083 {
1084 int namelen;
1085 uschar *value;
1086 namelen = ++url - name;
1087 value = string_dequote(&url);
1088 if (isspace(*url))
1089 {
1090 if (strncmpic(name, US"USER=", namelen) == 0) user = value;
1091 else if (strncmpic(name, US"PASS=", namelen) == 0) password = value;
1092 else if (strncmpic(name, US"SIZE=", namelen) == 0) sizelimit = Uatoi(value);
1093 else if (strncmpic(name, US"TIME=", namelen) == 0) timelimit = Uatoi(value);
7c7ad977
PH
1094 else if (strncmpic(name, US"CONNECT=", namelen) == 0) tcplimit = Uatoi(value);
1095 else if (strncmpic(name, US"NETTIME=", namelen) == 0) tcplimit = Uatoi(value);
0756eb3c
PH
1096
1097 /* Don't know if all LDAP libraries have LDAP_OPT_DEREF */
1098
1099 #ifdef LDAP_OPT_DEREF
1100 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1101 {
1102 if (strcmpic(value, US"never") == 0) dereference = LDAP_DEREF_NEVER;
1103 else if (strcmpic(value, US"searching") == 0)
1104 dereference = LDAP_DEREF_SEARCHING;
1105 else if (strcmpic(value, US"finding") == 0)
1106 dereference = LDAP_DEREF_FINDING;
1107 if (strcmpic(value, US"always") == 0) dereference = LDAP_DEREF_ALWAYS;
1108 }
1109 #else
1110 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1111 {
1112 *errmsg = string_sprintf("LDAP_OP_DEREF not defined in this LDAP "
1113 "library - cannot use \"dereference\"");
1114 DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
1115 return DEFER;
1116 }
6ec97b1b 1117 #endif
0756eb3c 1118
6ec97b1b
PH
1119 #ifdef LDAP_OPT_REFERRALS
1120 else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
1121 {
1122 if (strcmpic(value, US"follow") == 0) referrals = LDAP_OPT_ON;
1123 else if (strcmpic(value, US"nofollow") == 0) referrals = LDAP_OPT_OFF;
1124 else
1125 {
1126 *errmsg = string_sprintf("LDAP option REFERRALS is not \"follow\" "
1127 "or \"nofollow\"");
1128 DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
1129 return DEFER;
1130 }
1131 }
1132 #else
1133 else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
1134 {
1135 *errmsg = string_sprintf("LDAP_OP_REFERRALS not defined in this LDAP "
1136 "library - cannot use \"referrals\"");
1137 DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
1138 return DEFER;
1139 }
0756eb3c
PH
1140 #endif
1141
1142 else
1143 {
1144 *errmsg =
1145 string_sprintf("unknown parameter \"%.*s\" precedes LDAP URL",
1146 namelen, name);
1147 DEBUG(D_lookup) debug_printf("LDAP query error: %s\n", *errmsg);
1148 return DEFER;
1149 }
1150 while (isspace(*url)) url++;
1151 continue;
1152 }
1153 }
1154 *errmsg = US"malformed parameter setting precedes LDAP URL";
1155 DEBUG(D_lookup) debug_printf("LDAP query error: %s\n", *errmsg);
1156 return DEFER;
1157 }
1158
1159/* If user is set, de-URL-quote it. Some LDAP libraries do this for themselves,
1160but it seems that not all behave like this. The DN for the user is often the
1161result of ${quote_ldap_dn:...} quoting, which does apply URL quoting, because
1162that is needed when the DN is used as a base DN in a query. Sigh. This is all
1163far too complicated. */
1164
1165if (user != NULL)
1166 {
1167 uschar *s;
1168 uschar *t = user;
1169 for (s = user; *s != 0; s++)
1170 {
1171 int c, d;
1172 if (*s == '%' && isxdigit(c=s[1]) && isxdigit(d=s[2]))
1173 {
1174 c = tolower(c);
1175 d = tolower(d);
1176 *t++ =
1177 (((c >= 'a')? (10 + c - 'a') : c - '0') << 4) |
1178 ((d >= 'a')? (10 + d - 'a') : d - '0');
1179 s += 2;
1180 }
1181 else *t++ = *s;
1182 }
1183 *t = 0;
1184 }
1185
1186DEBUG(D_lookup)
1187 debug_printf("LDAP parameters: user=%s pass=%s size=%d time=%d connect=%d "
6ec97b1b
PH
1188 "dereference=%d referrals=%s\n", user, password, sizelimit, timelimit,
1189 tcplimit, dereference, (referrals == LDAP_OPT_ON)? "on" : "off");
0756eb3c
PH
1190
1191/* If the request is just to check authentication, some credentials must
1192be given. The password must not be empty because LDAP binds with an empty
1193password are considered anonymous, and will succeed on most installations. */
1194
1195if (search_type == SEARCH_LDAP_AUTH)
1196 {
1197 if (user == NULL || password == NULL)
1198 {
1199 *errmsg = US"ldapauth lookups must specify the username and password";
1200 return DEFER;
1201 }
1202 if (password[0] == 0)
1203 {
1204 DEBUG(D_lookup) debug_printf("Empty password: ldapauth returns FAIL\n");
1205 return FAIL;
1206 }
1207 }
1208
1209/* Check for valid ldap url starters */
1210
1211p = url + 4;
1212if (tolower(*p) == 's' || tolower(*p) == 'i') p++;
1213if (Ustrncmp(p, "://", 3) != 0)
1214 {
1215 *errmsg = string_sprintf("LDAP URL does not start with \"ldap://\", "
1216 "\"ldaps://\", or \"ldapi://\" (it starts with \"%.16s...\")", url);
1217 DEBUG(D_lookup) debug_printf("LDAP query error: %s\n", *errmsg);
1218 return DEFER;
1219 }
1220
1221/* No default servers, or URL contains a server name: just one attempt */
1222
1223if (eldap_default_servers == NULL || p[3] != '/')
1224 {
1225 return perform_ldap_search(url, NULL, 0, search_type, res, errmsg,
6ec97b1b
PH
1226 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference,
1227 referrals);
0756eb3c
PH
1228 }
1229
1230/* Loop through the default servers until OK or FAIL */
1231
1232list = eldap_default_servers;
1233while ((server = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
1234 {
1235 int rc;
1236 int port = 0;
1237 uschar *colon = Ustrchr(server, ':');
1238 if (colon != NULL)
1239 {
1240 *colon = 0;
1241 port = Uatoi(colon+1);
1242 }
1243 rc = perform_ldap_search(url, server, port, search_type, res, errmsg,
6ec97b1b
PH
1244 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference,
1245 referrals);
0756eb3c
PH
1246 if (rc != DEFER || defer_break) return rc;
1247 }
1248
1249return DEFER;
1250}
1251
1252
1253
1254/*************************************************
1255* Find entry point *
1256*************************************************/
1257
1258/* See local README for interface description. The different kinds of search
1259are handled by a common function, with a flag to differentiate between them.
1260The handle and filename arguments are not used. */
1261
e6d225ae 1262static int
0756eb3c
PH
1263eldap_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1264 uschar **result, uschar **errmsg, BOOL *do_cache)
1265{
1266/* Keep picky compilers happy */
1267do_cache = do_cache;
1268return(control_ldap_search(ldap_url, SEARCH_LDAP_SINGLE, result, errmsg));
1269}
1270
e6d225ae 1271static int
0756eb3c
PH
1272eldapm_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1273 uschar **result, uschar **errmsg, BOOL *do_cache)
1274{
1275/* Keep picky compilers happy */
1276do_cache = do_cache;
1277return(control_ldap_search(ldap_url, SEARCH_LDAP_MULTIPLE, result, errmsg));
1278}
1279
e6d225ae 1280static int
0756eb3c
PH
1281eldapdn_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1282 uschar **result, uschar **errmsg, BOOL *do_cache)
1283{
1284/* Keep picky compilers happy */
1285do_cache = do_cache;
1286return(control_ldap_search(ldap_url, SEARCH_LDAP_DN, result, errmsg));
1287}
1288
1289int
1290eldapauth_find(void *handle, uschar *filename, uschar *ldap_url, int length,
1291 uschar **result, uschar **errmsg, BOOL *do_cache)
1292{
1293/* Keep picky compilers happy */
1294do_cache = do_cache;
1295return(control_ldap_search(ldap_url, SEARCH_LDAP_AUTH, result, errmsg));
1296}
1297
1298
1299
1300/*************************************************
1301* Open entry point *
1302*************************************************/
1303
1304/* See local README for interface description. */
1305
e6d225ae 1306static void *
0756eb3c
PH
1307eldap_open(uschar *filename, uschar **errmsg)
1308{
1309return (void *)(1); /* Just return something non-null */
1310}
1311
1312
1313
1314/*************************************************
1315* Tidy entry point *
1316*************************************************/
1317
1318/* See local README for interface description.
1319Make sure that eldap_dn does not refer to reclaimed or worse, freed store */
1320
e6d225ae 1321static void
0756eb3c
PH
1322eldap_tidy(void)
1323{
1324LDAP_CONNECTION *lcp = NULL;
1325eldap_dn = NULL;
1326
1327while ((lcp = ldap_connections) != NULL)
1328 {
1329 DEBUG(D_lookup) debug_printf("unbind LDAP connection to %s:%d\n", lcp->host,
1330 lcp->port);
1331 ldap_unbind(lcp->ld);
1332 ldap_connections = lcp->next;
1333 }
1334}
1335
1336
1337
1338/*************************************************
1339* Quote entry point *
1340*************************************************/
1341
1342/* LDAP quoting is unbelievably messy. For a start, two different levels of
1343quoting have to be done: LDAP quoting, and URL quoting. The current
1344specification is the result of a suggestion by Brian Candler. It recognizes
1345two separate cases:
1346
1347(1) For text that appears in a search filter, the following escapes are
1348 required (see RFC 2254):
1349
1350 * -> \2A
1351 ( -> \28
1352 ) -> \29
1353 \ -> \5C
1354 NULL -> \00
1355
1356 Then the entire filter text must be URL-escaped. This kind of quoting is
1357 implemented by ${quote_ldap:....}. Note that we can never have a NULL
1358 in the input string, because that's a terminator.
1359
1360(2) For a DN that is part of a URL (i.e. the base DN), the characters
1361
1362 , + " \ < > ;
1363
1364 must be quoted by backslashing. See RFC 2253. Leading and trailing spaces
1365 must be escaped, as must a leading #. Then the string must be URL-quoted.
1366 This type of quoting is implemented by ${quote_ldap_dn:....}.
1367
1368For URL quoting, the only characters that need not be quoted are the
1369alphamerics and
1370
1371 ! $ ' ( ) * + - . _
1372
1373All the others must be hexified and preceded by %. This includes the
1374backslashes used for LDAP quoting.
1375
1376For a DN that is given in the USER parameter for authentication, we need the
1377same initial quoting as (2) but in this case, the result must NOT be
1378URL-escaped, because it isn't a URL. The way this is handled is by
1379de-URL-quoting the text when processing the USER parameter in
1380control_ldap_search() above. That means that the same quote operator can be
1381used. This has the additional advantage that spaces in the DN won't cause
1382parsing problems. For example:
1383
1384 USER=cn=${quote_ldap_dn:$1},%20dc=example,%20dc=com
1385
1386should be safe if there are spaces in $1.
1387
1388
1389Arguments:
1390 s the string to be quoted
1391 opt additional option text or NULL if none
1392 only "dn" is recognized
1393
1394Returns: the processed string or NULL for a bad option
1395*/
1396
1397
1398
1399/* The characters in this string, together with alphanumerics, never need
1400quoting in any way. */
1401
1402#define ALWAYS_LITERAL "!$'-._"
1403
1404/* The special characters in this string do not need to be URL-quoted. The set
1405is a bit larger than the general literals. */
1406
1407#define URL_NONQUOTE ALWAYS_LITERAL "()*+"
1408
1409/* The following macros define the characters that are quoted by quote_ldap and
1410quote_ldap_dn, respectively. */
1411
1412#define LDAP_QUOTE "*()\\"
1413#define LDAP_DN_QUOTE ",+\"\\<>;"
1414
1415
1416
e6d225ae 1417static uschar *
0756eb3c
PH
1418eldap_quote(uschar *s, uschar *opt)
1419{
1420register int c;
1421int count = 0;
1422int len = 0;
1423BOOL dn = FALSE;
1424uschar *t = s;
1425uschar *quoted;
1426
1427/* Test for a DN quotation. */
1428
1429if (opt != NULL)
1430 {
1431 if (Ustrcmp(opt, "dn") != 0) return NULL; /* No others recognized */
1432 dn = TRUE;
1433 }
1434
1435/* Compute how much extra store we need for the string. This doesn't have to be
1436exact as long as it isn't an underestimate. The worst case is the addition of 5
1437extra bytes for a single character. This occurs for certain characters in DNs,
1438where, for example, < turns into %5C%3C. For simplicity, we just add 5 for each
1439possibly escaped character. The really fast way would be just to test for
1440non-alphanumerics, but it is probably better to spot a few others that are
1441never escaped, because if there are no specials at all, we can avoid copying
1442the string. */
1443
1444while ((c = *t++) != 0)
1445 {
1446 len++;
1447 if (!isalnum(c) && Ustrchr(ALWAYS_LITERAL, c) == NULL) count += 5;
1448 }
1449if (count == 0) return s;
1450
1451/* Get sufficient store to hold the quoted string */
1452
1453t = quoted = store_get(len + count + 1);
1454
1455/* Handle plain quote_ldap */
1456
1457if (!dn)
1458 {
1459 while ((c = *s++) != 0)
1460 {
1461 if (!isalnum(c))
1462 {
1463 if (Ustrchr(LDAP_QUOTE, c) != NULL)
1464 {
1465 sprintf(CS t, "%%5C%02X", c); /* e.g. * => %5C2A */
1466 t += 5;
1467 continue;
1468 }
1469 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1470 {
1471 sprintf(CS t, "%%%02X", c);
1472 t += 3;
1473 continue;
1474 }
1475 }
1476 *t++ = c; /* unquoted character */
1477 }
1478 }
1479
1480/* Handle quote_ldap_dn */
1481
1482else
1483 {
1484 uschar *ss = s + len;
1485
1486 /* Find the last char before any trailing spaces */
1487
1488 while (ss > s && ss[-1] == ' ') ss--;
1489
1490 /* Quote leading spaces and sharps */
1491
1492 for (; s < ss; s++)
1493 {
1494 if (*s != ' ' && *s != '#') break;
1495 sprintf(CS t, "%%5C%%%02X", *s);
1496 t += 6;
1497 }
1498
1499 /* Handle the rest of the string, up to the trailing spaces */
1500
1501 while (s < ss)
1502 {
1503 c = *s++;
1504 if (!isalnum(c))
1505 {
1506 if (Ustrchr(LDAP_DN_QUOTE, c) != NULL)
1507 {
1508 Ustrncpy(t, "%5C", 3); /* insert \ where needed */
1509 t += 3; /* fall through to check URL */
1510 }
1511 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1512 {
1513 sprintf(CS t, "%%%02X", c);
1514 t += 3;
1515 continue;
1516 }
1517 }
1518 *t++ = c; /* unquoted character, or non-URL quoted after %5C */
1519 }
1520
1521 /* Handle the trailing spaces */
1522
1523 while (*ss++ != 0)
1524 {
1525 Ustrncpy(t, "%5C%20", 6);
1526 t += 6;
1527 }
1528 }
1529
1530/* Terminate the new string and return */
1531
1532*t = 0;
1533return quoted;
1534}
1535
6545de78
PP
1536
1537
1538/*************************************************
1539* Version reporting entry point *
1540*************************************************/
1541
1542/* See local README for interface description. */
1543
1544#include "../version.h"
1545
1546void
1547ldap_version_report(FILE *f)
1548{
1549#ifdef DYNLOOKUP
1550fprintf(f, "Library version: LDAP: Exim version %s\n", EXIM_VERSION_STR);
1551#endif
1552}
1553
1554
e6d225ae
DW
1555static lookup_info ldap_lookup_info = {
1556 US"ldap", /* lookup name */
1557 lookup_querystyle, /* query-style lookup */
1558 eldap_open, /* open function */
1559 NULL, /* check function */
1560 eldap_find, /* find function */
1561 NULL, /* no close function */
1562 eldap_tidy, /* tidy function */
6545de78
PP
1563 eldap_quote, /* quoting function */
1564 ldap_version_report /* version reporting */
e6d225ae
DW
1565};
1566
1567static lookup_info ldapdn_lookup_info = {
1568 US"ldapdn", /* lookup name */
1569 lookup_querystyle, /* query-style lookup */
1570 eldap_open, /* sic */ /* open function */
1571 NULL, /* check function */
1572 eldapdn_find, /* find function */
1573 NULL, /* no close function */
1574 eldap_tidy, /* sic */ /* tidy function */
6545de78
PP
1575 eldap_quote, /* sic */ /* quoting function */
1576 NULL /* no version reporting (redundant) */
e6d225ae
DW
1577};
1578
1579static lookup_info ldapm_lookup_info = {
1580 US"ldapm", /* lookup name */
1581 lookup_querystyle, /* query-style lookup */
1582 eldap_open, /* sic */ /* open function */
1583 NULL, /* check function */
1584 eldapm_find, /* find function */
1585 NULL, /* no close function */
1586 eldap_tidy, /* sic */ /* tidy function */
6545de78
PP
1587 eldap_quote, /* sic */ /* quoting function */
1588 NULL /* no version reporting (redundant) */
e6d225ae
DW
1589};
1590
1591#ifdef DYNLOOKUP
1592#define ldap_lookup_module_info _lookup_module_info
1593#endif
1594
1595static lookup_info *_lookup_list[] = { &ldap_lookup_info, &ldapdn_lookup_info, &ldapm_lookup_info };
1596lookup_module_info ldap_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 3 };
0756eb3c
PH
1597
1598/* End of lookups/ldap.c */