Copyright updates:
[exim.git] / src / src / lookups / ldap.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Many thanks to Stuart Lynne for contributing the original code for this
10 driver. Further contributions from Michael Haardt, Brian Candler, Barry
11 Pederson, Peter Savitch and Christian Kellner. Particular thanks to Brian for
12 researching how to handle the different kinds of error. */
13
14
15 #include "../exim.h"
16 #include "lf_functions.h"
17
18
19 /* Include LDAP headers. The code below uses some "old" LDAP interfaces that
20 are deprecated in OpenLDAP. I don't know their status in other LDAP
21 implementations. LDAP_DEPRECATED causes their prototypes to be defined in
22 ldap.h. */
23
24 #define LDAP_DEPRECATED 1
25
26 #include <lber.h>
27 #include <ldap.h>
28
29
30 /* Annoyingly, the different LDAP libraries handle errors in different ways,
31 and some other things too. There doesn't seem to be an automatic way of
32 distinguishing between them. Local/Makefile should contain a setting of
33 LDAP_LIB_TYPE, which in turn causes appropriate macros to be defined for the
34 different kinds. Those that matter are:
35
36 LDAP_LIB_NETSCAPE
37 LDAP_LIB_SOLARIS with synonym LDAP_LIB_SOLARIS7
38 LDAP_LIB_OPENLDAP2
39
40 These others may be defined, but are in fact the default, so are not tested:
41
42 LDAP_LIB_UMICHIGAN
43 LDAP_LIB_OPENLDAP1
44 */
45
46 #if defined(LDAP_LIB_SOLARIS7) && ! defined(LDAP_LIB_SOLARIS)
47 #define LDAP_LIB_SOLARIS
48 #endif
49
50
51 /* Just in case LDAP_NO_LIMIT is not defined by some of these libraries. */
52
53 #ifndef LDAP_NO_LIMIT
54 #define LDAP_NO_LIMIT 0
55 #endif
56
57
58 /* Just in case LDAP_DEREF_NEVER is not defined */
59
60 #ifndef LDAP_DEREF_NEVER
61 #define LDAP_DEREF_NEVER 0
62 #endif
63
64
65 /* Four types of LDAP search are implemented */
66
67 #define SEARCH_LDAP_MULTIPLE 0 /* Get attributes from multiple entries */
68 #define SEARCH_LDAP_SINGLE 1 /* Get attributes from one entry only */
69 #define SEARCH_LDAP_DN 2 /* Get just the DN from one entry */
70 #define SEARCH_LDAP_AUTH 3 /* Just checking for authentication */
71
72 /* In all 4 cases, the DN is left in $ldap_dn (which post-dates the
73 SEARCH_LDAP_DN lookup). */
74
75
76 /* Structure and anchor for caching connections. */
77
78 typedef struct ldap_connection {
79 struct ldap_connection *next;
80 uschar *host;
81 uschar *user;
82 uschar *password;
83 BOOL bound;
84 int port;
85 BOOL is_start_tls_called;
86 LDAP *ld;
87 } LDAP_CONNECTION;
88
89 static LDAP_CONNECTION *ldap_connections = NULL;
90
91
92
93 /*************************************************
94 * Internal search function *
95 *************************************************/
96
97 /* This is the function that actually does the work. It is called (indirectly
98 via control_ldap_search) from eldap_find(), eldapauth_find(), eldapdn_find(),
99 and eldapm_find(), with a difference in the "search_type" argument.
100
101 The case of eldapauth_find() is special in that all it does is do
102 authentication, returning OK or FAIL as appropriate. This isn't used as a
103 lookup. Instead, it is called from expand.c as an expansion condition test.
104
105 The DN from a successful lookup is placed in $ldap_dn. This feature postdates
106 the provision of the SEARCH_LDAP_DN facility for returning just the DN as the
107 data.
108
109 Arguments:
110 ldap_url the URL to be looked up
111 server server host name, when URL contains none
112 s_port server port, used when URL contains no name
113 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
114 SEARCH_LDAP_SINGLE allows values from one entry only
115 SEARCH_LDAP_DN gets the DN from one entry
116 res set to point at the result (not used for ldapauth)
117 errmsg set to point a message if result is not OK
118 defer_break set TRUE if no more servers to be tried after a DEFER
119 user user name for authentication, or NULL
120 password password for authentication, or NULL
121 sizelimit max number of entries returned, or 0 for no limit
122 timelimit max time to wait, or 0 for no limit
123 tcplimit max time for network activity, e.g. connect, or 0 for OS default
124 deference the dereference option, which is one of
125 LDAP_DEREF_{NEVER,SEARCHING,FINDING,ALWAYS}
126 referrals the referral option, which is LDAP_OPT_ON or LDAP_OPT_OFF
127
128 Returns: OK or FAIL or DEFER
129 FAIL is given only if a lookup was performed successfully, but
130 returned no data.
131 */
132
133 static int
134 perform_ldap_search(const uschar *ldap_url, uschar *server, int s_port,
135 int search_type, uschar **res, uschar **errmsg, BOOL *defer_break,
136 uschar *user, uschar *password, int sizelimit, int timelimit, int tcplimit,
137 int dereference, void *referrals)
138 {
139 LDAPURLDesc *ludp = NULL;
140 LDAPMessage *result = NULL;
141 BerElement *ber;
142 LDAP_CONNECTION *lcp;
143
144 struct timeval timeout;
145 struct timeval *timeoutptr = NULL;
146
147 gstring * data = NULL;
148 uschar *dn = NULL;
149 uschar *host;
150 uschar **values;
151 uschar **firstval;
152 uschar porttext[16];
153
154 uschar *error1 = NULL; /* string representation of errcode (static) */
155 uschar *error2 = NULL; /* error message from the server */
156 uschar *matched = NULL; /* partially matched DN */
157
158 int attrs_requested = 0;
159 int error_yield = DEFER;
160 int msgid;
161 int rc, ldap_rc, ldap_parse_rc;
162 int port;
163 int rescount = 0;
164 BOOL attribute_found = FALSE;
165 BOOL ldapi = FALSE;
166
167 DEBUG(D_lookup) debug_printf_indent("perform_ldap_search:"
168 " ldap%s URL = \"%s\" server=%s port=%d "
169 "sizelimit=%d timelimit=%d tcplimit=%d\n",
170 search_type == SEARCH_LDAP_MULTIPLE ? "m" :
171 search_type == SEARCH_LDAP_DN ? "dn" :
172 search_type == SEARCH_LDAP_AUTH ? "auth" : "",
173 ldap_url, server, s_port, sizelimit, timelimit, tcplimit);
174
175 /* Check if LDAP thinks the URL is a valid LDAP URL. We assume that if the LDAP
176 library that is in use doesn't recognize, say, "ldapi", it will barf here. */
177
178 if (!ldap_is_ldap_url(CS ldap_url))
179 {
180 *errmsg = string_sprintf("ldap_is_ldap_url: not an LDAP url \"%s\"\n",
181 ldap_url);
182 goto RETURN_ERROR_BREAK;
183 }
184
185 /* Parse the URL */
186
187 if ((rc = ldap_url_parse(CS ldap_url, &ludp)) != 0)
188 {
189 *errmsg = string_sprintf("ldap_url_parse: (error %d) parsing \"%s\"\n", rc,
190 ldap_url);
191 goto RETURN_ERROR_BREAK;
192 }
193
194 /* If the host name is empty, take it from the separate argument, if one is
195 given. OpenLDAP 2.0.6 sets an unset hostname to "" rather than empty, but
196 expects NULL later in ldap_init() to mean "default", annoyingly. In OpenLDAP
197 2.0.11 this has changed (it uses NULL). */
198
199 if ((!ludp->lud_host || !ludp->lud_host[0]) && server)
200 {
201 host = server;
202 port = s_port;
203 }
204 else
205 {
206 host = US ludp->lud_host;
207 if (host && !host[0]) host = NULL;
208 port = ludp->lud_port;
209 }
210
211 DEBUG(D_lookup) debug_printf_indent("after ldap_url_parse: host=%s port=%d\n",
212 host, port);
213
214 if (port == 0) port = LDAP_PORT; /* Default if none given */
215 sprintf(CS porttext, ":%d", port); /* For messages */
216
217 /* If the "host name" is actually a path, we are going to connect using a Unix
218 socket, regardless of whether "ldapi" was actually specified or not. This means
219 that a Unix socket can be declared in eldap_default_servers, and "traditional"
220 LDAP queries using just "ldap" can be used ("ldaps" is similarly overridden).
221 The path may start with "/" or it may already be escaped as "%2F" if it was
222 actually declared that way in eldap_default_servers. (I did it that way the
223 first time.) If the host name is not a path, the use of "ldapi" causes an
224 error, except in the default case. (But lud_scheme doesn't seem to exist in
225 older libraries.) */
226
227 if (host)
228 {
229 if ((host[0] == '/' || Ustrncmp(host, "%2F", 3) == 0))
230 {
231 ldapi = TRUE;
232 porttext[0] = 0; /* Remove port from messages */
233 }
234
235 #if defined LDAP_LIB_OPENLDAP2
236 else if (strncmp(ludp->lud_scheme, "ldapi", 5) == 0)
237 {
238 *errmsg = string_sprintf("ldapi requires an absolute path (\"%s\" given)",
239 host);
240 goto RETURN_ERROR;
241 }
242 #endif
243 }
244
245 /* Count the attributes; we need this later to tell us how to format results */
246
247 for (uschar ** attrp = USS ludp->lud_attrs; attrp && *attrp; attrp++)
248 attrs_requested++;
249
250 /* See if we can find a cached connection to this host. The port is not
251 relevant for ldapi. The host name pointer is set to NULL if no host was given
252 (implying the library default), rather than to the empty string. Note that in
253 this case, there is no difference between ldap and ldapi. */
254
255 for (lcp = ldap_connections; lcp; lcp = lcp->next)
256 {
257 if ((host == NULL) != (lcp->host == NULL) ||
258 (host != NULL && strcmpic(lcp->host, host) != 0))
259 continue;
260 if (ldapi || port == lcp->port) break;
261 }
262
263 /* Use this network timeout in any requests. */
264
265 if (tcplimit > 0)
266 {
267 timeout.tv_sec = tcplimit;
268 timeout.tv_usec = 0;
269 timeoutptr = &timeout;
270 }
271
272 /* If no cached connection found, we must open a connection to the server. If
273 the server name is actually an absolute path, we set ldapi=TRUE above. This
274 requests connection via a Unix socket. However, as far as I know, only OpenLDAP
275 supports the use of sockets, and the use of ldap_initialize(). */
276
277 if (!lcp)
278 {
279 LDAP *ld;
280
281 #ifdef LDAP_OPT_X_TLS_NEWCTX
282 int am_server = 0;
283 LDAP *ldsetctx;
284 #else
285 LDAP *ldsetctx = NULL;
286 #endif
287
288
289 /* --------------------------- OpenLDAP ------------------------ */
290
291 /* There seems to be a preference under OpenLDAP for ldap_initialize()
292 instead of ldap_init(), though I have as yet been unable to find
293 documentation that says this. (OpenLDAP documentation is sparse to
294 non-existent). So we handle OpenLDAP differently here. Also, support for
295 ldapi seems to be OpenLDAP-only at present. */
296
297 #ifdef LDAP_LIB_OPENLDAP2
298
299 /* We now need an empty string for the default host. Get some store in which
300 to build a URL for ldap_initialize(). In the ldapi case, it can't be bigger
301 than (9 + 3*Ustrlen(shost)), whereas in the other cases it can't be bigger
302 than the host name + "ldaps:///" plus : and a port number, say 20 + the
303 length of the host name. What we get should accommodate both, easily. */
304
305 uschar * shost = host ? host : US"";
306 rmark reset_point = store_mark();
307 gstring * g;
308
309 /* Handle connection via Unix socket ("ldapi"). We build a basic LDAP URI to
310 contain the path name, with slashes escaped as %2F. */
311
312 if (ldapi)
313 {
314 g = string_catn(NULL, US"ldapi://", 8);
315 for (uschar ch; (ch = *shost); shost++)
316 g = ch == '/' ? string_catn(g, US"%2F", 3) : string_catn(g, shost, 1);
317 }
318
319 /* This is not an ldapi call. Just build a URI with the protocol type, host
320 name, and port. */
321
322 else
323 {
324 uschar * init_ptr = Ustrchr(ldap_url, '/');
325 g = string_catn(NULL, ldap_url, init_ptr - ldap_url);
326 g = string_fmt_append(g, "//%s:%d/", shost, port);
327 }
328 string_from_gstring(g);
329
330 /* Call ldap_initialize() and check the result */
331
332 DEBUG(D_lookup) debug_printf_indent("ldap_initialize with URL %s\n", g->s);
333 if ((rc = ldap_initialize(&ld, CS g->s)) != LDAP_SUCCESS)
334 {
335 *errmsg = string_sprintf("ldap_initialize: (error %d) URL \"%s\"\n",
336 rc, g->s);
337 goto RETURN_ERROR;
338 }
339 store_reset(reset_point); /* Might as well save memory when we can */
340
341
342 /* ------------------------- Not OpenLDAP ---------------------- */
343
344 /* For libraries other than OpenLDAP, use ldap_init(). */
345
346 #else /* LDAP_LIB_OPENLDAP2 */
347 ld = ldap_init(CS host, port);
348 #endif /* LDAP_LIB_OPENLDAP2 */
349
350 /* -------------------------------------------------------------- */
351
352
353 /* Handle failure to initialize */
354
355 if (!ld)
356 {
357 *errmsg = string_sprintf("failed to initialize for LDAP server %s%s - %s",
358 host, porttext, strerror(errno));
359 goto RETURN_ERROR;
360 }
361
362 #ifdef LDAP_OPT_X_TLS_NEWCTX
363 ldsetctx = ld;
364 #endif
365
366 /* Set the TCP connect time limit if available. This is something that is
367 in Netscape SDK v4.1; I don't know about other libraries. */
368
369 #ifdef LDAP_X_OPT_CONNECT_TIMEOUT
370 if (tcplimit > 0)
371 {
372 int timeout1000 = tcplimit*1000;
373 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&timeout1000);
374 }
375 else
376 {
377 int notimeout = LDAP_X_IO_TIMEOUT_NO_TIMEOUT;
378 ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, (void *)&notimeout);
379 }
380 #endif
381
382 /* Set the TCP connect timeout. This works with OpenLDAP 2.2.14. */
383
384 #ifdef LDAP_OPT_NETWORK_TIMEOUT
385 if (tcplimit > 0)
386 ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *)timeoutptr);
387 #endif
388
389 /* I could not get TLS to work until I set the version to 3. That version
390 seems to be the default nowadays. The RFC is dated 1997, so I would hope
391 that all the LDAP libraries support it. Therefore, if eldap_version hasn't
392 been set, go for v3 if we can. */
393
394 if (eldap_version < 0)
395 {
396 #ifdef LDAP_VERSION3
397 eldap_version = LDAP_VERSION3;
398 #else
399 eldap_version = 2;
400 #endif
401 }
402
403 #ifdef LDAP_OPT_PROTOCOL_VERSION
404 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, (void *)&eldap_version);
405 #endif
406
407 DEBUG(D_lookup) debug_printf_indent("initialized for LDAP (v%d) server %s%s\n",
408 eldap_version, host, porttext);
409
410 /* If not using ldapi and TLS is available, set appropriate TLS options: hard
411 for "ldaps" and soft otherwise. */
412
413 #ifdef LDAP_OPT_X_TLS
414 if (!ldapi)
415 {
416 int tls_option;
417 # ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
418 if (eldap_require_cert)
419 {
420 tls_option =
421 Ustrcmp(eldap_require_cert, "hard") == 0 ? LDAP_OPT_X_TLS_HARD
422 : Ustrcmp(eldap_require_cert, "demand") == 0 ? LDAP_OPT_X_TLS_DEMAND
423 : Ustrcmp(eldap_require_cert, "allow") == 0 ? LDAP_OPT_X_TLS_ALLOW
424 : Ustrcmp(eldap_require_cert, "try") == 0 ? LDAP_OPT_X_TLS_TRY
425 : LDAP_OPT_X_TLS_NEVER;
426
427 DEBUG(D_lookup) debug_printf_indent(
428 "Require certificate overrides LDAP_OPT_X_TLS option (%d)\n",
429 tls_option);
430 }
431 else
432 # endif /* LDAP_OPT_X_TLS_REQUIRE_CERT */
433 if (strncmp(ludp->lud_scheme, "ldaps", 5) == 0)
434 {
435 tls_option = LDAP_OPT_X_TLS_HARD;
436 DEBUG(D_lookup)
437 debug_printf_indent("LDAP_OPT_X_TLS_HARD set due to ldaps:// URI\n");
438 }
439 else
440 {
441 tls_option = LDAP_OPT_X_TLS_TRY;
442 DEBUG(D_lookup)
443 debug_printf_indent("LDAP_OPT_X_TLS_TRY set due to ldap:// URI\n");
444 }
445 ldap_set_option(ld, LDAP_OPT_X_TLS, (void *)&tls_option);
446 }
447 #endif /* LDAP_OPT_X_TLS */
448
449 #ifdef LDAP_OPT_X_TLS_CACERTFILE
450 if (eldap_ca_cert_file)
451 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CACERTFILE, eldap_ca_cert_file);
452 #endif
453 #ifdef LDAP_OPT_X_TLS_CACERTDIR
454 if (eldap_ca_cert_dir)
455 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CACERTDIR, eldap_ca_cert_dir);
456 #endif
457 #ifdef LDAP_OPT_X_TLS_CERTFILE
458 if (eldap_cert_file)
459 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CERTFILE, eldap_cert_file);
460 #endif
461 #ifdef LDAP_OPT_X_TLS_KEYFILE
462 if (eldap_cert_key)
463 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_KEYFILE, eldap_cert_key);
464 #endif
465 #ifdef LDAP_OPT_X_TLS_CIPHER_SUITE
466 if (eldap_cipher_suite)
467 ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_CIPHER_SUITE, eldap_cipher_suite);
468 #endif
469 #ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
470 if (eldap_require_cert)
471 {
472 int cert_option =
473 Ustrcmp(eldap_require_cert, "hard") == 0 ? LDAP_OPT_X_TLS_HARD
474 : Ustrcmp(eldap_require_cert, "demand") == 0 ? LDAP_OPT_X_TLS_DEMAND
475 : Ustrcmp(eldap_require_cert, "allow") == 0 ? LDAP_OPT_X_TLS_ALLOW
476 : Ustrcmp(eldap_require_cert, "try") == 0 ? LDAP_OPT_X_TLS_TRY
477 : LDAP_OPT_X_TLS_NEVER;
478
479 /* This ldap handle is set at compile time based on client libs. Older
480 * versions want it to be global and newer versions can force a reload
481 * of the TLS context (to reload these settings we are changing from the
482 * default that loaded at instantiation). */
483 rc = ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option);
484 if (rc)
485 DEBUG(D_lookup)
486 debug_printf_indent("Unable to set TLS require cert_option(%d) globally: %s\n",
487 cert_option, ldap_err2string(rc));
488 }
489 #endif
490 #ifdef LDAP_OPT_X_TLS_NEWCTX
491 if ((rc = ldap_set_option(ldsetctx, LDAP_OPT_X_TLS_NEWCTX, &am_server)))
492 DEBUG(D_lookup)
493 debug_printf_indent("Unable to reload TLS context %d: %s\n",
494 rc, ldap_err2string(rc));
495 #endif
496
497 /* Now add this connection to the chain of cached connections */
498
499 lcp = store_get(sizeof(LDAP_CONNECTION), FALSE);
500 lcp->host = host ? string_copy(host) : NULL;
501 lcp->bound = FALSE;
502 lcp->user = NULL;
503 lcp->password = NULL;
504 lcp->port = port;
505 lcp->ld = ld;
506 lcp->next = ldap_connections;
507 lcp->is_start_tls_called = FALSE;
508 ldap_connections = lcp;
509 }
510
511 /* Found cached connection */
512
513 else
514 DEBUG(D_lookup)
515 debug_printf_indent("re-using cached connection to LDAP server %s%s\n",
516 host, porttext);
517
518 /* Bind with the user/password supplied, or an anonymous bind if these values
519 are NULL, unless a cached connection is already bound with the same values. */
520
521 if ( !lcp->bound
522 || !lcp->user && user
523 || lcp->user && !user
524 || lcp->user && user && Ustrcmp(lcp->user, user) != 0
525 || !lcp->password && password
526 || lcp->password && !password
527 || lcp->password && password && Ustrcmp(lcp->password, password) != 0
528 )
529 {
530 DEBUG(D_lookup) debug_printf_indent("%sbinding with user=%s password=%s\n",
531 lcp->bound ? "re-" : "", user, password);
532
533 if (eldap_start_tls && !lcp->is_start_tls_called && !ldapi)
534 {
535 #if defined(LDAP_OPT_X_TLS) && !defined(LDAP_LIB_SOLARIS)
536 /* The Oracle LDAP libraries (LDAP_LIB_TYPE=SOLARIS) don't support this.
537 * Note: moreover, they appear to now define LDAP_OPT_X_TLS and still not
538 * export an ldap_start_tls_s symbol.
539 */
540 if ( (rc = ldap_start_tls_s(lcp->ld, NULL, NULL)) != LDAP_SUCCESS)
541 {
542 *errmsg = string_sprintf("failed to initiate TLS processing on an "
543 "LDAP session to server %s%s - ldap_start_tls_s() returned %d:"
544 " %s", host, porttext, rc, ldap_err2string(rc));
545 goto RETURN_ERROR;
546 }
547 lcp->is_start_tls_called = TRUE;
548 #else
549 DEBUG(D_lookup) debug_printf_indent("TLS initiation not supported with this Exim"
550 " and your LDAP library.\n");
551 #endif
552 }
553 if ((msgid = ldap_bind(lcp->ld, CS user, CS password, LDAP_AUTH_SIMPLE))
554 == -1)
555 {
556 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
557 "%s%s - ldap_bind() returned -1", host, porttext);
558 goto RETURN_ERROR;
559 }
560
561 if ((rc = ldap_result(lcp->ld, msgid, 1, timeoutptr, &result)) <= 0)
562 {
563 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
564 "%s%s - LDAP error: %s", host, porttext,
565 rc == -1 ? "result retrieval failed" : "timeout" );
566 result = NULL;
567 goto RETURN_ERROR;
568 }
569
570 rc = ldap_result2error(lcp->ld, result, 0);
571
572 /* Invalid credentials when just checking credentials returns FAIL. This
573 stops any further servers being tried. */
574
575 if (search_type == SEARCH_LDAP_AUTH && rc == LDAP_INVALID_CREDENTIALS)
576 {
577 DEBUG(D_lookup)
578 debug_printf_indent("Invalid credentials: ldapauth returns FAIL\n");
579 error_yield = FAIL;
580 goto RETURN_ERROR_NOMSG;
581 }
582
583 /* Otherwise we have a problem that doesn't stop further servers from being
584 tried. */
585
586 if (rc != LDAP_SUCCESS)
587 {
588 *errmsg = string_sprintf("failed to bind the LDAP connection to server "
589 "%s%s - LDAP error %d: %s", host, porttext, rc, ldap_err2string(rc));
590 goto RETURN_ERROR;
591 }
592
593 /* Successful bind */
594
595 lcp->bound = TRUE;
596 lcp->user = !user ? NULL : string_copy(user);
597 lcp->password = !password ? NULL : string_copy(password);
598
599 ldap_msgfree(result);
600 result = NULL;
601 }
602
603 /* If we are just checking credentials, return OK. */
604
605 if (search_type == SEARCH_LDAP_AUTH)
606 {
607 DEBUG(D_lookup) debug_printf_indent("Bind succeeded: ldapauth returns OK\n");
608 goto RETURN_OK;
609 }
610
611 /* Before doing the search, set the time and size limits (if given). Here again
612 the different implementations of LDAP have chosen to do things differently. */
613
614 #if defined(LDAP_OPT_SIZELIMIT)
615 ldap_set_option(lcp->ld, LDAP_OPT_SIZELIMIT, (void *)&sizelimit);
616 ldap_set_option(lcp->ld, LDAP_OPT_TIMELIMIT, (void *)&timelimit);
617 #else
618 lcp->ld->ld_sizelimit = sizelimit;
619 lcp->ld->ld_timelimit = timelimit;
620 #endif
621
622 /* Similarly for dereferencing aliases. Don't know if this is possible on
623 an LDAP library without LDAP_OPT_DEREF. */
624
625 #if defined(LDAP_OPT_DEREF)
626 ldap_set_option(lcp->ld, LDAP_OPT_DEREF, (void *)&dereference);
627 #endif
628
629 /* Similarly for the referral setting; should the library follow referrals that
630 the LDAP server returns? The conditional is just in case someone uses a library
631 without it. */
632
633 #if defined(LDAP_OPT_REFERRALS)
634 ldap_set_option(lcp->ld, LDAP_OPT_REFERRALS, referrals);
635 #endif
636
637 /* Start the search on the server. */
638
639 DEBUG(D_lookup) debug_printf_indent("Start search\n");
640
641 msgid = ldap_search(lcp->ld, ludp->lud_dn, ludp->lud_scope, ludp->lud_filter,
642 ludp->lud_attrs, 0);
643
644 if (msgid == -1)
645 {
646 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
647 int err;
648 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
649 *errmsg = string_sprintf("ldap_search failed: %d, %s", err,
650 ldap_err2string(err));
651 #else
652 *errmsg = string_sprintf("ldap_search failed");
653 #endif
654
655 goto RETURN_ERROR;
656 }
657
658 /* Loop to pick up results as they come in, setting a timeout if one was
659 given. */
660
661 while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
662 LDAP_RES_SEARCH_ENTRY)
663 {
664 LDAPMessage *e;
665 int valuecount; /* We can see an attr spread across several
666 entries. If B is derived from A and we request
667 A and the directory contains both, A and B,
668 then we get two entries, one for A and one for B.
669 Here we just count the values per entry */
670
671 DEBUG(D_lookup) debug_printf_indent("LDAP result loop\n");
672
673 for(e = ldap_first_entry(lcp->ld, result), valuecount = 0;
674 e;
675 e = ldap_next_entry(lcp->ld, e))
676 {
677 uschar *new_dn;
678 BOOL insert_space = FALSE;
679
680 DEBUG(D_lookup) debug_printf_indent("LDAP entry loop\n");
681
682 rescount++; /* Count results */
683
684 /* Results for multiple entries values are separated by newlines. */
685
686 if (data) data = string_catn(data, US"\n", 1);
687
688 /* Get the DN from the last result. */
689
690 if ((new_dn = US ldap_get_dn(lcp->ld, e)))
691 {
692 if (dn)
693 {
694 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
695 ldap_memfree(dn);
696 #else /* OPENLDAP 1, UMich, Solaris */
697 free(dn);
698 #endif
699 }
700 /* Save for later */
701 dn = new_dn;
702 }
703
704 /* If the data we want is actually the DN rather than any attribute values,
705 (an "ldapdn" search) add it to the data string. If there are multiple
706 entries, the DNs will be concatenated, but we test for this case below, as
707 for SEARCH_LDAP_SINGLE, and give an error. */
708
709 if (search_type == SEARCH_LDAP_DN) /* Do not amalgamate these into one */
710 { /* condition, because of the else */
711 if (new_dn) /* below, that's for the first only */
712 {
713 data = string_cat(data, new_dn);
714 (void) string_from_gstring(data);
715 attribute_found = TRUE;
716 }
717 }
718
719 /* Otherwise, loop through the entry, grabbing attribute values. If there's
720 only one attribute being retrieved, no attribute name is given, and the
721 result is not quoted. Multiple values are separated by (comma).
722 If more than one attribute is being retrieved, the data is given as a
723 sequence of name=value pairs, separated by (space), with the value always in quotes.
724 If there are multiple values, they are given within the quotes, comma separated. */
725
726 else for (uschar * attr = US ldap_first_attribute(lcp->ld, e, &ber);
727 attr; attr = US ldap_next_attribute(lcp->ld, e, ber))
728 {
729 DEBUG(D_lookup) debug_printf_indent("LDAP attr loop\n");
730
731 /* In case of attrs_requested == 1 we just count the values, in all other cases
732 (0, >1) we count the values per attribute */
733 if (attrs_requested != 1) valuecount = 0;
734
735 if (attr[0] != 0)
736 {
737 /* Get array of values for this attribute. */
738
739 if ((firstval = values = USS ldap_get_values(lcp->ld, e, CS attr)))
740 {
741 if (attrs_requested != 1)
742 {
743 if (insert_space)
744 data = string_catn(data, US" ", 1);
745 else
746 insert_space = TRUE;
747 data = string_cat(data, attr);
748 data = string_catn(data, US"=\"", 2);
749 }
750
751 while (*values)
752 {
753 uschar *value = *values;
754 int len = Ustrlen(value);
755 ++valuecount;
756
757 DEBUG(D_lookup) debug_printf_indent("LDAP value loop %s:%s\n", attr, value);
758
759 /* In case we requested one attribute only but got several times
760 into that attr loop, we need to append the additional values.
761 (This may happen if you derive attributeTypes B and C from A and
762 then query for A.) In all other cases we detect the different
763 attribute and append only every non first value. */
764
765 if (data && valuecount > 1)
766 data = string_catn(data, US",", 1);
767
768 /* For multiple attributes, the data is in quotes. We must escape
769 internal quotes, backslashes, newlines, and must double commas. */
770
771 if (attrs_requested != 1)
772 for (int j = 0; j < len; j++)
773 {
774 if (value[j] == '\n')
775 data = string_catn(data, US"\\n", 2);
776 else if (value[j] == ',')
777 data = string_catn(data, US",,", 2);
778 else
779 {
780 if (value[j] == '\"' || value[j] == '\\')
781 data = string_catn(data, US"\\", 1);
782 data = string_catn(data, value+j, 1);
783 }
784 }
785
786 /* For single attributes, just double commas */
787
788 else
789 for (int j = 0; j < len; j++)
790 if (value[j] == ',')
791 data = string_catn(data, US",,", 2);
792 else
793 data = string_catn(data, value+j, 1);
794
795
796 /* Move on to the next value */
797
798 values++;
799 attribute_found = TRUE;
800 }
801
802 /* Closing quote at the end of the data for a named attribute. */
803
804 if (attrs_requested != 1)
805 data = string_catn(data, US"\"", 1);
806
807 /* Free the values */
808
809 ldap_value_free(CSS firstval);
810 }
811 }
812
813 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
814
815 /* Netscape and OpenLDAP2 LDAP's attrs are dynamically allocated and need
816 to be freed. UMich LDAP stores them in static storage and does not require
817 this. */
818
819 ldap_memfree(attr);
820 #endif
821 } /* End "for" loop for extracting attributes from an entry */
822 } /* End "for" loop for extracting entries from a result */
823
824 /* Free the result */
825
826 ldap_msgfree(result);
827 result = NULL;
828 } /* End "while" loop for multiple results */
829
830 /* Terminate the dynamic string that we have built and reclaim unused store.
831 In the odd case of a single attribute with zero-length value, allocate
832 an empty string. */
833
834 if (!data) data = string_get(1);
835 (void) string_from_gstring(data);
836 gstring_release_unused(data);
837
838 /* Copy the last dn into eldap_dn */
839
840 if (dn)
841 {
842 eldap_dn = string_copy(dn);
843 #if defined LDAP_LIB_NETSCAPE || defined LDAP_LIB_OPENLDAP2
844 ldap_memfree(dn);
845 #else /* OPENLDAP 1, UMich, Solaris */
846 free(dn);
847 #endif
848 }
849
850 DEBUG(D_lookup) debug_printf_indent("search ended by ldap_result yielding %d\n",rc);
851
852 if (rc == 0)
853 {
854 *errmsg = US"ldap_result timed out";
855 goto RETURN_ERROR;
856 }
857
858 /* A return code of -1 seems to mean "ldap_result failed internally or couldn't
859 provide you with a message". Other error states seem to exist where
860 ldap_result() didn't give us any message from the server at all, leaving result
861 set to NULL. Apparently, "the error parameters of the LDAP session handle will
862 be set accordingly". That's the best we can do to retrieve an error status; we
863 can't use functions like ldap_result2error because they parse a message from
864 the server, which we didn't get.
865
866 Annoyingly, the different implementations of LDAP have gone for different
867 methods of handling error codes and generating error messages. */
868
869 if (rc == -1 || !result)
870 {
871 int err;
872 DEBUG(D_lookup) debug_printf_indent("ldap_result failed\n");
873
874 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
875 ldap_get_option(lcp->ld, LDAP_OPT_ERROR_NUMBER, &err);
876 *errmsg = string_sprintf("ldap_result failed: %d, %s",
877 err, ldap_err2string(err));
878
879 #elif defined LDAP_LIB_NETSCAPE
880 /* Dubious (surely 'matched' is spurious here?) */
881 (void)ldap_get_lderrno(lcp->ld, &matched, &error1);
882 *errmsg = string_sprintf("ldap_result failed: %s (%s)", error1, matched);
883
884 #else /* UMich LDAP aka OpenLDAP 1.x */
885 *errmsg = string_sprintf("ldap_result failed: %d, %s",
886 lcp->ld->ld_errno, ldap_err2string(lcp->ld->ld_errno));
887 #endif
888
889 goto RETURN_ERROR;
890 }
891
892 /* A return code that isn't -1 doesn't necessarily mean there were no problems
893 with the search. The message must be an LDAP_RES_SEARCH_RESULT or
894 LDAP_RES_SEARCH_REFERENCE or else it's something we can't handle. Some versions
895 of LDAP do not define LDAP_RES_SEARCH_REFERENCE (LDAP v1 is one, it seems). So
896 we don't provide that functionality when we can't. :-) */
897
898 if (rc != LDAP_RES_SEARCH_RESULT
899 #ifdef LDAP_RES_SEARCH_REFERENCE
900 && rc != LDAP_RES_SEARCH_REFERENCE
901 #endif
902 )
903 {
904 *errmsg = string_sprintf("ldap_result returned unexpected code %d", rc);
905 goto RETURN_ERROR;
906 }
907
908 /* We have a result message from the server. This doesn't yet mean all is well.
909 We need to parse the message to find out exactly what's happened. */
910
911 #if defined LDAP_LIB_SOLARIS || defined LDAP_LIB_OPENLDAP2
912 ldap_rc = rc;
913 ldap_parse_rc = ldap_parse_result(lcp->ld, result, &rc, CSS &matched,
914 CSS &error2, NULL, NULL, 0);
915 DEBUG(D_lookup) debug_printf_indent("ldap_parse_result: %d\n", ldap_parse_rc);
916 if (ldap_parse_rc < 0 &&
917 (ldap_parse_rc != LDAP_NO_RESULTS_RETURNED
918 #ifdef LDAP_RES_SEARCH_REFERENCE
919 || ldap_rc != LDAP_RES_SEARCH_REFERENCE
920 #endif
921 ))
922 {
923 *errmsg = string_sprintf("ldap_parse_result failed %d", ldap_parse_rc);
924 goto RETURN_ERROR;
925 }
926 error1 = US ldap_err2string(rc);
927
928 #elif defined LDAP_LIB_NETSCAPE
929 /* Dubious (it doesn't reference 'result' at all!) */
930 rc = ldap_get_lderrno(lcp->ld, &matched, &error1);
931
932 #else /* UMich LDAP aka OpenLDAP 1.x */
933 rc = ldap_result2error(lcp->ld, result, 0);
934 error1 = ldap_err2string(rc);
935 error2 = lcp->ld->ld_error;
936 matched = lcp->ld->ld_matched;
937 #endif
938
939 /* Process the status as follows:
940
941 (1) If we get LDAP_SIZELIMIT_EXCEEDED, just carry on, to return the
942 truncated result list.
943
944 (2) If we get LDAP_RES_SEARCH_REFERENCE, also just carry on. This was a
945 submitted patch that is reported to "do the right thing" with Solaris
946 LDAP libraries. (The problem it addresses apparently does not occur with
947 Open LDAP.)
948
949 (3) The range of errors defined by LDAP_NAME_ERROR generally mean "that
950 object does not, or cannot, exist in the database". For those cases we
951 fail the lookup.
952
953 (4) All other non-successes here are treated as some kind of problem with
954 the lookup, so return DEFER (which is the default in error_yield).
955 */
956
957 DEBUG(D_lookup) debug_printf_indent("ldap_parse_result yielded %d: %s\n",
958 rc, ldap_err2string(rc));
959
960 if (rc != LDAP_SUCCESS && rc != LDAP_SIZELIMIT_EXCEEDED
961 #ifdef LDAP_RES_SEARCH_REFERENCE
962 && rc != LDAP_RES_SEARCH_REFERENCE
963 #endif
964 )
965 {
966 *errmsg = string_sprintf("LDAP search failed - error %d: %s%s%s%s%s",
967 rc,
968 error1 ? error1 : US"",
969 error2 && error2[0] ? US"/" : US"",
970 error2 ? error2 : US"",
971 matched && matched[0] ? US"/" : US"",
972 matched ? matched : US"");
973
974 #if defined LDAP_NAME_ERROR
975 if (LDAP_NAME_ERROR(rc))
976 #elif defined NAME_ERROR /* OPENLDAP1 calls it this */
977 if (NAME_ERROR(rc))
978 #else
979 if (rc == LDAP_NO_SUCH_OBJECT)
980 #endif
981
982 {
983 DEBUG(D_lookup) debug_printf_indent("lookup failure forced\n");
984 error_yield = FAIL;
985 }
986 goto RETURN_ERROR;
987 }
988
989 /* The search succeeded. Check if we have too many results */
990
991 if (search_type != SEARCH_LDAP_MULTIPLE && rescount > 1)
992 {
993 *errmsg = string_sprintf("LDAP search: more than one entry (%d) was returned "
994 "(filter not specific enough?)", rescount);
995 goto RETURN_ERROR_BREAK;
996 }
997
998 /* Check if we have too few (zero) entries */
999
1000 if (rescount < 1)
1001 {
1002 *errmsg = US"LDAP search: no results";
1003 error_yield = FAIL;
1004 goto RETURN_ERROR_BREAK;
1005 }
1006
1007 /* If an entry was found, but it had no attributes, we behave as if no entries
1008 were found, that is, the lookup failed. */
1009
1010 if (!attribute_found)
1011 {
1012 *errmsg = US"LDAP search: found no attributes";
1013 error_yield = FAIL;
1014 goto RETURN_ERROR;
1015 }
1016
1017 /* Otherwise, it's all worked */
1018
1019 DEBUG(D_lookup) debug_printf_indent("LDAP search: returning: %s\n", data->s);
1020 *res = data->s;
1021
1022 RETURN_OK:
1023 if (result) ldap_msgfree(result);
1024 ldap_free_urldesc(ludp);
1025 return OK;
1026
1027 /* Error returns */
1028
1029 RETURN_ERROR_BREAK:
1030 *defer_break = TRUE;
1031
1032 RETURN_ERROR:
1033 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
1034
1035 RETURN_ERROR_NOMSG:
1036 if (result) ldap_msgfree(result);
1037 if (ludp) ldap_free_urldesc(ludp);
1038
1039 #if defined LDAP_LIB_OPENLDAP2
1040 if (error2) ldap_memfree(error2);
1041 if (matched) ldap_memfree(matched);
1042 #endif
1043
1044 return error_yield;
1045 }
1046
1047
1048
1049 /*************************************************
1050 * Internal search control function *
1051 *************************************************/
1052
1053 /* This function is called from eldap_find(), eldapauth_find(), eldapdn_find(),
1054 and eldapm_find() with a difference in the "search_type" argument. It controls
1055 calls to perform_ldap_search() which actually does the work. We call that
1056 repeatedly for certain types of defer in the case when the URL contains no host
1057 name and eldap_default_servers is set to a list of servers to try. This gives
1058 more control than just passing over a list of hosts to ldap_open() because it
1059 handles other kinds of defer as well as just a failure to open. Note that the
1060 URL is defined to contain either zero or one "hostport" only.
1061
1062 Parameter data in addition to the URL can be passed as preceding text in the
1063 string, as items of the form XXX=yyy. The URL itself can be detected because it
1064 must begin "ldapx://", where x is empty, s, or i.
1065
1066 Arguments:
1067 ldap_url the URL to be looked up, optionally preceded by other parameter
1068 settings
1069 search_type SEARCH_LDAP_MULTIPLE allows values from multiple entries
1070 SEARCH_LDAP_SINGLE allows values from one entry only
1071 SEARCH_LDAP_DN gets the DN from one entry
1072 res set to point at the result
1073 errmsg set to point a message if result is not OK
1074
1075 Returns: OK or FAIL or DEFER
1076 */
1077
1078 static int
1079 control_ldap_search(const uschar *ldap_url, int search_type, uschar **res,
1080 uschar **errmsg)
1081 {
1082 BOOL defer_break = FALSE;
1083 int timelimit = LDAP_NO_LIMIT;
1084 int sizelimit = LDAP_NO_LIMIT;
1085 int tcplimit = 0;
1086 int sep = 0;
1087 int dereference = LDAP_DEREF_NEVER;
1088 void* referrals = LDAP_OPT_ON;
1089 const uschar *url = ldap_url;
1090 const uschar *p;
1091 uschar *user = NULL;
1092 uschar *password = NULL;
1093 uschar *local_servers = NULL;
1094 uschar *server;
1095 const uschar *list;
1096 uschar buffer[512];
1097
1098 while (isspace(*url)) url++;
1099
1100 /* Until the string begins "ldap", search for the other parameter settings that
1101 are recognized. They are of the form NAME=VALUE, with the value being
1102 optionally double-quoted. There must still be a space after it, however. No
1103 NAME has the value "ldap". */
1104
1105 while (strncmpic(url, US"ldap", 4) != 0)
1106 {
1107 const uschar *name = url;
1108 while (*url && *url != '=') url++;
1109 if (*url == '=')
1110 {
1111 int namelen;
1112 uschar *value;
1113 namelen = ++url - name;
1114 value = string_dequote(&url);
1115 if (isspace(*url))
1116 {
1117 if (strncmpic(name, US"USER=", namelen) == 0) user = value;
1118 else if (strncmpic(name, US"PASS=", namelen) == 0) password = value;
1119 else if (strncmpic(name, US"SIZE=", namelen) == 0) sizelimit = Uatoi(value);
1120 else if (strncmpic(name, US"TIME=", namelen) == 0) timelimit = Uatoi(value);
1121 else if (strncmpic(name, US"CONNECT=", namelen) == 0) tcplimit = Uatoi(value);
1122 else if (strncmpic(name, US"NETTIME=", namelen) == 0) tcplimit = Uatoi(value);
1123 else if (strncmpic(name, US"SERVERS=", namelen) == 0) local_servers = value;
1124
1125 /* Don't know if all LDAP libraries have LDAP_OPT_DEREF */
1126
1127 #ifdef LDAP_OPT_DEREF
1128 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1129 {
1130 if (strcmpic(value, US"never") == 0) dereference = LDAP_DEREF_NEVER;
1131 else if (strcmpic(value, US"searching") == 0)
1132 dereference = LDAP_DEREF_SEARCHING;
1133 else if (strcmpic(value, US"finding") == 0)
1134 dereference = LDAP_DEREF_FINDING;
1135 if (strcmpic(value, US"always") == 0) dereference = LDAP_DEREF_ALWAYS;
1136 }
1137 #else
1138 else if (strncmpic(name, US"DEREFERENCE=", namelen) == 0)
1139 {
1140 *errmsg = string_sprintf("LDAP_OP_DEREF not defined in this LDAP "
1141 "library - cannot use \"dereference\"");
1142 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
1143 return DEFER;
1144 }
1145 #endif
1146
1147 #ifdef LDAP_OPT_REFERRALS
1148 else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
1149 {
1150 if (strcmpic(value, US"follow") == 0) referrals = LDAP_OPT_ON;
1151 else if (strcmpic(value, US"nofollow") == 0) referrals = LDAP_OPT_OFF;
1152 else
1153 {
1154 *errmsg = US"LDAP option REFERRALS is not \"follow\" or \"nofollow\"";
1155 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
1156 return DEFER;
1157 }
1158 }
1159 #else
1160 else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
1161 {
1162 *errmsg = string_sprintf("LDAP_OP_REFERRALS not defined in this LDAP "
1163 "library - cannot use \"referrals\"");
1164 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
1165 return DEFER;
1166 }
1167 #endif
1168
1169 else
1170 {
1171 *errmsg =
1172 string_sprintf("unknown parameter \"%.*s\" precedes LDAP URL",
1173 namelen, name);
1174 DEBUG(D_lookup) debug_printf_indent("LDAP query error: %s\n", *errmsg);
1175 return DEFER;
1176 }
1177 while (isspace(*url)) url++;
1178 continue;
1179 }
1180 }
1181 *errmsg = US"malformed parameter setting precedes LDAP URL";
1182 DEBUG(D_lookup) debug_printf_indent("LDAP query error: %s\n", *errmsg);
1183 return DEFER;
1184 }
1185
1186 /* If user is set, de-URL-quote it. Some LDAP libraries do this for themselves,
1187 but it seems that not all behave like this. The DN for the user is often the
1188 result of ${quote_ldap_dn:...} quoting, which does apply URL quoting, because
1189 that is needed when the DN is used as a base DN in a query. Sigh. This is all
1190 far too complicated. */
1191
1192 if (user)
1193 {
1194 uschar *t = user;
1195 for (uschar * s = user; *s != 0; s++)
1196 {
1197 int c, d;
1198 if (*s == '%' && isxdigit(c=s[1]) && isxdigit(d=s[2]))
1199 {
1200 c = tolower(c);
1201 d = tolower(d);
1202 *t++ =
1203 (((c >= 'a')? (10 + c - 'a') : c - '0') << 4) |
1204 ((d >= 'a')? (10 + d - 'a') : d - '0');
1205 s += 2;
1206 }
1207 else *t++ = *s;
1208 }
1209 *t = 0;
1210 }
1211
1212 DEBUG(D_lookup)
1213 debug_printf_indent("LDAP parameters: user=%s pass=%s size=%d time=%d connect=%d "
1214 "dereference=%d referrals=%s\n", user, password, sizelimit, timelimit,
1215 tcplimit, dereference, referrals == LDAP_OPT_ON ? "on" : "off");
1216
1217 /* If the request is just to check authentication, some credentials must
1218 be given. The password must not be empty because LDAP binds with an empty
1219 password are considered anonymous, and will succeed on most installations. */
1220
1221 if (search_type == SEARCH_LDAP_AUTH)
1222 {
1223 if (!user || !password)
1224 {
1225 *errmsg = US"ldapauth lookups must specify the username and password";
1226 return DEFER;
1227 }
1228 if (!*password)
1229 {
1230 DEBUG(D_lookup) debug_printf_indent("Empty password: ldapauth returns FAIL\n");
1231 return FAIL;
1232 }
1233 }
1234
1235 /* Check for valid ldap url starters */
1236
1237 p = url + 4;
1238 if (tolower(*p) == 's' || tolower(*p) == 'i') p++;
1239 if (Ustrncmp(p, "://", 3) != 0)
1240 {
1241 *errmsg = string_sprintf("LDAP URL does not start with \"ldap://\", "
1242 "\"ldaps://\", or \"ldapi://\" (it starts with \"%.16s...\")", url);
1243 DEBUG(D_lookup) debug_printf_indent("LDAP query error: %s\n", *errmsg);
1244 return DEFER;
1245 }
1246
1247 /* No default servers, or URL contains a server name: just one attempt */
1248
1249 if (!eldap_default_servers && !local_servers || p[3] != '/')
1250 return perform_ldap_search(url, NULL, 0, search_type, res, errmsg,
1251 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference,
1252 referrals);
1253
1254 /* Loop through the default servers until OK or FAIL. Use local_servers list
1255 * if defined in the lookup, otherwise use the global default list */
1256 list = !local_servers ? eldap_default_servers : local_servers;
1257 while ((server = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
1258 {
1259 int rc;
1260 int port = 0;
1261 uschar *colon = Ustrchr(server, ':');
1262 if (colon)
1263 {
1264 *colon = 0;
1265 port = Uatoi(colon+1);
1266 }
1267 rc = perform_ldap_search(url, server, port, search_type, res, errmsg,
1268 &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference,
1269 referrals);
1270 if (rc != DEFER || defer_break) return rc;
1271 }
1272
1273 return DEFER;
1274 }
1275
1276
1277
1278 /*************************************************
1279 * Find entry point *
1280 *************************************************/
1281
1282 /* See local README for interface description. The different kinds of search
1283 are handled by a common function, with a flag to differentiate between them.
1284 The handle and filename arguments are not used. */
1285
1286 static int
1287 eldap_find(void * handle, const uschar * filename, const uschar * ldap_url,
1288 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
1289 const uschar * opts)
1290 {
1291 /* Keep picky compilers happy */
1292 do_cache = do_cache;
1293 return(control_ldap_search(ldap_url, SEARCH_LDAP_SINGLE, result, errmsg));
1294 }
1295
1296 static int
1297 eldapm_find(void * handle, const uschar * filename, const uschar * ldap_url,
1298 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
1299 const uschar * opts)
1300 {
1301 /* Keep picky compilers happy */
1302 do_cache = do_cache;
1303 return(control_ldap_search(ldap_url, SEARCH_LDAP_MULTIPLE, result, errmsg));
1304 }
1305
1306 static int
1307 eldapdn_find(void * handle, const uschar * filename, const uschar * ldap_url,
1308 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
1309 const uschar * opts)
1310 {
1311 /* Keep picky compilers happy */
1312 do_cache = do_cache;
1313 return(control_ldap_search(ldap_url, SEARCH_LDAP_DN, result, errmsg));
1314 }
1315
1316 int
1317 eldapauth_find(void * handle, const uschar * filename, const uschar * ldap_url,
1318 int length, uschar ** result, uschar ** errmsg, uint * do_cache)
1319 {
1320 /* Keep picky compilers happy */
1321 do_cache = do_cache;
1322 return(control_ldap_search(ldap_url, SEARCH_LDAP_AUTH, result, errmsg));
1323 }
1324
1325
1326
1327 /*************************************************
1328 * Open entry point *
1329 *************************************************/
1330
1331 /* See local README for interface description. */
1332
1333 static void *
1334 eldap_open(const uschar * filename, uschar ** errmsg)
1335 {
1336 return (void *)(1); /* Just return something non-null */
1337 }
1338
1339
1340
1341 /*************************************************
1342 * Tidy entry point *
1343 *************************************************/
1344
1345 /* See local README for interface description.
1346 Make sure that eldap_dn does not refer to reclaimed or worse, freed store */
1347
1348 static void
1349 eldap_tidy(void)
1350 {
1351 LDAP_CONNECTION *lcp = NULL;
1352 eldap_dn = NULL;
1353
1354 while ((lcp = ldap_connections) != NULL)
1355 {
1356 DEBUG(D_lookup) debug_printf_indent("unbind LDAP connection to %s:%d\n", lcp->host,
1357 lcp->port);
1358 if(lcp->bound == TRUE)
1359 ldap_unbind(lcp->ld);
1360 ldap_connections = lcp->next;
1361 }
1362 }
1363
1364
1365
1366 /*************************************************
1367 * Quote entry point *
1368 *************************************************/
1369
1370 /* LDAP quoting is unbelievably messy. For a start, two different levels of
1371 quoting have to be done: LDAP quoting, and URL quoting. The current
1372 specification is the result of a suggestion by Brian Candler. It recognizes
1373 two separate cases:
1374
1375 (1) For text that appears in a search filter, the following escapes are
1376 required (see RFC 2254):
1377
1378 * -> \2A
1379 ( -> \28
1380 ) -> \29
1381 \ -> \5C
1382 NULL -> \00
1383
1384 Then the entire filter text must be URL-escaped. This kind of quoting is
1385 implemented by ${quote_ldap:....}. Note that we can never have a NULL
1386 in the input string, because that's a terminator.
1387
1388 (2) For a DN that is part of a URL (i.e. the base DN), the characters
1389
1390 , + " \ < > ;
1391
1392 must be quoted by backslashing. See RFC 2253. Leading and trailing spaces
1393 must be escaped, as must a leading #. Then the string must be URL-quoted.
1394 This type of quoting is implemented by ${quote_ldap_dn:....}.
1395
1396 For URL quoting, the only characters that need not be quoted are the
1397 alphamerics and
1398
1399 ! $ ' ( ) * + - . _
1400
1401 All the others must be hexified and preceded by %. This includes the
1402 backslashes used for LDAP quoting.
1403
1404 For a DN that is given in the USER parameter for authentication, we need the
1405 same initial quoting as (2) but in this case, the result must NOT be
1406 URL-escaped, because it isn't a URL. The way this is handled is by
1407 de-URL-quoting the text when processing the USER parameter in
1408 control_ldap_search() above. That means that the same quote operator can be
1409 used. This has the additional advantage that spaces in the DN won't cause
1410 parsing problems. For example:
1411
1412 USER=cn=${quote_ldap_dn:$1},%20dc=example,%20dc=com
1413
1414 should be safe if there are spaces in $1.
1415
1416
1417 Arguments:
1418 s the string to be quoted
1419 opt additional option text or NULL if none
1420 only "dn" is recognized
1421
1422 Returns: the processed string or NULL for a bad option
1423 */
1424
1425
1426
1427 /* The characters in this string, together with alphanumerics, never need
1428 quoting in any way. */
1429
1430 #define ALWAYS_LITERAL "!$'-._"
1431
1432 /* The special characters in this string do not need to be URL-quoted. The set
1433 is a bit larger than the general literals. */
1434
1435 #define URL_NONQUOTE ALWAYS_LITERAL "()*+"
1436
1437 /* The following macros define the characters that are quoted by quote_ldap and
1438 quote_ldap_dn, respectively. */
1439
1440 #define LDAP_QUOTE "*()\\"
1441 #define LDAP_DN_QUOTE ",+\"\\<>;"
1442
1443
1444
1445 static uschar *
1446 eldap_quote(uschar *s, uschar *opt)
1447 {
1448 register int c;
1449 int count = 0;
1450 int len = 0;
1451 BOOL dn = FALSE;
1452 uschar *t = s;
1453 uschar *quoted;
1454
1455 /* Test for a DN quotation. */
1456
1457 if (opt != NULL)
1458 {
1459 if (Ustrcmp(opt, "dn") != 0) return NULL; /* No others recognized */
1460 dn = TRUE;
1461 }
1462
1463 /* Compute how much extra store we need for the string. This doesn't have to be
1464 exact as long as it isn't an underestimate. The worst case is the addition of 5
1465 extra bytes for a single character. This occurs for certain characters in DNs,
1466 where, for example, < turns into %5C%3C. For simplicity, we just add 5 for each
1467 possibly escaped character. The really fast way would be just to test for
1468 non-alphanumerics, but it is probably better to spot a few others that are
1469 never escaped, because if there are no specials at all, we can avoid copying
1470 the string. */
1471
1472 while ((c = *t++) != 0)
1473 {
1474 len++;
1475 if (!isalnum(c) && Ustrchr(ALWAYS_LITERAL, c) == NULL) count += 5;
1476 }
1477 if (count == 0) return s;
1478
1479 /* Get sufficient store to hold the quoted string */
1480
1481 t = quoted = store_get(len + count + 1, is_tainted(s));
1482
1483 /* Handle plain quote_ldap */
1484
1485 if (!dn)
1486 {
1487 while ((c = *s++) != 0)
1488 {
1489 if (!isalnum(c))
1490 {
1491 if (Ustrchr(LDAP_QUOTE, c) != NULL)
1492 {
1493 sprintf(CS t, "%%5C%02X", c); /* e.g. * => %5C2A */
1494 t += 5;
1495 continue;
1496 }
1497 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1498 {
1499 sprintf(CS t, "%%%02X", c);
1500 t += 3;
1501 continue;
1502 }
1503 }
1504 *t++ = c; /* unquoted character */
1505 }
1506 }
1507
1508 /* Handle quote_ldap_dn */
1509
1510 else
1511 {
1512 uschar *ss = s + len;
1513
1514 /* Find the last char before any trailing spaces */
1515
1516 while (ss > s && ss[-1] == ' ') ss--;
1517
1518 /* Quote leading spaces and sharps */
1519
1520 for (; s < ss; s++)
1521 {
1522 if (*s != ' ' && *s != '#') break;
1523 sprintf(CS t, "%%5C%%%02X", *s);
1524 t += 6;
1525 }
1526
1527 /* Handle the rest of the string, up to the trailing spaces */
1528
1529 while (s < ss)
1530 {
1531 c = *s++;
1532 if (!isalnum(c))
1533 {
1534 if (Ustrchr(LDAP_DN_QUOTE, c) != NULL)
1535 {
1536 Ustrncpy(t, US"%5C", 3); /* insert \ where needed */
1537 t += 3; /* fall through to check URL */
1538 }
1539 if (Ustrchr(URL_NONQUOTE, c) == NULL) /* e.g. ] => %5D */
1540 {
1541 sprintf(CS t, "%%%02X", c);
1542 t += 3;
1543 continue;
1544 }
1545 }
1546 *t++ = c; /* unquoted character, or non-URL quoted after %5C */
1547 }
1548
1549 /* Handle the trailing spaces */
1550
1551 while (*ss++ != 0)
1552 {
1553 Ustrncpy(t, US"%5C%20", 6);
1554 t += 6;
1555 }
1556 }
1557
1558 /* Terminate the new string and return */
1559
1560 *t = 0;
1561 return quoted;
1562 }
1563
1564
1565
1566 /*************************************************
1567 * Version reporting entry point *
1568 *************************************************/
1569
1570 /* See local README for interface description. */
1571
1572 #include "../version.h"
1573
1574 void
1575 ldap_version_report(FILE *f)
1576 {
1577 #ifdef DYNLOOKUP
1578 fprintf(f, "Library version: LDAP: Exim version %s\n", EXIM_VERSION_STR);
1579 #endif
1580 }
1581
1582
1583 static lookup_info ldap_lookup_info = {
1584 .name = US"ldap", /* lookup name */
1585 .type = lookup_querystyle, /* query-style lookup */
1586 .open = eldap_open, /* open function */
1587 .check = NULL, /* check function */
1588 .find = eldap_find, /* find function */
1589 .close = NULL, /* no close function */
1590 .tidy = eldap_tidy, /* tidy function */
1591 .quote = eldap_quote, /* quoting function */
1592 .version_report = ldap_version_report /* version reporting */
1593 };
1594
1595 static lookup_info ldapdn_lookup_info = {
1596 .name = US"ldapdn", /* lookup name */
1597 .type = lookup_querystyle, /* query-style lookup */
1598 .open = eldap_open, /* sic */ /* open function */
1599 .check = NULL, /* check function */
1600 .find = eldapdn_find, /* find function */
1601 .close = NULL, /* no close function */
1602 .tidy = eldap_tidy, /* sic */ /* tidy function */
1603 .quote = eldap_quote, /* sic */ /* quoting function */
1604 .version_report = NULL /* no version reporting (redundant) */
1605 };
1606
1607 static lookup_info ldapm_lookup_info = {
1608 .name = US"ldapm", /* lookup name */
1609 .type = lookup_querystyle, /* query-style lookup */
1610 .open = eldap_open, /* sic */ /* open function */
1611 .check = NULL, /* check function */
1612 .find = eldapm_find, /* find function */
1613 .close = NULL, /* no close function */
1614 .tidy = eldap_tidy, /* sic */ /* tidy function */
1615 .quote = eldap_quote, /* sic */ /* quoting function */
1616 .version_report = NULL /* no version reporting (redundant) */
1617 };
1618
1619 #ifdef DYNLOOKUP
1620 #define ldap_lookup_module_info _lookup_module_info
1621 #endif
1622
1623 static lookup_info *_lookup_list[] = { &ldap_lookup_info, &ldapdn_lookup_info, &ldapm_lookup_info };
1624 lookup_module_info ldap_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 3 };
1625
1626 /* End of lookups/ldap.c */