contrib/sendmail/libsm/ldap.c

   1 /*
   2  * Copyright (c) 2001-2009 Proofpoint, Inc. and its suppliers.
   3  *      All rights reserved.
   4  *
   5  * By using this file, you agree to the terms and conditions set
   6  * forth in the LICENSE file which can be found at the top level of
   7  * the sendmail distribution.
   8  */
   9
  10 /* some "deprecated" calls are used, e.g., ldap_get_values() */
  11 #define LDAP_DEPRECATED 1
  12
  13 #include <sm/gen.h>
  14 SM_RCSID("@(#)$Id: ldap.c,v 1.86 2013-11-22 20:51:43 ca Exp $")
  15
  16 #if LDAPMAP
  17 # include <sys/types.h>
  18 # include <errno.h>
  19 # include <setjmp.h>
  20 # include <stdlib.h>
  21 # include <unistd.h>
  22
  23 # include <sm/bitops.h>
  24 # include <sm/clock.h>
  25 # include <sm/conf.h>
  26 # include <sm/debug.h>
  27 # include <sm/errstring.h>
  28 # include <sm/ldap.h>
  29 # include <sm/string.h>
  30 # include <sm/sysexits.h>
  31 # include <sm/sendmail.h>
  32
  33 SM_DEBUG_T SmLDAPTrace = SM_DEBUG_INITIALIZER("sm_trace_ldap",
  34         "@(#)$Debug: sm_trace_ldap - trace LDAP operations $");
  35
  36 static bool     sm_ldap_has_objectclass __P((SM_LDAP_STRUCT *, LDAPMessage *, char *));
  37 static SM_LDAP_RECURSE_ENTRY *sm_ldap_add_recurse __P((SM_LDAP_RECURSE_LIST **, char *, int, SM_RPOOL_T *));
  38
  39 static char *sm_ldap_geterror __P((LDAP *));
  40
  41 /*
  42 **  SM_LDAP_CLEAR -- set default values for SM_LDAP_STRUCT
  43 **
  44 **      Parameters:
  45 **              lmap -- pointer to SM_LDAP_STRUCT to clear
  46 **
  47 **      Returns:
  48 **              None.
  49 **
  50 */
  51
  52 # if _FFR_LDAP_VERSION
  53 #  if defined(LDAP_VERSION_MAX) && _FFR_LDAP_VERSION > LDAP_VERSION_MAX
  54 #   error "_FFR_LDAP_VERSION > LDAP_VERSION_MAX"
  55 #  endif
  56 #  if defined(LDAP_VERSION_MIN) && _FFR_LDAP_VERSION < LDAP_VERSION_MIN
  57 #   error "_FFR_LDAP_VERSION < LDAP_VERSION_MAX"
  58 #  endif
  59 #  define SM_LDAP_VERSION_DEFAULT       _FFR_LDAP_VERSION
  60 # else /* _FFR_LDAP_VERSION */
  61 #  define SM_LDAP_VERSION_DEFAULT       0
  62 # endif /* _FFR_LDAP_VERSION */
  63
  64 void
  65 sm_ldap_clear(lmap)
  66         SM_LDAP_STRUCT *lmap;
  67 {
  68         if (lmap == NULL)
  69                 return;
  70
  71         lmap->ldap_host = NULL;
  72         lmap->ldap_port = LDAP_PORT;
  73         lmap->ldap_uri = NULL;
  74         lmap->ldap_version = SM_LDAP_VERSION_DEFAULT;
  75         lmap->ldap_deref = LDAP_DEREF_NEVER;
  76         lmap->ldap_timelimit = LDAP_NO_LIMIT;
  77         lmap->ldap_sizelimit = LDAP_NO_LIMIT;
  78 # ifdef LDAP_REFERRALS
  79         lmap->ldap_options = LDAP_OPT_REFERRALS;
  80 # else
  81         lmap->ldap_options = 0;
  82 # endif
  83         lmap->ldap_attrsep = '\0';
  84 # if LDAP_NETWORK_TIMEOUT
  85         lmap->ldap_networktmo = 0;
  86 # endif
  87         lmap->ldap_binddn = NULL;
  88         lmap->ldap_secret = NULL;
  89         lmap->ldap_method = LDAP_AUTH_SIMPLE;
  90         lmap->ldap_base = NULL;
  91         lmap->ldap_scope = LDAP_SCOPE_SUBTREE;
  92         lmap->ldap_attrsonly = LDAPMAP_FALSE;
  93         lmap->ldap_timeout.tv_sec = 0;
  94         lmap->ldap_timeout.tv_usec = 0;
  95         lmap->ldap_ld = NULL;
  96         lmap->ldap_filter = NULL;
  97         lmap->ldap_attr[0] = NULL;
  98         lmap->ldap_attr_type[0] = SM_LDAP_ATTR_NONE;
  99         lmap->ldap_attr_needobjclass[0] = NULL;
 100         lmap->ldap_res = NULL;
 101         lmap->ldap_next = NULL;
 102         lmap->ldap_pid = 0;
 103         lmap->ldap_multi_args = false;
 104 }
 105
 106 # if _FFR_SM_LDAP_DBG && defined(LBER_OPT_LOG_PRINT_FN)
 107 static void ldap_debug_cb __P((const char *msg));
 108
 109 static void
 110 ldap_debug_cb(msg)
 111         const char *msg;
 112 {
 113         if (sm_debug_active(&SmLDAPTrace, 4))
 114                 sm_dprintf("%s", msg);
 115 }
 116 # endif /* _FFR_SM_LDAP_DBG && defined(LBER_OPT_LOG_PRINT_FN) */
 117
 118
 119 # if LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT)
 120 #  define SET_LDAP_TMO(ld, lmap)                                        \
 121         do                                                              \
 122         {                                                               \
 123                 if (lmap->ldap_networktmo > 0)                          \
 124                 {                                                       \
 125                         struct timeval tmo;                             \
 126                                                                         \
 127                         if (sm_debug_active(&SmLDAPTrace, 9))           \
 128                                 sm_dprintf("ldap_networktmo=%d\n",      \
 129                                         lmap->ldap_networktmo);         \
 130                         tmo.tv_sec = lmap->ldap_networktmo;             \
 131                         tmo.tv_usec = 0;                                \
 132                         ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tmo); \
 133                 }       \
 134         } while (0)
 135 # else /* LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT) */
 136 #  define SET_LDAP_TMO(ld, lmap)
 137 # endif /* LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT) */
 138
 139 /*
 140 **  SM_LDAP_SETOPTSG -- set some (global) LDAP options
 141 **
 142 **      Parameters:
 143 **              lmap -- LDAP map information
 144 **
 145 **      Returns:
 146 **              None.
 147 **
 148 */
 149
 150 # if _FFR_SM_LDAP_DBG
 151 static bool dbg_init = false;
 152 # endif
 153 # if SM_CONF_LDAP_INITIALIZE
 154 static void sm_ldap_setoptsg __P((SM_LDAP_STRUCT *lmap));
 155 static void
 156 sm_ldap_setoptsg(lmap)
 157         SM_LDAP_STRUCT *lmap;
 158 {
 159 #  if USE_LDAP_SET_OPTION
 160
 161         SET_LDAP_TMO(NULL, lmap);
 162
 163 #   if _FFR_SM_LDAP_DBG
 164         if (!dbg_init && sm_debug_active(&SmLDAPTrace, 1) &&
 165             lmap->ldap_debug != 0)
 166         {
 167                 int r;
 168 #    if defined(LBER_OPT_LOG_PRINT_FN)
 169                 r = ber_set_option(NULL, LBER_OPT_LOG_PRINT_FN, ldap_debug_cb);
 170 #    endif
 171                 if (sm_debug_active(&SmLDAPTrace, 9))
 172                         sm_dprintf("ldap_debug0=%d\n", lmap->ldap_debug);
 173                 r = ber_set_option(NULL, LBER_OPT_DEBUG_LEVEL,
 174                                 &(lmap->ldap_debug));
 175                 if (sm_debug_active(&SmLDAPTrace, 9) && r != LDAP_OPT_SUCCESS)
 176                         sm_dprintf("ber_set_option=%d\n", r);
 177                 r = ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL,
 178                                 &(lmap->ldap_debug));
 179                 if (sm_debug_active(&SmLDAPTrace, 9) && r != LDAP_OPT_SUCCESS)
 180                         sm_dprintf("ldap_set_option=%d\n", r);
 181                 dbg_init = true;
 182         }
 183 #   endif /* _FFR_SM_LDAP_DBG */
 184 #  endif /* USE_LDAP_SET_OPTION */
 185 }
 186 # endif /* SM_CONF_LDAP_INITIALIZE */
 187
 188 /*
 189 **  SM_LDAP_SETOPTS -- set LDAP options
 190 **
 191 **      Parameters:
 192 **              ld -- LDAP session handle
 193 **              lmap -- LDAP map information
 194 **
 195 **      Returns:
 196 **              None.
 197 **
 198 */
 199
 200 void
 201 sm_ldap_setopts(ld, lmap)
 202         LDAP *ld;
 203         SM_LDAP_STRUCT *lmap;
 204 {
 205 # if USE_LDAP_SET_OPTION
 206         if (lmap->ldap_version != 0)
 207         {
 208                 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION,
 209                                 &lmap->ldap_version);
 210         }
 211         ldap_set_option(ld, LDAP_OPT_DEREF, &lmap->ldap_deref);
 212         if (bitset(LDAP_OPT_REFERRALS, lmap->ldap_options))
 213                 ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON);
 214         else
 215                 ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
 216         ldap_set_option(ld, LDAP_OPT_SIZELIMIT, &lmap->ldap_sizelimit);
 217         ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &lmap->ldap_timelimit);
 218         SET_LDAP_TMO(ld, lmap);
 219 #  if _FFR_SM_LDAP_DBG
 220         if ((!dbg_init || ld != NULL) && sm_debug_active(&SmLDAPTrace, 1)
 221             && lmap->ldap_debug > 0)
 222         {
 223                 int r;
 224
 225                 if (sm_debug_active(&SmLDAPTrace, 9))
 226                         sm_dprintf("ldap_debug=%d, dbg_init=%d\n",
 227                                 lmap->ldap_debug, dbg_init);
 228                 r = ldap_set_option(ld, LDAP_OPT_DEBUG_LEVEL,
 229                                 &(lmap->ldap_debug));
 230                 if (sm_debug_active(&SmLDAPTrace, 9) && r != LDAP_OPT_SUCCESS)
 231                         sm_dprintf("ldap_set_option=%d\n", r);
 232         }
 233 #  endif /* _FFR_SM_LDAP_DBG */
 234 #  ifdef LDAP_OPT_RESTART
 235         ldap_set_option(ld, LDAP_OPT_RESTART, LDAP_OPT_ON);
 236 #  endif
 237 #  if _FFR_TESTS
 238         if (sm_debug_active(&SmLDAPTrace, 101))
 239         {
 240                 char *cert;
 241                 char buf[PATH_MAX];
 242
 243                 cert = getcwd(buf, sizeof(buf));
 244                 if (NULL != cert)
 245                 {
 246                         int r;
 247
 248                         (void) sm_strlcat(buf, "/ldaps.pem", sizeof(buf));
 249                         r = ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE, cert);
 250                         sm_dprintf("LDAP_OPT_X_TLS_CACERTFILE(%s)=%d\n", cert, r);
 251                 }
 252         }
 253 #  endif /* _FFR_TESTS */
 254
 255 # else /* USE_LDAP_SET_OPTION */
 256         /* From here on in we can use ldap internal timelimits */
 257         ld->ld_deref = lmap->ldap_deref;
 258         ld->ld_options = lmap->ldap_options;
 259         ld->ld_sizelimit = lmap->ldap_sizelimit;
 260         ld->ld_timelimit = lmap->ldap_timelimit;
 261 # endif /* USE_LDAP_SET_OPTION */
 262 }
 263
 264 /*
 265 **  SM_LDAP_START -- actually connect to an LDAP server
 266 **
 267 **      Parameters:
 268 **              name -- name of map for debug output.
 269 **              lmap -- the LDAP map being opened.
 270 **
 271 **      Returns:
 272 **              true if connection is successful, false otherwise.
 273 **
 274 **      Side Effects:
 275 **              Populates lmap->ldap_ld.
 276 */
 277
 278 # if !USE_LDAP_INIT || !LDAP_NETWORK_TIMEOUT
 279 static jmp_buf  LDAPTimeout;
 280 static void     ldaptimeout __P((int));
 281
 282 /* ARGSUSED */
 283 static void
 284 ldaptimeout(unused)
 285         int unused;
 286 {
 287         /*
 288         **  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
 289         **      ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
 290         **      DOING.
 291         */
 292
 293         errno = ETIMEDOUT;
 294         longjmp(LDAPTimeout, 1);
 295 }
 296
 297
 298 #define SM_LDAP_SETTIMEOUT(to, where)                                   \
 299 do                                                                      \
 300 {                                                                       \
 301         if (to != 0)                                                    \
 302         {                                                               \
 303                 if (setjmp(LDAPTimeout) != 0)                           \
 304                 {                                                       \
 305                         if (sm_debug_active(&SmLDAPTrace, 9))           \
 306                                 sm_dprintf("ldap_settimeout(%s)=triggered\n",\
 307                                         where);                         \
 308                         errno = ETIMEDOUT;                              \
 309                         return false;                                   \
 310                 }                                                       \
 311                 ev = sm_setevent(to, ldaptimeout, 0);                   \
 312         }                                                               \
 313 } while (0)
 314
 315 #define SM_LDAP_CLEARTIMEOUT()                                          \
 316 do                                                                      \
 317 {                                                                       \
 318         if (ev != NULL)                                                 \
 319                 sm_clrevent(ev);                                        \
 320 } while (0)
 321 # endif /* !USE_LDAP_INIT || !LDAP_NETWORK_TIMEOUT */
 322
 323 bool
 324 sm_ldap_start(name, lmap)
 325         char *name;
 326         SM_LDAP_STRUCT *lmap;
 327 {
 328         int save_errno = 0;
 329         char *id;
 330         char *errmsg;
 331 # if !USE_LDAP_INIT || !LDAP_NETWORK_TIMEOUT
 332         SM_EVENT *ev = NULL;
 333 # endif
 334         LDAP *ld = NULL;
 335         struct timeval tmo;
 336         int msgid, err, r;
 337
 338         errmsg = NULL;
 339         if (sm_debug_active(&SmLDAPTrace, 2))
 340                 sm_dprintf("ldapmap_start(%s)\n", name == NULL ? "" : name);
 341
 342         if (lmap->ldap_host != NULL)
 343                 id = lmap->ldap_host;
 344         else if (lmap->ldap_uri != NULL)
 345                 id = lmap->ldap_uri;
 346         else
 347                 id = "localhost";
 348
 349         if (sm_debug_active(&SmLDAPTrace, 9))
 350         {
 351                 /* Don't print a port number for LDAP URIs */
 352                 if (lmap->ldap_uri != NULL)
 353                         sm_dprintf("ldapmap_start(%s)\n", id);
 354                 else
 355                         sm_dprintf("ldapmap_start(%s, %d)\n", id,
 356                                    lmap->ldap_port);
 357         }
 358
 359         if (lmap->ldap_uri != NULL)
 360         {
 361 # if SM_CONF_LDAP_INITIALIZE
 362                 if (sm_debug_active(&SmLDAPTrace, 9))
 363                         sm_dprintf("ldap_initialize(%s)\n", lmap->ldap_uri);
 364                 /* LDAP server supports URIs so use them directly */
 365                 save_errno = ldap_initialize(&ld, lmap->ldap_uri);
 366                 if (sm_debug_active(&SmLDAPTrace, 9))
 367                         sm_dprintf("ldap_initialize(%s)=%d, ld=%p\n", lmap->ldap_uri, save_errno, ld);
 368                 sm_ldap_setoptsg(lmap);
 369
 370 # else /* SM_CONF_LDAP_INITIALIZE */
 371                 LDAPURLDesc *ludp = NULL;
 372
 373                 /* Blast apart URL and use the ldap_init/ldap_open below */
 374                 err = ldap_url_parse(lmap->ldap_uri, &ludp);
 375                 if (err != 0)
 376                 {
 377                         errno = err + E_LDAPURLBASE;
 378                         return false;
 379                 }
 380                 lmap->ldap_host = sm_strdup_x(ludp->lud_host);
 381                 if (lmap->ldap_host == NULL)
 382                 {
 383                         save_errno = errno;
 384                         ldap_free_urldesc(ludp);
 385                         errno = save_errno;
 386                         return false;
 387                 }
 388                 lmap->ldap_port = ludp->lud_port;
 389                 ldap_free_urldesc(ludp);
 390 # endif /* SM_CONF_LDAP_INITIALIZE */
 391         }
 392
 393         if (ld == NULL)
 394         {
 395 # if USE_LDAP_INIT
 396                 if (sm_debug_active(&SmLDAPTrace, 9))
 397                         sm_dprintf("ldap_init(%s, %d)\n", lmap->ldap_host, lmap->ldap_port);
 398                 ld = ldap_init(lmap->ldap_host, lmap->ldap_port);
 399                 save_errno = errno;
 400
 401 # else /* USE_LDAP_INIT */
 402                 /*
 403                 **  If using ldap_open(), the actual connection to the server
 404                 **  happens now so we need the timeout here.  For ldap_init(),
 405                 **  the connection happens at bind time.
 406                 */
 407
 408                 if (sm_debug_active(&SmLDAPTrace, 9))
 409                         sm_dprintf("ldap_open(%s, %d)\n", lmap->ldap_host, lmap->ldap_port);
 410
 411                 SM_LDAP_SETTIMEOUT(lmap->ldap_timeout.tv_sec, "ldap_open");
 412                 ld = ldap_open(lmap->ldap_host, lmap->ldap_port);
 413                 save_errno = errno;
 414
 415                 /* clear the event if it has not sprung */
 416                 SM_LDAP_CLEARTIMEOUT();
 417 # endif /* USE_LDAP_INIT */
 418         }
 419
 420         errno = save_errno;
 421         if (ld == NULL)
 422         {
 423                 if (sm_debug_active(&SmLDAPTrace, 7))
 424                         sm_dprintf("FAIL: ldap_open(%s, %d)=%d\n", lmap->ldap_host, lmap->ldap_port, save_errno);
 425                 return false;
 426         }
 427
 428         sm_ldap_setopts(ld, lmap);
 429 # if USE_LDAP_INIT && !LDAP_NETWORK_TIMEOUT
 430         /*
 431         **  If using ldap_init(), the actual connection to the server
 432         **  happens at ldap_bind_s() so we need the timeout here.
 433         */
 434
 435         SM_LDAP_SETTIMEOUT(lmap->ldap_timeout.tv_sec, "ldap_bind");
 436 # endif /* USE_LDAP_INIT && !LDAP_NETWORK_TIMEOUT */
 437
 438 # ifdef LDAP_AUTH_KRBV4
 439         if (lmap->ldap_method == LDAP_AUTH_KRBV4 &&
 440             lmap->ldap_secret != NULL)
 441         {
 442                 /*
 443                 **  Need to put ticket in environment here instead of
 444                 **  during parseargs as there may be different tickets
 445                 **  for different LDAP connections.
 446                 */
 447
 448                 (void) putenv(lmap->ldap_secret);
 449         }
 450 # endif /* LDAP_AUTH_KRBV4 */
 451
 452 # if LDAP_NETWORK_TIMEOUT
 453         tmo.tv_sec = lmap->ldap_networktmo;
 454 # else
 455         tmo.tv_sec = lmap->ldap_timeout.tv_sec;
 456 # endif
 457         tmo.tv_usec = 0;
 458
 459         if (sm_debug_active(&SmLDAPTrace, 9))
 460                 sm_dprintf("ldap_bind(%s)\n", lmap->ldap_uri);
 461         errno = 0;
 462         msgid = ldap_bind(ld, lmap->ldap_binddn, lmap->ldap_secret,
 463                         lmap->ldap_method);
 464         save_errno = errno;
 465         if (sm_debug_active(&SmLDAPTrace, 9))
 466         {
 467                 errmsg = sm_ldap_geterror(ld);
 468                 sm_dprintf("ldap_bind(%s)=%d, errno=%d, ldaperr=%d, ld_error=%s, tmo=%lld\n",
 469                         lmap->ldap_uri, msgid, save_errno,
 470                         sm_ldap_geterrno(ld), errmsg, (long long) tmo.tv_sec);
 471                 if (NULL != errmsg)
 472                 {
 473                         ldap_memfree(errmsg);
 474                         errmsg = NULL;
 475                 }
 476         }
 477         if (-1 == msgid)
 478         {
 479                 r = -1;
 480                 err = sm_ldap_geterrno(ld);
 481                 if (LDAP_SUCCESS != err)
 482                         save_errno = err + E_LDAPBASE;
 483                 goto fail;
 484         }
 485
 486         errno = 0;
 487         r = ldap_result(ld, msgid, LDAP_MSG_ALL,
 488                         tmo.tv_sec == 0 ? NULL : &(tmo), &(lmap->ldap_res));
 489         save_errno = errno;
 490         if (sm_debug_active(&SmLDAPTrace, 9))
 491         {
 492                 errmsg = sm_ldap_geterror(ld);
 493                 sm_dprintf("ldap_result(%s)=%d, errno=%d, ldaperr=%d, ld_error=%s\n",
 494                         lmap->ldap_uri, r, errno,
 495                         sm_ldap_geterrno(ld), errmsg);
 496                 if (NULL != errmsg)
 497                 {
 498                         ldap_memfree(errmsg);
 499                         errmsg = NULL;
 500                 }
 501         }
 502         if (-1 == r)
 503         {
 504                 err = sm_ldap_geterrno(ld);
 505                 if (LDAP_SUCCESS != err)
 506                         save_errno = err + E_LDAPBASE;
 507                 goto fail;
 508         }
 509         if (0 == r)
 510         {
 511                 save_errno = ETIMEDOUT;
 512                 r = -1;
 513                 goto fail;
 514         }
 515         r = ldap_parse_result(ld, lmap->ldap_res, &err, NULL, &errmsg, NULL,
 516                                 NULL, 1);
 517         save_errno = errno;
 518         if (sm_debug_active(&SmLDAPTrace, 9))
 519                 sm_dprintf("ldap_parse_result(%s)=%d, err=%d, errmsg=%s\n",
 520                                 lmap->ldap_uri, r, err, errmsg);
 521         if (r != LDAP_SUCCESS)
 522                 goto fail;
 523         if (err != LDAP_SUCCESS)
 524         {
 525                 r = err;
 526                 goto fail;
 527         }
 528
 529 # if USE_LDAP_INIT && !LDAP_NETWORK_TIMEOUT
 530         /* clear the event if it has not sprung */
 531         SM_LDAP_CLEARTIMEOUT();
 532         if (sm_debug_active(&SmLDAPTrace, 9))
 533                 sm_dprintf("ldap_cleartimeout(%s)\n", lmap->ldap_uri);
 534 # endif /* USE_LDAP_INIT && !LDAP_NETWORK_TIMEOUT */
 535
 536         if (r != LDAP_SUCCESS)
 537         {
 538   fail:
 539                 if (-1 == r)
 540                         errno = save_errno;
 541                 else
 542                         errno = r + E_LDAPBASE;
 543                 if (NULL != errmsg)
 544                 {
 545                         ldap_memfree(errmsg);
 546                         errmsg = NULL;
 547                 }
 548                 return false;
 549         }
 550
 551         /* Save PID to make sure only this PID closes the LDAP connection */
 552         lmap->ldap_pid = getpid();
 553         lmap->ldap_ld = ld;
 554         if (NULL != errmsg)
 555         {
 556                 ldap_memfree(errmsg);
 557                 errmsg = NULL;
 558         }
 559         return true;
 560 }
 561
 562 /*
 563 **  SM_LDAP_SEARCH_M -- initiate multi-key LDAP search
 564 **
 565 **      Initiate an LDAP search, return the msgid.
 566 **      The calling function must collect the results.
 567 **
 568 **      Parameters:
 569 **              lmap -- LDAP map information
 570 **              argv -- key vector of substitutions in LDAP filter
 571 **                      NOTE: argv must have SM_LDAP_ARGS elements to prevent
 572 **                            out of bound array references
 573 **
 574 **      Returns:
 575 **              <0 on failure (SM_LDAP_ERR*), msgid on success
 576 **
 577 */
 578
 579 int
 580 sm_ldap_search_m(lmap, argv)
 581         SM_LDAP_STRUCT *lmap;
 582         char **argv;
 583 {
 584         int msgid;
 585         char *fp, *p, *q;
 586         char filter[LDAPMAP_MAX_FILTER + 1];
 587
 588         SM_REQUIRE(lmap != NULL);
 589         SM_REQUIRE(argv != NULL);
 590         SM_REQUIRE(argv[0] != NULL);
 591
 592         memset(filter, '\0', sizeof filter);
 593         fp = filter;
 594         p = lmap->ldap_filter;
 595         while ((q = strchr(p, '%')) != NULL)
 596         {
 597                 char *key;
 598
 599                 if (lmap->ldap_multi_args)
 600                 {
 601 # if SM_LDAP_ARGS < 10
 602 #  error _SM_LDAP_ARGS must be 10
 603 # endif
 604                         if (q[1] == 's')
 605                                 key = argv[0];
 606                         else if (q[1] >= '0' && q[1] <= '9')
 607                         {
 608                                 key = argv[q[1] - '0'];
 609                                 if (key == NULL)
 610                                 {
 611 # if SM_LDAP_ERROR_ON_MISSING_ARGS
 612                                         return SM_LDAP_ERR_ARG_MISS;
 613 # else
 614                                         key = "";
 615 # endif
 616                                 }
 617                         }
 618                         else
 619                                 key = NULL;
 620                 }
 621                 else
 622                         key = argv[0];
 623
 624                 if (q[1] == 's')
 625                 {
 626                         (void) sm_snprintf(fp, SPACELEFT(filter, fp),
 627                                            "%.*s%s", (int) (q - p), p, key);
 628                         fp += strlen(fp);
 629                         p = q + 2;
 630                 }
 631                 else if (q[1] == '0' ||
 632                          (lmap->ldap_multi_args && q[1] >= '0' && q[1] <= '9'))
 633                 {
 634                         char *k = key;
 635
 636                         (void) sm_snprintf(fp, SPACELEFT(filter, fp),
 637                                            "%.*s", (int) (q - p), p);
 638                         fp += strlen(fp);
 639                         p = q + 2;
 640
 641                         /* Properly escape LDAP special characters */
 642                         while (SPACELEFT(filter, fp) > 0 &&
 643                                *k != '\0')
 644                         {
 645                                 if (*k == '*' || *k == '(' ||
 646                                     *k == ')' || *k == '\\')
 647                                 {
 648                                         (void) sm_strlcat(fp,
 649                                                        (*k == '*' ? "\\2A" :
 650                                                         (*k == '(' ? "\\28" :
 651                                                          (*k == ')' ? "\\29" :
 652                                                           (*k == '\\' ? "\\5C" :
 653                                                            "\00")))),
 654                                                 SPACELEFT(filter, fp));
 655                                         fp += strlen(fp);
 656                                         k++;
 657                                 }
 658                                 else
 659                                         *fp++ = *k++;
 660                         }
 661                 }
 662                 else
 663                 {
 664                         (void) sm_snprintf(fp, SPACELEFT(filter, fp),
 665                                 "%.*s", (int) (q - p + 1), p);
 666                         p = q + (q[1] == '%' ? 2 : 1);
 667                         fp += strlen(fp);
 668                 }
 669         }
 670         (void) sm_strlcpy(fp, p, SPACELEFT(filter, fp));
 671         if (sm_debug_active(&SmLDAPTrace, 20))
 672                 sm_dprintf("ldap search filter=%s\n", filter);
 673
 674         lmap->ldap_res = NULL;
 675         msgid = ldap_search(lmap->ldap_ld, lmap->ldap_base,
 676                             lmap->ldap_scope, filter,
 677                             (lmap->ldap_attr[0] == NULL ? NULL :
 678                              lmap->ldap_attr),
 679                             lmap->ldap_attrsonly);
 680         return msgid;
 681 }
 682
 683 /*
 684 **  SM_LDAP_SEARCH -- initiate LDAP search
 685 **
 686 **      Initiate an LDAP search, return the msgid.
 687 **      The calling function must collect the results.
 688 **      Note this is just a wrapper into sm_ldap_search_m()
 689 **
 690 **      Parameters:
 691 **              lmap -- LDAP map information
 692 **              key -- key to substitute in LDAP filter
 693 **
 694 **      Returns:
 695 **              <0 on failure, msgid on success
 696 **
 697 */
 698
 699 int
 700 sm_ldap_search(lmap, key)
 701         SM_LDAP_STRUCT *lmap;
 702         char *key;
 703 {
 704         char *argv[SM_LDAP_ARGS];
 705
 706         memset(argv, '\0', sizeof argv);
 707         argv[0] = key;
 708         return sm_ldap_search_m(lmap, argv);
 709 }
 710
 711 /*
 712 **  SM_LDAP_HAS_OBJECTCLASS -- determine if an LDAP entry is part of a
 713 **                             particular objectClass
 714 **
 715 **      Parameters:
 716 **              lmap -- pointer to SM_LDAP_STRUCT in use
 717 **              entry -- current LDAP entry struct
 718 **              ocvalue -- particular objectclass in question.
 719 **                         may be of form (fee|foo|fum) meaning
 720 **                         any entry can be part of either fee,
 721 **                         foo or fum objectclass
 722 **
 723 **      Returns:
 724 **              true if item has that objectClass
 725 */
 726
 727 static bool
 728 sm_ldap_has_objectclass(lmap, entry, ocvalue)
 729         SM_LDAP_STRUCT *lmap;
 730         LDAPMessage *entry;
 731         char *ocvalue;
 732 {
 733         char **vals = NULL;
 734         int i;
 735
 736         if (ocvalue == NULL)
 737                 return false;
 738
 739         vals = ldap_get_values(lmap->ldap_ld, entry, "objectClass");
 740         if (vals == NULL)
 741                 return false;
 742
 743         for (i = 0; vals[i] != NULL; i++)
 744         {
 745                 char *p;
 746                 char *q;
 747
 748                 p = q = ocvalue;
 749                 while (*p != '\0')
 750                 {
 751                         while (*p != '\0' && *p != '|')
 752                                 p++;
 753
 754                         if ((p - q) == strlen(vals[i]) &&
 755                             sm_strncasecmp(vals[i], q, p - q) == 0)
 756                         {
 757                                 ldap_value_free(vals);
 758                                 return true;
 759                         }
 760
 761                         while (*p == '|')
 762                                 p++;
 763                         q = p;
 764                 }
 765         }
 766
 767         ldap_value_free(vals);
 768         return false;
 769 }
 770
 771 /*
 772 **  SM_LDAP_RESULTS -- return results from an LDAP lookup in result
 773 **
 774 **      Parameters:
 775 **              lmap -- pointer to SM_LDAP_STRUCT in use
 776 **              msgid -- msgid returned by sm_ldap_search()
 777 **              flags -- flags for the lookup
 778 **              delim -- delimiter for result concatenation
 779 **              rpool -- memory pool for storage
 780 **              result -- return string
 781 **              recurse -- recursion list
 782 **
 783 **      Returns:
 784 **              status (sysexit)
 785 */
 786
 787 # define SM_LDAP_ERROR_CLEANUP()                                \
 788 {                                                               \
 789         if (lmap->ldap_res != NULL)                             \
 790         {                                                       \
 791                 ldap_msgfree(lmap->ldap_res);                   \
 792                 lmap->ldap_res = NULL;                          \
 793         }                                                       \
 794         (void) ldap_abandon(lmap->ldap_ld, msgid);              \
 795 }
 796
 797 static SM_LDAP_RECURSE_ENTRY *
 798 sm_ldap_add_recurse(top, item, type, rpool)
 799         SM_LDAP_RECURSE_LIST **top;
 800         char *item;
 801         int type;
 802         SM_RPOOL_T *rpool;
 803 {
 804         int n;
 805         int m;
 806         int p;
 807         int insertat;
 808         int moveb;
 809         int oldsizeb;
 810         int rc;
 811         SM_LDAP_RECURSE_ENTRY *newe;
 812         SM_LDAP_RECURSE_ENTRY **olddata;
 813
 814         /*
 815         **  This code will maintain a list of
 816         **  SM_LDAP_RECURSE_ENTRY structures
 817         **  in ascending order.
 818         */
 819
 820         if (*top == NULL)
 821         {
 822                 /* Allocate an initial SM_LDAP_RECURSE_LIST struct */
 823                 *top = sm_rpool_malloc_x(rpool, sizeof **top);
 824                 (*top)->lrl_cnt = 0;
 825                 (*top)->lrl_size = 0;
 826                 (*top)->lrl_data = NULL;
 827         }
 828
 829         if ((*top)->lrl_cnt >= (*top)->lrl_size)
 830         {
 831                 /* Grow the list of SM_LDAP_RECURSE_ENTRY ptrs */
 832                 olddata = (*top)->lrl_data;
 833                 if ((*top)->lrl_size == 0)
 834                 {
 835                         oldsizeb = 0;
 836                         (*top)->lrl_size = 256;
 837                 }
 838                 else
 839                 {
 840                         oldsizeb = (*top)->lrl_size * sizeof *((*top)->lrl_data);
 841                         (*top)->lrl_size *= 2;
 842                 }
 843                 (*top)->lrl_data = sm_rpool_malloc_x(rpool,
 844                                                     (*top)->lrl_size * sizeof *((*top)->lrl_data));
 845                 if (oldsizeb > 0)
 846                         memcpy((*top)->lrl_data, olddata, oldsizeb);
 847         }
 848
 849         /*
 850         **  Binary search/insert item:type into list.
 851         **  Return current entry pointer if already exists.
 852         */
 853
 854         n = 0;
 855         m = (*top)->lrl_cnt - 1;
 856         if (m < 0)
 857                 insertat = 0;
 858         else
 859                 insertat = -1;
 860
 861         while (insertat == -1)
 862         {
 863                 p = (m + n) / 2;
 864
 865                 rc = sm_strcasecmp(item, (*top)->lrl_data[p]->lr_search);
 866                 if (rc == 0)
 867                         rc = type - (*top)->lrl_data[p]->lr_type;
 868
 869                 if (rc < 0)
 870                         m = p - 1;
 871                 else if (rc > 0)
 872                         n = p + 1;
 873                 else
 874                         return (*top)->lrl_data[p];
 875
 876                 if (m == -1)
 877                         insertat = 0;
 878                 else if (n >= (*top)->lrl_cnt)
 879                         insertat = (*top)->lrl_cnt;
 880                 else if (m < n)
 881                         insertat = m + 1;
 882         }
 883
 884         /*
 885         ** Not found in list, make room
 886         ** at insert point and add it.
 887         */
 888
 889         newe = sm_rpool_malloc_x(rpool, sizeof *newe);
 890         if (newe != NULL)
 891         {
 892                 moveb = ((*top)->lrl_cnt - insertat) * sizeof *((*top)->lrl_data);
 893                 if (moveb > 0)
 894                         memmove(&((*top)->lrl_data[insertat + 1]),
 895                                 &((*top)->lrl_data[insertat]),
 896                                 moveb);
 897
 898                 newe->lr_search = sm_rpool_strdup_x(rpool, item);
 899                 newe->lr_type = type;
 900                 newe->lr_ludp = NULL;
 901                 newe->lr_attrs = NULL;
 902                 newe->lr_done = false;
 903
 904                 ((*top)->lrl_data)[insertat] = newe;
 905                 (*top)->lrl_cnt++;
 906         }
 907         return newe;
 908 }
 909
 910 int
 911 sm_ldap_results(lmap, msgid, flags, delim, rpool, result,
 912                 resultln, resultsz, recurse)
 913         SM_LDAP_STRUCT *lmap;
 914         int msgid;
 915         int flags;
 916         int delim;
 917         SM_RPOOL_T *rpool;
 918         char **result;
 919         int *resultln;
 920         int *resultsz;
 921         SM_LDAP_RECURSE_LIST *recurse;
 922 {
 923         bool toplevel;
 924         int i;
 925         int statp;
 926         int vsize;
 927         int ret;
 928         int save_errno;
 929         char *p;
 930         SM_LDAP_RECURSE_ENTRY *rl;
 931
 932         /* Are we the top top level of the search? */
 933         toplevel = (recurse == NULL);
 934
 935         /* Get results */
 936         statp = EX_NOTFOUND;
 937         while ((ret = ldap_result(lmap->ldap_ld, msgid, 0,
 938                                   (lmap->ldap_timeout.tv_sec == 0 ? NULL :
 939                                    &(lmap->ldap_timeout)),
 940                                   &(lmap->ldap_res))) == LDAP_RES_SEARCH_ENTRY)
 941         {
 942                 LDAPMessage *entry;
 943
 944                 /* If we don't want multiple values and we have one, break */
 945                 if ((char) delim == '\0' &&
 946                     !bitset(SM_LDAP_SINGLEMATCH, flags) &&
 947                     *result != NULL)
 948                         break;
 949
 950                 /* Cycle through all entries */
 951                 for (entry = ldap_first_entry(lmap->ldap_ld, lmap->ldap_res);
 952                      entry != NULL;
 953                      entry = ldap_next_entry(lmap->ldap_ld, lmap->ldap_res))
 954                 {
 955                         BerElement *ber;
 956                         char *attr;
 957                         char **vals = NULL;
 958                         char *dn;
 959
 960                         /*
 961                         **  If matching only and found an entry,
 962                         **  no need to spin through attributes
 963                         */
 964
 965                         if (bitset(SM_LDAP_MATCHONLY, flags))
 966                         {
 967                                 statp = EX_OK;
 968                                 continue;
 969                         }
 970
 971 # if _FFR_LDAP_SINGLEDN
 972                         if (bitset(SM_LDAP_SINGLEDN, flags) && *result != NULL)
 973                         {
 974                                 /* only wanted one match */
 975                                 SM_LDAP_ERROR_CLEANUP();
 976                                 errno = ENOENT;
 977                                 return EX_NOTFOUND;
 978                         }
 979 # endif /* _FFR_LDAP_SINGLEDN */
 980
 981                         /* record completed DN's to prevent loops */
 982                         dn = ldap_get_dn(lmap->ldap_ld, entry);
 983                         if (dn == NULL)
 984                         {
 985                                 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
 986                                 save_errno += E_LDAPBASE;
 987                                 SM_LDAP_ERROR_CLEANUP();
 988                                 errno = save_errno;
 989                                 return EX_TEMPFAIL;
 990                         }
 991
 992                         rl = sm_ldap_add_recurse(&recurse, dn,
 993                                                  SM_LDAP_ATTR_DN,
 994                                                  rpool);
 995
 996                         if (rl == NULL)
 997                         {
 998                                 ldap_memfree(dn);
 999                                 SM_LDAP_ERROR_CLEANUP();
1000                                 errno = ENOMEM;
1001                                 return EX_OSERR;
1002                         }
1003                         else if (rl->lr_done)
1004                         {
1005                                 /* already on list, skip it */
1006                                 ldap_memfree(dn);
1007                                 continue;
1008                         }
1009                         ldap_memfree(dn);
1010
1011 # if !defined(LDAP_VERSION_MAX) && !defined(LDAP_OPT_SIZELIMIT)
1012                         /*
1013                         **  Reset value to prevent lingering
1014                         **  LDAP_DECODING_ERROR due to
1015                         **  OpenLDAP 1.X's hack (see below)
1016                         */
1017
1018                         lmap->ldap_ld->ld_errno = LDAP_SUCCESS;
1019 # endif /* !defined(LDAP_VERSION_MAX) !defined(LDAP_OPT_SIZELIMIT) */
1020
1021                         for (attr = ldap_first_attribute(lmap->ldap_ld, entry,
1022                                                          &ber);
1023                              attr != NULL;
1024                              attr = ldap_next_attribute(lmap->ldap_ld, entry,
1025                                                         ber))
1026                         {
1027                                 char *tmp, *vp_tmp;
1028                                 int type;
1029                                 char *needobjclass = NULL;
1030
1031                                 type = SM_LDAP_ATTR_NONE;
1032                                 for (i = 0; lmap->ldap_attr[i] != NULL; i++)
1033                                 {
1034                                         if (SM_STRCASEEQ(lmap->ldap_attr[i],
1035                                                          attr))
1036                                         {
1037                                                 type = lmap->ldap_attr_type[i];
1038                                                 needobjclass = lmap->ldap_attr_needobjclass[i];
1039                                                 break;
1040                                         }
1041                                 }
1042
1043                                 if (bitset(SM_LDAP_USE_ALLATTR, flags) &&
1044                                     type == SM_LDAP_ATTR_NONE)
1045                                 {
1046                                         /* URL lookups specify attrs to use */
1047                                         type = SM_LDAP_ATTR_NORMAL;
1048                                         needobjclass = NULL;
1049                                 }
1050
1051                                 if (type == SM_LDAP_ATTR_NONE)
1052                                 {
1053                                         /* attribute not requested */
1054                                         ldap_memfree(attr);
1055                                         SM_LDAP_ERROR_CLEANUP();
1056                                         errno = EFAULT;
1057                                         return EX_SOFTWARE;
1058                                 }
1059
1060                                 /*
1061                                 **  For recursion on a particular attribute,
1062                                 **  we may need to see if this entry is
1063                                 **  part of a particular objectclass.
1064                                 **  Also, ignore objectClass attribute.
1065                                 **  Otherwise we just ignore this attribute.
1066                                 */
1067
1068                                 if (type == SM_LDAP_ATTR_OBJCLASS ||
1069                                     (needobjclass != NULL &&
1070                                      !sm_ldap_has_objectclass(lmap, entry,
1071                                                               needobjclass)))
1072                                 {
1073                                         ldap_memfree(attr);
1074                                         continue;
1075                                 }
1076
1077                                 if (lmap->ldap_attrsonly == LDAPMAP_FALSE)
1078                                 {
1079                                         vals = ldap_get_values(lmap->ldap_ld,
1080                                                                entry,
1081                                                                attr);
1082                                         if (vals == NULL)
1083                                         {
1084                                                 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1085                                                 if (save_errno == LDAP_SUCCESS)
1086                                                 {
1087                                                         ldap_memfree(attr);
1088                                                         continue;
1089                                                 }
1090
1091                                                 /* Must be an error */
1092                                                 save_errno += E_LDAPBASE;
1093                                                 ldap_memfree(attr);
1094                                                 SM_LDAP_ERROR_CLEANUP();
1095                                                 errno = save_errno;
1096                                                 return EX_TEMPFAIL;
1097                                         }
1098                                 }
1099
1100                                 statp = EX_OK;
1101
1102 # if !defined(LDAP_VERSION_MAX) && !defined(LDAP_OPT_SIZELIMIT)
1103                                 /*
1104                                 **  Reset value to prevent lingering
1105                                 **  LDAP_DECODING_ERROR due to
1106                                 **  OpenLDAP 1.X's hack (see below)
1107                                 */
1108
1109                                 lmap->ldap_ld->ld_errno = LDAP_SUCCESS;
1110 # endif /* !defined(LDAP_VERSION_MAX) !defined(LDAP_OPT_SIZELIMIT) */
1111
1112                                 /*
1113                                 **  If matching only,
1114                                 **  no need to spin through entries
1115                                 */
1116
1117                                 if (bitset(SM_LDAP_MATCHONLY, flags))
1118                                 {
1119                                         if (lmap->ldap_attrsonly == LDAPMAP_FALSE)
1120                                                 ldap_value_free(vals);
1121                                         ldap_memfree(attr);
1122                                         continue;
1123                                 }
1124
1125                                 /*
1126                                 **  If we don't want multiple values,
1127                                 **  return first found.
1128                                 */
1129
1130                                 if ((char) delim == '\0')
1131                                 {
1132                                         if (*result != NULL)
1133                                         {
1134                                                 /* already have a value */
1135                                                 if (bitset(SM_LDAP_SINGLEMATCH,
1136                                                            flags))
1137                                                 {
1138                                                         /* only wanted one match */
1139                                                         SM_LDAP_ERROR_CLEANUP();
1140                                                         errno = ENOENT;
1141                                                         return EX_NOTFOUND;
1142                                                 }
1143                                                 break;
1144                                         }
1145
1146                                         if (lmap->ldap_attrsonly == LDAPMAP_TRUE)
1147                                         {
1148                                                 *result = sm_rpool_strdup_x(rpool,
1149                                                                             attr);
1150                                                 ldap_memfree(attr);
1151                                                 break;
1152                                         }
1153
1154                                         if (vals[0] == NULL)
1155                                         {
1156                                                 ldap_value_free(vals);
1157                                                 ldap_memfree(attr);
1158                                                 continue;
1159                                         }
1160
1161                                         vsize = strlen(vals[0]) + 1;
1162                                         if (lmap->ldap_attrsep != '\0')
1163                                                 vsize += strlen(attr) + 1;
1164                                         *result = sm_rpool_malloc_x(rpool,
1165                                                                     vsize);
1166                                         if (lmap->ldap_attrsep != '\0')
1167                                                 sm_snprintf(*result, vsize,
1168                                                             "%s%c%s",
1169                                                             attr,
1170                                                             lmap->ldap_attrsep,
1171                                                             vals[0]);
1172                                         else
1173                                                 sm_strlcpy(*result, vals[0],
1174                                                            vsize);
1175                                         ldap_value_free(vals);
1176                                         ldap_memfree(attr);
1177                                         break;
1178                                 }
1179
1180                                 /* attributes only */
1181                                 if (lmap->ldap_attrsonly == LDAPMAP_TRUE)
1182                                 {
1183                                         if (*result == NULL)
1184                                                 *result = sm_rpool_strdup_x(rpool,
1185                                                                             attr);
1186                                         else
1187                                         {
1188                                                 if (bitset(SM_LDAP_SINGLEMATCH,
1189                                                            flags) &&
1190                                                     *result != NULL)
1191                                                 {
1192                                                         /* only wanted one match */
1193                                                         SM_LDAP_ERROR_CLEANUP();
1194                                                         errno = ENOENT;
1195                                                         return EX_NOTFOUND;
1196                                                 }
1197
1198                                                 vsize = strlen(*result) +
1199                                                         strlen(attr) + 2;
1200                                                 tmp = sm_rpool_malloc_x(rpool,
1201                                                                         vsize);
1202                                                 (void) sm_snprintf(tmp,
1203                                                         vsize, "%s%c%s",
1204                                                         *result, (char) delim,
1205                                                         attr);
1206                                                 *result = tmp;
1207                                         }
1208                                         ldap_memfree(attr);
1209                                         continue;
1210                                 }
1211
1212                                 /*
1213                                 **  If there is more than one, munge then
1214                                 **  into a map_coldelim separated string.
1215                                 **  If we are recursing we may have an entry
1216                                 **  with no 'normal' values to put in the
1217                                 **  string.
1218                                 **  This is not an error.
1219                                 */
1220
1221                                 if (type == SM_LDAP_ATTR_NORMAL &&
1222                                     bitset(SM_LDAP_SINGLEMATCH, flags) &&
1223                                     *result != NULL)
1224                                 {
1225                                         /* only wanted one match */
1226                                         SM_LDAP_ERROR_CLEANUP();
1227                                         errno = ENOENT;
1228                                         return EX_NOTFOUND;
1229                                 }
1230
1231                                 vsize = 0;
1232                                 for (i = 0; vals[i] != NULL; i++)
1233                                 {
1234                                         if (type == SM_LDAP_ATTR_DN ||
1235                                             type == SM_LDAP_ATTR_FILTER ||
1236                                             type == SM_LDAP_ATTR_URL)
1237                                         {
1238                                                 /* add to recursion */
1239                                                 if (sm_ldap_add_recurse(&recurse,
1240                                                                         vals[i],
1241                                                                         type,
1242                                                                         rpool) == NULL)
1243                                                 {
1244                                                         SM_LDAP_ERROR_CLEANUP();
1245                                                         errno = ENOMEM;
1246                                                         return EX_OSERR;
1247                                                 }
1248                                                 continue;
1249                                         }
1250
1251                                         vsize += strlen(vals[i]) + 1;
1252                                         if (lmap->ldap_attrsep != '\0')
1253                                                 vsize += strlen(attr) + 1;
1254                                 }
1255
1256                                 /*
1257                                 **  Create/Append to string any normal
1258                                 **  attribute values.  Otherwise, just free
1259                                 **  memory and move on to the next
1260                                 **  attribute in this entry.
1261                                 */
1262
1263                                 if (type == SM_LDAP_ATTR_NORMAL && vsize > 0)
1264                                 {
1265                                         char *pe;
1266
1267                                         /* Grow result string if needed */
1268                                         if ((*resultln + vsize) >= *resultsz)
1269                                         {
1270                                                 while ((*resultln + vsize) >= *resultsz)
1271                                                 {
1272                                                         if (*resultsz == 0)
1273                                                                 *resultsz = 1024;
1274                                                         else
1275                                                                 *resultsz *= 2;
1276                                                 }
1277
1278                                                 vp_tmp = sm_rpool_malloc_x(rpool, *resultsz);
1279                                                 *vp_tmp = '\0';
1280
1281                                                 if (*result != NULL)
1282                                                         sm_strlcpy(vp_tmp,
1283                                                                    *result,
1284                                                                    *resultsz);
1285                                                 *result = vp_tmp;
1286                                         }
1287
1288                                         p = *result + *resultln;
1289                                         pe = *result + *resultsz;
1290
1291                                         for (i = 0; vals[i] != NULL; i++)
1292                                         {
1293                                                 if (*resultln > 0 &&
1294                                                     p < pe)
1295                                                         *p++ = (char) delim;
1296
1297                                                 if (lmap->ldap_attrsep != '\0')
1298                                                 {
1299                                                         p += sm_strlcpy(p, attr,
1300                                                                         pe - p);
1301                                                         if (p < pe)
1302                                                                 *p++ = lmap->ldap_attrsep;
1303                                                 }
1304
1305                                                 p += sm_strlcpy(p, vals[i],
1306                                                                 pe - p);
1307                                                 *resultln = p - (*result);
1308                                                 if (p >= pe)
1309                                                 {
1310                                                         /* Internal error: buffer too small for LDAP values */
1311                                                         SM_LDAP_ERROR_CLEANUP();
1312                                                         errno = ENOMEM;
1313                                                         return EX_OSERR;
1314                                                 }
1315                                         }
1316                                 }
1317
1318                                 ldap_value_free(vals);
1319                                 ldap_memfree(attr);
1320                         }
1321                         save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1322
1323                         /*
1324                         **  We check save_errno != LDAP_DECODING_ERROR since
1325                         **  OpenLDAP 1.X has a very ugly *undocumented*
1326                         **  hack of returning this error code from
1327                         **  ldap_next_attribute() if the library freed the
1328                         **  ber attribute.  See:
1329                         **  http://www.openldap.org/lists/openldap-devel/9901/msg00064.html
1330                         */
1331
1332                         if (save_errno != LDAP_SUCCESS &&
1333                             save_errno != LDAP_DECODING_ERROR)
1334                         {
1335                                 /* Must be an error */
1336                                 save_errno += E_LDAPBASE;
1337                                 SM_LDAP_ERROR_CLEANUP();
1338                                 errno = save_errno;
1339                                 return EX_TEMPFAIL;
1340                         }
1341
1342                         /* mark this DN as done */
1343                         rl->lr_done = true;
1344                         if (rl->lr_ludp != NULL)
1345                         {
1346                                 ldap_free_urldesc(rl->lr_ludp);
1347                                 rl->lr_ludp = NULL;
1348                         }
1349                         if (rl->lr_attrs != NULL)
1350                         {
1351                                 free(rl->lr_attrs);
1352                                 rl->lr_attrs = NULL;
1353                         }
1354
1355                         /* We don't want multiple values and we have one */
1356                         if ((char) delim == '\0' &&
1357                             !bitset(SM_LDAP_SINGLEMATCH, flags) &&
1358                             *result != NULL)
1359                                 break;
1360                 }
1361                 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1362                 if (save_errno != LDAP_SUCCESS &&
1363                     save_errno != LDAP_DECODING_ERROR)
1364                 {
1365                         /* Must be an error */
1366                         save_errno += E_LDAPBASE;
1367                         SM_LDAP_ERROR_CLEANUP();
1368                         errno = save_errno;
1369                         return EX_TEMPFAIL;
1370                 }
1371                 ldap_msgfree(lmap->ldap_res);
1372                 lmap->ldap_res = NULL;
1373         }
1374
1375         if (ret == 0)
1376                 save_errno = ETIMEDOUT;
1377         else if (ret == LDAP_RES_SEARCH_RESULT)
1378         {
1379                 /*
1380                 **  We may have gotten an LDAP_RES_SEARCH_RESULT response
1381                 **  with an error inside it, so we have to extract that
1382                 **  with ldap_parse_result().  This can happen when talking
1383                 **  to an LDAP proxy whose backend has gone down.
1384                 */
1385
1386                 if (lmap->ldap_res == NULL)
1387                         save_errno = LDAP_UNAVAILABLE;
1388                 else
1389                 {
1390                         int rc;
1391
1392                         save_errno = ldap_parse_result(lmap->ldap_ld,
1393                                         lmap->ldap_res, &rc, NULL, NULL,
1394                                         NULL, NULL, 0);
1395                         if (save_errno == LDAP_SUCCESS)
1396                                 save_errno = rc;
1397                 }
1398         }
1399         else
1400                 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1401         if (save_errno != LDAP_SUCCESS)
1402         {
1403                 statp = EX_TEMPFAIL;
1404                 switch (save_errno)
1405                 {
1406 # ifdef LDAP_SERVER_DOWN
1407                   case LDAP_SERVER_DOWN:
1408 # endif
1409                   case LDAP_TIMEOUT:
1410                   case ETIMEDOUT:
1411                   case LDAP_UNAVAILABLE:
1412
1413                         /*
1414                         **  server disappeared,
1415                         **  try reopen on next search
1416                         */
1417
1418                         statp = EX_RESTART;
1419                         break;
1420                 }
1421                 if (ret != 0)
1422                         save_errno += E_LDAPBASE;
1423                 SM_LDAP_ERROR_CLEANUP();
1424                 errno = save_errno;
1425                 return statp;
1426         }
1427
1428         if (lmap->ldap_res != NULL)
1429         {
1430                 ldap_msgfree(lmap->ldap_res);
1431                 lmap->ldap_res = NULL;
1432         }
1433
1434         if (toplevel)
1435         {
1436                 int rlidx;
1437
1438                 /*
1439                 **  Spin through the built-up recurse list at the top
1440                 **  of the recursion.  Since new items are added at the
1441                 **  end of the shared list, we actually only ever get
1442                 **  one level of recursion before things pop back to the
1443                 **  top.  Any items added to the list during that recursion
1444                 **  will be expanded by the top level.
1445                 */
1446
1447                 for (rlidx = 0; recurse != NULL && rlidx < recurse->lrl_cnt;
1448                      rlidx++)
1449                 {
1450                         int newflags;
1451                         int sid;
1452                         int status;
1453
1454                         rl = recurse->lrl_data[rlidx];
1455
1456                         newflags = flags;
1457                         if (rl->lr_done)
1458                         {
1459                                 /* already expanded */
1460                                 continue;
1461                         }
1462
1463                         if (rl->lr_type == SM_LDAP_ATTR_DN)
1464                         {
1465                                 /* do DN search */
1466                                 sid = ldap_search(lmap->ldap_ld,
1467                                                   rl->lr_search,
1468                                                   lmap->ldap_scope,
1469                                                   "(objectClass=*)",
1470                                                   (lmap->ldap_attr[0] == NULL ?
1471                                                    NULL : lmap->ldap_attr),
1472                                                   lmap->ldap_attrsonly);
1473                         }
1474                         else if (rl->lr_type == SM_LDAP_ATTR_FILTER)
1475                         {
1476                                 /* do new search */
1477                                 sid = ldap_search(lmap->ldap_ld,
1478                                                   lmap->ldap_base,
1479                                                   lmap->ldap_scope,
1480                                                   rl->lr_search,
1481                                                   (lmap->ldap_attr[0] == NULL ?
1482                                                    NULL : lmap->ldap_attr),
1483                                                   lmap->ldap_attrsonly);
1484                         }
1485                         else if (rl->lr_type == SM_LDAP_ATTR_URL)
1486                         {
1487                                 /* Parse URL */
1488                                 sid = ldap_url_parse(rl->lr_search,
1489                                                      &rl->lr_ludp);
1490
1491                                 if (sid != 0)
1492                                 {
1493                                         errno = sid + E_LDAPURLBASE;
1494                                         return EX_TEMPFAIL;
1495                                 }
1496
1497                                 /* We need to add objectClass */
1498                                 if (rl->lr_ludp->lud_attrs != NULL)
1499                                 {
1500                                         int attrnum = 0;
1501
1502                                         while (rl->lr_ludp->lud_attrs[attrnum] != NULL)
1503                                         {
1504                                                 if (strcasecmp(rl->lr_ludp->lud_attrs[attrnum],
1505                                                                "objectClass") == 0)
1506                                                 {
1507                                                         /* already requested */
1508                                                         attrnum = -1;
1509                                                         break;
1510                                                 }
1511                                                 attrnum++;
1512                                         }
1513
1514                                         if (attrnum >= 0)
1515                                         {
1516                                                 int i;
1517
1518                                                 rl->lr_attrs = (char **)malloc(sizeof(char *) * (attrnum + 2));
1519                                                 if (rl->lr_attrs == NULL)
1520                                                 {
1521                                                         save_errno = errno;
1522                                                         ldap_free_urldesc(rl->lr_ludp);
1523                                                         errno = save_errno;
1524                                                         return EX_TEMPFAIL;
1525                                                 }
1526                                                 for (i = 0 ; i < attrnum; i++)
1527                                                 {
1528                                                         rl->lr_attrs[i] = rl->lr_ludp->lud_attrs[i];
1529                                                 }
1530                                                 rl->lr_attrs[i++] = "objectClass";
1531                                                 rl->lr_attrs[i++] = NULL;
1532                                         }
1533                                 }
1534
1535                                 /*
1536                                 **  Use the existing connection
1537                                 **  for this search.  It really
1538                                 **  should use lud_scheme://lud_host:lud_port/
1539                                 **  instead but that would require
1540                                 **  opening a new connection.
1541                                 **  This should be fixed ASAP.
1542                                 */
1543
1544                                 sid = ldap_search(lmap->ldap_ld,
1545                                                   rl->lr_ludp->lud_dn,
1546                                                   rl->lr_ludp->lud_scope,
1547                                                   rl->lr_ludp->lud_filter,
1548                                                   rl->lr_attrs,
1549                                                   lmap->ldap_attrsonly);
1550
1551                                 /* Use the attributes specified by URL */
1552                                 newflags |= SM_LDAP_USE_ALLATTR;
1553                         }
1554                         else
1555                         {
1556                                 /* unknown or illegal attribute type */
1557                                 errno = EFAULT;
1558                                 return EX_SOFTWARE;
1559                         }
1560
1561                         /* Collect results */
1562                         if (sid == -1)
1563                         {
1564                                 save_errno = sm_ldap_geterrno(lmap->ldap_ld);
1565                                 statp = EX_TEMPFAIL;
1566                                 switch (save_errno)
1567                                 {
1568 # ifdef LDAP_SERVER_DOWN
1569                                   case LDAP_SERVER_DOWN:
1570 # endif
1571                                   case LDAP_TIMEOUT:
1572                                   case ETIMEDOUT:
1573                                   case LDAP_UNAVAILABLE:
1574
1575                                         /*
1576                                         **  server disappeared,
1577                                         **  try reopen on next search
1578                                         */
1579
1580                                         statp = EX_RESTART;
1581                                         break;
1582                                 }
1583                                 errno = save_errno + E_LDAPBASE;
1584                                 return statp;
1585                         }
1586
1587                         status = sm_ldap_results(lmap, sid, newflags, delim,
1588                                                  rpool, result, resultln,
1589                                                  resultsz, recurse);
1590                         save_errno = errno;
1591                         if (status != EX_OK && status != EX_NOTFOUND)
1592                         {
1593                                 errno = save_errno;
1594                                 return status;
1595                         }
1596
1597                         /* Mark as done */
1598                         rl->lr_done = true;
1599                         if (rl->lr_ludp != NULL)
1600                         {
1601                                 ldap_free_urldesc(rl->lr_ludp);
1602                                 rl->lr_ludp = NULL;
1603                         }
1604                         if (rl->lr_attrs != NULL)
1605                         {
1606                                 free(rl->lr_attrs);
1607                                 rl->lr_attrs = NULL;
1608                         }
1609
1610                         /* Reset rlidx as new items may have been added */
1611                         rlidx = -1;
1612                 }
1613         }
1614         return statp;
1615 }
1616
1617 /*
1618 **  SM_LDAP_CLOSE -- close LDAP connection
1619 **
1620 **      Parameters:
1621 **              lmap -- LDAP map information
1622 **
1623 **      Returns:
1624 **              None.
1625 */
1626
1627 void
1628 sm_ldap_close(lmap)
1629         SM_LDAP_STRUCT *lmap;
1630 {
1631         if (lmap->ldap_ld == NULL)
1632                 return;
1633
1634         if (lmap->ldap_pid == getpid())
1635                 ldap_unbind(lmap->ldap_ld);
1636         lmap->ldap_ld = NULL;
1637         lmap->ldap_pid = 0;
1638 }
1639
1640 /*
1641 **  SM_LDAP_GETERRNO -- get ldap errno value
1642 **
1643 **      Parameters:
1644 **              ld -- LDAP session handle
1645 **
1646 **      Returns:
1647 **              LDAP errno.
1648 */
1649
1650 int
1651 sm_ldap_geterrno(ld)
1652         LDAP *ld;
1653 {
1654         int err = LDAP_SUCCESS;
1655
1656 # if defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3
1657 #  ifdef LDAP_OPT_RESULT_CODE
1658 #   define LDAP_GET_RESULT_CODE LDAP_OPT_RESULT_CODE
1659 #  else
1660 #   define LDAP_GET_RESULT_CODE LDAP_OPT_ERROR_NUMBER
1661 #  endif
1662         (void) ldap_get_option(ld, LDAP_GET_RESULT_CODE, &err);
1663 # else
1664 #  ifdef LDAP_OPT_SIZELIMIT
1665         err = ldap_get_lderrno(ld, NULL, NULL);
1666 #  else
1667         err = ld->ld_errno;
1668
1669         /*
1670         **  Reset value to prevent lingering LDAP_DECODING_ERROR due to
1671         **  OpenLDAP 1.X's hack (see above)
1672         */
1673
1674         ld->ld_errno = LDAP_SUCCESS;
1675 #  endif /* LDAP_OPT_SIZELIMIT */
1676 # endif /* defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3 */
1677         return err;
1678 }
1679
1680 /*
1681 **  SM_LDAP_GETERROR -- get ldap error value
1682 **
1683 **      Parameters:
1684 **              ld -- LDAP session handle
1685 **
1686 **      Returns:
1687 **              LDAP error
1688 */
1689
1690 static char *
1691 sm_ldap_geterror(ld)
1692         LDAP *ld;
1693 {
1694         char *error = NULL;
1695
1696 # if defined(LDAP_OPT_DIAGNOSTIC_MESSAGE)
1697         (void) ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, &error);
1698 # endif
1699         return error;
1700 }
1701
1702
1703 #endif /* LDAPMAP */