ldap.c 29 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #if !defined(CURL_DISABLE_LDAP) && !defined(USE_OPENLDAP)
  26. /*
  27. * Notice that USE_OPENLDAP is only a source code selection switch. When
  28. * libcurl is built with USE_OPENLDAP defined the libcurl source code that
  29. * gets compiled is the code from openldap.c, otherwise the code that gets
  30. * compiled is the code from ldap.c.
  31. *
  32. * When USE_OPENLDAP is defined a recent version of the OpenLDAP library
  33. * might be required for compilation and runtime. In order to use ancient
  34. * OpenLDAP library versions, USE_OPENLDAP shall not be defined.
  35. */
  36. /* Wincrypt must be included before anything that could include OpenSSL. */
  37. #if defined(USE_WIN32_CRYPTO)
  38. #include <wincrypt.h>
  39. /* Undefine wincrypt conflicting symbols for BoringSSL. */
  40. #undef X509_NAME
  41. #undef X509_EXTENSIONS
  42. #undef PKCS7_ISSUER_AND_SERIAL
  43. #undef PKCS7_SIGNER_INFO
  44. #undef OCSP_REQUEST
  45. #undef OCSP_RESPONSE
  46. #endif
  47. #ifdef USE_WIN32_LDAP /* Use Windows LDAP implementation. */
  48. # include <winldap.h>
  49. # ifndef LDAP_VENDOR_NAME
  50. # error Your Platform SDK is NOT sufficient for LDAP support! \
  51. Update your Platform SDK, or disable LDAP support!
  52. # else
  53. # include <winber.h>
  54. # endif
  55. #else
  56. # define LDAP_DEPRECATED 1 /* Be sure ldap_init() is defined. */
  57. # ifdef HAVE_LBER_H
  58. # include <lber.h>
  59. # endif
  60. # include <ldap.h>
  61. # if (defined(HAVE_LDAP_SSL) && defined(HAVE_LDAP_SSL_H))
  62. # include <ldap_ssl.h>
  63. # endif /* HAVE_LDAP_SSL && HAVE_LDAP_SSL_H */
  64. #endif
  65. #include "urldata.h"
  66. #include <curl/curl.h>
  67. #include "sendf.h"
  68. #include "escape.h"
  69. #include "progress.h"
  70. #include "transfer.h"
  71. #include "strcase.h"
  72. #include "strtok.h"
  73. #include "curl_ldap.h"
  74. #include "curl_multibyte.h"
  75. #include "curl_base64.h"
  76. #include "connect.h"
  77. /* The last 3 #include files should be in this order */
  78. #include "curl_printf.h"
  79. #include "curl_memory.h"
  80. #include "memdebug.h"
  81. #ifndef HAVE_LDAP_URL_PARSE
  82. /* Use our own implementation. */
  83. struct ldap_urldesc {
  84. char *lud_host;
  85. int lud_port;
  86. #if defined(USE_WIN32_LDAP)
  87. TCHAR *lud_dn;
  88. TCHAR **lud_attrs;
  89. #else
  90. char *lud_dn;
  91. char **lud_attrs;
  92. #endif
  93. int lud_scope;
  94. #if defined(USE_WIN32_LDAP)
  95. TCHAR *lud_filter;
  96. #else
  97. char *lud_filter;
  98. #endif
  99. char **lud_exts;
  100. size_t lud_attrs_dups; /* how many were dup'ed, this field is not in the
  101. "real" struct so can only be used in code
  102. without HAVE_LDAP_URL_PARSE defined */
  103. };
  104. #undef LDAPURLDesc
  105. #define LDAPURLDesc struct ldap_urldesc
  106. static int _ldap_url_parse(struct Curl_easy *data,
  107. const struct connectdata *conn,
  108. LDAPURLDesc **ludp);
  109. static void _ldap_free_urldesc(LDAPURLDesc *ludp);
  110. #undef ldap_free_urldesc
  111. #define ldap_free_urldesc _ldap_free_urldesc
  112. #endif
  113. #ifdef DEBUG_LDAP
  114. #define LDAP_TRACE(x) do { \
  115. _ldap_trace("%u: ", __LINE__); \
  116. _ldap_trace x; \
  117. } while(0)
  118. static void _ldap_trace(const char *fmt, ...);
  119. #else
  120. #define LDAP_TRACE(x) Curl_nop_stmt
  121. #endif
  122. #if defined(USE_WIN32_LDAP) && defined(ldap_err2string)
  123. /* Use ansi error strings in UNICODE builds */
  124. #undef ldap_err2string
  125. #define ldap_err2string ldap_err2stringA
  126. #endif
  127. #if defined(USE_WIN32_LDAP) && defined(_MSC_VER) && (_MSC_VER <= 1600)
  128. /* Workaround for warning:
  129. 'type cast' : conversion from 'int' to 'void *' of greater size */
  130. #undef LDAP_OPT_ON
  131. #undef LDAP_OPT_OFF
  132. #define LDAP_OPT_ON ((void *)(size_t)1)
  133. #define LDAP_OPT_OFF ((void *)(size_t)0)
  134. #endif
  135. static CURLcode ldap_do(struct Curl_easy *data, bool *done);
  136. /*
  137. * LDAP protocol handler.
  138. */
  139. const struct Curl_handler Curl_handler_ldap = {
  140. "LDAP", /* scheme */
  141. ZERO_NULL, /* setup_connection */
  142. ldap_do, /* do_it */
  143. ZERO_NULL, /* done */
  144. ZERO_NULL, /* do_more */
  145. ZERO_NULL, /* connect_it */
  146. ZERO_NULL, /* connecting */
  147. ZERO_NULL, /* doing */
  148. ZERO_NULL, /* proto_getsock */
  149. ZERO_NULL, /* doing_getsock */
  150. ZERO_NULL, /* domore_getsock */
  151. ZERO_NULL, /* perform_getsock */
  152. ZERO_NULL, /* disconnect */
  153. ZERO_NULL, /* readwrite */
  154. ZERO_NULL, /* connection_check */
  155. ZERO_NULL, /* attach connection */
  156. PORT_LDAP, /* defport */
  157. CURLPROTO_LDAP, /* protocol */
  158. CURLPROTO_LDAP, /* family */
  159. PROTOPT_NONE /* flags */
  160. };
  161. #ifdef HAVE_LDAP_SSL
  162. /*
  163. * LDAPS protocol handler.
  164. */
  165. const struct Curl_handler Curl_handler_ldaps = {
  166. "LDAPS", /* scheme */
  167. ZERO_NULL, /* setup_connection */
  168. ldap_do, /* do_it */
  169. ZERO_NULL, /* done */
  170. ZERO_NULL, /* do_more */
  171. ZERO_NULL, /* connect_it */
  172. ZERO_NULL, /* connecting */
  173. ZERO_NULL, /* doing */
  174. ZERO_NULL, /* proto_getsock */
  175. ZERO_NULL, /* doing_getsock */
  176. ZERO_NULL, /* domore_getsock */
  177. ZERO_NULL, /* perform_getsock */
  178. ZERO_NULL, /* disconnect */
  179. ZERO_NULL, /* readwrite */
  180. ZERO_NULL, /* connection_check */
  181. ZERO_NULL, /* attach connection */
  182. PORT_LDAPS, /* defport */
  183. CURLPROTO_LDAPS, /* protocol */
  184. CURLPROTO_LDAP, /* family */
  185. PROTOPT_SSL /* flags */
  186. };
  187. #endif
  188. #if defined(USE_WIN32_LDAP)
  189. #if defined(USE_WINDOWS_SSPI)
  190. static int ldap_win_bind_auth(LDAP *server, const char *user,
  191. const char *passwd, unsigned long authflags)
  192. {
  193. ULONG method = 0;
  194. SEC_WINNT_AUTH_IDENTITY cred;
  195. int rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
  196. memset(&cred, 0, sizeof(cred));
  197. #if defined(USE_SPNEGO)
  198. if(authflags & CURLAUTH_NEGOTIATE) {
  199. method = LDAP_AUTH_NEGOTIATE;
  200. }
  201. else
  202. #endif
  203. #if defined(USE_NTLM)
  204. if(authflags & CURLAUTH_NTLM) {
  205. method = LDAP_AUTH_NTLM;
  206. }
  207. else
  208. #endif
  209. #if !defined(CURL_DISABLE_CRYPTO_AUTH)
  210. if(authflags & CURLAUTH_DIGEST) {
  211. method = LDAP_AUTH_DIGEST;
  212. }
  213. else
  214. #endif
  215. {
  216. /* required anyway if one of upper preprocessor definitions enabled */
  217. }
  218. if(method && user && passwd) {
  219. rc = Curl_create_sspi_identity(user, passwd, &cred);
  220. if(!rc) {
  221. rc = ldap_bind_s(server, NULL, (TCHAR *)&cred, method);
  222. Curl_sspi_free_identity(&cred);
  223. }
  224. }
  225. else {
  226. /* proceed with current user credentials */
  227. method = LDAP_AUTH_NEGOTIATE;
  228. rc = ldap_bind_s(server, NULL, NULL, method);
  229. }
  230. return rc;
  231. }
  232. #endif /* #if defined(USE_WINDOWS_SSPI) */
  233. static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
  234. const char *user, const char *passwd)
  235. {
  236. int rc = LDAP_INVALID_CREDENTIALS;
  237. PTCHAR inuser = NULL;
  238. PTCHAR inpass = NULL;
  239. if(user && passwd && (data->set.httpauth & CURLAUTH_BASIC)) {
  240. inuser = curlx_convert_UTF8_to_tchar((char *) user);
  241. inpass = curlx_convert_UTF8_to_tchar((char *) passwd);
  242. rc = ldap_simple_bind_s(server, inuser, inpass);
  243. curlx_unicodefree(inuser);
  244. curlx_unicodefree(inpass);
  245. }
  246. #if defined(USE_WINDOWS_SSPI)
  247. else {
  248. rc = ldap_win_bind_auth(server, user, passwd, data->set.httpauth);
  249. }
  250. #endif
  251. return rc;
  252. }
  253. #endif /* #if defined(USE_WIN32_LDAP) */
  254. #if defined(USE_WIN32_LDAP)
  255. #define FREE_ON_WINLDAP(x) curlx_unicodefree(x)
  256. #else
  257. #define FREE_ON_WINLDAP(x)
  258. #endif
  259. static CURLcode ldap_do(struct Curl_easy *data, bool *done)
  260. {
  261. CURLcode result = CURLE_OK;
  262. int rc = 0;
  263. LDAP *server = NULL;
  264. LDAPURLDesc *ludp = NULL;
  265. LDAPMessage *ldapmsg = NULL;
  266. LDAPMessage *entryIterator;
  267. int num = 0;
  268. struct connectdata *conn = data->conn;
  269. int ldap_proto = LDAP_VERSION3;
  270. int ldap_ssl = 0;
  271. char *val_b64 = NULL;
  272. size_t val_b64_sz = 0;
  273. curl_off_t dlsize = 0;
  274. #ifdef LDAP_OPT_NETWORK_TIMEOUT
  275. struct timeval ldap_timeout = {10, 0}; /* 10 sec connection/search timeout */
  276. #endif
  277. #if defined(USE_WIN32_LDAP)
  278. TCHAR *host = NULL;
  279. #else
  280. char *host = NULL;
  281. #endif
  282. char *user = NULL;
  283. char *passwd = NULL;
  284. *done = TRUE; /* unconditionally */
  285. infof(data, "LDAP local: LDAP Vendor = %s ; LDAP Version = %d",
  286. LDAP_VENDOR_NAME, LDAP_VENDOR_VERSION);
  287. infof(data, "LDAP local: %s", data->state.url);
  288. #ifdef HAVE_LDAP_URL_PARSE
  289. rc = ldap_url_parse(data->state.url, &ludp);
  290. #else
  291. rc = _ldap_url_parse(data, conn, &ludp);
  292. #endif
  293. if(rc) {
  294. failf(data, "Bad LDAP URL: %s", ldap_err2string(rc));
  295. result = CURLE_URL_MALFORMAT;
  296. goto quit;
  297. }
  298. /* Get the URL scheme (either ldap or ldaps) */
  299. if(conn->given->flags & PROTOPT_SSL)
  300. ldap_ssl = 1;
  301. infof(data, "LDAP local: trying to establish %s connection",
  302. ldap_ssl ? "encrypted" : "cleartext");
  303. #if defined(USE_WIN32_LDAP)
  304. host = curlx_convert_UTF8_to_tchar(conn->host.name);
  305. if(!host) {
  306. result = CURLE_OUT_OF_MEMORY;
  307. goto quit;
  308. }
  309. #else
  310. host = conn->host.name;
  311. #endif
  312. if(data->state.aptr.user) {
  313. user = conn->user;
  314. passwd = conn->passwd;
  315. }
  316. #ifdef LDAP_OPT_NETWORK_TIMEOUT
  317. ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
  318. #endif
  319. ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
  320. if(ldap_ssl) {
  321. #ifdef HAVE_LDAP_SSL
  322. #ifdef USE_WIN32_LDAP
  323. /* Win32 LDAP SDK doesn't support insecure mode without CA! */
  324. server = ldap_sslinit(host, conn->port, 1);
  325. ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
  326. #else
  327. int ldap_option;
  328. char *ldap_ca = conn->ssl_config.CAfile;
  329. #if defined(CURL_HAS_NOVELL_LDAPSDK)
  330. rc = ldapssl_client_init(NULL, NULL);
  331. if(rc != LDAP_SUCCESS) {
  332. failf(data, "LDAP local: ldapssl_client_init %s", ldap_err2string(rc));
  333. result = CURLE_SSL_CERTPROBLEM;
  334. goto quit;
  335. }
  336. if(conn->ssl_config.verifypeer) {
  337. /* Novell SDK supports DER or BASE64 files. */
  338. int cert_type = LDAPSSL_CERT_FILETYPE_B64;
  339. if((data->set.ssl.cert_type) &&
  340. (strcasecompare(data->set.ssl.cert_type, "DER")))
  341. cert_type = LDAPSSL_CERT_FILETYPE_DER;
  342. if(!ldap_ca) {
  343. failf(data, "LDAP local: ERROR %s CA cert not set",
  344. (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"));
  345. result = CURLE_SSL_CERTPROBLEM;
  346. goto quit;
  347. }
  348. infof(data, "LDAP local: using %s CA cert '%s'",
  349. (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
  350. ldap_ca);
  351. rc = ldapssl_add_trusted_cert(ldap_ca, cert_type);
  352. if(rc != LDAP_SUCCESS) {
  353. failf(data, "LDAP local: ERROR setting %s CA cert: %s",
  354. (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
  355. ldap_err2string(rc));
  356. result = CURLE_SSL_CERTPROBLEM;
  357. goto quit;
  358. }
  359. ldap_option = LDAPSSL_VERIFY_SERVER;
  360. }
  361. else
  362. ldap_option = LDAPSSL_VERIFY_NONE;
  363. rc = ldapssl_set_verify_mode(ldap_option);
  364. if(rc != LDAP_SUCCESS) {
  365. failf(data, "LDAP local: ERROR setting cert verify mode: %s",
  366. ldap_err2string(rc));
  367. result = CURLE_SSL_CERTPROBLEM;
  368. goto quit;
  369. }
  370. server = ldapssl_init(host, conn->port, 1);
  371. if(!server) {
  372. failf(data, "LDAP local: Cannot connect to %s:%u",
  373. conn->host.dispname, conn->port);
  374. result = CURLE_COULDNT_CONNECT;
  375. goto quit;
  376. }
  377. #elif defined(LDAP_OPT_X_TLS)
  378. if(conn->ssl_config.verifypeer) {
  379. /* OpenLDAP SDK supports BASE64 files. */
  380. if((data->set.ssl.cert_type) &&
  381. (!strcasecompare(data->set.ssl.cert_type, "PEM"))) {
  382. failf(data, "LDAP local: ERROR OpenLDAP only supports PEM cert-type");
  383. result = CURLE_SSL_CERTPROBLEM;
  384. goto quit;
  385. }
  386. if(!ldap_ca) {
  387. failf(data, "LDAP local: ERROR PEM CA cert not set");
  388. result = CURLE_SSL_CERTPROBLEM;
  389. goto quit;
  390. }
  391. infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
  392. rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
  393. if(rc != LDAP_SUCCESS) {
  394. failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
  395. ldap_err2string(rc));
  396. result = CURLE_SSL_CERTPROBLEM;
  397. goto quit;
  398. }
  399. ldap_option = LDAP_OPT_X_TLS_DEMAND;
  400. }
  401. else
  402. ldap_option = LDAP_OPT_X_TLS_NEVER;
  403. rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
  404. if(rc != LDAP_SUCCESS) {
  405. failf(data, "LDAP local: ERROR setting cert verify mode: %s",
  406. ldap_err2string(rc));
  407. result = CURLE_SSL_CERTPROBLEM;
  408. goto quit;
  409. }
  410. server = ldap_init(host, conn->port);
  411. if(!server) {
  412. failf(data, "LDAP local: Cannot connect to %s:%u",
  413. conn->host.dispname, conn->port);
  414. result = CURLE_COULDNT_CONNECT;
  415. goto quit;
  416. }
  417. ldap_option = LDAP_OPT_X_TLS_HARD;
  418. rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
  419. if(rc != LDAP_SUCCESS) {
  420. failf(data, "LDAP local: ERROR setting SSL/TLS mode: %s",
  421. ldap_err2string(rc));
  422. result = CURLE_SSL_CERTPROBLEM;
  423. goto quit;
  424. }
  425. /*
  426. rc = ldap_start_tls_s(server, NULL, NULL);
  427. if(rc != LDAP_SUCCESS) {
  428. failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
  429. ldap_err2string(rc));
  430. result = CURLE_SSL_CERTPROBLEM;
  431. goto quit;
  432. }
  433. */
  434. #else
  435. /* we should probably never come up to here since configure
  436. should check in first place if we can support LDAP SSL/TLS */
  437. failf(data, "LDAP local: SSL/TLS not supported with this version "
  438. "of the OpenLDAP toolkit\n");
  439. result = CURLE_SSL_CERTPROBLEM;
  440. goto quit;
  441. #endif
  442. #endif
  443. #endif /* CURL_LDAP_USE_SSL */
  444. }
  445. else if(data->set.use_ssl > CURLUSESSL_TRY) {
  446. failf(data, "LDAP local: explicit TLS not supported");
  447. result = CURLE_NOT_BUILT_IN;
  448. goto quit;
  449. }
  450. else {
  451. server = ldap_init(host, conn->port);
  452. if(!server) {
  453. failf(data, "LDAP local: Cannot connect to %s:%u",
  454. conn->host.dispname, conn->port);
  455. result = CURLE_COULDNT_CONNECT;
  456. goto quit;
  457. }
  458. }
  459. #ifdef USE_WIN32_LDAP
  460. ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
  461. rc = ldap_win_bind(data, server, user, passwd);
  462. #else
  463. rc = ldap_simple_bind_s(server, user, passwd);
  464. #endif
  465. if(!ldap_ssl && rc) {
  466. ldap_proto = LDAP_VERSION2;
  467. ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
  468. #ifdef USE_WIN32_LDAP
  469. rc = ldap_win_bind(data, server, user, passwd);
  470. #else
  471. rc = ldap_simple_bind_s(server, user, passwd);
  472. #endif
  473. }
  474. if(rc) {
  475. #ifdef USE_WIN32_LDAP
  476. failf(data, "LDAP local: bind via ldap_win_bind %s",
  477. ldap_err2string(rc));
  478. #else
  479. failf(data, "LDAP local: bind via ldap_simple_bind_s %s",
  480. ldap_err2string(rc));
  481. #endif
  482. result = CURLE_LDAP_CANNOT_BIND;
  483. goto quit;
  484. }
  485. rc = ldap_search_s(server, ludp->lud_dn, ludp->lud_scope,
  486. ludp->lud_filter, ludp->lud_attrs, 0, &ldapmsg);
  487. if(rc && rc != LDAP_SIZELIMIT_EXCEEDED) {
  488. failf(data, "LDAP remote: %s", ldap_err2string(rc));
  489. result = CURLE_LDAP_SEARCH_FAILED;
  490. goto quit;
  491. }
  492. for(num = 0, entryIterator = ldap_first_entry(server, ldapmsg);
  493. entryIterator;
  494. entryIterator = ldap_next_entry(server, entryIterator), num++) {
  495. BerElement *ber = NULL;
  496. #if defined(USE_WIN32_LDAP)
  497. TCHAR *attribute;
  498. #else
  499. char *attribute;
  500. #endif
  501. int i;
  502. /* Get the DN and write it to the client */
  503. {
  504. char *name;
  505. size_t name_len;
  506. #if defined(USE_WIN32_LDAP)
  507. TCHAR *dn = ldap_get_dn(server, entryIterator);
  508. name = curlx_convert_tchar_to_UTF8(dn);
  509. if(!name) {
  510. ldap_memfree(dn);
  511. result = CURLE_OUT_OF_MEMORY;
  512. goto quit;
  513. }
  514. #else
  515. char *dn = name = ldap_get_dn(server, entryIterator);
  516. #endif
  517. name_len = strlen(name);
  518. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"DN: ", 4);
  519. if(result) {
  520. FREE_ON_WINLDAP(name);
  521. ldap_memfree(dn);
  522. goto quit;
  523. }
  524. result = Curl_client_write(data, CLIENTWRITE_BODY, name, name_len);
  525. if(result) {
  526. FREE_ON_WINLDAP(name);
  527. ldap_memfree(dn);
  528. goto quit;
  529. }
  530. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
  531. if(result) {
  532. FREE_ON_WINLDAP(name);
  533. ldap_memfree(dn);
  534. goto quit;
  535. }
  536. dlsize += name_len + 5;
  537. FREE_ON_WINLDAP(name);
  538. ldap_memfree(dn);
  539. }
  540. /* Get the attributes and write them to the client */
  541. for(attribute = ldap_first_attribute(server, entryIterator, &ber);
  542. attribute;
  543. attribute = ldap_next_attribute(server, entryIterator, ber)) {
  544. BerValue **vals;
  545. size_t attr_len;
  546. #if defined(USE_WIN32_LDAP)
  547. char *attr = curlx_convert_tchar_to_UTF8(attribute);
  548. if(!attr) {
  549. if(ber)
  550. ber_free(ber, 0);
  551. result = CURLE_OUT_OF_MEMORY;
  552. goto quit;
  553. }
  554. #else
  555. char *attr = attribute;
  556. #endif
  557. attr_len = strlen(attr);
  558. vals = ldap_get_values_len(server, entryIterator, attribute);
  559. if(vals) {
  560. for(i = 0; (vals[i] != NULL); i++) {
  561. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\t", 1);
  562. if(result) {
  563. ldap_value_free_len(vals);
  564. FREE_ON_WINLDAP(attr);
  565. ldap_memfree(attribute);
  566. if(ber)
  567. ber_free(ber, 0);
  568. goto quit;
  569. }
  570. result = Curl_client_write(data, CLIENTWRITE_BODY, attr, attr_len);
  571. if(result) {
  572. ldap_value_free_len(vals);
  573. FREE_ON_WINLDAP(attr);
  574. ldap_memfree(attribute);
  575. if(ber)
  576. ber_free(ber, 0);
  577. goto quit;
  578. }
  579. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)": ", 2);
  580. if(result) {
  581. ldap_value_free_len(vals);
  582. FREE_ON_WINLDAP(attr);
  583. ldap_memfree(attribute);
  584. if(ber)
  585. ber_free(ber, 0);
  586. goto quit;
  587. }
  588. dlsize += attr_len + 3;
  589. if((attr_len > 7) &&
  590. (strcmp(";binary", attr + (attr_len - 7)) == 0)) {
  591. /* Binary attribute, encode to base64. */
  592. result = Curl_base64_encode(vals[i]->bv_val, vals[i]->bv_len,
  593. &val_b64, &val_b64_sz);
  594. if(result) {
  595. ldap_value_free_len(vals);
  596. FREE_ON_WINLDAP(attr);
  597. ldap_memfree(attribute);
  598. if(ber)
  599. ber_free(ber, 0);
  600. goto quit;
  601. }
  602. if(val_b64_sz > 0) {
  603. result = Curl_client_write(data, CLIENTWRITE_BODY, val_b64,
  604. val_b64_sz);
  605. free(val_b64);
  606. if(result) {
  607. ldap_value_free_len(vals);
  608. FREE_ON_WINLDAP(attr);
  609. ldap_memfree(attribute);
  610. if(ber)
  611. ber_free(ber, 0);
  612. goto quit;
  613. }
  614. dlsize += val_b64_sz;
  615. }
  616. }
  617. else {
  618. result = Curl_client_write(data, CLIENTWRITE_BODY, vals[i]->bv_val,
  619. vals[i]->bv_len);
  620. if(result) {
  621. ldap_value_free_len(vals);
  622. FREE_ON_WINLDAP(attr);
  623. ldap_memfree(attribute);
  624. if(ber)
  625. ber_free(ber, 0);
  626. goto quit;
  627. }
  628. dlsize += vals[i]->bv_len;
  629. }
  630. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
  631. if(result) {
  632. ldap_value_free_len(vals);
  633. FREE_ON_WINLDAP(attr);
  634. ldap_memfree(attribute);
  635. if(ber)
  636. ber_free(ber, 0);
  637. goto quit;
  638. }
  639. dlsize++;
  640. }
  641. /* Free memory used to store values */
  642. ldap_value_free_len(vals);
  643. }
  644. /* Free the attribute as we are done with it */
  645. FREE_ON_WINLDAP(attr);
  646. ldap_memfree(attribute);
  647. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
  648. if(result)
  649. goto quit;
  650. dlsize++;
  651. Curl_pgrsSetDownloadCounter(data, dlsize);
  652. }
  653. if(ber)
  654. ber_free(ber, 0);
  655. }
  656. quit:
  657. if(ldapmsg) {
  658. ldap_msgfree(ldapmsg);
  659. LDAP_TRACE(("Received %d entries\n", num));
  660. }
  661. if(rc == LDAP_SIZELIMIT_EXCEEDED)
  662. infof(data, "There are more than %d entries", num);
  663. if(ludp)
  664. ldap_free_urldesc(ludp);
  665. if(server)
  666. ldap_unbind_s(server);
  667. #if defined(HAVE_LDAP_SSL) && defined(CURL_HAS_NOVELL_LDAPSDK)
  668. if(ldap_ssl)
  669. ldapssl_client_deinit();
  670. #endif /* HAVE_LDAP_SSL && CURL_HAS_NOVELL_LDAPSDK */
  671. FREE_ON_WINLDAP(host);
  672. /* no data to transfer */
  673. Curl_setup_transfer(data, -1, -1, FALSE, -1);
  674. connclose(conn, "LDAP connection always disable re-use");
  675. return result;
  676. }
  677. #ifdef DEBUG_LDAP
  678. static void _ldap_trace(const char *fmt, ...)
  679. {
  680. static int do_trace = -1;
  681. va_list args;
  682. if(do_trace == -1) {
  683. const char *env = getenv("CURL_TRACE");
  684. do_trace = (env && strtol(env, NULL, 10) > 0);
  685. }
  686. if(!do_trace)
  687. return;
  688. va_start(args, fmt);
  689. vfprintf(stderr, fmt, args);
  690. va_end(args);
  691. }
  692. #endif
  693. #ifndef HAVE_LDAP_URL_PARSE
  694. /*
  695. * Return scope-value for a scope-string.
  696. */
  697. static int str2scope(const char *p)
  698. {
  699. if(strcasecompare(p, "one"))
  700. return LDAP_SCOPE_ONELEVEL;
  701. if(strcasecompare(p, "onetree"))
  702. return LDAP_SCOPE_ONELEVEL;
  703. if(strcasecompare(p, "base"))
  704. return LDAP_SCOPE_BASE;
  705. if(strcasecompare(p, "sub"))
  706. return LDAP_SCOPE_SUBTREE;
  707. if(strcasecompare(p, "subtree"))
  708. return LDAP_SCOPE_SUBTREE;
  709. return (-1);
  710. }
  711. /*
  712. * Split 'str' into strings separated by commas.
  713. * Note: out[] points into 'str'.
  714. */
  715. static bool split_str(char *str, char ***out, size_t *count)
  716. {
  717. char **res;
  718. char *lasts;
  719. char *s;
  720. size_t i;
  721. size_t items = 1;
  722. s = strchr(str, ',');
  723. while(s) {
  724. items++;
  725. s = strchr(++s, ',');
  726. }
  727. res = calloc(items, sizeof(char *));
  728. if(!res)
  729. return FALSE;
  730. for(i = 0, s = strtok_r(str, ",", &lasts); s && i < items;
  731. s = strtok_r(NULL, ",", &lasts), i++)
  732. res[i] = s;
  733. *out = res;
  734. *count = items;
  735. return TRUE;
  736. }
  737. /*
  738. * Break apart the pieces of an LDAP URL.
  739. * Syntax:
  740. * ldap://<hostname>:<port>/<base_dn>?<attributes>?<scope>?<filter>?<ext>
  741. *
  742. * <hostname> already known from 'conn->host.name'.
  743. * <port> already known from 'conn->remote_port'.
  744. * extract the rest from 'data->state.path+1'. All fields are optional.
  745. * e.g.
  746. * ldap://<hostname>:<port>/?<attributes>?<scope>?<filter>
  747. * yields ludp->lud_dn = "".
  748. *
  749. * Defined in RFC4516 section 2.
  750. */
  751. static int _ldap_url_parse2(struct Curl_easy *data,
  752. const struct connectdata *conn, LDAPURLDesc *ludp)
  753. {
  754. int rc = LDAP_SUCCESS;
  755. char *p;
  756. char *path;
  757. char *q = NULL;
  758. char *query = NULL;
  759. size_t i;
  760. if(!data ||
  761. !data->state.up.path ||
  762. data->state.up.path[0] != '/' ||
  763. !strncasecompare("LDAP", data->state.up.scheme, 4))
  764. return LDAP_INVALID_SYNTAX;
  765. ludp->lud_scope = LDAP_SCOPE_BASE;
  766. ludp->lud_port = conn->remote_port;
  767. ludp->lud_host = conn->host.name;
  768. /* Duplicate the path */
  769. p = path = strdup(data->state.up.path + 1);
  770. if(!path)
  771. return LDAP_NO_MEMORY;
  772. /* Duplicate the query if present */
  773. if(data->state.up.query) {
  774. q = query = strdup(data->state.up.query);
  775. if(!query) {
  776. free(path);
  777. return LDAP_NO_MEMORY;
  778. }
  779. }
  780. /* Parse the DN (Distinguished Name) */
  781. if(*p) {
  782. char *dn = p;
  783. char *unescaped;
  784. CURLcode result;
  785. LDAP_TRACE(("DN '%s'\n", dn));
  786. /* Unescape the DN */
  787. result = Curl_urldecode(dn, 0, &unescaped, NULL, REJECT_ZERO);
  788. if(result) {
  789. rc = LDAP_NO_MEMORY;
  790. goto quit;
  791. }
  792. #if defined(USE_WIN32_LDAP)
  793. /* Convert the unescaped string to a tchar */
  794. ludp->lud_dn = curlx_convert_UTF8_to_tchar(unescaped);
  795. /* Free the unescaped string as we are done with it */
  796. free(unescaped);
  797. if(!ludp->lud_dn) {
  798. rc = LDAP_NO_MEMORY;
  799. goto quit;
  800. }
  801. #else
  802. ludp->lud_dn = unescaped;
  803. #endif
  804. }
  805. p = q;
  806. if(!p)
  807. goto quit;
  808. /* Parse the attributes. skip "??" */
  809. q = strchr(p, '?');
  810. if(q)
  811. *q++ = '\0';
  812. if(*p) {
  813. char **attributes;
  814. size_t count = 0;
  815. /* Split the string into an array of attributes */
  816. if(!split_str(p, &attributes, &count)) {
  817. rc = LDAP_NO_MEMORY;
  818. goto quit;
  819. }
  820. /* Allocate our array (+1 for the NULL entry) */
  821. #if defined(USE_WIN32_LDAP)
  822. ludp->lud_attrs = calloc(count + 1, sizeof(TCHAR *));
  823. #else
  824. ludp->lud_attrs = calloc(count + 1, sizeof(char *));
  825. #endif
  826. if(!ludp->lud_attrs) {
  827. free(attributes);
  828. rc = LDAP_NO_MEMORY;
  829. goto quit;
  830. }
  831. for(i = 0; i < count; i++) {
  832. char *unescaped;
  833. CURLcode result;
  834. LDAP_TRACE(("attr[%zu] '%s'\n", i, attributes[i]));
  835. /* Unescape the attribute */
  836. result = Curl_urldecode(attributes[i], 0, &unescaped, NULL,
  837. REJECT_ZERO);
  838. if(result) {
  839. free(attributes);
  840. rc = LDAP_NO_MEMORY;
  841. goto quit;
  842. }
  843. #if defined(USE_WIN32_LDAP)
  844. /* Convert the unescaped string to a tchar */
  845. ludp->lud_attrs[i] = curlx_convert_UTF8_to_tchar(unescaped);
  846. /* Free the unescaped string as we are done with it */
  847. free(unescaped);
  848. if(!ludp->lud_attrs[i]) {
  849. free(attributes);
  850. rc = LDAP_NO_MEMORY;
  851. goto quit;
  852. }
  853. #else
  854. ludp->lud_attrs[i] = unescaped;
  855. #endif
  856. ludp->lud_attrs_dups++;
  857. }
  858. free(attributes);
  859. }
  860. p = q;
  861. if(!p)
  862. goto quit;
  863. /* Parse the scope. skip "??" */
  864. q = strchr(p, '?');
  865. if(q)
  866. *q++ = '\0';
  867. if(*p) {
  868. ludp->lud_scope = str2scope(p);
  869. if(ludp->lud_scope == -1) {
  870. rc = LDAP_INVALID_SYNTAX;
  871. goto quit;
  872. }
  873. LDAP_TRACE(("scope %d\n", ludp->lud_scope));
  874. }
  875. p = q;
  876. if(!p)
  877. goto quit;
  878. /* Parse the filter */
  879. q = strchr(p, '?');
  880. if(q)
  881. *q++ = '\0';
  882. if(*p) {
  883. char *filter = p;
  884. char *unescaped;
  885. CURLcode result;
  886. LDAP_TRACE(("filter '%s'\n", filter));
  887. /* Unescape the filter */
  888. result = Curl_urldecode(filter, 0, &unescaped, NULL, REJECT_ZERO);
  889. if(result) {
  890. rc = LDAP_NO_MEMORY;
  891. goto quit;
  892. }
  893. #if defined(USE_WIN32_LDAP)
  894. /* Convert the unescaped string to a tchar */
  895. ludp->lud_filter = curlx_convert_UTF8_to_tchar(unescaped);
  896. /* Free the unescaped string as we are done with it */
  897. free(unescaped);
  898. if(!ludp->lud_filter) {
  899. rc = LDAP_NO_MEMORY;
  900. goto quit;
  901. }
  902. #else
  903. ludp->lud_filter = unescaped;
  904. #endif
  905. }
  906. p = q;
  907. if(p && !*p) {
  908. rc = LDAP_INVALID_SYNTAX;
  909. goto quit;
  910. }
  911. quit:
  912. free(path);
  913. free(query);
  914. return rc;
  915. }
  916. static int _ldap_url_parse(struct Curl_easy *data,
  917. const struct connectdata *conn,
  918. LDAPURLDesc **ludpp)
  919. {
  920. LDAPURLDesc *ludp = calloc(1, sizeof(*ludp));
  921. int rc;
  922. *ludpp = NULL;
  923. if(!ludp)
  924. return LDAP_NO_MEMORY;
  925. rc = _ldap_url_parse2(data, conn, ludp);
  926. if(rc != LDAP_SUCCESS) {
  927. _ldap_free_urldesc(ludp);
  928. ludp = NULL;
  929. }
  930. *ludpp = ludp;
  931. return (rc);
  932. }
  933. static void _ldap_free_urldesc(LDAPURLDesc *ludp)
  934. {
  935. if(!ludp)
  936. return;
  937. #if defined(USE_WIN32_LDAP)
  938. curlx_unicodefree(ludp->lud_dn);
  939. curlx_unicodefree(ludp->lud_filter);
  940. #else
  941. free(ludp->lud_dn);
  942. free(ludp->lud_filter);
  943. #endif
  944. if(ludp->lud_attrs) {
  945. size_t i;
  946. for(i = 0; i < ludp->lud_attrs_dups; i++) {
  947. #if defined(USE_WIN32_LDAP)
  948. curlx_unicodefree(ludp->lud_attrs[i]);
  949. #else
  950. free(ludp->lud_attrs[i]);
  951. #endif
  952. }
  953. free(ludp->lud_attrs);
  954. }
  955. free(ludp);
  956. }
  957. #endif /* !HAVE_LDAP_URL_PARSE */
  958. #endif /* !CURL_DISABLE_LDAP && !USE_OPENLDAP */