ldap.c 29 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #if !defined(CURL_DISABLE_LDAP) && !defined(USE_OPENLDAP)
  26. /*
  27. * Notice that USE_OPENLDAP is only a source code selection switch. When
  28. * libcurl is built with USE_OPENLDAP defined the libcurl source code that
  29. * gets compiled is the code from openldap.c, otherwise the code that gets
  30. * compiled is the code from ldap.c.
  31. *
  32. * When USE_OPENLDAP is defined a recent version of the OpenLDAP library
  33. * might be required for compilation and runtime. In order to use ancient
  34. * OpenLDAP library versions, USE_OPENLDAP shall not be defined.
  35. */
  36. /* Wincrypt must be included before anything that could include OpenSSL. */
  37. #if defined(USE_WIN32_CRYPTO)
  38. #include <wincrypt.h>
  39. /* Undefine wincrypt conflicting symbols for BoringSSL. */
  40. #undef X509_NAME
  41. #undef X509_EXTENSIONS
  42. #undef PKCS7_ISSUER_AND_SERIAL
  43. #undef PKCS7_SIGNER_INFO
  44. #undef OCSP_REQUEST
  45. #undef OCSP_RESPONSE
  46. #endif
  47. #ifdef USE_WIN32_LDAP /* Use Windows LDAP implementation. */
  48. # include <winldap.h>
  49. # ifndef LDAP_VENDOR_NAME
  50. # error Your Platform SDK is NOT sufficient for LDAP support! \
  51. Update your Platform SDK, or disable LDAP support!
  52. # else
  53. # include <winber.h>
  54. # endif
  55. #else
  56. # define LDAP_DEPRECATED 1 /* Be sure ldap_init() is defined. */
  57. # ifdef HAVE_LBER_H
  58. # include <lber.h>
  59. # endif
  60. # include <ldap.h>
  61. # if (defined(HAVE_LDAP_SSL) && defined(HAVE_LDAP_SSL_H))
  62. # include <ldap_ssl.h>
  63. # endif /* HAVE_LDAP_SSL && HAVE_LDAP_SSL_H */
  64. #endif
  65. #include "urldata.h"
  66. #include <curl/curl.h>
  67. #include "sendf.h"
  68. #include "escape.h"
  69. #include "progress.h"
  70. #include "transfer.h"
  71. #include "strcase.h"
  72. #include "strtok.h"
  73. #include "curl_ldap.h"
  74. #include "curl_multibyte.h"
  75. #include "curl_base64.h"
  76. #include "connect.h"
  77. /* The last 3 #include files should be in this order */
  78. #include "curl_printf.h"
  79. #include "curl_memory.h"
  80. #include "memdebug.h"
  81. #ifndef HAVE_LDAP_URL_PARSE
  82. /* Use our own implementation. */
  83. struct ldap_urldesc {
  84. char *lud_host;
  85. int lud_port;
  86. #if defined(USE_WIN32_LDAP)
  87. TCHAR *lud_dn;
  88. TCHAR **lud_attrs;
  89. #else
  90. char *lud_dn;
  91. char **lud_attrs;
  92. #endif
  93. int lud_scope;
  94. #if defined(USE_WIN32_LDAP)
  95. TCHAR *lud_filter;
  96. #else
  97. char *lud_filter;
  98. #endif
  99. char **lud_exts;
  100. size_t lud_attrs_dups; /* how many were dup'ed, this field is not in the
  101. "real" struct so can only be used in code
  102. without HAVE_LDAP_URL_PARSE defined */
  103. };
  104. #undef LDAPURLDesc
  105. #define LDAPURLDesc struct ldap_urldesc
  106. static int _ldap_url_parse(struct Curl_easy *data,
  107. const struct connectdata *conn,
  108. LDAPURLDesc **ludp);
  109. static void _ldap_free_urldesc(LDAPURLDesc *ludp);
  110. #undef ldap_free_urldesc
  111. #define ldap_free_urldesc _ldap_free_urldesc
  112. #endif
  113. #ifdef DEBUG_LDAP
  114. #define LDAP_TRACE(x) do { \
  115. _ldap_trace("%u: ", __LINE__); \
  116. _ldap_trace x; \
  117. } while(0)
  118. static void _ldap_trace(const char *fmt, ...);
  119. #else
  120. #define LDAP_TRACE(x) Curl_nop_stmt
  121. #endif
  122. #if defined(USE_WIN32_LDAP) && defined(ldap_err2string)
  123. /* Use ansi error strings in UNICODE builds */
  124. #undef ldap_err2string
  125. #define ldap_err2string ldap_err2stringA
  126. #endif
  127. static CURLcode ldap_do(struct Curl_easy *data, bool *done);
  128. /*
  129. * LDAP protocol handler.
  130. */
  131. const struct Curl_handler Curl_handler_ldap = {
  132. "LDAP", /* scheme */
  133. ZERO_NULL, /* setup_connection */
  134. ldap_do, /* do_it */
  135. ZERO_NULL, /* done */
  136. ZERO_NULL, /* do_more */
  137. ZERO_NULL, /* connect_it */
  138. ZERO_NULL, /* connecting */
  139. ZERO_NULL, /* doing */
  140. ZERO_NULL, /* proto_getsock */
  141. ZERO_NULL, /* doing_getsock */
  142. ZERO_NULL, /* domore_getsock */
  143. ZERO_NULL, /* perform_getsock */
  144. ZERO_NULL, /* disconnect */
  145. ZERO_NULL, /* readwrite */
  146. ZERO_NULL, /* connection_check */
  147. ZERO_NULL, /* attach connection */
  148. PORT_LDAP, /* defport */
  149. CURLPROTO_LDAP, /* protocol */
  150. CURLPROTO_LDAP, /* family */
  151. PROTOPT_NONE /* flags */
  152. };
  153. #ifdef HAVE_LDAP_SSL
  154. /*
  155. * LDAPS protocol handler.
  156. */
  157. const struct Curl_handler Curl_handler_ldaps = {
  158. "LDAPS", /* scheme */
  159. ZERO_NULL, /* setup_connection */
  160. ldap_do, /* do_it */
  161. ZERO_NULL, /* done */
  162. ZERO_NULL, /* do_more */
  163. ZERO_NULL, /* connect_it */
  164. ZERO_NULL, /* connecting */
  165. ZERO_NULL, /* doing */
  166. ZERO_NULL, /* proto_getsock */
  167. ZERO_NULL, /* doing_getsock */
  168. ZERO_NULL, /* domore_getsock */
  169. ZERO_NULL, /* perform_getsock */
  170. ZERO_NULL, /* disconnect */
  171. ZERO_NULL, /* readwrite */
  172. ZERO_NULL, /* connection_check */
  173. ZERO_NULL, /* attach connection */
  174. PORT_LDAPS, /* defport */
  175. CURLPROTO_LDAPS, /* protocol */
  176. CURLPROTO_LDAP, /* family */
  177. PROTOPT_SSL /* flags */
  178. };
  179. #endif
  180. #if defined(USE_WIN32_LDAP)
  181. #if defined(USE_WINDOWS_SSPI)
  182. static int ldap_win_bind_auth(LDAP *server, const char *user,
  183. const char *passwd, unsigned long authflags)
  184. {
  185. ULONG method = 0;
  186. SEC_WINNT_AUTH_IDENTITY cred;
  187. int rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
  188. memset(&cred, 0, sizeof(cred));
  189. #if defined(USE_SPNEGO)
  190. if(authflags & CURLAUTH_NEGOTIATE) {
  191. method = LDAP_AUTH_NEGOTIATE;
  192. }
  193. else
  194. #endif
  195. #if defined(USE_NTLM)
  196. if(authflags & CURLAUTH_NTLM) {
  197. method = LDAP_AUTH_NTLM;
  198. }
  199. else
  200. #endif
  201. #if !defined(CURL_DISABLE_CRYPTO_AUTH)
  202. if(authflags & CURLAUTH_DIGEST) {
  203. method = LDAP_AUTH_DIGEST;
  204. }
  205. else
  206. #endif
  207. {
  208. /* required anyway if one of upper preprocessor definitions enabled */
  209. }
  210. if(method && user && passwd) {
  211. rc = Curl_create_sspi_identity(user, passwd, &cred);
  212. if(!rc) {
  213. rc = ldap_bind_s(server, NULL, (TCHAR *)&cred, method);
  214. Curl_sspi_free_identity(&cred);
  215. }
  216. }
  217. else {
  218. /* proceed with current user credentials */
  219. method = LDAP_AUTH_NEGOTIATE;
  220. rc = ldap_bind_s(server, NULL, NULL, method);
  221. }
  222. return rc;
  223. }
  224. #endif /* #if defined(USE_WINDOWS_SSPI) */
  225. static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
  226. const char *user, const char *passwd)
  227. {
  228. int rc = LDAP_INVALID_CREDENTIALS;
  229. PTCHAR inuser = NULL;
  230. PTCHAR inpass = NULL;
  231. if(user && passwd && (data->set.httpauth & CURLAUTH_BASIC)) {
  232. inuser = curlx_convert_UTF8_to_tchar((char *) user);
  233. inpass = curlx_convert_UTF8_to_tchar((char *) passwd);
  234. rc = ldap_simple_bind_s(server, inuser, inpass);
  235. curlx_unicodefree(inuser);
  236. curlx_unicodefree(inpass);
  237. }
  238. #if defined(USE_WINDOWS_SSPI)
  239. else {
  240. rc = ldap_win_bind_auth(server, user, passwd, data->set.httpauth);
  241. }
  242. #endif
  243. return rc;
  244. }
  245. #endif /* #if defined(USE_WIN32_LDAP) */
  246. #if defined(USE_WIN32_LDAP)
  247. #define FREE_ON_WINLDAP(x) curlx_unicodefree(x)
  248. #else
  249. #define FREE_ON_WINLDAP(x)
  250. #endif
  251. static CURLcode ldap_do(struct Curl_easy *data, bool *done)
  252. {
  253. CURLcode result = CURLE_OK;
  254. int rc = 0;
  255. LDAP *server = NULL;
  256. LDAPURLDesc *ludp = NULL;
  257. LDAPMessage *ldapmsg = NULL;
  258. LDAPMessage *entryIterator;
  259. int num = 0;
  260. struct connectdata *conn = data->conn;
  261. int ldap_proto = LDAP_VERSION3;
  262. int ldap_ssl = 0;
  263. char *val_b64 = NULL;
  264. size_t val_b64_sz = 0;
  265. curl_off_t dlsize = 0;
  266. #ifdef LDAP_OPT_NETWORK_TIMEOUT
  267. struct timeval ldap_timeout = {10, 0}; /* 10 sec connection/search timeout */
  268. #endif
  269. #if defined(USE_WIN32_LDAP)
  270. TCHAR *host = NULL;
  271. #else
  272. char *host = NULL;
  273. #endif
  274. char *user = NULL;
  275. char *passwd = NULL;
  276. *done = TRUE; /* unconditionally */
  277. infof(data, "LDAP local: LDAP Vendor = %s ; LDAP Version = %d",
  278. LDAP_VENDOR_NAME, LDAP_VENDOR_VERSION);
  279. infof(data, "LDAP local: %s", data->state.url);
  280. #ifdef HAVE_LDAP_URL_PARSE
  281. rc = ldap_url_parse(data->state.url, &ludp);
  282. #else
  283. rc = _ldap_url_parse(data, conn, &ludp);
  284. #endif
  285. if(rc) {
  286. failf(data, "Bad LDAP URL: %s", ldap_err2string(rc));
  287. result = CURLE_URL_MALFORMAT;
  288. goto quit;
  289. }
  290. /* Get the URL scheme (either ldap or ldaps) */
  291. if(conn->given->flags & PROTOPT_SSL)
  292. ldap_ssl = 1;
  293. infof(data, "LDAP local: trying to establish %s connection",
  294. ldap_ssl ? "encrypted" : "cleartext");
  295. #if defined(USE_WIN32_LDAP)
  296. host = curlx_convert_UTF8_to_tchar(conn->host.name);
  297. if(!host) {
  298. result = CURLE_OUT_OF_MEMORY;
  299. goto quit;
  300. }
  301. #else
  302. host = conn->host.name;
  303. #endif
  304. if(data->state.aptr.user) {
  305. user = conn->user;
  306. passwd = conn->passwd;
  307. }
  308. #ifdef LDAP_OPT_NETWORK_TIMEOUT
  309. ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
  310. #endif
  311. ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
  312. if(ldap_ssl) {
  313. #ifdef HAVE_LDAP_SSL
  314. #ifdef USE_WIN32_LDAP
  315. /* Win32 LDAP SDK doesn't support insecure mode without CA! */
  316. server = ldap_sslinit(host, conn->port, 1);
  317. ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
  318. #else
  319. int ldap_option;
  320. char *ldap_ca = conn->ssl_config.CAfile;
  321. #if defined(CURL_HAS_NOVELL_LDAPSDK)
  322. rc = ldapssl_client_init(NULL, NULL);
  323. if(rc != LDAP_SUCCESS) {
  324. failf(data, "LDAP local: ldapssl_client_init %s", ldap_err2string(rc));
  325. result = CURLE_SSL_CERTPROBLEM;
  326. goto quit;
  327. }
  328. if(conn->ssl_config.verifypeer) {
  329. /* Novell SDK supports DER or BASE64 files. */
  330. int cert_type = LDAPSSL_CERT_FILETYPE_B64;
  331. if((data->set.ssl.cert_type) &&
  332. (strcasecompare(data->set.ssl.cert_type, "DER")))
  333. cert_type = LDAPSSL_CERT_FILETYPE_DER;
  334. if(!ldap_ca) {
  335. failf(data, "LDAP local: ERROR %s CA cert not set",
  336. (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"));
  337. result = CURLE_SSL_CERTPROBLEM;
  338. goto quit;
  339. }
  340. infof(data, "LDAP local: using %s CA cert '%s'",
  341. (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
  342. ldap_ca);
  343. rc = ldapssl_add_trusted_cert(ldap_ca, cert_type);
  344. if(rc != LDAP_SUCCESS) {
  345. failf(data, "LDAP local: ERROR setting %s CA cert: %s",
  346. (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
  347. ldap_err2string(rc));
  348. result = CURLE_SSL_CERTPROBLEM;
  349. goto quit;
  350. }
  351. ldap_option = LDAPSSL_VERIFY_SERVER;
  352. }
  353. else
  354. ldap_option = LDAPSSL_VERIFY_NONE;
  355. rc = ldapssl_set_verify_mode(ldap_option);
  356. if(rc != LDAP_SUCCESS) {
  357. failf(data, "LDAP local: ERROR setting cert verify mode: %s",
  358. ldap_err2string(rc));
  359. result = CURLE_SSL_CERTPROBLEM;
  360. goto quit;
  361. }
  362. server = ldapssl_init(host, conn->port, 1);
  363. if(!server) {
  364. failf(data, "LDAP local: Cannot connect to %s:%u",
  365. conn->host.dispname, conn->port);
  366. result = CURLE_COULDNT_CONNECT;
  367. goto quit;
  368. }
  369. #elif defined(LDAP_OPT_X_TLS)
  370. if(conn->ssl_config.verifypeer) {
  371. /* OpenLDAP SDK supports BASE64 files. */
  372. if((data->set.ssl.cert_type) &&
  373. (!strcasecompare(data->set.ssl.cert_type, "PEM"))) {
  374. failf(data, "LDAP local: ERROR OpenLDAP only supports PEM cert-type");
  375. result = CURLE_SSL_CERTPROBLEM;
  376. goto quit;
  377. }
  378. if(!ldap_ca) {
  379. failf(data, "LDAP local: ERROR PEM CA cert not set");
  380. result = CURLE_SSL_CERTPROBLEM;
  381. goto quit;
  382. }
  383. infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
  384. rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
  385. if(rc != LDAP_SUCCESS) {
  386. failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
  387. ldap_err2string(rc));
  388. result = CURLE_SSL_CERTPROBLEM;
  389. goto quit;
  390. }
  391. ldap_option = LDAP_OPT_X_TLS_DEMAND;
  392. }
  393. else
  394. ldap_option = LDAP_OPT_X_TLS_NEVER;
  395. rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
  396. if(rc != LDAP_SUCCESS) {
  397. failf(data, "LDAP local: ERROR setting cert verify mode: %s",
  398. ldap_err2string(rc));
  399. result = CURLE_SSL_CERTPROBLEM;
  400. goto quit;
  401. }
  402. server = ldap_init(host, conn->port);
  403. if(!server) {
  404. failf(data, "LDAP local: Cannot connect to %s:%u",
  405. conn->host.dispname, conn->port);
  406. result = CURLE_COULDNT_CONNECT;
  407. goto quit;
  408. }
  409. ldap_option = LDAP_OPT_X_TLS_HARD;
  410. rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
  411. if(rc != LDAP_SUCCESS) {
  412. failf(data, "LDAP local: ERROR setting SSL/TLS mode: %s",
  413. ldap_err2string(rc));
  414. result = CURLE_SSL_CERTPROBLEM;
  415. goto quit;
  416. }
  417. /*
  418. rc = ldap_start_tls_s(server, NULL, NULL);
  419. if(rc != LDAP_SUCCESS) {
  420. failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
  421. ldap_err2string(rc));
  422. result = CURLE_SSL_CERTPROBLEM;
  423. goto quit;
  424. }
  425. */
  426. #else
  427. /* we should probably never come up to here since configure
  428. should check in first place if we can support LDAP SSL/TLS */
  429. failf(data, "LDAP local: SSL/TLS not supported with this version "
  430. "of the OpenLDAP toolkit\n");
  431. result = CURLE_SSL_CERTPROBLEM;
  432. goto quit;
  433. #endif
  434. #endif
  435. #endif /* CURL_LDAP_USE_SSL */
  436. }
  437. else if(data->set.use_ssl > CURLUSESSL_TRY) {
  438. failf(data, "LDAP local: explicit TLS not supported");
  439. result = CURLE_NOT_BUILT_IN;
  440. goto quit;
  441. }
  442. else {
  443. server = ldap_init(host, conn->port);
  444. if(!server) {
  445. failf(data, "LDAP local: Cannot connect to %s:%u",
  446. conn->host.dispname, conn->port);
  447. result = CURLE_COULDNT_CONNECT;
  448. goto quit;
  449. }
  450. }
  451. #ifdef USE_WIN32_LDAP
  452. ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
  453. rc = ldap_win_bind(data, server, user, passwd);
  454. #else
  455. rc = ldap_simple_bind_s(server, user, passwd);
  456. #endif
  457. if(!ldap_ssl && rc) {
  458. ldap_proto = LDAP_VERSION2;
  459. ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
  460. #ifdef USE_WIN32_LDAP
  461. rc = ldap_win_bind(data, server, user, passwd);
  462. #else
  463. rc = ldap_simple_bind_s(server, user, passwd);
  464. #endif
  465. }
  466. if(rc) {
  467. #ifdef USE_WIN32_LDAP
  468. failf(data, "LDAP local: bind via ldap_win_bind %s",
  469. ldap_err2string(rc));
  470. #else
  471. failf(data, "LDAP local: bind via ldap_simple_bind_s %s",
  472. ldap_err2string(rc));
  473. #endif
  474. result = CURLE_LDAP_CANNOT_BIND;
  475. goto quit;
  476. }
  477. rc = ldap_search_s(server, ludp->lud_dn, ludp->lud_scope,
  478. ludp->lud_filter, ludp->lud_attrs, 0, &ldapmsg);
  479. if(rc && rc != LDAP_SIZELIMIT_EXCEEDED) {
  480. failf(data, "LDAP remote: %s", ldap_err2string(rc));
  481. result = CURLE_LDAP_SEARCH_FAILED;
  482. goto quit;
  483. }
  484. for(num = 0, entryIterator = ldap_first_entry(server, ldapmsg);
  485. entryIterator;
  486. entryIterator = ldap_next_entry(server, entryIterator), num++) {
  487. BerElement *ber = NULL;
  488. #if defined(USE_WIN32_LDAP)
  489. TCHAR *attribute;
  490. #else
  491. char *attribute;
  492. #endif
  493. int i;
  494. /* Get the DN and write it to the client */
  495. {
  496. char *name;
  497. size_t name_len;
  498. #if defined(USE_WIN32_LDAP)
  499. TCHAR *dn = ldap_get_dn(server, entryIterator);
  500. name = curlx_convert_tchar_to_UTF8(dn);
  501. if(!name) {
  502. ldap_memfree(dn);
  503. result = CURLE_OUT_OF_MEMORY;
  504. goto quit;
  505. }
  506. #else
  507. char *dn = name = ldap_get_dn(server, entryIterator);
  508. #endif
  509. name_len = strlen(name);
  510. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"DN: ", 4);
  511. if(result) {
  512. FREE_ON_WINLDAP(name);
  513. ldap_memfree(dn);
  514. goto quit;
  515. }
  516. result = Curl_client_write(data, CLIENTWRITE_BODY, name, name_len);
  517. if(result) {
  518. FREE_ON_WINLDAP(name);
  519. ldap_memfree(dn);
  520. goto quit;
  521. }
  522. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
  523. if(result) {
  524. FREE_ON_WINLDAP(name);
  525. ldap_memfree(dn);
  526. goto quit;
  527. }
  528. dlsize += name_len + 5;
  529. FREE_ON_WINLDAP(name);
  530. ldap_memfree(dn);
  531. }
  532. /* Get the attributes and write them to the client */
  533. for(attribute = ldap_first_attribute(server, entryIterator, &ber);
  534. attribute;
  535. attribute = ldap_next_attribute(server, entryIterator, ber)) {
  536. BerValue **vals;
  537. size_t attr_len;
  538. #if defined(USE_WIN32_LDAP)
  539. char *attr = curlx_convert_tchar_to_UTF8(attribute);
  540. if(!attr) {
  541. if(ber)
  542. ber_free(ber, 0);
  543. result = CURLE_OUT_OF_MEMORY;
  544. goto quit;
  545. }
  546. #else
  547. char *attr = attribute;
  548. #endif
  549. attr_len = strlen(attr);
  550. vals = ldap_get_values_len(server, entryIterator, attribute);
  551. if(vals) {
  552. for(i = 0; (vals[i] != NULL); i++) {
  553. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\t", 1);
  554. if(result) {
  555. ldap_value_free_len(vals);
  556. FREE_ON_WINLDAP(attr);
  557. ldap_memfree(attribute);
  558. if(ber)
  559. ber_free(ber, 0);
  560. goto quit;
  561. }
  562. result = Curl_client_write(data, CLIENTWRITE_BODY, attr, attr_len);
  563. if(result) {
  564. ldap_value_free_len(vals);
  565. FREE_ON_WINLDAP(attr);
  566. ldap_memfree(attribute);
  567. if(ber)
  568. ber_free(ber, 0);
  569. goto quit;
  570. }
  571. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)": ", 2);
  572. if(result) {
  573. ldap_value_free_len(vals);
  574. FREE_ON_WINLDAP(attr);
  575. ldap_memfree(attribute);
  576. if(ber)
  577. ber_free(ber, 0);
  578. goto quit;
  579. }
  580. dlsize += attr_len + 3;
  581. if((attr_len > 7) &&
  582. (strcmp(";binary", attr + (attr_len - 7)) == 0)) {
  583. /* Binary attribute, encode to base64. */
  584. result = Curl_base64_encode(vals[i]->bv_val, vals[i]->bv_len,
  585. &val_b64, &val_b64_sz);
  586. if(result) {
  587. ldap_value_free_len(vals);
  588. FREE_ON_WINLDAP(attr);
  589. ldap_memfree(attribute);
  590. if(ber)
  591. ber_free(ber, 0);
  592. goto quit;
  593. }
  594. if(val_b64_sz > 0) {
  595. result = Curl_client_write(data, CLIENTWRITE_BODY, val_b64,
  596. val_b64_sz);
  597. free(val_b64);
  598. if(result) {
  599. ldap_value_free_len(vals);
  600. FREE_ON_WINLDAP(attr);
  601. ldap_memfree(attribute);
  602. if(ber)
  603. ber_free(ber, 0);
  604. goto quit;
  605. }
  606. dlsize += val_b64_sz;
  607. }
  608. }
  609. else {
  610. result = Curl_client_write(data, CLIENTWRITE_BODY, vals[i]->bv_val,
  611. vals[i]->bv_len);
  612. if(result) {
  613. ldap_value_free_len(vals);
  614. FREE_ON_WINLDAP(attr);
  615. ldap_memfree(attribute);
  616. if(ber)
  617. ber_free(ber, 0);
  618. goto quit;
  619. }
  620. dlsize += vals[i]->bv_len;
  621. }
  622. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
  623. if(result) {
  624. ldap_value_free_len(vals);
  625. FREE_ON_WINLDAP(attr);
  626. ldap_memfree(attribute);
  627. if(ber)
  628. ber_free(ber, 0);
  629. goto quit;
  630. }
  631. dlsize++;
  632. }
  633. /* Free memory used to store values */
  634. ldap_value_free_len(vals);
  635. }
  636. /* Free the attribute as we are done with it */
  637. FREE_ON_WINLDAP(attr);
  638. ldap_memfree(attribute);
  639. result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
  640. if(result)
  641. goto quit;
  642. dlsize++;
  643. Curl_pgrsSetDownloadCounter(data, dlsize);
  644. }
  645. if(ber)
  646. ber_free(ber, 0);
  647. }
  648. quit:
  649. if(ldapmsg) {
  650. ldap_msgfree(ldapmsg);
  651. LDAP_TRACE(("Received %d entries\n", num));
  652. }
  653. if(rc == LDAP_SIZELIMIT_EXCEEDED)
  654. infof(data, "There are more than %d entries", num);
  655. if(ludp)
  656. ldap_free_urldesc(ludp);
  657. if(server)
  658. ldap_unbind_s(server);
  659. #if defined(HAVE_LDAP_SSL) && defined(CURL_HAS_NOVELL_LDAPSDK)
  660. if(ldap_ssl)
  661. ldapssl_client_deinit();
  662. #endif /* HAVE_LDAP_SSL && CURL_HAS_NOVELL_LDAPSDK */
  663. FREE_ON_WINLDAP(host);
  664. /* no data to transfer */
  665. Curl_setup_transfer(data, -1, -1, FALSE, -1);
  666. connclose(conn, "LDAP connection always disable re-use");
  667. return result;
  668. }
  669. #ifdef DEBUG_LDAP
  670. static void _ldap_trace(const char *fmt, ...)
  671. {
  672. static int do_trace = -1;
  673. va_list args;
  674. if(do_trace == -1) {
  675. const char *env = getenv("CURL_TRACE");
  676. do_trace = (env && strtol(env, NULL, 10) > 0);
  677. }
  678. if(!do_trace)
  679. return;
  680. va_start(args, fmt);
  681. vfprintf(stderr, fmt, args);
  682. va_end(args);
  683. }
  684. #endif
  685. #ifndef HAVE_LDAP_URL_PARSE
  686. /*
  687. * Return scope-value for a scope-string.
  688. */
  689. static int str2scope(const char *p)
  690. {
  691. if(strcasecompare(p, "one"))
  692. return LDAP_SCOPE_ONELEVEL;
  693. if(strcasecompare(p, "onetree"))
  694. return LDAP_SCOPE_ONELEVEL;
  695. if(strcasecompare(p, "base"))
  696. return LDAP_SCOPE_BASE;
  697. if(strcasecompare(p, "sub"))
  698. return LDAP_SCOPE_SUBTREE;
  699. if(strcasecompare(p, "subtree"))
  700. return LDAP_SCOPE_SUBTREE;
  701. return (-1);
  702. }
  703. /*
  704. * Split 'str' into strings separated by commas.
  705. * Note: out[] points into 'str'.
  706. */
  707. static bool split_str(char *str, char ***out, size_t *count)
  708. {
  709. char **res;
  710. char *lasts;
  711. char *s;
  712. size_t i;
  713. size_t items = 1;
  714. s = strchr(str, ',');
  715. while(s) {
  716. items++;
  717. s = strchr(++s, ',');
  718. }
  719. res = calloc(items, sizeof(char *));
  720. if(!res)
  721. return FALSE;
  722. for(i = 0, s = strtok_r(str, ",", &lasts); s && i < items;
  723. s = strtok_r(NULL, ",", &lasts), i++)
  724. res[i] = s;
  725. *out = res;
  726. *count = items;
  727. return TRUE;
  728. }
  729. /*
  730. * Break apart the pieces of an LDAP URL.
  731. * Syntax:
  732. * ldap://<hostname>:<port>/<base_dn>?<attributes>?<scope>?<filter>?<ext>
  733. *
  734. * <hostname> already known from 'conn->host.name'.
  735. * <port> already known from 'conn->remote_port'.
  736. * extract the rest from 'data->state.path+1'. All fields are optional.
  737. * e.g.
  738. * ldap://<hostname>:<port>/?<attributes>?<scope>?<filter>
  739. * yields ludp->lud_dn = "".
  740. *
  741. * Defined in RFC4516 section 2.
  742. */
  743. static int _ldap_url_parse2(struct Curl_easy *data,
  744. const struct connectdata *conn, LDAPURLDesc *ludp)
  745. {
  746. int rc = LDAP_SUCCESS;
  747. char *p;
  748. char *path;
  749. char *q = NULL;
  750. char *query = NULL;
  751. size_t i;
  752. if(!data ||
  753. !data->state.up.path ||
  754. data->state.up.path[0] != '/' ||
  755. !strncasecompare("LDAP", data->state.up.scheme, 4))
  756. return LDAP_INVALID_SYNTAX;
  757. ludp->lud_scope = LDAP_SCOPE_BASE;
  758. ludp->lud_port = conn->remote_port;
  759. ludp->lud_host = conn->host.name;
  760. /* Duplicate the path */
  761. p = path = strdup(data->state.up.path + 1);
  762. if(!path)
  763. return LDAP_NO_MEMORY;
  764. /* Duplicate the query if present */
  765. if(data->state.up.query) {
  766. q = query = strdup(data->state.up.query);
  767. if(!query) {
  768. free(path);
  769. return LDAP_NO_MEMORY;
  770. }
  771. }
  772. /* Parse the DN (Distinguished Name) */
  773. if(*p) {
  774. char *dn = p;
  775. char *unescaped;
  776. CURLcode result;
  777. LDAP_TRACE(("DN '%s'\n", dn));
  778. /* Unescape the DN */
  779. result = Curl_urldecode(dn, 0, &unescaped, NULL, REJECT_ZERO);
  780. if(result) {
  781. rc = LDAP_NO_MEMORY;
  782. goto quit;
  783. }
  784. #if defined(USE_WIN32_LDAP)
  785. /* Convert the unescaped string to a tchar */
  786. ludp->lud_dn = curlx_convert_UTF8_to_tchar(unescaped);
  787. /* Free the unescaped string as we are done with it */
  788. free(unescaped);
  789. if(!ludp->lud_dn) {
  790. rc = LDAP_NO_MEMORY;
  791. goto quit;
  792. }
  793. #else
  794. ludp->lud_dn = unescaped;
  795. #endif
  796. }
  797. p = q;
  798. if(!p)
  799. goto quit;
  800. /* Parse the attributes. skip "??" */
  801. q = strchr(p, '?');
  802. if(q)
  803. *q++ = '\0';
  804. if(*p) {
  805. char **attributes;
  806. size_t count = 0;
  807. /* Split the string into an array of attributes */
  808. if(!split_str(p, &attributes, &count)) {
  809. rc = LDAP_NO_MEMORY;
  810. goto quit;
  811. }
  812. /* Allocate our array (+1 for the NULL entry) */
  813. #if defined(USE_WIN32_LDAP)
  814. ludp->lud_attrs = calloc(count + 1, sizeof(TCHAR *));
  815. #else
  816. ludp->lud_attrs = calloc(count + 1, sizeof(char *));
  817. #endif
  818. if(!ludp->lud_attrs) {
  819. free(attributes);
  820. rc = LDAP_NO_MEMORY;
  821. goto quit;
  822. }
  823. for(i = 0; i < count; i++) {
  824. char *unescaped;
  825. CURLcode result;
  826. LDAP_TRACE(("attr[%zu] '%s'\n", i, attributes[i]));
  827. /* Unescape the attribute */
  828. result = Curl_urldecode(attributes[i], 0, &unescaped, NULL,
  829. REJECT_ZERO);
  830. if(result) {
  831. free(attributes);
  832. rc = LDAP_NO_MEMORY;
  833. goto quit;
  834. }
  835. #if defined(USE_WIN32_LDAP)
  836. /* Convert the unescaped string to a tchar */
  837. ludp->lud_attrs[i] = curlx_convert_UTF8_to_tchar(unescaped);
  838. /* Free the unescaped string as we are done with it */
  839. free(unescaped);
  840. if(!ludp->lud_attrs[i]) {
  841. free(attributes);
  842. rc = LDAP_NO_MEMORY;
  843. goto quit;
  844. }
  845. #else
  846. ludp->lud_attrs[i] = unescaped;
  847. #endif
  848. ludp->lud_attrs_dups++;
  849. }
  850. free(attributes);
  851. }
  852. p = q;
  853. if(!p)
  854. goto quit;
  855. /* Parse the scope. skip "??" */
  856. q = strchr(p, '?');
  857. if(q)
  858. *q++ = '\0';
  859. if(*p) {
  860. ludp->lud_scope = str2scope(p);
  861. if(ludp->lud_scope == -1) {
  862. rc = LDAP_INVALID_SYNTAX;
  863. goto quit;
  864. }
  865. LDAP_TRACE(("scope %d\n", ludp->lud_scope));
  866. }
  867. p = q;
  868. if(!p)
  869. goto quit;
  870. /* Parse the filter */
  871. q = strchr(p, '?');
  872. if(q)
  873. *q++ = '\0';
  874. if(*p) {
  875. char *filter = p;
  876. char *unescaped;
  877. CURLcode result;
  878. LDAP_TRACE(("filter '%s'\n", filter));
  879. /* Unescape the filter */
  880. result = Curl_urldecode(filter, 0, &unescaped, NULL, REJECT_ZERO);
  881. if(result) {
  882. rc = LDAP_NO_MEMORY;
  883. goto quit;
  884. }
  885. #if defined(USE_WIN32_LDAP)
  886. /* Convert the unescaped string to a tchar */
  887. ludp->lud_filter = curlx_convert_UTF8_to_tchar(unescaped);
  888. /* Free the unescaped string as we are done with it */
  889. free(unescaped);
  890. if(!ludp->lud_filter) {
  891. rc = LDAP_NO_MEMORY;
  892. goto quit;
  893. }
  894. #else
  895. ludp->lud_filter = unescaped;
  896. #endif
  897. }
  898. p = q;
  899. if(p && !*p) {
  900. rc = LDAP_INVALID_SYNTAX;
  901. goto quit;
  902. }
  903. quit:
  904. free(path);
  905. free(query);
  906. return rc;
  907. }
  908. static int _ldap_url_parse(struct Curl_easy *data,
  909. const struct connectdata *conn,
  910. LDAPURLDesc **ludpp)
  911. {
  912. LDAPURLDesc *ludp = calloc(1, sizeof(*ludp));
  913. int rc;
  914. *ludpp = NULL;
  915. if(!ludp)
  916. return LDAP_NO_MEMORY;
  917. rc = _ldap_url_parse2(data, conn, ludp);
  918. if(rc != LDAP_SUCCESS) {
  919. _ldap_free_urldesc(ludp);
  920. ludp = NULL;
  921. }
  922. *ludpp = ludp;
  923. return (rc);
  924. }
  925. static void _ldap_free_urldesc(LDAPURLDesc *ludp)
  926. {
  927. if(!ludp)
  928. return;
  929. #if defined(USE_WIN32_LDAP)
  930. curlx_unicodefree(ludp->lud_dn);
  931. curlx_unicodefree(ludp->lud_filter);
  932. #else
  933. free(ludp->lud_dn);
  934. free(ludp->lud_filter);
  935. #endif
  936. if(ludp->lud_attrs) {
  937. size_t i;
  938. for(i = 0; i < ludp->lud_attrs_dups; i++) {
  939. #if defined(USE_WIN32_LDAP)
  940. curlx_unicodefree(ludp->lud_attrs[i]);
  941. #else
  942. free(ludp->lud_attrs[i]);
  943. #endif
  944. }
  945. free(ludp->lud_attrs);
  946. }
  947. free(ludp);
  948. }
  949. #endif /* !HAVE_LDAP_URL_PARSE */
  950. #endif /* !CURL_DISABLE_LDAP && !USE_OPENLDAP */