965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

08d6658a4e2ec8104cd1307f6baa75fdb07a24f8Mark Washenberger#include "auth-common.h"

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

44fc0a34c39f1ddb3a776918630010867a5dd04eTimo Sirainen#if defined(BUILTIN_LDAP) || defined(PLUGIN_BUILD)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

7d6389e4053c2dac1fb37180b5756b00785983dcTimo Sirainen#include "network.h"

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen#include "ioloop.h"

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen#include "array.h"

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen#include "hash.h"

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen#include "aqueue.h"

d1f0acc7fc722e13e8296228703adfe8a884d59eTimo Sirainen#include "str.h"

f8464772990b52cb8de4553bc1135adcf72813b8Timo Sirainen#include "env-util.h"

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen#include "var-expand.h"

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen#include "settings.h"

e714eed72515794c46c6712a611e5ab924d903daTimo Sirainen#include "userdb.h"

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen#include "db-ldap.h"

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen#include <stddef.h>

0cb57ee35d4cab9c03434d7abf312c081ed554d4Timo Sirainen#include <stdlib.h>

d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen#include <unistd.h>

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen#define HAVE_LDAP_SASL

d8c2d988a913d1aae9abf2dd50c611c87d81d72aTimo Sirainen#ifdef HAVE_SASL_SASL_H

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen# include <sasl/sasl.h>

d8c2d988a913d1aae9abf2dd50c611c87d81d72aTimo Sirainen#elif defined (HAVE_SASL_H)

d8c2d988a913d1aae9abf2dd50c611c87d81d72aTimo Sirainen# include <sasl.h>

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen#else

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen# undef HAVE_LDAP_SASL

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen#endif

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen#ifdef LDAP_OPT_X_TLS

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen# define OPENLDAP_TLS_OPTIONS

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen#endif

d8c2d988a913d1aae9abf2dd50c611c87d81d72aTimo Sirainen#if SASL_VERSION_MAJOR < 2

d8c2d988a913d1aae9abf2dd50c611c87d81d72aTimo Sirainen# undef HAVE_LDAP_SASL

d8c2d988a913d1aae9abf2dd50c611c87d81d72aTimo Sirainen#endif

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen

594d203bdcbd160688bce5d5a6d65783b919ad49Timo Sirainen#ifndef LDAP_SASL_QUIET

594d203bdcbd160688bce5d5a6d65783b919ad49Timo Sirainen# define LDAP_SASL_QUIET 0 /* Doesn't exist in Solaris LDAP */

594d203bdcbd160688bce5d5a6d65783b919ad49Timo Sirainen#endif

594d203bdcbd160688bce5d5a6d65783b919ad49Timo Sirainen

a8fc29f19ea6e2d472ba779b2dd5ca4e1f3dac79Timo Sirainen#if LDAP_VENDOR_VERSION <= 20112

3e1ded79bbc9166aa221bcf62d8eb2bee179c557Timo Sirainen# define OPENLDAP_ASYNC_WORKAROUND

3e1ded79bbc9166aa221bcf62d8eb2bee179c557Timo Sirainen#endif

3e1ded79bbc9166aa221bcf62d8eb2bee179c557Timo Sirainen

48559742084e98049335c21c53dfd1ff95f11cd8Timo Sirainen#ifndef LDAP_OPT_SUCCESS

48559742084e98049335c21c53dfd1ff95f11cd8Timo Sirainen# define LDAP_OPT_SUCCESS LDAP_SUCCESS

48559742084e98049335c21c53dfd1ff95f11cd8Timo Sirainen#endif

48559742084e98049335c21c53dfd1ff95f11cd8Timo Sirainen

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainenstruct db_ldap_value {

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen const char **values;

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen bool used;

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen};

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainenstruct db_ldap_result_iterate_context {

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen pool_t pool;

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen struct auth_request *auth_request;

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen const ARRAY_TYPE(ldap_field) *attr_map;

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen unsigned int attr_idx;

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen /* ldap_attr_name => struct db_ldap_value */

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen struct hash_table *ldap_attrs;

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen struct var_expand_table *var_table;

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen const char *val_1_arr[2];

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen string_t *var, *debug;

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen};

4261a8b43792dc4db4b39e6910319835b7450e84Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstruct db_ldap_sasl_bind_context {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen const char *authcid;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen const char *passwd;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen const char *realm;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen const char *authzid;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen};

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen#define DEF_STR(name) DEF_STRUCT_STR(name, ldap_settings)

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen#define DEF_INT(name) DEF_STRUCT_INT(name, ldap_settings)

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen#define DEF_BOOL(name) DEF_STRUCT_BOOL(name, ldap_settings)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainenstatic struct setting_def setting_defs[] = {

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(hosts),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(uris),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(dn),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(dnpass),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_BOOL(auth_bind),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(auth_bind_userdn),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_BOOL(tls),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_BOOL(sasl_bind),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(sasl_mech),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(sasl_realm),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(sasl_authz_id),

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen DEF_STR(tls_ca_cert_file),

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen DEF_STR(tls_ca_cert_dir),

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen DEF_STR(tls_cert_file),

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen DEF_STR(tls_key_file),

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen DEF_STR(tls_cipher_suite),

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen DEF_STR(tls_require_cert),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(deref),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(scope),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(base),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_INT(ldap_version),

f4a19b0cf11cdff437571708d9d788d02a906a00Timo Sirainen DEF_STR(debug_level),

f8464772990b52cb8de4553bc1135adcf72813b8Timo Sirainen DEF_STR(ldaprc_path),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(user_attrs),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(user_filter),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(pass_attrs),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(pass_filter),

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen DEF_STR(iterate_attrs),

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen DEF_STR(iterate_filter),

a84eb0599fa1d796206eaed65c4e3239f0799276Timo Sirainen DEF_STR(default_pass_scheme),

964c86de7158ccafdfe665853579d71232e2634eTimo Sirainen DEF_BOOL(userdb_warning_disable),

e25885d4c7c4b392c66bbf26a9b892362d90f001Timo Sirainen

e25885d4c7c4b392c66bbf26a9b892362d90f001Timo Sirainen { 0, NULL, 0 }

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen};

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

ab0d9eecd85f74acae18fe88529302e0776cc500Timo Sirainenstatic struct ldap_settings default_ldap_settings = {

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .hosts = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .uris = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .dn = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .dnpass = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .auth_bind = FALSE,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .auth_bind_userdn = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls = FALSE,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .sasl_bind = FALSE,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .sasl_mech = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .sasl_realm = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .sasl_authz_id = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls_ca_cert_file = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls_ca_cert_dir = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls_cert_file = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls_key_file = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls_cipher_suite = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .tls_require_cert = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .deref = "never",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .scope = "subtree",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .base = NULL,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .ldap_version = 3,

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .debug_level = "0",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .ldaprc_path = "",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .user_attrs = "homeDirectory=home,uidNumber=uid,gidNumber=gid",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .user_filter = "(&(objectClass=posixAccount)(uid=%u))",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .pass_attrs = "uid=user,userPassword=password",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .pass_filter = "(&(objectClass=posixAccount)(uid=%u))",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .iterate_attrs = "uid=user",

7bafda1813454621e03615e83d55bccfa7cc56bdTimo Sirainen .iterate_filter = "(objectClass=posixAccount)",

964c86de7158ccafdfe665853579d71232e2634eTimo Sirainen .default_pass_scheme = "crypt",

964c86de7158ccafdfe665853579d71232e2634eTimo Sirainen .userdb_warning_disable = FALSE

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen};

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

c4457e497e01b57565d24da624968699b166e02aTimo Sirainenstatic struct ldap_connection *ldap_connections = NULL;

c4457e497e01b57565d24da624968699b166e02aTimo Sirainen

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainenstatic int db_ldap_bind(struct ldap_connection *conn);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic void db_ldap_conn_close(struct ldap_connection *conn);

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainenstatic int deref2str(const char *str)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen{

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen if (strcasecmp(str, "never") == 0)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen return LDAP_DEREF_NEVER;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen if (strcasecmp(str, "searching") == 0)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen return LDAP_DEREF_SEARCHING;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen if (strcasecmp(str, "finding") == 0)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen return LDAP_DEREF_FINDING;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen if (strcasecmp(str, "always") == 0)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen return LDAP_DEREF_ALWAYS;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen i_fatal("LDAP: Unknown deref option '%s'", str);

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen}

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainenstatic int scope2str(const char *str)

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen{

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen if (strcasecmp(str, "base") == 0)

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen return LDAP_SCOPE_BASE;

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen if (strcasecmp(str, "onelevel") == 0)

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen return LDAP_SCOPE_ONELEVEL;

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen if (strcasecmp(str, "subtree") == 0)

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen return LDAP_SCOPE_SUBTREE;

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen i_fatal("LDAP: Unknown scope option '%s'", str);

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen}

e82af44fe25ca9b88210f313548dc08538e4a677Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen#ifdef OPENLDAP_TLS_OPTIONS

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainenstatic int tls_require_cert2str(const char *str)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen{

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (strcasecmp(str, "never") == 0)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen return LDAP_OPT_X_TLS_NEVER;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (strcasecmp(str, "hard") == 0)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen return LDAP_OPT_X_TLS_HARD;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (strcasecmp(str, "demand") == 0)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen return LDAP_OPT_X_TLS_DEMAND;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (strcasecmp(str, "allow") == 0)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen return LDAP_OPT_X_TLS_ALLOW;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (strcasecmp(str, "try") == 0)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen return LDAP_OPT_X_TLS_TRY;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen i_fatal("LDAP: Unknown tls_require_cert value '%s'", str);

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen}

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen#endif

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen

78361883c67c58e339697c167ca285731f50287bTimo Sirainenstatic int ldap_get_errno(struct ldap_connection *conn)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen{

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen int ret, err;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen ret = ldap_get_option(conn->ld, LDAP_OPT_ERROR_NUMBER, (void *) &err);

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen if (ret != LDAP_SUCCESS) {

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen i_error("LDAP: Can't get error number: %s",

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen ldap_err2string(ret));

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen return LDAP_UNAVAILABLE;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen }

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

78361883c67c58e339697c167ca285731f50287bTimo Sirainen return err;

78361883c67c58e339697c167ca285731f50287bTimo Sirainen}

78361883c67c58e339697c167ca285731f50287bTimo Sirainen

78361883c67c58e339697c167ca285731f50287bTimo Sirainenconst char *ldap_get_error(struct ldap_connection *conn)

78361883c67c58e339697c167ca285731f50287bTimo Sirainen{

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen const char *ret;

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen char *str = NULL;

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen ret = ldap_err2string(ldap_get_errno(conn));

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen ldap_get_option(conn->ld, LDAP_OPT_ERROR_STRING, (void *)&str);

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen if (str != NULL) {

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen ret = t_strconcat(ret, ", ", str, NULL);

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen ldap_memfree(str);

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen }

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen ldap_set_option(conn->ld, LDAP_OPT_ERROR_STRING, NULL);

c184857e1fc86878761f6e47896c9cc1fad2d666Timo Sirainen return ret;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen}

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainenstatic void ldap_conn_reconnect(struct ldap_connection *conn)

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_conn_close(conn);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (db_ldap_connect(conn) < 0)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_conn_close(conn);

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen}

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic int ldap_handle_error(struct ldap_connection *conn)

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen{

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen int err = ldap_get_errno(conn);

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen switch (err) {

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_SUCCESS:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen i_unreached();

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_SIZELIMIT_EXCEEDED:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_TIMELIMIT_EXCEEDED:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_NO_SUCH_ATTRIBUTE:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_UNDEFINED_TYPE:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_INAPPROPRIATE_MATCHING:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_CONSTRAINT_VIOLATION:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_TYPE_OR_VALUE_EXISTS:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_INVALID_SYNTAX:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_NO_SUCH_OBJECT:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_ALIAS_PROBLEM:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_INVALID_DN_SYNTAX:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_IS_LEAF:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_ALIAS_DEREF_PROBLEM:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_FILTER_ERROR:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen /* invalid input */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return -1;

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_SERVER_DOWN:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_TIMEOUT:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_UNAVAILABLE:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_BUSY:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen#ifdef LDAP_CONNECT_ERROR

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_CONNECT_ERROR:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen#endif

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_LOCAL_ERROR:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen case LDAP_INVALID_CREDENTIALS:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen default:

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen /* connection problems */

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen ldap_conn_reconnect(conn);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return 0;

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen }

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen}

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic int db_ldap_request_bind(struct ldap_connection *conn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request *request)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request_bind *brequest =

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen (struct ldap_request_bind *)request;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(request->type == LDAP_REQUEST_TYPE_BIND);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(request->msgid == -1);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->conn_state == LDAP_CONN_STATE_BOUND_AUTH ||

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->conn_state == LDAP_CONN_STATE_BOUND_DEFAULT);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->pending_count == 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->msgid = ldap_bind(conn->ld, brequest->dn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->auth_request->mech_password,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen LDAP_AUTH_SIMPLE);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (request->msgid == -1) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen auth_request_log_error(request->auth_request, "ldap",

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen "ldap_bind(%s) failed: %s",

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen brequest->dn, ldap_get_error(conn));

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (ldap_handle_error(conn) < 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* broken request, remove it */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return 0;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return -1;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->conn_state = LDAP_CONN_STATE_BINDING;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return 1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen}

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic int db_ldap_request_search(struct ldap_connection *conn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request *request)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request_search *srequest =

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen (struct ldap_request_search *)request;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->conn_state == LDAP_CONN_STATE_BOUND_DEFAULT);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(request->msgid == -1);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->msgid =

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ldap_search(conn->ld, srequest->base, conn->set.ldap_scope,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen srequest->filter, srequest->attributes, 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (request->msgid == -1) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen auth_request_log_error(request->auth_request, "ldap",

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen "ldap_search(%s) parsing failed: %s",

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen srequest->filter, ldap_get_error(conn));

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (ldap_handle_error(conn) < 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* broken request, remove it */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return 0;

1a59321a1116f9819e7b2899379a44de339ce802Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return -1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return 1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen}

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic bool db_ldap_request_queue_next(struct ldap_connection *conn)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request *const *requestp, *request;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen int ret = -1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

89676692402d8a58415b2c11256652322091ebabTimo Sirainen /* connecting may call db_ldap_connect_finish(), which gets us back

89676692402d8a58415b2c11256652322091ebabTimo Sirainen if (db_ldap_connect(conn) < 0)

89676692402d8a58415b2c11256652322091ebabTimo Sirainen return FALSE;

d779da03fd24e13b0c6fbfa9a93ad0e4132c9f47Timo Sirainen

42ec694fb0f2e1fb1d8afcfb441382daea487bd9Timo Sirainen if (conn->pending_count == aqueue_count(conn->request_queue)) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* no non-pending requests */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return FALSE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

42ec694fb0f2e1fb1d8afcfb441382daea487bd9Timo Sirainen if (conn->pending_count > DB_LDAP_MAX_PENDING_REQUESTS) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* wait until server has replied to some requests */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return FALSE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

1a59321a1116f9819e7b2899379a44de339ce802Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen requestp = array_idx(&conn->request_array,

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen aqueue_idx(conn->request_queue,

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen conn->pending_count));

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request = *requestp;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (conn->pending_count > 0 &&

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->type == LDAP_REQUEST_TYPE_BIND) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* we can't do binds until all existing requests are finished */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return FALSE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen switch (conn->conn_state) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen case LDAP_CONN_STATE_DISCONNECTED:

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen case LDAP_CONN_STATE_BINDING:

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* wait until we're in bound state */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return FALSE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen case LDAP_CONN_STATE_BOUND_AUTH:

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (request->type == LDAP_REQUEST_TYPE_BIND)

0c822051bb9a910ee588fd97f7ec6f9df3d1b3c6Timo Sirainen break;

0c822051bb9a910ee588fd97f7ec6f9df3d1b3c6Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* bind to default dn first */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->pending_count == 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen (void)db_ldap_bind(conn);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return FALSE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen case LDAP_CONN_STATE_BOUND_DEFAULT:

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* we can do anything in this state */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen break;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen switch (request->type) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen case LDAP_REQUEST_TYPE_BIND:

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ret = db_ldap_request_bind(conn, request);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen break;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen case LDAP_REQUEST_TYPE_SEARCH:

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ret = db_ldap_request_search(conn, request);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen break;

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen }

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (ret > 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* success */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(request->msgid != -1);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->pending_count++;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return TRUE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen } else if (ret < 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* disconnected */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return FALSE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen } else {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* broken request, remove from queue */

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen aqueue_delete_tail(conn->request_queue);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->callback(conn, request, NULL);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return TRUE;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen}

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainenstatic bool

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainendb_ldap_check_limits(struct ldap_connection *conn, struct ldap_request *request)

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen{

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen struct ldap_request *const *first_requestp;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen unsigned int count;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen time_t secs_diff;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen count = aqueue_count(conn->request_queue);

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen if (count == 0)

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen return TRUE;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen first_requestp = array_idx(&conn->request_array,

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen aqueue_idx(conn->request_queue, 0));

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen secs_diff = ioloop_time - (*first_requestp)->create_time;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen if (secs_diff > DB_LDAP_REQUEST_LOST_TIMEOUT_SECS) {

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen auth_request_log_error(request->auth_request, "ldap",

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen "Connection appears to be hanging, reconnecting");

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen ldap_conn_reconnect(conn);

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen return TRUE;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen }

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen return TRUE;

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen}

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenvoid db_ldap_request(struct ldap_connection *conn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request *request)

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen{

d95ef05d0c6ea5fdc8bc877dcf8f3b8fff6d8fb4Timo Sirainen i_assert(request->auth_request != NULL);

d95ef05d0c6ea5fdc8bc877dcf8f3b8fff6d8fb4Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->msgid = -1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->create_time = ioloop_time;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

584a5375b70caa8bf7b202248aea84092bcb9c22Timo Sirainen if (!db_ldap_check_limits(conn, request)) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->callback(conn, request, NULL);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen aqueue_append(conn->request_queue, &request);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen (void)db_ldap_request_queue_next(conn);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen}

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic int db_ldap_connect_finish(struct ldap_connection *conn, int ret)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (ret == LDAP_SERVER_DOWN) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_error("LDAP: Can't connect to server: %s",

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->set.uris != NULL ?

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->set.uris : conn->set.hosts);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return -1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (ret != LDAP_SUCCESS) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_error("LDAP: binding failed (dn %s): %s",

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->set.dn == NULL ? "(none)" : conn->set.dn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ldap_get_error(conn));

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return -1;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen if (conn->to != NULL)

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen timeout_remove(&conn->to);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->conn_state = LDAP_CONN_STATE_BOUND_DEFAULT;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen while (db_ldap_request_queue_next(conn))

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return 0;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen}

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic void db_ldap_default_bind_finished(struct ldap_connection *conn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen LDAPMessage *res)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen int ret;

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->pending_count == 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->default_bind_msgid = -1;

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ret = ldap_result2error(conn->ld, res, FALSE);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (db_ldap_connect_finish(conn, ret) < 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* lost connection, close it */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_conn_close(conn);

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen}

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainenstatic void db_ldap_abort_requests(struct ldap_connection *conn,

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen unsigned int max_count,

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen unsigned int timeout_secs,

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen bool error, const char *reason)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request *const *requestp, *request;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen time_t diff;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen while (aqueue_count(conn->request_queue) > 0 && max_count > 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen requestp = array_idx(&conn->request_array,

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen aqueue_idx(conn->request_queue, 0));

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request = *requestp;

e023e3c2677ab66d7a7445eae9caf3d739e199cbTimo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen diff = ioloop_time - request->create_time;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (diff < (time_t)timeout_secs)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen break;

e023e3c2677ab66d7a7445eae9caf3d739e199cbTimo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* timed out, abort */

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen aqueue_delete_tail(conn->request_queue);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (request->msgid != -1) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->pending_count > 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->pending_count--;

e023e3c2677ab66d7a7445eae9caf3d739e199cbTimo Sirainen }

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen if (error) {

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen auth_request_log_error(request->auth_request, "ldap",

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen "%s", reason);

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen } else {

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen auth_request_log_info(request->auth_request, "ldap",

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen "%s", reason);

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->callback(conn, request, NULL);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen max_count--;

e023e3c2677ab66d7a7445eae9caf3d739e199cbTimo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen}

e023e3c2677ab66d7a7445eae9caf3d739e199cbTimo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainenstatic struct ldap_request *

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainendb_ldap_find_request(struct ldap_connection *conn, int msgid,

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen unsigned int *idx_r)

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request *const *requests, *request = NULL;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen unsigned int i, count;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen count = aqueue_count(conn->request_queue);

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen if (count == 0)

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen return NULL;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen requests = array_idx(&conn->request_array, 0);

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen for (i = 0; i < count; i++) {

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen request = requests[aqueue_idx(conn->request_queue, i)];

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen if (request->msgid == msgid) {

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen *idx_r = i;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen return request;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen }

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen if (request->msgid == -1)

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen break;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen }

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen return NULL;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen}

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainenstatic void

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainendb_ldap_handle_result(struct ldap_connection *conn, LDAPMessage *res)

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen{

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen struct ldap_request *request;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen unsigned int idx;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen int msgid, ret;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen msgid = ldap_msgid(res);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (msgid == conn->default_bind_msgid) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_default_bind_finished(conn, res);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen }

e023e3c2677ab66d7a7445eae9caf3d739e199cbTimo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen request = db_ldap_find_request(conn, msgid, &idx);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (request == NULL) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_error("LDAP: Reply with unknown msgid %d", msgid);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen return;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen i_assert(conn->pending_count > 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (request->type == LDAP_REQUEST_TYPE_BIND) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->conn_state == LDAP_CONN_STATE_BINDING);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->pending_count == 1);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->conn_state = LDAP_CONN_STATE_BOUND_AUTH;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen } else {

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen switch (ldap_msgtype(res)) {

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen case LDAP_RES_SEARCH_ENTRY:

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen case LDAP_RES_SEARCH_RESULT:

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen break;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen case LDAP_RES_SEARCH_REFERENCE:

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen /* we're going to ignore this */

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen return;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen default:

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen i_error("LDAP: Reply with unexpected type %d",

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen ldap_msgtype(res));

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen return;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen }

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen }

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen if (ldap_msgtype(res) == LDAP_RES_SEARCH_ENTRY)

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen ret = LDAP_SUCCESS;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen else {

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen conn->pending_count--;

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen aqueue_delete(conn->request_queue, idx);

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen ret = ldap_result2error(conn->ld, res, 0);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen if (ret != LDAP_SUCCESS && request->type == LDAP_REQUEST_TYPE_SEARCH) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* handle search failures here */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct ldap_request_search *srequest =

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen (struct ldap_request_search *)request;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen auth_request_log_error(request->auth_request, "ldap",

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen "ldap_search(base=%s filter=%s) failed: %s",

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen srequest->base, srequest->filter,

0a8926b91a84abf462afdc1ed95def229377d7ffTimo Sirainen ldap_err2string(ret));

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen res = NULL;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen

19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen T_BEGIN {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen request->callback(conn, request, res);

19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen } T_END;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen if (idx > 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* see if there are timed out requests */

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen db_ldap_abort_requests(conn, idx,

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen DB_LDAP_REQUEST_LOST_TIMEOUT_SECS,

3cff7935d606a75357472a3e4269e0b06ac1bef2Timo Sirainen TRUE, "Request lost");

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen }

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen}

ed5e91e58dfc372c2135c55427bf6f25a7725042Timo Sirainen

2cfe9983ce7a6280636ee12beccc2e865111967bTimo Sirainenstatic void ldap_input(struct ldap_connection *conn)

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen{

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen struct timeval timeout;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen LDAPMessage *res;

c51fe409810cbb2432b72d6819bd183469fcaebcTimo Sirainen time_t prev_reply_diff;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen int ret;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen do {

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen if (conn->ld == NULL)

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen return;

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen memset(&timeout, 0, sizeof(timeout));

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen ret = ldap_result(conn->ld, LDAP_RES_ANY, 0, &timeout, &res);

7d6389e4053c2dac1fb37180b5756b00785983dcTimo Sirainen#ifdef OPENLDAP_ASYNC_WORKAROUND

a8fc29f19ea6e2d472ba779b2dd5ca4e1f3dac79Timo Sirainen if (ret == 0) {

a8fc29f19ea6e2d472ba779b2dd5ca4e1f3dac79Timo Sirainen /* try again, there may be another in buffer */

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen ret = ldap_result(conn->ld, LDAP_RES_ANY, 0,

a8fc29f19ea6e2d472ba779b2dd5ca4e1f3dac79Timo Sirainen &timeout, &res);

a8fc29f19ea6e2d472ba779b2dd5ca4e1f3dac79Timo Sirainen }

7d6389e4053c2dac1fb37180b5756b00785983dcTimo Sirainen#endif

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen if (ret <= 0)

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen break;

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_handle_result(conn, res);

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen ldap_msgfree(res);

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen } while (conn->io != NULL);

c51fe409810cbb2432b72d6819bd183469fcaebcTimo Sirainen

c51fe409810cbb2432b72d6819bd183469fcaebcTimo Sirainen prev_reply_diff = ioloop_time - conn->last_reply_stamp;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->last_reply_stamp = ioloop_time;

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen if (ret > 0) {

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen /* input disabled, continue once it's enabled */

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen i_assert(conn->io == NULL);

43d3ea2780b5f8557ede7b4c039e8f56cb8d357dTimo Sirainen } else if (ret == 0) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen /* send more requests */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen while (db_ldap_request_queue_next(conn))

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen ;

d39e77e1f7f58e1e21042a673b718541fa3f63c7Timo Sirainen } else if (ldap_get_errno(conn) != LDAP_SERVER_DOWN) {

613daa324c2b61ec69291519a57186be7cc23286Timo Sirainen i_error("LDAP: ldap_result() failed: %s", ldap_get_error(conn));

0d68d1da0825e01be3f207042b9132ae8dfc9c06Timo Sirainen ldap_conn_reconnect(conn);

63cde222abaaa2a9bdaa9a143698dbc8b23bd742Timo Sirainen } else if (aqueue_count(conn->request_queue) > 0 ||

c51fe409810cbb2432b72d6819bd183469fcaebcTimo Sirainen prev_reply_diff < DB_LDAP_IDLE_RECONNECT_SECS) {

d39e77e1f7f58e1e21042a673b718541fa3f63c7Timo Sirainen i_error("LDAP: Connection lost to LDAP server, reconnecting");

d39e77e1f7f58e1e21042a673b718541fa3f63c7Timo Sirainen ldap_conn_reconnect(conn);

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen } else {

d39e77e1f7f58e1e21042a673b718541fa3f63c7Timo Sirainen /* server probably disconnected an idle connection. don't

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_conn_close(conn);

54cc31729775282a6f3e0c02adcd1ab4cadc1cdfTimo Sirainen }

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen}

965ed6ea3fc8f7637bd0d159d2fdb283a191ce34Timo Sirainen

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen#ifdef HAVE_LDAP_SASL

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainenstatic int

43d32cbe60fdaef2699d99f1ca259053e9350411Timo Sirainensasl_interact(LDAP *ld ATTR_UNUSED, unsigned flags ATTR_UNUSED,

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen void *defaults, void *interact)

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen{

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen struct db_ldap_sasl_bind_context *context = defaults;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen sasl_interact_t *in;

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen const char *str;

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen for (in = interact; in->id != SASL_CB_LIST_END; in++) {

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen switch (in->id) {

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen case SASL_CB_GETREALM:

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen str = context->realm;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen break;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen case SASL_CB_AUTHNAME:

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen str = context->authcid;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen break;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen case SASL_CB_USER:

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen str = context->authzid;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen break;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen case SASL_CB_PASS:

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen str = context->passwd;

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen break;

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen default:

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen str = NULL;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen break;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen }

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen if (str != NULL) {

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen in->len = strlen(str);

23f8c5356cacdbd1cc09a39a08ef37a39125bb74Timo Sirainen in->result = str;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen }

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen }

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen return LDAP_SUCCESS;

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen}

dd2d3ef41dc407afb8afc49e18ff53640e4b4e02Timo Sirainen#endif

a399486f2d8d5bed51bc6344baba61a7f2b0dcdbTimo Sirainen

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainenstatic void ldap_connection_timeout(struct ldap_connection *conn)

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen{

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen i_assert(conn->conn_state == LDAP_CONN_STATE_BINDING);

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen i_error("LDAP: Initial binding to LDAP server timed out");

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen db_ldap_conn_close(conn);

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen}

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainenstatic int db_ldap_bind(struct ldap_connection *conn)

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen{

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen int msgid;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->conn_state != LDAP_CONN_STATE_BINDING);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->default_bind_msgid == -1);

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(conn->pending_count == 0);

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

763fd2ac217023c0940415379abcd5eb7a0f7ba7Timo Sirainen msgid = ldap_bind(conn->ld, conn->set.dn, conn->set.dnpass,

763fd2ac217023c0940415379abcd5eb7a0f7ba7Timo Sirainen LDAP_AUTH_SIMPLE);

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen if (msgid == -1) {

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen i_assert(ldap_get_errno(conn) != LDAP_SUCCESS);

7cf0a6613fca9983b8a3443f9f6ef15df5a22162Timo Sirainen if (db_ldap_connect_finish(conn, ldap_get_errno(conn)) < 0) {

7cf0a6613fca9983b8a3443f9f6ef15df5a22162Timo Sirainen /* lost connection, close it */

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen db_ldap_conn_close(conn);

7cf0a6613fca9983b8a3443f9f6ef15df5a22162Timo Sirainen }

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen return -1;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen }

1a59321a1116f9819e7b2899379a44de339ce802Timo Sirainen

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->conn_state = LDAP_CONN_STATE_BINDING;

fc4ff2356fee6389d4cf2b3f12f4098a436f0502Timo Sirainen conn->default_bind_msgid = msgid;

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen if (conn->to != NULL)

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen timeout_remove(&conn->to);

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen conn->to = timeout_add(DB_LDAP_REQUEST_LOST_TIMEOUT_SECS*1000,

2d0a002723dac5c58c250f6566efb1f5e474c169Timo Sirainen ldap_connection_timeout, conn);

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen return 0;

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen}

16133a719ce8b6a5b8cedd721340cc1607c43433Timo Sirainen

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainenstatic void db_ldap_get_fd(struct ldap_connection *conn)

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen{

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen int ret;

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen /* get the connection's fd */

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen ret = ldap_get_option(conn->ld, LDAP_OPT_DESC, (void *)&conn->fd);

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen if (ret != LDAP_SUCCESS) {

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen i_fatal("LDAP: Can't get connection fd: %s",

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen ldap_err2string(ret));

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen }

d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (conn->fd <= STDERR_FILENO) {

d2ded6e1da2d07ac070888873ddc10999a6d87baTimo Sirainen /* Solaris LDAP library seems to be broken */

d2ded6e1da2d07ac070888873ddc10999a6d87baTimo Sirainen i_fatal("LDAP: Buggy LDAP library returned wrong fd: %d",

d2ded6e1da2d07ac070888873ddc10999a6d87baTimo Sirainen conn->fd);

d2ded6e1da2d07ac070888873ddc10999a6d87baTimo Sirainen }

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen i_assert(conn->fd != -1);

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen net_set_nonblock(conn->fd, TRUE);

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen}

b270b29d458f3cbd6e63320bb17e23f809da0045Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainenstatic void

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainendb_ldap_set_opt(struct ldap_connection *conn, int opt, const void *value,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen const char *optname, const char *value_str)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen{

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen int ret;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen ret = ldap_set_option(conn == NULL ? NULL : conn->ld, opt, value);

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (ret != LDAP_SUCCESS) {

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen i_fatal("LDAP: Can't set option %s to %s: %s",

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen optname, value_str, ldap_err2string(ret));

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen }

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen}

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainenstatic void

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainendb_ldap_set_opt_str(struct ldap_connection *conn, int opt, const char *value,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen const char *optname)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen{

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (value != NULL)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt(conn, opt, value, optname, value);

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen}

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainenstatic void db_ldap_set_tls_options(struct ldap_connection *conn)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen{

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (!conn->set.tls)

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen return;

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen#ifdef OPENLDAP_TLS_OPTIONS

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt_str(NULL, LDAP_OPT_X_TLS_CACERTFILE,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen conn->set.tls_ca_cert_file, "tls_ca_cert_file");

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt_str(NULL, LDAP_OPT_X_TLS_CACERTDIR,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen conn->set.tls_ca_cert_dir, "tls_ca_cert_dir");

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt_str(NULL, LDAP_OPT_X_TLS_CERTFILE,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen conn->set.tls_cert_file, "tls_cert_file");

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt_str(NULL, LDAP_OPT_X_TLS_KEYFILE,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen conn->set.tls_key_file, "tls_key_file");

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt_str(NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen conn->set.tls_cipher_suite, "tls_cipher_suite");

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen if (conn->set.tls_require_cert != NULL) {

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen int value = tls_require_cert2str(conn->set.tls_require_cert);

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen db_ldap_set_opt(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &value,

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen "tls_require_cert", conn->set.tls_require_cert);

b96dcd982888d89e6f2508258d6d9588d79c7a26Timo Sirainen }

f023d5a1665cc388131159914898ceecc526eda5Timo Sirainen#else

f023d5a1665cc388131159914898ceecc526eda5Timo Sirainen if (conn->set.tls_ca_cert_file != NULL ||

f023d5a1665cc388131159914898ceecc526eda5Timo Sirainen conn->set.tls_ca_cert_dir != NULL ||

f023d5a1665cc388131159914898ceecc526eda5Timo Sirainen conn->set.tls_cert_file != NULL ||

f023d5a1665cc388131159914898ceecc526eda5Timo Sirainen conn->set.tls_key_file != NULL ||

f023d5a1665cc388131159914898ceecc526eda5Timo Sirainen conn->set.tls_cipher_suite != NULL)