09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

1b21d7b3d97def358b2e923655edeb16613a1c31gstein

1b21d7b3d97def358b2e923655edeb16613a1c31gstein#include "httpd.h"

1b21d7b3d97def358b2e923655edeb16613a1c31gstein#include "http_config.h"

1b21d7b3d97def358b2e923655edeb16613a1c31gstein#include "http_core.h"

1b21d7b3d97def358b2e923655edeb16613a1c31gstein#include "http_log.h"

1b21d7b3d97def358b2e923655edeb16613a1c31gstein#include "http_protocol.h"

2d71630471d1c23f0137309e3c3957c633ecbfd6rbb#include "http_request.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "util_mutex.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "util_ldap.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "util_ldap_cache.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include <apr_strings.h>

51af95bb51b5084e883bad250b2afa2838e9ceebfielding

d4f1d9c1ff112a8ab9bee31f196973761329b236rbb#if APR_HAVE_UNISTD_H

7fae9cc4639013f3c04c085547256c68814aee8ftrawick#include <unistd.h>

7fae9cc4639013f3c04c085547256c68814aee8ftrawick#endif

7fae9cc4639013f3c04c085547256c68814aee8ftrawick

7fae9cc4639013f3c04c085547256c68814aee8ftrawick#if !APR_HAS_LDAP

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#error mod_ldap requires APR-util to have LDAP support built in

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#ifndef APR_LDAP_SIZELIMIT

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define APR_LDAP_SIZELIMIT -1

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron#ifdef LDAP_OPT_DEBUG_LEVEL

785be1b6298010956622771c870ab3cd8ca57a2faaron#define AP_LDAP_OPT_DEBUG LDAP_OPT_DEBUG_LEVEL

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#else

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#ifdef LDAP_OPT_DEBUG

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define AP_LDAP_OPT_DEBUG LDAP_OPT_DEBUG

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define AP_LDAP_HOPLIMIT_UNSET -1

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define AP_LDAP_CHASEREFERRALS_OFF 0

785be1b6298010956622771c870ab3cd8ca57a2faaron#define AP_LDAP_CHASEREFERRALS_ON 1

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron#define AP_LDAP_CONNPOOL_DEFAULT -1

785be1b6298010956622771c870ab3cd8ca57a2faaron#define AP_LDAP_CONNPOOL_INFINITE -2

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron#if !defined(LDAP_OPT_NETWORK_TIMEOUT) && defined(LDAP_OPT_CONNECT_TIMEOUT)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define LDAP_OPT_NETWORK_TIMEOUT LDAP_OPT_CONNECT_TIMEOUT

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

f4b96a996afbc46872f57ad1450e6ee1c8f13707jorton

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingmodule AP_MODULE_DECLARE_DATA ldap_module;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic const char *ldap_cache_mutex_type = "ldap-cache";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic apr_status_t uldap_connection_unbind(void *param);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define LDAP_CACHE_LOCK() do { \

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (st->util_ldap_cache_lock) \

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_global_mutex_lock(st->util_ldap_cache_lock); \

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding} while (0)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define LDAP_CACHE_UNLOCK() do { \

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (st->util_ldap_cache_lock) \

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_global_mutex_unlock(st->util_ldap_cache_lock); \

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding} while (0)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic void util_ldap_strdup (char **str, const char *newstr)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (*str) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding free(*str);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *str = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (newstr) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *str = strdup(newstr);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic int util_ldap_handler(request_rec *r)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_state_t *st;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding r->allowed |= (1 << M_GET);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (r->method_number != M_GET) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return DECLINED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (strcmp(r->handler, "ldap-status")) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return DECLINED;

45acd673a68181802b112e97e84fa3813ddd3ec1stoddard }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding &ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_set_content_type(r, "text/html; charset=ISO-8859-1");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (r->header_only)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return OK;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_rputs(DOCTYPE_HTML_3_2

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "<html><head><title>LDAP Cache Information</title></head>\n", r);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_rputs("<body bgcolor='#ffffff'><h1 align=center>LDAP Cache Information"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "</h1>\n", r);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ald_cache_display(r, st);

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm

e8f95a682820a599fe41b22977010636be5c2717jim return OK;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawickstatic void uldap_connection_close(util_ldap_connection_t *ldc)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick /* We leave bound LDAP connections floating around in our pool,

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames if (!ldc->keep) {

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames uldap_connection_unbind(ldc);

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames ldc->r = NULL;

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames }

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames else {

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames /* mark our connection as available for reuse */

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames ldc->freed = apr_time_now();

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames ldc->r = NULL;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick#if APR_HAS_THREADS

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick apr_thread_mutex_unlock(ldc->lock);

560f6ac786d611b858b2bad932713d9e971f0716trawick#endif

560f6ac786d611b858b2bad932713d9e971f0716trawick }

560f6ac786d611b858b2bad932713d9e971f0716trawick}

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawickstatic apr_status_t uldap_connection_unbind(void *param)

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick{

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick util_ldap_connection_t *ldc = param;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (ldc) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (ldc->ldap) {

eae32ab3fb398ca408bc2d45b22adf1b67a75471rbb if (ldc->r) {

39b76a07959a0a332366c735a23894d9e8ed6872trawick ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc);

de00ec7378227d05be63ecd2053ebbb01b940023jorton }

f3aa436e29aa30e29695a18b7f469dd66b39b7e4jorton ldap_unbind_s(ldc->ldap);

de00ec7378227d05be63ecd2053ebbb01b940023jorton ldc->ldap = NULL;

de00ec7378227d05be63ecd2053ebbb01b940023jorton }

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->bound = 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick /* forget the rebind info for this conn */

39b76a07959a0a332366c735a23894d9e8ed6872trawick if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {

de00ec7378227d05be63ecd2053ebbb01b940023jorton apr_ldap_rebind_remove(ldc->ldap);

f3aa436e29aa30e29695a18b7f469dd66b39b7e4jorton apr_pool_clear(ldc->rebind_pool);

de00ec7378227d05be63ecd2053ebbb01b940023jorton }

de00ec7378227d05be63ecd2053ebbb01b940023jorton }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron return APR_SUCCESS;

066877f1a045103acfdd376d48cdd473c33f409bdougm}

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick

f3aa436e29aa30e29695a18b7f469dd66b39b7e4jorton#if 0

97c78987224dcd037076d393aad1867c26b2c8cftrawickstatic apr_status_t util_ldap_connection_remove (void *param) {

97c78987224dcd037076d393aad1867c26b2c8cftrawick util_ldap_connection_t *ldc = param, *l = NULL, *prev = NULL;

97c78987224dcd037076d393aad1867c26b2c8cftrawick util_ldap_state_t *st;

97c78987224dcd037076d393aad1867c26b2c8cftrawick

97c78987224dcd037076d393aad1867c26b2c8cftrawick if (!ldc) return APR_SUCCESS;

97c78987224dcd037076d393aad1867c26b2c8cftrawick

97c78987224dcd037076d393aad1867c26b2c8cftrawick st = ldc->st;

97c78987224dcd037076d393aad1867c26b2c8cftrawick

97c78987224dcd037076d393aad1867c26b2c8cftrawick uldap_connection_unbind(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if APR_HAS_THREADS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_lock(st->mutex);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Remove ldc from the list */

785be1b6298010956622771c870ab3cd8ca57a2faaron for (l=st->connections; l; l=l->next) {

785be1b6298010956622771c870ab3cd8ca57a2faaron if (l == ldc) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (prev) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding prev->next = l->next;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding st->connections = l->next;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding break;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron prev = l;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (ldc->bindpw) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding free((void*)ldc->bindpw);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (ldc->binddn) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding free((void*)ldc->binddn);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_THREADS

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_unlock(ldc->lock);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_unlock(st->mutex);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Destory the pool associated with this connection */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_pool_destroy(ldc->pool);

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return APR_SUCCESS;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic int uldap_connection_init(request_rec *r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_connection_t *ldc)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

f4b96a996afbc46872f57ad1450e6ee1c8f13707jorton int rc = 0, ldap_option = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int version = LDAP_VERSION3;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_ldap_err_t *result = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#ifdef LDAP_OPT_NETWORK_TIMEOUT

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding struct timeval connectionTimeout = {0};

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_state_t *st =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (util_ldap_state_t *)ap_get_module_config(r->server->module_config,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding &ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int have_client_certs = !apr_is_empty_array(ldc->client_certs);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if !APR_HAS_SOLARIS_LDAPSDK

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int secure = APR_LDAP_NONE;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#else

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

785be1b6298010956622771c870ab3cd8ca57a2faaron int secure = have_client_certs ? APR_LDAP_NONE : ldc->secure;

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Since the host will include a port if the default port is not used,

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_ldap_init(r->pool, &(ldc->ldap),

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->host,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding APR_LDAP_SSL == ldc->secure ? LDAPS_PORT : LDAP_PORT,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding secure, &(result));

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (NULL == result) {

785be1b6298010956622771c870ab3cd8ca57a2faaron /* something really bad happened */

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->bound = 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron if (NULL == ldc->reason) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->reason = "LDAP: ldap initialization failed";

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron return(APR_EGENERAL);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm

785be1b6298010956622771c870ab3cd8ca57a2faaron if (result->rc) {

2d399cd7535887fceaa9f8f116eb98ce68ddd602trawick ldc->reason = result->reason;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->bound = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return result->rc;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (NULL == ldc->ldap)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->bound = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (NULL == ldc->reason) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "LDAP: ldap initialization failed";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = result->reason;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return(result->rc);

a7ed9c525f9460187f327cea953bf90ecf1bdc51gstein }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "LDC %pp init", ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Now that we have an ldap struct, add it to the referral list for rebinds. */

a7ed9c525f9460187f327cea953bf90ecf1bdc51gstein rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw);

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick if (rc != APR_SUCCESS) {

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "LDAP: Unable to add rebind cross reference entry. Out of memory?");

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick uldap_connection_unbind(ldc);

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick ldc->reason = "LDAP: Unable to add rebind cross reference entry.";

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick return(rc);

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick }

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick }

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick /* always default to LDAP V3 */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm

785be1b6298010956622771c870ab3cd8ca57a2faaron /* set client certificates */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (have_client_certs) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_ldap_set_option(r->pool, ldc->ldap, APR_LDAP_OPT_TLS_CERT,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->client_certs, &(result));

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm if (LDAP_SUCCESS != result->rc) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding uldap_connection_unbind( ldc );

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = result->reason;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return(result->rc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* switch on SSL/TLS */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (APR_LDAP_NONE != ldc->secure

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_SOLARIS_LDAPSDK

785be1b6298010956622771c870ab3cd8ca57a2faaron /* See comments near apr_ldap_init() above */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding && have_client_certs

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ) {

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm apr_ldap_set_option(r->pool, ldc->ldap,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding APR_LDAP_OPT_TLS, &ldc->secure, &(result));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (LDAP_SUCCESS != result->rc) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding uldap_connection_unbind( ldc );

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = result->reason;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return(result->rc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

a7ed9c525f9460187f327cea953bf90ecf1bdc51gstein

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Set the alias dereferencing option */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldap_option = ldc->deref;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldap_set_option(ldc->ldap, LDAP_OPT_DEREF, &ldap_option);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

f4b96a996afbc46872f57ad1450e6ee1c8f13707jorton if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick /* Set options for rebind and referrals. */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_error(APLOG_MARK, APLOG_TRACE4, 0, r->server, APLOGNO(01278)

785be1b6298010956622771c870ab3cd8ca57a2faaron "LDAP: Setting referrals to %s.",

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick ((ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) ? "On" : "Off"));

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick apr_ldap_set_option(r->pool, ldc->ldap,

39b76a07959a0a332366c735a23894d9e8ed6872trawick APR_LDAP_OPT_REFERRALS,

8fd7c5046d164fb0959222497e5925dfc6a52ff3trawick (void *)((ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) ?

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick LDAP_OPT_ON : LDAP_OPT_OFF),

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick &(result));

e8f95a682820a599fe41b22977010636be5c2717jim if (result->rc != LDAP_SUCCESS) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, APLOGNO(01279)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "Unable to set LDAP_OPT_REFERRALS option to %s: %d.",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ((ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) ? "On" : "Off"),

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result->rc);

8f8ec0957334f50b7ac11359f90490ee467258eedreid result->reason = "Unable to set LDAP_OPT_REFERRALS.";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = result->reason;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding uldap_connection_unbind(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return(result->rc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if ((ldc->ReferralHopLimit != AP_LDAP_HOPLIMIT_UNSET) && ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Referral hop limit - only if referrals are enabled and a hop limit is explicitly requested */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, APLOGNO(01280)

785be1b6298010956622771c870ab3cd8ca57a2faaron "Setting referral hop limit to %d.",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->ReferralHopLimit);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_ldap_set_option(r->pool, ldc->ldap,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding APR_LDAP_OPT_REFHOPLIMIT,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (void *)&ldc->ReferralHopLimit,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding &(result));

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (result->rc != LDAP_SUCCESS) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, APLOGNO(01281)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "Unable to set LDAP_OPT_REFHOPLIMIT option to %d: %d.",

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf ldc->ReferralHopLimit,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result->rc);

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick result->reason = "Unable to set LDAP_OPT_REFHOPLIMIT.";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = result->reason;

39b76a07959a0a332366c735a23894d9e8ed6872trawick uldap_connection_unbind(ldc);

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick return(result->rc);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

39b76a07959a0a332366c735a23894d9e8ed6872trawick

785be1b6298010956622771c870ab3cd8ca57a2faaron#ifdef APR_LDAP_OPT_VERIFY_CERT

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_ldap_set_option(r->pool, ldc->ldap, APR_LDAP_OPT_VERIFY_CERT,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf &(st->verify_svr_cert), &(result));

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf#else

785be1b6298010956622771c870ab3cd8ca57a2faaron#if defined(LDAPSSL_VERIFY_SERVER)

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (st->verify_svr_cert) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf result->rc = ldapssl_set_verify_mode(LDAPSSL_VERIFY_SERVER);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf else {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf result->rc = ldapssl_set_verify_mode(LDAPSSL_VERIFY_NONE);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron#elif defined(LDAP_OPT_X_TLS_REQUIRE_CERT)

785be1b6298010956622771c870ab3cd8ca57a2faaron /* This is not a per-connection setting so just pass NULL for the

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (st->verify_svr_cert) {

066877f1a045103acfdd376d48cdd473c33f409bdougm int i = LDAP_OPT_X_TLS_DEMAND;

785be1b6298010956622771c870ab3cd8ca57a2faaron result->rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &i);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf int i = LDAP_OPT_X_TLS_NEVER;

785be1b6298010956622771c870ab3cd8ca57a2faaron result->rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &i);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron#ifdef LDAP_OPT_NETWORK_TIMEOUT

785be1b6298010956622771c870ab3cd8ca57a2faaron if (st->connectionTimeout > 0) {

785be1b6298010956622771c870ab3cd8ca57a2faaron connectionTimeout.tv_sec = st->connectionTimeout;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (connectionTimeout.tv_sec > 0) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf rc = apr_ldap_set_option(r->pool, ldc->ldap, LDAP_OPT_NETWORK_TIMEOUT,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf (void *)&connectionTimeout, &(result));

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (APR_SUCCESS != rc) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(01282)

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf "LDAP: Could not set the connection timeout");

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

066877f1a045103acfdd376d48cdd473c33f409bdougm }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron#ifdef LDAP_OPT_TIMEOUT

785be1b6298010956622771c870ab3cd8ca57a2faaron /*

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (st->opTimeout) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf rc = apr_ldap_set_option(r->pool, ldc->ldap, LDAP_OPT_TIMEOUT,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf st->opTimeout, &(result));

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (APR_SUCCESS != rc) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(01283)

785be1b6298010956622771c870ab3cd8ca57a2faaron "LDAP: Could not set LDAP_OPT_TIMEOUT");

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf#endif

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf return(rc);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf}

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanfstatic int uldap_ld_errno(util_ldap_connection_t *ldc)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron int ldaprc;

785be1b6298010956622771c870ab3cd8ca57a2faaron#ifdef LDAP_OPT_ERROR_NUMBER

785be1b6298010956622771c870ab3cd8ca57a2faaron if (LDAP_SUCCESS == ldap_get_option(ldc->ldap, LDAP_OPT_ERROR_NUMBER, &ldaprc)) return ldaprc;

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron#ifdef LDAP_OPT_RESULT_CODE

2d399cd7535887fceaa9f8f116eb98ce68ddd602trawick if (LDAP_SUCCESS == ldap_get_option(ldc->ldap, LDAP_OPT_RESULT_CODE, &ldaprc)) return ldaprc;

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron return LDAP_OTHER;

785be1b6298010956622771c870ab3cd8ca57a2faaron}

785be1b6298010956622771c870ab3cd8ca57a2faaron

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanfstatic int uldap_simple_bind(util_ldap_connection_t *ldc, char *binddn,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf char* bindpw, struct timeval *timeout)

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf{

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf LDAPMessage *result;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf int rc;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf int msgid = ldap_simple_bind(ldc->ldap, binddn, bindpw);

785be1b6298010956622771c870ab3cd8ca57a2faaron if (msgid == -1) {

e8f95a682820a599fe41b22977010636be5c2717jim ldc->reason = "LDAP: ldap_simple_bind() failed";

785be1b6298010956622771c870ab3cd8ca57a2faaron return uldap_ld_errno(ldc);

2d399cd7535887fceaa9f8f116eb98ce68ddd602trawick }

785be1b6298010956622771c870ab3cd8ca57a2faaron rc = ldap_result(ldc->ldap, msgid, 0, timeout, &result);

785be1b6298010956622771c870ab3cd8ca57a2faaron if (rc == -1) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->reason = "LDAP: ldap_simple_bind() result retrieval failed";

785be1b6298010956622771c870ab3cd8ca57a2faaron /* -1 is LDAP_SERVER_DOWN in openldap, use something else */

785be1b6298010956622771c870ab3cd8ca57a2faaron return uldap_ld_errno(ldc);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else if (rc == 0) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "LDAP: ldap_simple_bind() timed out";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding rc = LDAP_TIMEOUT;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding } else if (ldap_parse_result(ldc->ldap, result, &rc, NULL, NULL, NULL,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding NULL, 1) == -1) {

ebc18d48bea83ee5ed7a1b4e30007e5192539829wrowe ldc->reason = "LDAP: ldap_simple_bind() parse result failed";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return uldap_ld_errno(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp bind", ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return rc;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic int uldap_connection_open(request_rec *r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_connection_t *ldc)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int rc = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int failures = 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron int new_connection = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_state_t *st;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

f4b96a996afbc46872f57ad1450e6ee1c8f13707jorton /* sanity check for NULL */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!ldc) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return -1;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

5f08a022a210f4e511561e89f500621a15e6177dtrawick /* If the connection is already bound, return

785be1b6298010956622771c870ab3cd8ca57a2faaron if (ldc->bound && !ldc->must_rebind)

785be1b6298010956622771c870ab3cd8ca57a2faaron {

e8f95a682820a599fe41b22977010636be5c2717jim ldc->reason = "LDAP: connection open successful (already bound)";

5f08a022a210f4e511561e89f500621a15e6177dtrawick return LDAP_SUCCESS;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* create the ldap session handle

785be1b6298010956622771c870ab3cd8ca57a2faaron if (NULL == ldc->ldap)

785be1b6298010956622771c870ab3cd8ca57a2faaron {

785be1b6298010956622771c870ab3cd8ca57a2faaron new_connection = 1;

785be1b6298010956622771c870ab3cd8ca57a2faaron rc = uldap_connection_init( r, ldc );

785be1b6298010956622771c870ab3cd8ca57a2faaron if (LDAP_SUCCESS != rc)

785be1b6298010956622771c870ab3cd8ca57a2faaron {

785be1b6298010956622771c870ab3cd8ca57a2faaron return rc;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding st = (util_ldap_state_t *)ap_get_module_config(r->server->module_config,

f4b96a996afbc46872f57ad1450e6ee1c8f13707jorton &ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* loop trying to bind up to st->retries times if LDAP_SERVER_DOWN or LDAP_TIMEOUT

900127764fb985c340ee4979cac97146a330c694trawick

900127764fb985c340ee4979cac97146a330c694trawick while (failures <= st->retries) {

785be1b6298010956622771c870ab3cd8ca57a2faaron if (failures > 0 && st->retry_delay > 0) {

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_sleep(st->retry_delay);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

2d399cd7535887fceaa9f8f116eb98ce68ddd602trawick rc = uldap_simple_bind(ldc, (char *)ldc->binddn, (char *)ldc->bindpw,

785be1b6298010956622771c870ab3cd8ca57a2faaron st->opTimeout);

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (rc == LDAP_SUCCESS) break;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron failures++;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (AP_LDAP_IS_SERVER_DOWN(rc)) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "ldap_simple_bind() failed with server down "

785be1b6298010956622771c870ab3cd8ca57a2faaron "(try %d)", failures);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else if (rc == LDAP_TIMEOUT) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01284)

785be1b6298010956622771c870ab3cd8ca57a2faaron "ldap_simple_bind() timed out on %s "

785be1b6298010956622771c870ab3cd8ca57a2faaron "connection, dropped by firewall?",

785be1b6298010956622771c870ab3cd8ca57a2faaron new_connection ? "new" : "reused");

785be1b6298010956622771c870ab3cd8ca57a2faaron if (new_connection) break;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Other errors not retryable */

785be1b6298010956622771c870ab3cd8ca57a2faaron break;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

2d399cd7535887fceaa9f8f116eb98ce68ddd602trawick

785be1b6298010956622771c870ab3cd8ca57a2faaron if (!(failures % 2)) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "attempt to re-init the connection");

785be1b6298010956622771c870ab3cd8ca57a2faaron uldap_connection_unbind(ldc);

785be1b6298010956622771c870ab3cd8ca57a2faaron if (LDAP_SUCCESS != uldap_connection_init(r, ldc)) {

785be1b6298010956622771c870ab3cd8ca57a2faaron /* leave rc as the initial bind return code */

785be1b6298010956622771c870ab3cd8ca57a2faaron break;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* free the handle if there was an error

785be1b6298010956622771c870ab3cd8ca57a2faaron if (LDAP_SUCCESS != rc)

785be1b6298010956622771c870ab3cd8ca57a2faaron {

785be1b6298010956622771c870ab3cd8ca57a2faaron uldap_connection_unbind(ldc);

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->reason = "LDAP: ldap_simple_bind() failed";

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->bound = 1;

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->must_rebind = 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc->reason = "LDAP: connection open successful";

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron return(rc);

785be1b6298010956622771c870ab3cd8ca57a2faaron}

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawickstatic int compare_client_certs(apr_array_header_t *srcs,

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick apr_array_header_t *dests)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron int i = 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron struct apr_ldap_opt_tls_cert_t *src, *dest;

785be1b6298010956622771c870ab3cd8ca57a2faaron

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick /* arrays both NULL? if so, then equal */

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick if (srcs == NULL && dests == NULL) {

066877f1a045103acfdd376d48cdd473c33f409bdougm return 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick /* arrays different length or either NULL? If so, then not equal */

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick if (srcs == NULL || dests == NULL || srcs->nelts != dests->nelts) {

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick return 1;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* run an actual comparison */

785be1b6298010956622771c870ab3cd8ca57a2faaron src = (struct apr_ldap_opt_tls_cert_t *)srcs->elts;

785be1b6298010956622771c870ab3cd8ca57a2faaron dest = (struct apr_ldap_opt_tls_cert_t *)dests->elts;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding for (i = 0; i < srcs->nelts; i++) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if ((strcmp(src[i].path, dest[i].path)) ||

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (src[i].type != dest[i].type) ||

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* One is passwordless? If so, then not equal */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ((src[i].password == NULL) ^ (dest[i].password == NULL)) ||

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (src[i].password != NULL && dest[i].password != NULL &&

785be1b6298010956622771c870ab3cd8ca57a2faaron strcmp(src[i].password, dest[i].password))) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return 1;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* if we got here, the cert arrays were identical */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return 0;

bbbf8f0e622ad5a37ccf70f35660fc755575278arbb

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm}

2659802f083b95856f571b49e4ec087838b53039rederpj

785be1b6298010956622771c870ab3cd8ca57a2faaron

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanfstatic util_ldap_connection_t *

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf uldap_connection_find(request_rec *r,

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf const char *host, int port,

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf const char *binddn, const char *bindpw,

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf deref_options deref, int secure)

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf{

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf struct util_ldap_connection_t *l, *p; /* To traverse the linked list */

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf int secureflag = secure;

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf apr_time_t now = apr_time_now();

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf util_ldap_state_t *st =

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf (util_ldap_state_t *)ap_get_module_config(r->server->module_config,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding &ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_config_t *dc =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (util_ldap_config_t *) ap_get_module_config(r->per_dir_config, &ldap_module);

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf#if APR_HAS_THREADS

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick /* mutex lock this function */

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick apr_thread_mutex_lock(st->mutex);

4f133508c93204c06e1acba9774ff184e5812606niq#endif

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf

9c518951a46c7a12e20876827bb2e84ef87d3c11jerenkrantz if (secure < APR_LDAP_NONE) {

9c518951a46c7a12e20876827bb2e84ef87d3c11jerenkrantz secureflag = st->secure;

9c518951a46c7a12e20876827bb2e84ef87d3c11jerenkrantz }

9c518951a46c7a12e20876827bb2e84ef87d3c11jerenkrantz

9c518951a46c7a12e20876827bb2e84ef87d3c11jerenkrantz /* Search for an exact connection match in the list that is not

4f133508c93204c06e1acba9774ff184e5812606niq for (l=st->connections,p=NULL; l; l=l->next) {

4f133508c93204c06e1acba9774ff184e5812606niq#if APR_HAS_THREADS

4f133508c93204c06e1acba9774ff184e5812606niq if (APR_SUCCESS == apr_thread_mutex_trylock(l->lock)) {

4f133508c93204c06e1acba9774ff184e5812606niq#endif

4f133508c93204c06e1acba9774ff184e5812606niq if ( (l->port == port) && (strcmp(l->host, host) == 0)

4f133508c93204c06e1acba9774ff184e5812606niq && ((!l->binddn && !binddn) || (l->binddn && binddn

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick && !strcmp(l->binddn, binddn)))

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick && ((!l->bindpw && !bindpw) || (l->bindpw && bindpw

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick && !strcmp(l->bindpw, bindpw)))

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding && (l->deref == deref) && (l->secure == secureflag)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding && !compare_client_certs(dc->client_certs, l->client_certs))

4f133508c93204c06e1acba9774ff184e5812606niq {

644be6f54749d2d9950d2c4d2ac448f7af016d26martin if (st->connection_pool_ttl > 0) {

43c3e6a4b559b76b750c245ee95e2782c15b4296jim if (l->bound && (now - l->freed) > st->connection_pool_ttl) {

644be6f54749d2d9950d2c4d2ac448f7af016d26martin ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,

43c3e6a4b559b76b750c245ee95e2782c15b4296jim "Removing LDAP connection last used %" APR_TIME_T_FMT " seconds ago",

43c3e6a4b559b76b750c245ee95e2782c15b4296jim (now - l->freed) / APR_USEC_PER_SEC);

644be6f54749d2d9950d2c4d2ac448f7af016d26martin l->r = r;

43c3e6a4b559b76b750c245ee95e2782c15b4296jim uldap_connection_unbind(l);

644be6f54749d2d9950d2c4d2ac448f7af016d26martin /* Go ahead (by falling through) and use it, so we don't create more just to unbind some other old ones */

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick }

e8f95a682820a599fe41b22977010636be5c2717jim ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r,

e8f95a682820a599fe41b22977010636be5c2717jim "Reuse %s LDC %pp",

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick l->bound ? "bound" : "unbound", l);

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick }

71715c646d5231de578431f8961e711764b899d3fanf break;

3c8b3749225668f06abbb2b023a833a2cef46931brianp }

3c8b3749225668f06abbb2b023a833a2cef46931brianp#if APR_HAS_THREADS

3c8b3749225668f06abbb2b023a833a2cef46931brianp /* If this connection didn't match the criteria, then we

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_unlock(l->lock);

ccad4fdc6c75a352157a413bd3bbaf4d0c8a6f72brianp }

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

3c8b3749225668f06abbb2b023a833a2cef46931brianp p = l;

3c8b3749225668f06abbb2b023a833a2cef46931brianp }

3c8b3749225668f06abbb2b023a833a2cef46931brianp

785be1b6298010956622771c870ab3cd8ca57a2faaron /* If nothing found, search again, but we don't care about the

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick if (!l) {

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick for (l=st->connections,p=NULL; l; l=l->next) {

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick#if APR_HAS_THREADS

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick if (APR_SUCCESS == apr_thread_mutex_trylock(l->lock)) {

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if ((l->port == port) && (strcmp(l->host, host) == 0) &&

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf (l->deref == deref) && (l->secure == secureflag) &&

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf !compare_client_certs(dc->client_certs, l->client_certs))

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf {

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf if (st->connection_pool_ttl > 0) {

2d399cd7535887fceaa9f8f116eb98ce68ddd602trawick if (l->bound && (now - l->freed) > st->connection_pool_ttl) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf "Removing LDAP connection last used %" APR_TIME_T_FMT " seconds ago",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (now - l->freed) / APR_USEC_PER_SEC);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->r = r;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding uldap_connection_unbind(l);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Go ahead (by falling through) and use it, so we don't create more just to unbind some other old ones */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "Reuse %s LDC %pp (will rebind)",

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm l->bound ? "bound" : "unbound", l);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* the bind credentials have changed */

785be1b6298010956622771c870ab3cd8ca57a2faaron l->must_rebind = 1;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_strdup((char**)&(l->binddn), binddn);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_strdup((char**)&(l->bindpw), bindpw);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding break;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_THREADS

785be1b6298010956622771c870ab3cd8ca57a2faaron /* If this connection didn't match the criteria, then we

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_unlock(l->lock);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding p = l;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* If no connection was found after the second search, we

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!l) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_pool_t *newpool;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (apr_pool_create(&newpool, NULL) != APR_SUCCESS) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01285)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "util_ldap: Failed to create memory pool");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if APR_HAS_THREADS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_unlock(st->mutex);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

3d96ee83babeec32482c9082c9426340cee8c44dwrowe

785be1b6298010956622771c870ab3cd8ca57a2faaron /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* create the details of this connection in the new pool */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l = apr_pcalloc(newpool, sizeof(util_ldap_connection_t));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->pool = newpool;

e8f95a682820a599fe41b22977010636be5c2717jim l->st = st;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if APR_HAS_THREADS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_create(&l->lock, APR_THREAD_MUTEX_DEFAULT, l->pool);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_lock(l->lock);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->bound = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->host = apr_pstrdup(l->pool, host);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->port = port;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->deref = deref;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_strdup((char**)&(l->binddn), binddn);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_strdup((char**)&(l->bindpw), bindpw);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->ChaseReferrals = dc->ChaseReferrals;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->ReferralHopLimit = dc->ReferralHopLimit;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron /* The security mode after parsing the URL will always be either

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->secure = secureflag;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* save away a copy of the client cert list that is presently valid */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs);

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* whether or not to keep this connection in the pool when it's returned */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "util_ldap: Failed to create memory pool");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if APR_HAS_THREADS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_unlock(st->mutex);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (p) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding p->next = l;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding st->connections = l;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

dad234382d8424e1c5a30af2838e172aec9d6d1bdreid#if APR_HAS_THREADS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_unlock(st->mutex);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding l->r = r;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return l;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic int uldap_cache_comparedn(request_rec *r, util_ldap_connection_t *ldc,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *url, const char *dn,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *reqdn, int compare_dn_on_server)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron int result = 0;

785be1b6298010956622771c870ab3cd8ca57a2faaron util_url_node_t *curl;

785be1b6298010956622771c870ab3cd8ca57a2faaron util_url_node_t curnode;

785be1b6298010956622771c870ab3cd8ca57a2faaron util_dn_compare_node_t *node;

785be1b6298010956622771c870ab3cd8ca57a2faaron util_dn_compare_node_t newnode;

785be1b6298010956622771c870ab3cd8ca57a2faaron int failures = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding LDAPMessage *res, *entry;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *searchdn;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron util_ldap_state_t *st = (util_ldap_state_t *)

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_get_module_config(r->server->module_config,

785be1b6298010956622771c870ab3cd8ca57a2faaron &ldap_module);

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* get cache entry (or create one) */

785be1b6298010956622771c870ab3cd8ca57a2faaron LDAP_CACHE_LOCK();

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron curnode.url = url;

785be1b6298010956622771c870ab3cd8ca57a2faaron curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode);

785be1b6298010956622771c870ab3cd8ca57a2faaron if (curl == NULL) {

785be1b6298010956622771c870ab3cd8ca57a2faaron curl = util_ald_create_caches(st, url);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron LDAP_CACHE_UNLOCK();

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* a simple compare? */

785be1b6298010956622771c870ab3cd8ca57a2faaron if (!compare_dn_on_server) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* unlock this read lock */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (strcmp(dn, reqdn)) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "DN Comparison FALSE (direct strcmp())";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return LDAP_COMPARE_FALSE;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

51af95bb51b5084e883bad250b2afa2838e9ceebfielding else {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "DN Comparison TRUE (direct strcmp())";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return LDAP_COMPARE_TRUE;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (curl) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* no - it's a server side compare */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding LDAP_CACHE_LOCK();

dad234382d8424e1c5a30af2838e172aec9d6d1bdreid

382fa07a63096c4a1aabfed36433ea5ac9c40ad0trawick /* is it in the compare cache? */

c1b808d160bfb5c849263be8d4acff600853a328trawick newnode.reqdn = (char *)reqdn;

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb node = util_ald_cache_fetch(curl->dn_compare_cache, &newnode);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (node != NULL) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* If it's in the cache, it's good */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* unlock this read lock */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding LDAP_CACHE_UNLOCK();

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "DN Comparison TRUE (cached)";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return LDAP_COMPARE_TRUE;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* unlock this read lock */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding LDAP_CACHE_UNLOCK();

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaronstart_over:

785be1b6298010956622771c870ab3cd8ca57a2faaron if (failures > st->retries) {

785be1b6298010956622771c870ab3cd8ca57a2faaron return result;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (failures > 0 && st->retry_delay > 0) {

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_sleep(st->retry_delay);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* make a server connection */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (LDAP_SUCCESS != (result = uldap_connection_open(r, ldc))) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* connect to server failed */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return result;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

51af95bb51b5084e883bad250b2afa2838e9ceebfielding /* search for reqdn */

785be1b6298010956622771c870ab3cd8ca57a2faaron result = ldap_search_ext_s(ldc->ldap, (char *)reqdn, LDAP_SCOPE_BASE,

785be1b6298010956622771c870ab3cd8ca57a2faaron "(objectclass=*)", NULL, 1,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding NULL, NULL, st->opTimeout, APR_LDAP_SIZELIMIT, &res);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (AP_LDAP_IS_SERVER_DOWN(result))

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "DN Comparison ldap_search_ext_s() "

45acd673a68181802b112e97e84fa3813ddd3ec1stoddard "failed with server down";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding uldap_connection_unbind(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding failures++;

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "%s (attempt %d)", ldc->reason, failures);

785be1b6298010956622771c870ab3cd8ca57a2faaron goto start_over;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron if (result == LDAP_TIMEOUT && failures == 0) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason = "DN Comparison ldap_search_ext_s() "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "failed with timeout";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding uldap_connection_unbind(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding failures++;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "%s (attempt %d)", ldc->reason, failures);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding goto start_over;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna }

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna if (result != LDAP_SUCCESS) {

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna /* search for reqdn failed - no match */

e8f95a682820a599fe41b22977010636be5c2717jim ldc->reason = "DN Comparison ldap_search_ext_s() failed";

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna return result;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna }

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna entry = ldap_first_entry(ldc->ldap, res);

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna searchdn = ldap_get_dn(ldc->ldap, entry);

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna ldap_msgfree(res);

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna if (strcmp(dn, searchdn) != 0) {

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna /* compare unsuccessful */

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna ldc->reason = "DN Comparison FALSE (checked on server)";

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna result = LDAP_COMPARE_FALSE;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna }

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna else {

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna if (curl) {

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna /* compare successful - add to the compare cache */

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna LDAP_CACHE_LOCK();

e8f95a682820a599fe41b22977010636be5c2717jim newnode.reqdn = (char *)reqdn;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna newnode.dn = (char *)dn;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna node = util_ald_cache_fetch(curl->dn_compare_cache, &newnode);

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna if ( (node == NULL)

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna || (strcmp(reqdn, node->reqdn) != 0)

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna || (strcmp(dn, node->dn) != 0))

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna {

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna util_ald_cache_insert(curl->dn_compare_cache, &newnode);

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna }

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna LDAP_CACHE_UNLOCK();

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna }

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna ldc->reason = "DN Comparison TRUE (checked on server)";

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna result = LDAP_COMPARE_TRUE;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna }

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna ldap_memfree(searchdn);

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna return result;

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna}

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquernastatic int uldap_cache_compare(request_rec *r, util_ldap_connection_t *ldc,

20f1b1a67eef5ab0f3295608c89964a7dca4fdd1pquerna const char *url, const char *dn,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *attrib, const char *value)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int result = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_url_node_t *curl;

45acd673a68181802b112e97e84fa3813ddd3ec1stoddard util_url_node_t curnode;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_compare_node_t *compare_nodep;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_compare_node_t the_compare_node;

8f8ec0957334f50b7ac11359f90490ee467258eedreid apr_time_t curtime = 0; /* silence gcc -Wall */

382fa07a63096c4a1aabfed36433ea5ac9c40ad0trawick int failures = 0;

f4b96a996afbc46872f57ad1450e6ee1c8f13707jorton

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick util_ldap_state_t *st = (util_ldap_state_t *)

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb ap_get_module_config(r->server->module_config,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding &ldap_module);

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* get cache entry (or create one) */

785be1b6298010956622771c870ab3cd8ca57a2faaron LDAP_CACHE_LOCK();

785be1b6298010956622771c870ab3cd8ca57a2faaron curnode.url = url;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding curl = util_ald_cache_fetch(st->util_ldap_cache, &curnode);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (curl == NULL) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf curl = util_ald_create_caches(st, url);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding LDAP_CACHE_UNLOCK();

c1b808d160bfb5c849263be8d4acff600853a328trawick

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb if (curl) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* make a comparison to the cache */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding LDAP_CACHE_LOCK();

785be1b6298010956622771c870ab3cd8ca57a2faaron curtime = apr_time_now();

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron the_compare_node.dn = (char *)dn;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding the_compare_node.attrib = (char *)attrib;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding the_compare_node.value = (char *)value;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf the_compare_node.result = 0;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf the_compare_node.sgl_processed = 0;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf the_compare_node.subgroupList = NULL;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding compare_nodep = util_ald_cache_fetch(curl->compare_cache,

&the_compare_node);

if (compare_nodep != NULL) {

/* found it... */

if (curtime - compare_nodep->lastcompare > st->compare_cache_ttl) {

/* ...but it is too old */

util_ald_cache_remove(curl->compare_cache, compare_nodep);

}

else {

/* ...and it is good */

if (LDAP_COMPARE_TRUE == compare_nodep->result) {

ldc->reason = "Comparison true (cached)";

}

else if (LDAP_COMPARE_FALSE == compare_nodep->result) {

ldc->reason = "Comparison false (cached)";

}

else if (LDAP_NO_SUCH_ATTRIBUTE == compare_nodep->result) {

ldc->reason = "Comparison no such attribute (cached)";

}

else {

ldc->reason = "Comparison undefined (cached)";

}

/* record the result code to return with the reason... */

result = compare_nodep->result;

/* and unlock this read lock */

LDAP_CACHE_UNLOCK();

return result;

}

}

/* unlock this read lock */

LDAP_CACHE_UNLOCK();

}

start_over:

if (failures > st->retries) {

return result;

}

if (failures > 0 && st->retry_delay > 0) {

apr_sleep(st->retry_delay);

}

if (LDAP_SUCCESS != (result = uldap_connection_open(r, ldc))) {

/* uldap_connection_open() retried already */

return result;

}

result = ldap_compare_s(ldc->ldap,

(char *)dn,

(char *)attrib,

(char *)value);

if (AP_LDAP_IS_SERVER_DOWN(result)) {

/* connection failed - try again */

ldc->reason = "ldap_compare_s() failed with server down";

uldap_connection_unbind(ldc);

failures++;

ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "%s (attempt %d)", ldc->reason, failures);

goto start_over;

}

if (result == LDAP_TIMEOUT && failures == 0) {

/*

ldc->reason = "ldap_compare_s() failed with timeout";

uldap_connection_unbind(ldc);

failures++;

ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "%s (attempt %d)", ldc->reason, failures);

goto start_over;

}

ldc->reason = "Comparison complete";

if ((LDAP_COMPARE_TRUE == result) ||

(LDAP_COMPARE_FALSE == result) ||

(LDAP_NO_SUCH_ATTRIBUTE == result)) {

if (curl) {

/* compare completed; caching result */

LDAP_CACHE_LOCK();

the_compare_node.lastcompare = curtime;

the_compare_node.result = result;

the_compare_node.sgl_processed = 0;

the_compare_node.subgroupList = NULL;

/* If the node doesn't exist then insert it, otherwise just update

compare_nodep = util_ald_cache_fetch(curl->compare_cache,

&the_compare_node);

if ( (compare_nodep == NULL)

|| (strcmp(the_compare_node.dn, compare_nodep->dn) != 0)

|| (strcmp(the_compare_node.attrib,compare_nodep->attrib) != 0)

|| (strcmp(the_compare_node.value, compare_nodep->value) != 0))

{

void *junk;

junk = util_ald_cache_insert(curl->compare_cache,

&the_compare_node);

if (junk == NULL) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01287)

"cache_compare: Cache insertion failure.");

}

}

else {

compare_nodep->lastcompare = curtime;

compare_nodep->result = result;

}

LDAP_CACHE_UNLOCK();

}

if (LDAP_COMPARE_TRUE == result) {

ldc->reason = "Comparison true (adding to cache)";

return LDAP_COMPARE_TRUE;

}

else if (LDAP_COMPARE_FALSE == result) {

ldc->reason = "Comparison false (adding to cache)";

return LDAP_COMPARE_FALSE;

}

else {

ldc->reason = "Comparison no such attribute (adding to cache)";

return LDAP_NO_SUCH_ATTRIBUTE;

}

}

return result;

}

static util_compare_subgroup_t* uldap_get_subgroups(request_rec *r,

util_ldap_connection_t *ldc,

const char *url,

const char *dn,

char **subgroupAttrs,

apr_array_header_t *subgroupclasses)

{

int failures = 0;

int result = LDAP_COMPARE_FALSE;

util_compare_subgroup_t *res = NULL;

LDAPMessage *sga_res, *entry;

struct mod_auth_ldap_groupattr_entry_t *sgc_ents;

apr_array_header_t *subgroups = apr_array_make(r->pool, 20, sizeof(char *));

util_ldap_state_t *st = (util_ldap_state_t *)

ap_get_module_config(r->server->module_config,

&ldap_module);

sgc_ents = (struct mod_auth_ldap_groupattr_entry_t *) subgroupclasses->elts;

if (!subgroupAttrs) {

return res;

}

start_over:

/*

if (failures > st->retries) {

return res;

}

if (failures > 0 && st->retry_delay > 0) {

apr_sleep(st->retry_delay);

}

if (LDAP_SUCCESS != (result = uldap_connection_open(r, ldc))) {

/* uldap_connection_open() retried already */

return res;

}

/* try to do the search */

result = ldap_search_ext_s(ldc->ldap, (char *)dn, LDAP_SCOPE_BASE,

(char *)"cn=*", subgroupAttrs, 0,

NULL, NULL, NULL, APR_LDAP_SIZELIMIT, &sga_res);

if (AP_LDAP_IS_SERVER_DOWN(result)) {

ldc->reason = "ldap_search_ext_s() for subgroups failed with server"

" down";

uldap_connection_unbind(ldc);

failures++;

ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "%s (attempt %d)", ldc->reason, failures);

goto start_over;

}

if (result == LDAP_TIMEOUT && failures == 0) {

/*

ldc->reason = "ldap_search_ext_s() for subgroups failed with timeout";

uldap_connection_unbind(ldc);

failures++;

ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, "%s (attempt %d)", ldc->reason, failures);

goto start_over;

}

/* if there is an error (including LDAP_NO_SUCH_OBJECT) return now */

if (result != LDAP_SUCCESS) {

ldc->reason = "ldap_search_ext_s() for subgroups failed";

return res;

}

entry = ldap_first_entry(ldc->ldap, sga_res);

/*

if (subgroupAttrs) {

int indx = 0, tmp_sgcIndex;

while (subgroupAttrs[indx]) {

char **values;

int val_index = 0;

/* Get *all* matching "member" values from this group. */

values = ldap_get_values(ldc->ldap, entry, subgroupAttrs[indx]);

if (values) {

val_index = 0;

/*

while (values[val_index]) {

/* Check if this entry really is a group. */

tmp_sgcIndex = 0;

result = LDAP_COMPARE_FALSE;

while ((tmp_sgcIndex < subgroupclasses->nelts)

&& (result != LDAP_COMPARE_TRUE)) {

result = uldap_cache_compare(r, ldc, url,

values[val_index],

"objectClass",

sgc_ents[tmp_sgcIndex].name

);

if (result != LDAP_COMPARE_TRUE) {

tmp_sgcIndex++;

}

}

/* It's a group, so add it to the array. */

if (result == LDAP_COMPARE_TRUE) {

char **newgrp = (char **) apr_array_push(subgroups);

*newgrp = apr_pstrdup(r->pool, values[val_index]);

}

val_index++;

}

ldap_value_free(values);

}

indx++;

}

}

ldap_msgfree(sga_res);

if (subgroups->nelts > 0) {

/* We need to fill in tmp_local_subgroups using the data from LDAP */

int sgindex;

char **group;

res = apr_pcalloc(r->pool, sizeof(util_compare_subgroup_t));

res->subgroupDNs = apr_palloc(r->pool,

sizeof(char *) * (subgroups->nelts));

for (sgindex = 0; (group = apr_array_pop(subgroups)); sgindex++) {

res->subgroupDNs[sgindex] = apr_pstrdup(r->pool, *group);

}

res->len = sgindex;

}

return res;

}