sendmail/libsm/ldap.c

/*
 * Copyright (c) 2001-2009 Sendmail, Inc. and its suppliers.
 *      All rights reserved.
 *
 * By using this file, you agree to the terms and conditions set
 * forth in the LICENSE file which can be found at the top level of
 * the sendmail distribution.
 */

/* some "deprecated" calls are used, e.g., ldap_get_values() */
#define LDAP_DEPRECATED 1

#include <sm/gen.h>
SM_RCSID("@(#)$Id: ldap.c,v 1.83 2009/06/19 22:02:26 guenther Exp $")

#if LDAPMAP
# include <sys/types.h>
# include <errno.h>
# include <setjmp.h>
# include <stdlib.h>
# include <unistd.h>

# include <sm/bitops.h>
# include <sm/clock.h>
# include <sm/conf.h>
# include <sm/debug.h>
# include <sm/errstring.h>
# include <sm/ldap.h>
# include <sm/string.h>
#  ifdef EX_OK
#   undef EX_OK         /* for SVr4.2 SMP */
#  endif /* EX_OK */
# include <sm/sysexits.h>

SM_DEBUG_T SmLDAPTrace = SM_DEBUG_INITIALIZER("sm_trace_ldap",
    "@(#)$Debug: sm_trace_ldap - trace LDAP operations $");

static void ldaptimeout __P((int));
static bool sm_ldap_has_objectclass __P((SM_LDAP_STRUCT *, LDAPMessage *, char *));
static SM_LDAP_RECURSE_ENTRY *sm_ldap_add_recurse __P((SM_LDAP_RECURSE_LIST **, char *, int, SM_RPOOL_T *));

/*
**  SM_LDAP_CLEAR -- set default values for SM_LDAP_STRUCT
**
**  Parameters:
**      lmap -- pointer to SM_LDAP_STRUCT to clear
**
**  Returns:
**      None.
**
*/

#if _FFR_LDAP_VERSION
# if defined(LDAP_VERSION_MAX) && _FFR_LDAP_VERSION > LDAP_VERSION_MAX
    ERROR FFR_LDAP_VERSION > _LDAP_VERSION_MAX
# endif /* defined(LDAP_VERSION_MAX) && _FFR_LDAP_VERSION > LDAP_VERSION_MAX */
# if defined(LDAP_VERSION_MIN) && _FFR_LDAP_VERSION < LDAP_VERSION_MIN
    ERROR FFR_LDAP_VERSION < _LDAP_VERSION_MIN
# endif /* defined(LDAP_VERSION_MIN) && _FFR_LDAP_VERSION < LDAP_VERSION_MIN */
# define SM_LDAP_VERSION_DEFAULT    _FFR_LDAP_VERSION
#else /* _FFR_LDAP_VERSION */
# define SM_LDAP_VERSION_DEFAULT    0
#endif /* _FFR_LDAP_VERSION */

void
sm_ldap_clear(lmap)
    SM_LDAP_STRUCT *lmap;
{
    if (lmap == NULL)
        return;

    lmap->ldap_host = NULL;
    lmap->ldap_port = LDAP_PORT;
    lmap->ldap_uri = NULL;
    lmap->ldap_version = SM_LDAP_VERSION_DEFAULT;
    lmap->ldap_deref = LDAP_DEREF_NEVER;
    lmap->ldap_timelimit = LDAP_NO_LIMIT;
    lmap->ldap_sizelimit = LDAP_NO_LIMIT;
# ifdef LDAP_REFERRALS
    lmap->ldap_options = LDAP_OPT_REFERRALS;
# else /* LDAP_REFERRALS */
    lmap->ldap_options = 0;
# endif /* LDAP_REFERRALS */
    lmap->ldap_attrsep = '\0';
    lmap->ldap_binddn = NULL;
    lmap->ldap_secret = NULL;
    lmap->ldap_method = LDAP_AUTH_SIMPLE;
    lmap->ldap_base = NULL;
    lmap->ldap_scope = LDAP_SCOPE_SUBTREE;
    lmap->ldap_attrsonly = LDAPMAP_FALSE;
    lmap->ldap_timeout.tv_sec = 0;
    lmap->ldap_timeout.tv_usec = 0;
    lmap->ldap_ld = NULL;
    lmap->ldap_filter = NULL;
    lmap->ldap_attr[0] = NULL;
    lmap->ldap_attr_type[0] = SM_LDAP_ATTR_NONE;
    lmap->ldap_attr_needobjclass[0] = NULL;
    lmap->ldap_res = NULL;
    lmap->ldap_next = NULL;
    lmap->ldap_pid = 0;
    lmap->ldap_multi_args = false;
}

/*
**  SM_LDAP_START -- actually connect to an LDAP server
**
**  Parameters:
**      name -- name of map for debug output.
**      lmap -- the LDAP map being opened.
**
**  Returns:
**      true if connection is successful, false otherwise.
**
**  Side Effects:
**      Populates lmap->ldap_ld.
*/

static jmp_buf  LDAPTimeout;

#define SM_LDAP_SETTIMEOUT(to)                      \
do                                  \
{                                   \
    if (to != 0)                            \
    {                               \
        if (setjmp(LDAPTimeout) != 0)               \
        {                           \
            errno = ETIMEDOUT;              \
            return false;                   \
        }                           \
        ev = sm_setevent(to, ldaptimeout, 0);           \
    }                               \
} while (0)

#define SM_LDAP_CLEARTIMEOUT()                      \
do                                  \
{                                   \
    if (ev != NULL)                         \
        sm_clrevent(ev);                    \
} while (0)

bool
sm_ldap_start(name, lmap)
    char *name;
    SM_LDAP_STRUCT *lmap;
{
    int bind_result;
    int save_errno = 0;
    char *id;
    SM_EVENT *ev = NULL;
    LDAP *ld = NULL;

    if (sm_debug_active(&SmLDAPTrace, 2))
        sm_dprintf("ldapmap_start(%s)\n", name == NULL ? "" : name);

    if (lmap->ldap_host != NULL)
        id = lmap->ldap_host;
    else if (lmap->ldap_uri != NULL)
        id = lmap->ldap_uri;
    else
        id = "localhost";

    if (sm_debug_active(&SmLDAPTrace, 9))
    {
        /* Don't print a port number for LDAP URIs */
        if (lmap->ldap_uri != NULL)
            sm_dprintf("ldapmap_start(%s)\n", id);
        else
            sm_dprintf("ldapmap_start(%s, %d)\n", id,
                   lmap->ldap_port);
    }

    if (lmap->ldap_uri != NULL)
    {
#if SM_CONF_LDAP_INITIALIZE
        /* LDAP server supports URIs so use them directly */
        save_errno = ldap_initialize(&ld, lmap->ldap_uri);
#else /* SM_CONF_LDAP_INITIALIZE */
        int err;
        LDAPURLDesc *ludp = NULL;

        /* Blast apart URL and use the ldap_init/ldap_open below */
        err = ldap_url_parse(lmap->ldap_uri, &ludp);
        if (err != 0)
        {
            errno = err + E_LDAPURLBASE;
            return false;
        }
        lmap->ldap_host = sm_strdup_x(ludp->lud_host);
        if (lmap->ldap_host == NULL)
        {
            save_errno = errno;
            ldap_free_urldesc(ludp);
            errno = save_errno;
            return false;
        }
        lmap->ldap_port = ludp->lud_port;
        ldap_free_urldesc(ludp);
#endif /* SM_CONF_LDAP_INITIALIZE */
    }

    if (ld == NULL)
    {
# if USE_LDAP_INIT
        ld = ldap_init(lmap->ldap_host, lmap->ldap_port);
        save_errno = errno;
# else /* USE_LDAP_INIT */
        /*
        **  If using ldap_open(), the actual connection to the server
        **  happens now so we need the timeout here.  For ldap_init(),
        **  the connection happens at bind time.
        */

        SM_LDAP_SETTIMEOUT(lmap->ldap_timeout.tv_sec);
        ld = ldap_open(lmap->ldap_host, lmap->ldap_port);
        save_errno = errno;

        /* clear the event if it has not sprung */
        SM_LDAP_CLEARTIMEOUT();
# endif /* USE_LDAP_INIT */
    }

    errno = save_errno;
    if (ld == NULL)
        return false;

    sm_ldap_setopts(ld, lmap);

# if USE_LDAP_INIT
    /*
    **  If using ldap_init(), the actual connection to the server
    **  happens at ldap_bind_s() so we need the timeout here.
    */

    SM_LDAP_SETTIMEOUT(lmap->ldap_timeout.tv_sec);
# endif /* USE_LDAP_INIT */

# ifdef LDAP_AUTH_KRBV4
    if (lmap->ldap_method == LDAP_AUTH_KRBV4 &&
        lmap->ldap_secret != NULL)
    {
        /*
        **  Need to put ticket in environment here instead of
        **  during parseargs as there may be different tickets
        **  for different LDAP connections.
        */

        (void) putenv(lmap->ldap_secret);
    }
# endif /* LDAP_AUTH_KRBV4 */

    bind_result = ldap_bind_s(ld, lmap->ldap_binddn,
                  lmap->ldap_secret, lmap->ldap_method);

# if USE_LDAP_INIT
    /* clear the event if it has not sprung */
    SM_LDAP_CLEARTIMEOUT();
# endif /* USE_LDAP_INIT */

    if (bind_result != LDAP_SUCCESS)
    {
        errno = bind_result + E_LDAPBASE;
        return false;
    }

    /* Save PID to make sure only this PID closes the LDAP connection */
    lmap->ldap_pid = getpid();
    lmap->ldap_ld = ld;
    return true;
}

/* ARGSUSED */
static void
ldaptimeout(unused)
    int unused;
{
    /*
    **  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
    **  ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
    **  DOING.
    */

    errno = ETIMEDOUT;
    longjmp(LDAPTimeout, 1);
}

/*
**  SM_LDAP_SEARCH_M -- initiate multi-key LDAP search
**
**  Initiate an LDAP search, return the msgid.
**  The calling function must collect the results.
**
**  Parameters:
**      lmap -- LDAP map information
**      argv -- key vector of substitutions in LDAP filter
**              NOTE: argv must have SM_LDAP_ARGS elements to prevent
**                out of bound array references
**
**  Returns:
**      <0 on failure (SM_LDAP_ERR*), msgid on success
**
*/

int
sm_ldap_search_m(lmap, argv)
    SM_LDAP_STRUCT *lmap;
    char **argv;
{
    int msgid;
    char *fp, *p, *q;
    char filter[LDAPMAP_MAX_FILTER + 1];

    SM_REQUIRE(lmap != NULL);
    SM_REQUIRE(argv != NULL);
    SM_REQUIRE(argv[0] != NULL);

    memset(filter, '\0', sizeof filter);
    fp = filter;
    p = lmap->ldap_filter;
    while ((q = strchr(p, '%')) != NULL)
    {
        char *key;

        if (lmap->ldap_multi_args)
        {
#if SM_LDAP_ARGS < 10
# ERROR _SM_LDAP_ARGS must be 10
#endif /* SM_LDAP_ARGS < 10 */
            if (q[1] == 's')
                key = argv[0];
            else if (q[1] >= '0' && q[1] <= '9')
            {
                key = argv[q[1] - '0'];
                if (key == NULL)
                {
# if SM_LDAP_ERROR_ON_MISSING_ARGS
                    return SM_LDAP_ERR_ARG_MISS;
# else /* SM_LDAP_ERROR_ON_MISSING_ARGS */
                    key = "";
# endif /* SM_LDAP_ERROR_ON_MISSING_ARGS */
                }
            }
            else
                key = NULL;
        }
        else
            key = argv[0];

        if (q[1] == 's')
        {
            (void) sm_snprintf(fp, SPACELEFT(filter, fp),
                       "%.*s%s", (int) (q - p), p, key);
            fp += strlen(fp);
            p = q + 2;
        }
        else if (q[1] == '0' ||
             (lmap->ldap_multi_args && q[1] >= '0' && q[1] <= '9'))
        {
            char *k = key;

            (void) sm_snprintf(fp, SPACELEFT(filter, fp),
                       "%.*s", (int) (q - p), p);
            fp += strlen(fp);
            p = q + 2;

            /* Properly escape LDAP special characters */
            while (SPACELEFT(filter, fp) > 0 &&
                   *k != '\0')
            {
                if (*k == '*' || *k == '(' ||
                    *k == ')' || *k == '\\')
                {
                    (void) sm_strlcat(fp,
                               (*k == '*' ? "\\2A" :
                            (*k == '(' ? "\\28" :
                             (*k == ')' ? "\\29" :
                              (*k == '\\' ? "\\5C" :
                               "\00")))),
                        SPACELEFT(filter, fp));
                    fp += strlen(fp);
                    k++;
                }
                else
                    *fp++ = *k++;
            }
        }
        else
        {
            (void) sm_snprintf(fp, SPACELEFT(filter, fp),
                "%.*s", (int) (q - p + 1), p);
            p = q + (q[1] == '%' ? 2 : 1);
            fp += strlen(fp);
        }
    }
    (void) sm_strlcpy(fp, p, SPACELEFT(filter, fp));
    if (sm_debug_active(&SmLDAPTrace, 20))
        sm_dprintf("ldap search filter=%s\n", filter);

    lmap->ldap_res = NULL;
    msgid = ldap_search(lmap->ldap_ld, lmap->ldap_base,
                lmap->ldap_scope, filter,
                (lmap->ldap_attr[0] == NULL ? NULL :
                 lmap->ldap_attr),
                lmap->ldap_attrsonly);
    return msgid;
}

/*
**  SM_LDAP_SEARCH -- initiate LDAP search
**
**  Initiate an LDAP search, return the msgid.
**  The calling function must collect the results.
**  Note this is just a wrapper into sm_ldap_search_m()
**
**  Parameters:
**      lmap -- LDAP map information
**      key -- key to substitute in LDAP filter
**
**  Returns:
**      <0 on failure, msgid on success
**
*/

int
sm_ldap_search(lmap, key)
    SM_LDAP_STRUCT *lmap;
    char *key;
{
    char *argv[SM_LDAP_ARGS];

    memset(argv, '\0', sizeof argv);
    argv[0] = key;
    return sm_ldap_search_m(lmap, argv);
}

/*
**  SM_LDAP_HAS_OBJECTCLASS -- determine if an LDAP entry is part of a
**                 particular objectClass
**
**  Parameters:
**      lmap -- pointer to SM_LDAP_STRUCT in use
**      entry -- current LDAP entry struct
**      ocvalue -- particular objectclass in question.
**             may be of form (fee|foo|fum) meaning
**             any entry can be part of either fee,
**             foo or fum objectclass
**
**  Returns:
**      true if item has that objectClass
*/

static bool
sm_ldap_has_objectclass(lmap, entry, ocvalue)
    SM_LDAP_STRUCT *lmap;
    LDAPMessage *entry;
    char *ocvalue;
{
    char **vals = NULL;
    int i;

    if (ocvalue == NULL)
        return false;

    vals = ldap_get_values(lmap->ldap_ld, entry, "objectClass");
    if (vals == NULL)
        return false;

    for (i = 0; vals[i] != NULL; i++)
    {
        char *p;
        char *q;

        p = q = ocvalue;
        while (*p != '\0')
        {
            while (*p != '\0' && *p != '|')
                p++;

            if ((p - q) == strlen(vals[i]) &&
                sm_strncasecmp(vals[i], q, p - q) == 0)
            {
                ldap_value_free(vals);
                return true;
            }

            while (*p == '|')
                p++;
            q = p;
        }
    }

    ldap_value_free(vals);
    return false;
}

/*
**  SM_LDAP_RESULTS -- return results from an LDAP lookup in result
**
**  Parameters:
**      lmap -- pointer to SM_LDAP_STRUCT in use
**      msgid -- msgid returned by sm_ldap_search()
**      flags -- flags for the lookup
**      delim -- delimiter for result concatenation
**      rpool -- memory pool for storage
**      result -- return string
**      recurse -- recursion list
**
**  Returns:
**      status (sysexit)
*/

# define SM_LDAP_ERROR_CLEANUP()                \
{                               \
    if (lmap->ldap_res != NULL)             \
    {                           \
        ldap_msgfree(lmap->ldap_res);           \
        lmap->ldap_res = NULL;              \
    }                           \
    (void) ldap_abandon(lmap->ldap_ld, msgid);      \
}

static SM_LDAP_RECURSE_ENTRY *
sm_ldap_add_recurse(top, item, type, rpool)
    SM_LDAP_RECURSE_LIST **top;
    char *item;
    int type;
    SM_RPOOL_T *rpool;
{
    int n;
    int m;
    int p;
    int insertat;
    int moveb;
    int oldsizeb;
    int rc;
    SM_LDAP_RECURSE_ENTRY *newe;
    SM_LDAP_RECURSE_ENTRY **olddata;

    /*
    **  This code will maintain a list of
    **  SM_LDAP_RECURSE_ENTRY structures
    **  in ascending order.
    */

    if (*top == NULL)
    {
        /* Allocate an initial SM_LDAP_RECURSE_LIST struct */
        *top = sm_rpool_malloc_x(rpool, sizeof **top);
        (*top)->lrl_cnt = 0;
        (*top)->lrl_size = 0;
        (*top)->lrl_data = NULL;
    }

    if ((*top)->lrl_cnt >= (*top)->lrl_size)
    {
        /* Grow the list of SM_LDAP_RECURSE_ENTRY ptrs */
        olddata = (*top)->lrl_data;
        if ((*top)->lrl_size == 0)
        {
            oldsizeb = 0;
            (*top)->lrl_size = 256;
        }
        else
        {
            oldsizeb = (*top)->lrl_size * sizeof *((*top)->lrl_data);
            (*top)->lrl_size *= 2;
        }
        (*top)->lrl_data = sm_rpool_malloc_x(rpool,
                            (*top)->lrl_size * sizeof *((*top)->lrl_data));
        if (oldsizeb > 0)
            memcpy((*top)->lrl_data, olddata, oldsizeb);
    }

    /*
    **  Binary search/insert item:type into list.
    **  Return current entry pointer if already exists.
    */

    n = 0;
    m = (*top)->lrl_cnt - 1;
    if (m < 0)
        insertat = 0;
    else
        insertat = -1;

    while (insertat == -1)
    {
        p = (m + n) / 2;

        rc = sm_strcasecmp(item, (*top)->lrl_data[p]->lr_search);
        if (rc == 0)
            rc = type - (*top)->lrl_data[p]->lr_type;

        if (rc < 0)
            m = p - 1;
        else if (rc > 0)
            n = p + 1;
        else
            return (*top)->lrl_data[p];

        if (m == -1)
            insertat = 0;
        else if (n >= (*top)->lrl_cnt)
            insertat = (*top)->lrl_cnt;
        else if (m < n)
            insertat = m + 1;
    }

    /*
    ** Not found in list, make room
    ** at insert point and add it.
    */

    newe = sm_rpool_malloc_x(rpool, sizeof *newe);
    if (newe != NULL)
    {
        moveb = ((*top)->lrl_cnt - insertat) * sizeof *((*top)->lrl_data);
        if (moveb > 0)
            memmove(&((*top)->lrl_data[insertat + 1]),
                &((*top)->lrl_data[insertat]),
                moveb);

        newe->lr_search = sm_rpool_strdup_x(rpool, item);
        newe->lr_type = type;
        newe->lr_ludp = NULL;
        newe->lr_attrs = NULL;
        newe->lr_done = false;

        ((*top)->lrl_data)[insertat] = newe;
        (*top)->lrl_cnt++;
    }
    return newe;
}

int
sm_ldap_results(lmap, msgid, flags, delim, rpool, result,
        resultln, resultsz, recurse)
    SM_LDAP_STRUCT *lmap;
    int msgid;
    int flags;
    int delim;
    SM_RPOOL_T *rpool;
    char **result;
    int *resultln;
    int *resultsz;
    SM_LDAP_RECURSE_LIST *recurse;
{
    bool toplevel;
    int i;
    int statp;
    int vsize;
    int ret;
    int save_errno;
    char *p;
    SM_LDAP_RECURSE_ENTRY *rl;

    /* Are we the top top level of the search? */
    toplevel = (recurse == NULL);

    /* Get results */
    statp = EX_NOTFOUND;
    while ((ret = ldap_result(lmap->ldap_ld, msgid, 0,
                  (lmap->ldap_timeout.tv_sec == 0 ? NULL :
                   &(lmap->ldap_timeout)),
                  &(lmap->ldap_res))) == LDAP_RES_SEARCH_ENTRY)
    {
        LDAPMessage *entry;

        /* If we don't want multiple values and we have one, break */
        if ((char) delim == '\0' &&
            !bitset(SM_LDAP_SINGLEMATCH, flags) &&
            *result != NULL)
            break;

        /* Cycle through all entries */
        for (entry = ldap_first_entry(lmap->ldap_ld, lmap->ldap_res);
             entry != NULL;
             entry = ldap_next_entry(lmap->ldap_ld, lmap->ldap_res))
        {
            BerElement *ber;
            char *attr;
            char **vals = NULL;
            char *dn;

            /*
            **  If matching only and found an entry,
            **  no need to spin through attributes
            */

            if (bitset(SM_LDAP_MATCHONLY, flags))
            {
                statp = EX_OK;
                continue;
            }

#if _FFR_LDAP_SINGLEDN
            if (bitset(SM_LDAP_SINGLEDN, flags) && *result != NULL)
            {
                /* only wanted one match */
                SM_LDAP_ERROR_CLEANUP();
                errno = ENOENT;
                return EX_NOTFOUND;
            }
#endif /* _FFR_LDAP_SINGLEDN */

            /* record completed DN's to prevent loops */
            dn = ldap_get_dn(lmap->ldap_ld, entry);
            if (dn == NULL)
            {
                save_errno = sm_ldap_geterrno(lmap->ldap_ld);
                save_errno += E_LDAPBASE;
                SM_LDAP_ERROR_CLEANUP();
                errno = save_errno;
                return EX_TEMPFAIL;
            }

            rl = sm_ldap_add_recurse(&recurse, dn,
                         SM_LDAP_ATTR_DN,
                         rpool);

            if (rl == NULL)
            {
                ldap_memfree(dn);
                SM_LDAP_ERROR_CLEANUP();
                errno = ENOMEM;
                return EX_OSERR;
            }
            else if (rl->lr_done)
            {
                /* already on list, skip it */
                ldap_memfree(dn);
                continue;
            }
            ldap_memfree(dn);

# if !defined(LDAP_VERSION_MAX) && !defined(LDAP_OPT_SIZELIMIT)
            /*
            **  Reset value to prevent lingering
            **  LDAP_DECODING_ERROR due to
            **  OpenLDAP 1.X's hack (see below)
            */

            lmap->ldap_ld->ld_errno = LDAP_SUCCESS;
# endif /* !defined(LDAP_VERSION_MAX) !defined(LDAP_OPT_SIZELIMIT) */

            for (attr = ldap_first_attribute(lmap->ldap_ld, entry,
                             &ber);
                 attr != NULL;
                 attr = ldap_next_attribute(lmap->ldap_ld, entry,
                            ber))
            {
                char *tmp, *vp_tmp;
                int type;
                char *needobjclass = NULL;

                type = SM_LDAP_ATTR_NONE;
                for (i = 0; lmap->ldap_attr[i] != NULL; i++)
                {
                    if (sm_strcasecmp(lmap->ldap_attr[i],
                              attr) == 0)
                    {
                        type = lmap->ldap_attr_type[i];
                        needobjclass = lmap->ldap_attr_needobjclass[i];
                        break;
                    }
                }

                if (bitset(SM_LDAP_USE_ALLATTR, flags) &&
                    type == SM_LDAP_ATTR_NONE)
                {
                    /* URL lookups specify attrs to use */
                    type = SM_LDAP_ATTR_NORMAL;
                    needobjclass = NULL;
                }

                if (type == SM_LDAP_ATTR_NONE)
                {
                    /* attribute not requested */
                    ldap_memfree(attr);
                    SM_LDAP_ERROR_CLEANUP();
                    errno = EFAULT;
                    return EX_SOFTWARE;
                }

                /*
                **  For recursion on a particular attribute,
                **  we may need to see if this entry is
                **  part of a particular objectclass.
                **  Also, ignore objectClass attribute.
                **  Otherwise we just ignore this attribute.
                */

                if (type == SM_LDAP_ATTR_OBJCLASS ||
                    (needobjclass != NULL &&
                     !sm_ldap_has_objectclass(lmap, entry,
                                  needobjclass)))
                {
                    ldap_memfree(attr);
                    continue;
                }

                if (lmap->ldap_attrsonly == LDAPMAP_FALSE)
                {
                    vals = ldap_get_values(lmap->ldap_ld,
                                   entry,
                                   attr);
                    if (vals == NULL)
                    {
                        save_errno = sm_ldap_geterrno(lmap->ldap_ld);
                        if (save_errno == LDAP_SUCCESS)
                        {
                            ldap_memfree(attr);
                            continue;
                        }

                        /* Must be an error */
                        save_errno += E_LDAPBASE;
                        ldap_memfree(attr);
                        SM_LDAP_ERROR_CLEANUP();
                        errno = save_errno;
                        return EX_TEMPFAIL;
                    }
                }

                statp = EX_OK;

# if !defined(LDAP_VERSION_MAX) && !defined(LDAP_OPT_SIZELIMIT)
                /*
                **  Reset value to prevent lingering
                **  LDAP_DECODING_ERROR due to
                **  OpenLDAP 1.X's hack (see below)
                */

                lmap->ldap_ld->ld_errno = LDAP_SUCCESS;
# endif /* !defined(LDAP_VERSION_MAX) !defined(LDAP_OPT_SIZELIMIT) */

                /*
                **  If matching only,
                **  no need to spin through entries
                */

                if (bitset(SM_LDAP_MATCHONLY, flags))
                {
                    if (lmap->ldap_attrsonly == LDAPMAP_FALSE)
                        ldap_value_free(vals);
                    ldap_memfree(attr);
                    continue;
                }

                /*
                **  If we don't want multiple values,
                **  return first found.
                */

                if ((char) delim == '\0')
                {
                    if (*result != NULL)
                    {
                        /* already have a value */
                        if (bitset(SM_LDAP_SINGLEMATCH,
                               flags))
                        {
                            /* only wanted one match */
                            SM_LDAP_ERROR_CLEANUP();
                            errno = ENOENT;
                            return EX_NOTFOUND;
                        }
                        break;
                    }

                    if (lmap->ldap_attrsonly == LDAPMAP_TRUE)
                    {
                        *result = sm_rpool_strdup_x(rpool,
                                        attr);
                        ldap_memfree(attr);
                        break;
                    }

                    if (vals[0] == NULL)
                    {
                        ldap_value_free(vals);
                        ldap_memfree(attr);
                        continue;
                    }

                    vsize = strlen(vals[0]) + 1;
                    if (lmap->ldap_attrsep != '\0')
                        vsize += strlen(attr) + 1;
                    *result = sm_rpool_malloc_x(rpool,
                                    vsize);
                    if (lmap->ldap_attrsep != '\0')
                        sm_snprintf(*result, vsize,
                                "%s%c%s",
                                attr,
                                lmap->ldap_attrsep,
                                vals[0]);
                    else
                        sm_strlcpy(*result, vals[0],
                               vsize);
                    ldap_value_free(vals);
                    ldap_memfree(attr);
                    break;
                }

                /* attributes only */
                if (lmap->ldap_attrsonly == LDAPMAP_TRUE)
                {
                    if (*result == NULL)
                        *result = sm_rpool_strdup_x(rpool,
                                        attr);
                    else
                    {
                        if (bitset(SM_LDAP_SINGLEMATCH,
                               flags) &&
                            *result != NULL)
                        {
                            /* only wanted one match */
                            SM_LDAP_ERROR_CLEANUP();
                            errno = ENOENT;
                            return EX_NOTFOUND;
                        }

                        vsize = strlen(*result) +
                            strlen(attr) + 2;
                        tmp = sm_rpool_malloc_x(rpool,
                                    vsize);
                        (void) sm_snprintf(tmp,
                            vsize, "%s%c%s",
                            *result, (char) delim,
                            attr);
                        *result = tmp;
                    }
                    ldap_memfree(attr);
                    continue;
                }

                /*
                **  If there is more than one, munge then
                **  into a map_coldelim separated string.
                **  If we are recursing we may have an entry
                **  with no 'normal' values to put in the
                **  string.
                **  This is not an error.
                */

                if (type == SM_LDAP_ATTR_NORMAL &&
                    bitset(SM_LDAP_SINGLEMATCH, flags) &&
                    *result != NULL)
                {
                    /* only wanted one match */
                    SM_LDAP_ERROR_CLEANUP();
                    errno = ENOENT;
                    return EX_NOTFOUND;
                }

                vsize = 0;
                for (i = 0; vals[i] != NULL; i++)
                {
                    if (type == SM_LDAP_ATTR_DN ||
                        type == SM_LDAP_ATTR_FILTER ||
                        type == SM_LDAP_ATTR_URL)
                    {
                        /* add to recursion */
                        if (sm_ldap_add_recurse(&recurse,
                                    vals[i],
                                    type,
                                    rpool) == NULL)
                        {
                            SM_LDAP_ERROR_CLEANUP();
                            errno = ENOMEM;
                            return EX_OSERR;
                        }
                        continue;
                    }

                    vsize += strlen(vals[i]) + 1;
                    if (lmap->ldap_attrsep != '\0')
                        vsize += strlen(attr) + 1;
                }

                /*
                **  Create/Append to string any normal
                **  attribute values.  Otherwise, just free
                **  memory and move on to the next
                **  attribute in this entry.
                */

                if (type == SM_LDAP_ATTR_NORMAL && vsize > 0)
                {
                    char *pe;

                    /* Grow result string if needed */
                    if ((*resultln + vsize) >= *resultsz)
                    {
                        while ((*resultln + vsize) >= *resultsz)
                        {
                            if (*resultsz == 0)
                                *resultsz = 1024;
                            else
                                *resultsz *= 2;
                        }

                        vp_tmp = sm_rpool_malloc_x(rpool, *resultsz);
                        *vp_tmp = '\0';

                        if (*result != NULL)
                            sm_strlcpy(vp_tmp,
                                   *result,
                                   *resultsz);
                        *result = vp_tmp;
                    }

                    p = *result + *resultln;
                    pe = *result + *resultsz;

                    for (i = 0; vals[i] != NULL; i++)
                    {
                        if (*resultln > 0 &&
                            p < pe)
                            *p++ = (char) delim;

                        if (lmap->ldap_attrsep != '\0')
                        {
                            p += sm_strlcpy(p, attr,
                                    pe - p);
                            if (p < pe)
                                *p++ = lmap->ldap_attrsep;
                        }

                        p += sm_strlcpy(p, vals[i],
                                pe - p);
                        *resultln = p - (*result);
                        if (p >= pe)
                        {
                            /* Internal error: buffer too small for LDAP values */
                            SM_LDAP_ERROR_CLEANUP();
                            errno = ENOMEM;
                            return EX_OSERR;
                        }
                    }
                }

                ldap_value_free(vals);
                ldap_memfree(attr);
            }
            save_errno = sm_ldap_geterrno(lmap->ldap_ld);

            /*
            **  We check save_errno != LDAP_DECODING_ERROR since
            **  OpenLDAP 1.X has a very ugly *undocumented*
            **  hack of returning this error code from
            **  ldap_next_attribute() if the library freed the
            **  ber attribute.  See:
            **  http://www.openldap.org/lists/openldap-devel/9901/msg00064.html
            */

            if (save_errno != LDAP_SUCCESS &&
                save_errno != LDAP_DECODING_ERROR)
            {
                /* Must be an error */
                save_errno += E_LDAPBASE;
                SM_LDAP_ERROR_CLEANUP();
                errno = save_errno;
                return EX_TEMPFAIL;
            }

            /* mark this DN as done */
            rl->lr_done = true;
            if (rl->lr_ludp != NULL)
            {
                ldap_free_urldesc(rl->lr_ludp);
                rl->lr_ludp = NULL;
            }
            if (rl->lr_attrs != NULL)
            {
                free(rl->lr_attrs);
                rl->lr_attrs = NULL;
            }

            /* We don't want multiple values and we have one */
            if ((char) delim == '\0' &&
                !bitset(SM_LDAP_SINGLEMATCH, flags) &&
                *result != NULL)
                break;
        }
        save_errno = sm_ldap_geterrno(lmap->ldap_ld);
        if (save_errno != LDAP_SUCCESS &&
            save_errno != LDAP_DECODING_ERROR)
        {
            /* Must be an error */
            save_errno += E_LDAPBASE;
            SM_LDAP_ERROR_CLEANUP();
            errno = save_errno;
            return EX_TEMPFAIL;
        }
        ldap_msgfree(lmap->ldap_res);
        lmap->ldap_res = NULL;
    }

    if (ret == 0)
        save_errno = ETIMEDOUT;
    else
    {
        int rc;

        /*
        **  We may have gotten an LDAP_RES_SEARCH_RESULT response
        **  with an error inside it, so we have to extract that
        **  with ldap_parse_result().  This can happen when talking
        **  to an LDAP proxy whose backend has gone down.
        */

        save_errno = ldap_parse_result(lmap->ldap_ld, lmap->ldap_res,
                       &rc, NULL, NULL, NULL, NULL, 0);
        if (save_errno == LDAP_SUCCESS)
            save_errno = rc;
    }
    if (save_errno != LDAP_SUCCESS)
    {
        statp = EX_TEMPFAIL;
        switch (save_errno)
        {
#ifdef LDAP_SERVER_DOWN
          case LDAP_SERVER_DOWN:
#endif /* LDAP_SERVER_DOWN */
          case LDAP_TIMEOUT:
          case ETIMEDOUT:
          case LDAP_UNAVAILABLE:

            /*
            **  server disappeared,
            **  try reopen on next search
            */

            statp = EX_RESTART;
            break;
        }
        if (ret != 0)
            save_errno += E_LDAPBASE;
        SM_LDAP_ERROR_CLEANUP();
        errno = save_errno;
        return statp;
    }

    if (lmap->ldap_res != NULL)
    {
        ldap_msgfree(lmap->ldap_res);
        lmap->ldap_res = NULL;
    }

    if (toplevel)
    {
        int rlidx;

        /*
        **  Spin through the built-up recurse list at the top
        **  of the recursion.  Since new items are added at the
        **  end of the shared list, we actually only ever get
        **  one level of recursion before things pop back to the
        **  top.  Any items added to the list during that recursion
        **  will be expanded by the top level.
        */

        for (rlidx = 0; recurse != NULL && rlidx < recurse->lrl_cnt;
             rlidx++)
        {
            int newflags;
            int sid;
            int status;

            rl = recurse->lrl_data[rlidx];

            newflags = flags;
            if (rl->lr_done)
            {
                /* already expanded */
                continue;
            }

            if (rl->lr_type == SM_LDAP_ATTR_DN)
            {
                /* do DN search */
                sid = ldap_search(lmap->ldap_ld,
                          rl->lr_search,
                          lmap->ldap_scope,
                          "(objectClass=*)",
                          (lmap->ldap_attr[0] == NULL ?
                           NULL : lmap->ldap_attr),
                          lmap->ldap_attrsonly);
            }
            else if (rl->lr_type == SM_LDAP_ATTR_FILTER)
            {
                /* do new search */
                sid = ldap_search(lmap->ldap_ld,
                          lmap->ldap_base,
                          lmap->ldap_scope,
                          rl->lr_search,
                          (lmap->ldap_attr[0] == NULL ?
                           NULL : lmap->ldap_attr),
                          lmap->ldap_attrsonly);
            }
            else if (rl->lr_type == SM_LDAP_ATTR_URL)
            {
                /* Parse URL */
                sid = ldap_url_parse(rl->lr_search,
                             &rl->lr_ludp);

                if (sid != 0)
                {
                    errno = sid + E_LDAPURLBASE;
                    return EX_TEMPFAIL;
                }

                /* We need to add objectClass */
                if (rl->lr_ludp->lud_attrs != NULL)
                {
                    int attrnum = 0;

                    while (rl->lr_ludp->lud_attrs[attrnum] != NULL)
                    {
                        if (strcasecmp(rl->lr_ludp->lud_attrs[attrnum],
                                   "objectClass") == 0)
                        {
                            /* already requested */
                            attrnum = -1;
                            break;
                        }
                        attrnum++;
                    }

                    if (attrnum >= 0)
                    {
                        int i;

                        rl->lr_attrs = (char **)malloc(sizeof(char *) * (attrnum + 2));
                        if (rl->lr_attrs == NULL)
                        {
                            save_errno = errno;
                            ldap_free_urldesc(rl->lr_ludp);
                            errno = save_errno;
                            return EX_TEMPFAIL;
                        }
                        for (i = 0 ; i < attrnum; i++)
                        {
                            rl->lr_attrs[i] = rl->lr_ludp->lud_attrs[i];
                        }
                        rl->lr_attrs[i++] = "objectClass";
                        rl->lr_attrs[i++] = NULL;
                    }
                }

                /*
                **  Use the existing connection
                **  for this search.  It really
                **  should use lud_scheme://lud_host:lud_port/
                **  instead but that would require
                **  opening a new connection.
                **  This should be fixed ASAP.
                */

                sid = ldap_search(lmap->ldap_ld,
                          rl->lr_ludp->lud_dn,
                          rl->lr_ludp->lud_scope,
                          rl->lr_ludp->lud_filter,
                          rl->lr_attrs,
                          lmap->ldap_attrsonly);

                /* Use the attributes specified by URL */
                newflags |= SM_LDAP_USE_ALLATTR;
            }
            else
            {
                /* unknown or illegal attribute type */
                errno = EFAULT;
                return EX_SOFTWARE;
            }

            /* Collect results */
            if (sid == -1)
            {
                save_errno = sm_ldap_geterrno(lmap->ldap_ld);
                statp = EX_TEMPFAIL;
                switch (save_errno)
                {
#ifdef LDAP_SERVER_DOWN
                  case LDAP_SERVER_DOWN:
#endif /* LDAP_SERVER_DOWN */
                  case LDAP_TIMEOUT:
                  case ETIMEDOUT:
                  case LDAP_UNAVAILABLE:

                    /*
                    **  server disappeared,
                    **  try reopen on next search
                    */

                    statp = EX_RESTART;
                    break;
                }
                errno = save_errno + E_LDAPBASE;
                return statp;
            }

            status = sm_ldap_results(lmap, sid, newflags, delim,
                         rpool, result, resultln,
                         resultsz, recurse);
            save_errno = errno;
            if (status != EX_OK && status != EX_NOTFOUND)
            {
                errno = save_errno;
                return status;
            }

            /* Mark as done */
            rl->lr_done = true;
            if (rl->lr_ludp != NULL)
            {
                ldap_free_urldesc(rl->lr_ludp);
                rl->lr_ludp = NULL;
            }
            if (rl->lr_attrs != NULL)
            {
                free(rl->lr_attrs);
                rl->lr_attrs = NULL;
            }

            /* Reset rlidx as new items may have been added */
            rlidx = -1;
        }
    }
    return statp;
}

/*
**  SM_LDAP_CLOSE -- close LDAP connection
**
**  Parameters:
**      lmap -- LDAP map information
**
**  Returns:
**      None.
**
*/

void
sm_ldap_close(lmap)
    SM_LDAP_STRUCT *lmap;
{
    if (lmap->ldap_ld == NULL)
        return;

    if (lmap->ldap_pid == getpid())
        ldap_unbind(lmap->ldap_ld);
    lmap->ldap_ld = NULL;
    lmap->ldap_pid = 0;
}

/*
**  SM_LDAP_SETOPTS -- set LDAP options
**
**  Parameters:
**      ld -- LDAP session handle
**      lmap -- LDAP map information
**
**  Returns:
**      None.
**
*/

void
sm_ldap_setopts(ld, lmap)
    LDAP *ld;
    SM_LDAP_STRUCT *lmap;
{
# if USE_LDAP_SET_OPTION
    if (lmap->ldap_version != 0)
    {
        ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION,
                &lmap->ldap_version);
    }
    ldap_set_option(ld, LDAP_OPT_DEREF, &lmap->ldap_deref);
    if (bitset(LDAP_OPT_REFERRALS, lmap->ldap_options))
        ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON);
    else
        ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
    ldap_set_option(ld, LDAP_OPT_SIZELIMIT, &lmap->ldap_sizelimit);
    ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &lmap->ldap_timelimit);
#  if _FFR_LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT)
    if (lmap->ldap_networktmo > 0)
    {
        struct timeval tmo;

        tmo.tv_sec = lmap->ldap_networktmo;
        tmo.tv_usec = 0;
        ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tmo);
    }
#  endif /* _FFR_LDAP_NETWORK_TIMEOUT && defined(LDAP_OPT_NETWORK_TIMEOUT) */
#  ifdef LDAP_OPT_RESTART
    ldap_set_option(ld, LDAP_OPT_RESTART, LDAP_OPT_ON);
#  endif /* LDAP_OPT_RESTART */
# else /* USE_LDAP_SET_OPTION */
    /* From here on in we can use ldap internal timelimits */
    ld->ld_deref = lmap->ldap_deref;
    ld->ld_options = lmap->ldap_options;
    ld->ld_sizelimit = lmap->ldap_sizelimit;
    ld->ld_timelimit = lmap->ldap_timelimit;
# endif /* USE_LDAP_SET_OPTION */
}

/*
**  SM_LDAP_GETERRNO -- get ldap errno value
**
**  Parameters:
**      ld -- LDAP session handle
**
**  Returns:
**      LDAP errno.
**
*/

int
sm_ldap_geterrno(ld)
    LDAP *ld;
{
    int err = LDAP_SUCCESS;

# if defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3
    (void) ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &err);
# else /* defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3 */
#  ifdef LDAP_OPT_SIZELIMIT
    err = ldap_get_lderrno(ld, NULL, NULL);
#  else /* LDAP_OPT_SIZELIMIT */
    err = ld->ld_errno;

    /*
    **  Reset value to prevent lingering LDAP_DECODING_ERROR due to
    **  OpenLDAP 1.X's hack (see above)
    */

    ld->ld_errno = LDAP_SUCCESS;
#  endif /* LDAP_OPT_SIZELIMIT */
# endif /* defined(LDAP_VERSION_MAX) && LDAP_VERSION_MAX >= 3 */
    return err;
}
# endif /* LDAPMAP */