X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=libraries%2Flibldap%2Fgetdn.c;h=4dd2279ee5fd0ab31748b52fb4eca7e39aa5c5cf;hb=70092b38fb23b9141a2b8414fb5a9c5200f3c12d;hp=f3c60465fd42b44a6bca5f3f58fe3164b1d50d24;hpb=959edd88c0dc0ad558d9ebc423996c7a9d0f8cbc;p=openldap diff --git a/libraries/libldap/getdn.c b/libraries/libldap/getdn.c index f3c60465fd..4dd2279ee5 100644 --- a/libraries/libldap/getdn.c +++ b/libraries/libldap/getdn.c @@ -28,7 +28,7 @@ #define PRETTY_ESCAPE /* parsing/printing routines */ -static int str2strval( const char *str, struct berval *val, +static int str2strval( const char *str, ber_len_t stoplen, struct berval *val, const char **next, unsigned flags, unsigned *retFlags ); static int DCE2strval( const char *str, struct berval *val, const char **next, unsigned flags ); @@ -84,12 +84,15 @@ ldap_get_dn( LDAP *ld, LDAPMessage *entry ) char *dn; BerElement tmp; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_get_dn\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_get_dn\n", 0, 0, 0 ); +#endif - if ( entry == NULL ) { - ld->ld_errno = LDAP_PARAM_ERROR; - return( NULL ); - } + assert( ld != NULL ); + assert( LDAP_VALID(ld) ); + assert( entry != NULL ); tmp = *entry->lm_ber; /* struct copy */ if ( ber_scanf( &tmp, "{a" /*}*/, &dn ) == LBER_ERROR ) { @@ -108,7 +111,11 @@ ldap_dn2ufn( LDAP_CONST char *dn ) { char *out = NULL; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_dn2ufn\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_dn2ufn\n", 0, 0, 0 ); +#endif ( void )ldap_dn_normalize( dn, LDAP_DN_FORMAT_LDAP, &out, LDAP_DN_FORMAT_UFN ); @@ -127,7 +134,11 @@ ldap_explode_dn( LDAP_CONST char *dn, int notypes ) int iRDN; unsigned flag = notypes ? LDAP_DN_FORMAT_UFN : LDAP_DN_FORMAT_LDAPV3; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_explode_dn\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_explode_dn\n", 0, 0, 0 ); +#endif if ( ldap_str2dn( dn, &tmpDN, LDAP_DN_FORMAT_LDAP ) != LDAP_SUCCESS ) { @@ -167,7 +178,11 @@ ldap_explode_rdn( LDAP_CONST char *rdn, int notypes ) const char *p; int iAVA; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_explode_rdn\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_explode_rdn\n", 0, 0, 0 ); +#endif /* * we only parse the first rdn @@ -248,7 +263,11 @@ ldap_dn2dcedn( LDAP_CONST char *dn ) { char *out = NULL; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_dn2dcedn\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_dn2dcedn\n", 0, 0, 0 ); +#endif ( void )ldap_dn_normalize( dn, LDAP_DN_FORMAT_LDAP, &out, LDAP_DN_FORMAT_DCE ); @@ -261,7 +280,11 @@ ldap_dcedn2dn( LDAP_CONST char *dce ) { char *out = NULL; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_dcedn2dn\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_dcedn2dn\n", 0, 0, 0 ); +#endif ( void )ldap_dn_normalize( dce, LDAP_DN_FORMAT_DCE, &out, LDAP_DN_FORMAT_LDAPV3 ); @@ -273,7 +296,11 @@ ldap_dn2ad_canonical( LDAP_CONST char *dn ) { char *out = NULL; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_dn2ad_canonical\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_dn2ad_canonical\n", 0, 0, 0 ); +#endif ( void )ldap_dn_normalize( dn, LDAP_DN_FORMAT_LDAP, &out, LDAP_DN_FORMAT_AD_CANONICAL ); @@ -305,7 +332,11 @@ ldap_dn_normalize( LDAP_CONST char *dnin, int rc; LDAPDN *tmpDN = NULL; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ENTRY, "ldap_dn_normalize\n" )); +#else Debug( LDAP_DEBUG_TRACE, "ldap_dn_normalize\n", 0, 0, 0 ); +#endif assert( dnout ); @@ -599,24 +630,20 @@ ldap_dnfree( LDAPDN *dn ) #define TMP_RDN_SLOTS 32 int -ldap_bv2dn( struct berval *bv, LDAPDN **dn, unsigned flags ) +ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) { - assert( bv ); - assert( dn ); - - /* - * FIXME: ldap_bv2dn() and ldap_str2dn() will be swapped, - * i.e. ldap_str2dn() will become a wrapper for ldap_bv2dn() - */ - if ( bv->bv_len != strlen( bv->bv_val ) ) { - return LDAP_INVALID_DN_SYNTAX; - } + struct berval bv; - return ldap_str2dn( bv->bv_val, dn, flags ); + assert( str ); + + bv.bv_len = strlen( str ); + bv.bv_val = (char *) str; + + return ldap_bv2dn( &bv, dn, flags ); } int -ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) +ldap_bv2dn( struct berval *bv, LDAPDN **dn, unsigned flags ) { const char *p; int rc = LDAP_DECODING_ERROR; @@ -625,11 +652,19 @@ ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) LDAPDN *newDN = NULL; LDAPRDN *newRDN = NULL, *tmpDN_[TMP_RDN_SLOTS], **tmpDN = tmpDN_; int num_slots = TMP_RDN_SLOTS; + char *str = bv->bv_val; + char *end = str + bv->bv_len; - assert( str ); + assert( bv ); + assert( bv->bv_val ); assert( dn ); - Debug( LDAP_DEBUG_TRACE, "=> ldap_str2dn(%s,%u)\n%s", str, flags, "" ); +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ARGS, "ldap_bv2dn(%s,%u)\n%s", + str, flags, "" )); +#else + Debug( LDAP_DEBUG_TRACE, "=> ldap_bv2dn(%s,%u)\n%s", str, flags, "" ); +#endif *dn = NULL; @@ -650,10 +685,15 @@ ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) return LDAP_PARAM_ERROR; } - if ( str[ 0 ] == '\0' ) { + if ( bv->bv_len == 0 ) { return LDAP_SUCCESS; } + if( memchr( bv->bv_val, '\0', bv->bv_len ) != NULL ) { + /* value must have embedded NULs */ + return LDAP_DECODING_ERROR; + } + p = str; if ( LDAP_DN_DCE( flags ) ) { @@ -682,10 +722,13 @@ ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) #endif } - for ( ; p[ 0 ]; p++ ) { + for ( ; p < end; p++ ) { int err; + struct berval tmpbv; + tmpbv.bv_len = bv->bv_len - ( p - str ); + tmpbv.bv_val = (char *)p; - err = ldap_str2rdn( p, &newRDN, (char **) &p, flags ); + err = ldap_bv2rdn( &tmpbv, &newRDN, (char **) &p, flags ); if ( err != LDAP_SUCCESS ) { goto parsing_error; } @@ -693,7 +736,7 @@ ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) /* * We expect a rdn separator */ - if ( p[ 0 ] ) { + if ( p < end && p[ 0 ] ) { switch ( LDAP_DN_FORMAT( flags ) ) { case LDAP_DN_FORMAT_LDAPV3: if ( !LDAP_DN_RDN_SEP( p[ 0 ] ) ) { @@ -749,7 +792,7 @@ ldap_str2dn( LDAP_CONST char *str, LDAPDN **dn, unsigned flags ) num_slots *= 2; } - if ( p[ 0 ] == '\0' ) { + if ( p >= end || p[ 0 ] == '\0' ) { /* * the DN is over, phew */ @@ -793,7 +836,12 @@ return_result:; LDAP_FREE( tmpDN ); } - Debug( LDAP_DEBUG_TRACE, "<= ldap_str2dn(%s,%u)=%d\n", str, flags, rc ); +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_RESULTS, "<= ldap_bv2dn(%s,%u)=%d\n", + str, flags, rc )); +#else + Debug( LDAP_DEBUG_TRACE, "<= ldap_bv2dn(%s,%u)=%d\n", str, flags, rc ); +#endif *dn = newDN; return( rc ); @@ -811,7 +859,22 @@ int ldap_str2rdn( LDAP_CONST char *str, LDAPRDN **rdn, char **n_in, unsigned flags ) { - const char **n = (const char **) n_in; + struct berval bv; + + assert( str ); + assert( str[ 0 ] != '\0' ); /* FIXME: is this required? */ + + bv.bv_len = strlen( str ); + bv.bv_val = (char *) str; + + return ldap_bv2rdn( &bv, rdn, n_in, flags ); +} + +int +ldap_bv2rdn( struct berval *bv, LDAPRDN **rdn, + char **n_in, unsigned flags ) +{ + const char **n = (const char **) n_in; const char *p; int navas = 0; int state = B4AVA; @@ -825,14 +888,18 @@ ldap_str2rdn( LDAP_CONST char *str, LDAPRDN **rdn, LDAPRDN *newRDN = NULL; LDAPAVA *tmpRDN_[TMP_AVA_SLOTS], **tmpRDN = tmpRDN_; int num_slots = TMP_AVA_SLOTS; + + char *str; + ber_len_t stoplen; - assert( str ); + assert( bv ); + assert( bv->bv_len ); + assert( bv->bv_val ); assert( rdn || flags & LDAP_DN_SKIP ); assert( n ); -#if 0 - Debug( LDAP_DEBUG_TRACE, "=> ldap_str2rdn(%s,%u)\n%s", str, flags, "" ); -#endif + str = bv->bv_val; + stoplen = bv->bv_len; if ( rdn ) { *rdn = NULL; @@ -856,8 +923,14 @@ ldap_str2rdn( LDAP_CONST char *str, LDAPRDN **rdn, return LDAP_PARAM_ERROR; } - if ( str[ 0 ] == '\0' ) { + if ( bv->bv_len == 0 ) { return LDAP_SUCCESS; + + } + + if( memchr( bv->bv_val, '\0', bv->bv_len ) != NULL ) { + /* value must have embedded NULs */ + return LDAP_DECODING_ERROR; } p = str; @@ -1126,7 +1199,8 @@ ldap_str2rdn( LDAP_CONST char *str, LDAPRDN **rdn, switch ( LDAP_DN_FORMAT( flags ) ) { case LDAP_DN_FORMAT_LDAP: case LDAP_DN_FORMAT_LDAPV3: - if ( str2strval( p, &attrValue, &p, flags, + if ( str2strval( p, stoplen - ( p - str ), + &attrValue, &p, flags, &attrValueEncoding ) ) { goto parsing_error; } @@ -1292,11 +1366,6 @@ return_result:; LDAP_FREE( tmpRDN ); } -#if 0 - Debug( LDAP_DEBUG_TRACE, "<= ldap_str2rdn(%*s)=%d\n", - p - str, str, rc ); -#endif - if ( rdn ) { *rdn = newRDN; } @@ -1310,9 +1379,9 @@ return_result:; * '\' + HEXPAIR(p) -> unhex(p) */ static int -str2strval( const char *str, struct berval *val, const char **next, unsigned flags, unsigned *retFlags ) +str2strval( const char *str, ber_len_t stoplen, struct berval *val, const char **next, unsigned flags, unsigned *retFlags ) { - const char *p, *startPos, *endPos = NULL; + const char *p, *end, *startPos, *endPos = NULL; ber_len_t len, escapes; assert( str ); @@ -1320,8 +1389,8 @@ str2strval( const char *str, struct berval *val, const char **next, unsigned fla assert( next ); *next = NULL; - - for ( startPos = p = str, escapes = 0; p[ 0 ]; p++ ) { + end = str + stoplen; + for ( startPos = p = str, escapes = 0; p < end; p++ ) { if ( LDAP_DN_ESCAPE( p[ 0 ] ) ) { p++; if ( p[ 0 ] == '\0' ) { @@ -1362,6 +1431,9 @@ str2strval( const char *str, struct berval *val, const char **next, unsigned fla return( 1 ); } else if (!LDAP_DN_ASCII_PRINTABLE( p[ 0 ] ) ) { + if ( p[ 0 ] == '\0' ) { + return( 1 ); + } *retFlags = LDAP_AVA_NONPRINTABLE; } else if ( ( LDAP_DN_LDAP( flags ) && LDAP_DN_VALUE_END_V2( p[ 0 ] ) ) @@ -1409,7 +1481,13 @@ str2strval( const char *str, struct berval *val, const char **next, unsigned fla val->bv_len = len; if ( escapes == 0 ) { - val->bv_val = LDAP_STRNDUP( startPos, len ); + if ( *retFlags == LDAP_AVA_NONPRINTABLE ) { + val->bv_val = LDAP_MALLOC( len + 1 ); + AC_MEMCPY( val->bv_val, startPos, len ); + val->bv_val[ len ] = '\0'; + } else { + val->bv_val = LDAP_STRNDUP( startPos, len ); + } } else { ber_len_t s, d; @@ -1674,7 +1752,7 @@ quotedIA52strval( const char *str, struct berval *val, const char **next, unsign } len = endPos - startPos - escapes; - assert( len >= 0 ); + assert( endPos >= startPos + escapes ); val->bv_len = len; if ( escapes == 0 ) { val->bv_val = LDAP_STRNDUP( startPos, len ); @@ -2799,7 +2877,7 @@ ldap_rdn2bv( LDAPRDN *rdn, struct berval *bv, unsigned flags ) break; default: - return( LDAP_PARAM_ERROR ); + return LDAP_PARAM_ERROR; } bv->bv_val = LDAP_MALLOC( l + 1 ); @@ -2888,7 +2966,12 @@ int ldap_dn2bv( LDAPDN *dn, struct berval *bv, unsigned flags ) bv->bv_len = 0; bv->bv_val = NULL; +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_ARGS, "=> ldap_dn2bv(%u)\n%s%s", + flags, "", "" )); +#else Debug( LDAP_DEBUG_TRACE, "=> ldap_dn2bv(%u)\n%s%s", flags, "", "" ); +#endif /* * a null dn means an empty dn string @@ -3195,10 +3278,204 @@ int ldap_dn2bv( LDAPDN *dn, struct berval *bv, unsigned flags ) return LDAP_PARAM_ERROR; } +#ifdef NEW_LOGGING + LDAP_LOG (( "getdn", LDAP_LEVEL_RESULTS, "<= ldap_dn2bv(%s,%u)=%d\n", + bv->bv_val, flags, rc )); +#else Debug( LDAP_DEBUG_TRACE, "<= ldap_dn2bv(%s,%u)=%d\n", bv->bv_val, flags, rc ); +#endif return_results:; return( rc ); } +#ifdef HAVE_TLS +#include +#include + +/* Convert a structured DN from an X.509 certificate into an LDAPV3 DN. + * x509_name must be an (X509_NAME *). If func is non-NULL, the + * constructed DN will use numeric OIDs to identify attributeTypes, + * and the func() will be invoked to rewrite the DN with the given + * flags. + * + * Otherwise the DN will use shortNames as defined in the OpenSSL + * library. + * + * It's preferable to let slapd do the OID to attributeType mapping, + * because the OpenSSL tables are known to have many typos in versions + * up to (at least) 0.9.6c. However, the LDAP client has no schema tables, + * so we're forced to use OpenSSL's mapping there. + * -- Howard Chu 2002-04-18 + */ + +int +ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func, + unsigned flags ) +{ + LDAPDN *newDN; + LDAPRDN *newRDN; + LDAPAVA *newAVA, *baseAVA; + X509_NAME_ENTRY *ne; + ASN1_OBJECT *obj; + ASN1_STRING *str; + char oids[8192], *oidptr = oids, *oidbuf = NULL; + void *ptrs[2048]; + int i, j, k = 0, navas, nrdns, rc = LDAP_SUCCESS; + int set = -1; + size_t dnsize, oidrem = sizeof(oids), oidsize = 0; + int csize; + + struct berval Val; + + assert( bv ); + bv->bv_len = 0; + bv->bv_val = NULL; + + /* Get the number of AVAs. This is not necessarily the same as + * the number of RDNs. + */ + navas = X509_NAME_entry_count( x509_name ); + + /* Get the last element, to see how many RDNs there are */ + ne = X509_NAME_get_entry( x509_name, navas - 1 ); + nrdns = ne->set + 1; + + /* Allocate the DN/RDN/AVA stuff as a single block */ + dnsize = sizeof(LDAPDN) + sizeof(LDAPRDN *) * (nrdns+1); + dnsize += sizeof(LDAPRDN) * nrdns + sizeof(LDAPAVA *) * (navas+nrdns); + dnsize += sizeof(LDAPAVA) * navas; + if (dnsize > sizeof(ptrs)) { + newDN = (LDAPDN *)LDAP_MALLOC( dnsize ); + if ( newDN == NULL ) + return LDAP_NO_MEMORY; + } else { + newDN = (LDAPDN *)ptrs; + } + + newDN[0] = (LDAPRDN**)(newDN+1); + newDN[0][nrdns] = NULL; + newRDN = (LDAPRDN*)(newDN[0] + nrdns+1); + newAVA = (LDAPAVA*)(newRDN + navas + nrdns*2); + baseAVA = newAVA; + + /* Retrieve RDNs in reverse order; LDAP is backwards from X.500. */ + for ( i = nrdns - 1, j = 0; i >= 0; i-- ) { + ne = X509_NAME_get_entry( x509_name, i ); + obj = X509_NAME_ENTRY_get_object( ne ); + str = X509_NAME_ENTRY_get_data( ne ); + + /* If set changed, move to next RDN */ + if ( set != ne->set ) { + /* If this is not the first time, end the + * previous RDN and advance. + */ + if ( j > 0 ) { + newRDN[0][k] = NULL; + newRDN = (LDAPRDN*)(newRDN[0]+k+1); + } + newDN[0][j++] = newRDN; + + newRDN[0] = (LDAPAVA**)(newRDN+1); + k = 0; + set = ne->set; + } + newAVA->la_private = NULL; + newAVA->la_flags = LDAP_AVA_STRING; + + if ( !func ) { + int n = OBJ_obj2nid( obj ); + + if (n == NID_undef) + goto get_oid; + newAVA->la_attr.bv_val = (char *)OBJ_nid2sn( n ); + newAVA->la_attr.bv_len = strlen( newAVA->la_attr.bv_val ); + } else { +get_oid: newAVA->la_attr.bv_val = oidptr; + newAVA->la_attr.bv_len = OBJ_obj2txt( oidptr, oidrem, obj, 1 ); + oidptr += newAVA->la_attr.bv_len + 1; + oidrem -= newAVA->la_attr.bv_len + 1; + + /* Running out of OID buffer space? */ + if (oidrem < 128) { + if ( oidsize == 0 ) { + oidsize = sizeof(oids) * 2; + oidrem = oidsize; + oidbuf = LDAP_MALLOC( oidsize ); + if ( oidbuf == NULL ) goto nomem; + oidptr = oidbuf; + } else { + char *old = oidbuf; + oidbuf = LDAP_REALLOC( oidbuf, oidsize*2 ); + if ( oidbuf == NULL ) goto nomem; + /* Buffer moved! Fix AVA pointers */ + if ( old != oidbuf ) { + LDAPAVA *a; + long dif = oidbuf - old; + + for (a=baseAVA; a<=newAVA; a++){ + if (a->la_attr.bv_val >= old && + a->la_attr.bv_val <= (old + oidsize)) + a->la_attr.bv_val += dif; + } + } + oidptr = oidbuf + oidsize - oidrem; + oidrem += oidsize; + oidsize *= 2; + } + } + } + Val.bv_val = str->data; + Val.bv_len = str->length; + switch( str->type ) { + case V_ASN1_UNIVERSALSTRING: + /* This uses 32-bit ISO 10646-1 */ + csize = 4; goto to_utf8; + case V_ASN1_BMPSTRING: + /* This uses 16-bit ISO 10646-1 */ + csize = 2; goto to_utf8; + case V_ASN1_T61STRING: + /* This uses 8-bit, assume ISO 8859-1 */ + csize = 1; +to_utf8: rc = ldap_ucs_to_utf8s( &Val, csize, &newAVA->la_value ); + if (rc != LDAP_SUCCESS) goto nomem; + newAVA->la_flags = LDAP_AVA_NONPRINTABLE; + break; + case V_ASN1_UTF8STRING: + newAVA->la_flags = LDAP_AVA_NONPRINTABLE; + /* This is already in UTF-8 encoding */ + case V_ASN1_IA5STRING: + case V_ASN1_PRINTABLESTRING: + /* These are always 7-bit strings */ + ber_dupbv( &newAVA->la_value, &Val ); + default: + ; + } + newRDN[0][k] = newAVA; + newAVA++; + k++; + } + newRDN[0][k] = NULL; + + if ( func ) { + rc = func( newDN, flags ); + if ( rc != LDAP_SUCCESS ) + goto nomem; + } + + rc = ldap_dn2bv( newDN, bv, LDAP_DN_FORMAT_LDAPV3 ); + +nomem: + for (;baseAVA < newAVA; baseAVA++) { + LDAP_FREE( baseAVA->la_value.bv_val ); + } + + if ( oidsize != 0 ) + LDAP_FREE( oidbuf ); + if ( newDN != (LDAPDN*) ptrs ) + LDAP_FREE( newDN ); + return rc; +} +#endif /* HAVE_TLS */ +