git.sur5r.net Git - openldap/blob - libraries/libldap/request.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2015 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  16  * All rights reserved.
  17  */
  18 /* This notice applies to changes, created by or for Novell, Inc.,
  19  * to preexisting works for which notices appear elsewhere in this file.
  20  *
  21  * Copyright (C) 1999, 2000 Novell, Inc. All Rights Reserved.
  22  *
  23  * THIS WORK IS SUBJECT TO U.S. AND INTERNATIONAL COPYRIGHT LAWS AND TREATIES.
  24  * USE, MODIFICATION, AND REDISTRIBUTION OF THIS WORK IS SUBJECT TO VERSION
  25  * 2.0.1 OF THE OPENLDAP PUBLIC LICENSE, A COPY OF WHICH IS AVAILABLE AT
  26  * HTTP://WWW.OPENLDAP.ORG/LICENSE.HTML OR IN THE FILE "LICENSE" IN THE
  27  * TOP-LEVEL DIRECTORY OF THE DISTRIBUTION. ANY USE OR EXPLOITATION OF THIS
  28  * WORK OTHER THAN AS AUTHORIZED IN VERSION 2.0.1 OF THE OPENLDAP PUBLIC
  29  * LICENSE, OR OTHER PRIOR WRITTEN CONSENT FROM NOVELL, COULD SUBJECT THE
  30  * PERPETRATOR TO CRIMINAL AND CIVIL LIABILITY.
  31  *---
  32  * Modification to OpenLDAP source by Novell, Inc.
  33  * April 2000 sfs  Added code to chase V3 referrals
  34  *  request.c - sending of ldap requests; handling of referrals
  35  *---
  36  * Note: A verbatim copy of version 2.0.1 of the OpenLDAP Public License
  37  * can be found in the file "build/LICENSE-2.0.1" in this distribution
  38  * of OpenLDAP Software.
  39  */
  40
  41 #include "portable.h"
  42
  43 #include <stdio.h>
  44
  45 #include <ac/stdlib.h>
  46
  47 #include <ac/errno.h>
  48 #include <ac/socket.h>
  49 #include <ac/string.h>
  50 #include <ac/time.h>
  51 #include <ac/unistd.h>
  52
  53 #include "ldap-int.h"
  54 #include "lber.h"
  55
  56 /* used by ldap_send_server_request and ldap_new_connection */
  57 #ifdef LDAP_R_COMPILE
  58 #define LDAP_CONN_LOCK_IF(nolock) \
  59         { if (nolock) LDAP_MUTEX_LOCK( &ld->ld_conn_mutex ); }
  60 #define LDAP_CONN_UNLOCK_IF(nolock) \
  61         { if (nolock) LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex ); }
  62 #define LDAP_REQ_LOCK_IF(nolock) \
  63         { if (nolock) LDAP_MUTEX_LOCK( &ld->ld_req_mutex ); }
  64 #define LDAP_REQ_UNLOCK_IF(nolock) \
  65         { if (nolock) LDAP_MUTEX_UNLOCK( &ld->ld_req_mutex ); }
  66 #define LDAP_RES_LOCK_IF(nolock) \
  67         { if (nolock) LDAP_MUTEX_LOCK( &ld->ld_res_mutex ); }
  68 #define LDAP_RES_UNLOCK_IF(nolock) \
  69         { if (nolock) LDAP_MUTEX_UNLOCK( &ld->ld_res_mutex ); }
  70 #else
  71 #define LDAP_CONN_LOCK_IF(nolock)
  72 #define LDAP_CONN_UNLOCK_IF(nolock)
  73 #define LDAP_REQ_LOCK_IF(nolock)
  74 #define LDAP_REQ_UNLOCK_IF(nolock)
  75 #define LDAP_RES_LOCK_IF(nolock)
  76 #define LDAP_RES_UNLOCK_IF(nolock)
  77 #endif
  78
  79 static LDAPConn *find_connection LDAP_P(( LDAP *ld, LDAPURLDesc *srv, int any ));
  80 static void use_connection LDAP_P(( LDAP *ld, LDAPConn *lc ));
  81 static void ldap_free_request_int LDAP_P(( LDAP *ld, LDAPRequest *lr ));
  82
  83 static BerElement *
  84 re_encode_request( LDAP *ld,
  85         BerElement *origber,
  86         ber_int_t msgid,
  87         int sref,
  88         LDAPURLDesc *srv,
  89         int *type );
  90
  91 BerElement *
  92 ldap_alloc_ber_with_options( LDAP *ld )
  93 {
  94         BerElement      *ber;
  95
  96         ber = ber_alloc_t( ld->ld_lberoptions );
  97         if ( ber == NULL ) {
  98                 ld->ld_errno = LDAP_NO_MEMORY;
  99         }
 100
 101         return( ber );
 102 }
 103
 104
 105 void
 106 ldap_set_ber_options( LDAP *ld, BerElement *ber )
 107 {
 108         /* ld_lberoptions is constant, hence no lock */
 109         ber->ber_options = ld->ld_lberoptions;
 110 }
 111
 112
 113 /* sets needed mutexes - no mutexes set to this point */
 114 ber_int_t
 115 ldap_send_initial_request(
 116         LDAP *ld,
 117         ber_tag_t msgtype,
 118         const char *dn,
 119         BerElement *ber,
 120         ber_int_t msgid)
 121 {
 122         int rc = 1;
 123         ber_socket_t sd = AC_SOCKET_INVALID;
 124
 125         Debug( LDAP_DEBUG_TRACE, "ldap_send_initial_request\n", 0, 0, 0 );
 126
 127         LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 128         if ( ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, &sd ) == -1 ) {
 129                 /* not connected yet */
 130                 rc = ldap_open_defconn( ld );
 131
 132         }
 133         if ( ld->ld_defconn && ld->ld_defconn->lconn_status == LDAP_CONNST_CONNECTING )
 134                 rc = ldap_int_check_async_open( ld, sd );
 135         if( rc < 0 ) {
 136                 ber_free( ber, 1 );
 137                 LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 138                 return( -1 );
 139         } else if ( rc == 0 ) {
 140                 Debug( LDAP_DEBUG_TRACE,
 141                         "ldap_open_defconn: successful\n",
 142                         0, 0, 0 );
 143         }
 144
 145 #ifdef LDAP_CONNECTIONLESS
 146         if (LDAP_IS_UDP(ld)) {
 147                 if (msgtype == LDAP_REQ_BIND) {
 148                         LDAP_MUTEX_LOCK( &ld->ld_options.ldo_mutex );
 149                         if (ld->ld_options.ldo_cldapdn)
 150                                 ldap_memfree(ld->ld_options.ldo_cldapdn);
 151                         ld->ld_options.ldo_cldapdn = ldap_strdup(dn);
 152                         ber_free( ber, 1 );
 153                         LDAP_MUTEX_UNLOCK( &ld->ld_options.ldo_mutex );
 154                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 155                         return 0;
 156                 }
 157                 if (msgtype != LDAP_REQ_ABANDON && msgtype != LDAP_REQ_SEARCH)
 158                 {
 159                         ber_free( ber, 1 );
 160                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 161                         return LDAP_PARAM_ERROR;
 162                 }
 163         }
 164 #endif
 165         LDAP_MUTEX_LOCK( &ld->ld_req_mutex );
 166         rc = ldap_send_server_request( ld, ber, msgid, NULL,
 167                 NULL, NULL, NULL, 0, 0 );
 168         LDAP_MUTEX_UNLOCK( &ld->ld_req_mutex );
 169         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 170         return(rc);
 171 }
 172
 173
 174 /* protected by conn_mutex */
 175 int
 176 ldap_int_flush_request(
 177         LDAP *ld,
 178         LDAPRequest *lr )
 179 {
 180         LDAPConn *lc = lr->lr_conn;
 181
 182         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 183         if ( ber_flush2( lc->lconn_sb, lr->lr_ber, LBER_FLUSH_FREE_NEVER ) != 0 ) {
 184                 if ( sock_errno() == EAGAIN ) {
 185                         /* need to continue write later */
 186                         lr->lr_status = LDAP_REQST_WRITING;
 187                         ldap_mark_select_write( ld, lc->lconn_sb );
 188                         ld->ld_errno = LDAP_BUSY;
 189                         return -2;
 190                 } else {
 191                         ld->ld_errno = LDAP_SERVER_DOWN;
 192                         ldap_free_request( ld, lr );
 193                         ldap_free_connection( ld, lc, 0, 0 );
 194                         return( -1 );
 195                 }
 196         } else {
 197                 if ( lr->lr_parent == NULL ) {
 198                         lr->lr_ber->ber_end = lr->lr_ber->ber_ptr;
 199                         lr->lr_ber->ber_ptr = lr->lr_ber->ber_buf;
 200                 }
 201                 lr->lr_status = LDAP_REQST_INPROGRESS;
 202
 203                 /* sent -- waiting for a response */
 204                 ldap_mark_select_read( ld, lc->lconn_sb );
 205                 ldap_clear_select_write( ld, lc->lconn_sb );
 206         }
 207         return 0;
 208 }
 209
 210 /*
 211  * protected by req_mutex
 212  * if m_noconn then protect using conn_lock
 213  * else already protected with conn_lock
 214  * if m_res then also protected by res_mutex
 215  */
 216
 217 int
 218 ldap_send_server_request(
 219         LDAP *ld,
 220         BerElement *ber,
 221         ber_int_t msgid,
 222         LDAPRequest *parentreq,
 223         LDAPURLDesc **srvlist,
 224         LDAPConn *lc,
 225         LDAPreqinfo *bind,
 226         int m_noconn,
 227         int m_res )
 228 {
 229         LDAPRequest     *lr;
 230         int             incparent, rc;
 231
 232         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
 233         Debug( LDAP_DEBUG_TRACE, "ldap_send_server_request\n", 0, 0, 0 );
 234
 235         incparent = 0;
 236         ld->ld_errno = LDAP_SUCCESS;    /* optimistic */
 237
 238         LDAP_CONN_LOCK_IF(m_noconn);
 239         if ( lc == NULL ) {
 240                 if ( srvlist == NULL ) {
 241                         lc = ld->ld_defconn;
 242                 } else {
 243                         lc = find_connection( ld, *srvlist, 1 );
 244                         if ( lc == NULL ) {
 245                                 if ( (bind != NULL) && (parentreq != NULL) ) {
 246                                         /* Remember the bind in the parent */
 247                                         incparent = 1;
 248                                         ++parentreq->lr_outrefcnt;
 249                                 }
 250                                 lc = ldap_new_connection( ld, srvlist, 0,
 251                                         1, bind, 1, m_res );
 252                         }
 253                 }
 254         }
 255
 256         /* async connect... */
 257         if ( lc != NULL && lc->lconn_status == LDAP_CONNST_CONNECTING ) {
 258                 ber_socket_t    sd = AC_SOCKET_ERROR;
 259                 struct timeval  tv = { 0 };
 260
 261                 ber_sockbuf_ctrl( lc->lconn_sb, LBER_SB_OPT_GET_FD, &sd );
 262
 263                 /* poll ... */
 264                 switch ( ldap_int_poll( ld, sd, &tv, 1 ) ) {
 265                 case 0:
 266                         /* go on! */
 267                         lc->lconn_status = LDAP_CONNST_CONNECTED;
 268                         break;
 269
 270                 case -2:
 271                         /* async only occurs if a network timeout is set */
 272
 273                         /* honor network timeout */
 274                         LDAP_MUTEX_LOCK( &ld->ld_options.ldo_mutex );
 275                         if ( time( NULL ) - lc->lconn_created <= ld->ld_options.ldo_tm_net.tv_sec )
 276                         {
 277                                 /* caller will have to call again */
 278                                 ld->ld_errno = LDAP_X_CONNECTING;
 279                         }
 280                         LDAP_MUTEX_UNLOCK( &ld->ld_options.ldo_mutex );
 281                         /* fallthru */
 282
 283                 default:
 284                         /* error */
 285                         break;
 286                 }
 287         }
 288
 289         if ( lc == NULL || lc->lconn_status != LDAP_CONNST_CONNECTED ) {
 290                 if ( ld->ld_errno == LDAP_SUCCESS ) {
 291                         ld->ld_errno = LDAP_SERVER_DOWN;
 292                 }
 293
 294                 ber_free( ber, 1 );
 295                 if ( incparent ) {
 296                         /* Forget about the bind */
 297                         --parentreq->lr_outrefcnt;
 298                 }
 299                 LDAP_CONN_UNLOCK_IF(m_noconn);
 300                 return( -1 );
 301         }
 302
 303         use_connection( ld, lc );
 304
 305 #ifdef LDAP_CONNECTIONLESS
 306         if ( LDAP_IS_UDP( ld )) {
 307                 BerElement tmpber = *ber;
 308                 ber_rewind( &tmpber );
 309                 LDAP_MUTEX_LOCK( &ld->ld_options.ldo_mutex );
 310                 rc = ber_write( &tmpber, ld->ld_options.ldo_peer,
 311                         sizeof( struct sockaddr_storage ), 0 );
 312                 LDAP_MUTEX_UNLOCK( &ld->ld_options.ldo_mutex );
 313                 if ( rc == -1 ) {
 314                         ld->ld_errno = LDAP_ENCODING_ERROR;
 315                         LDAP_CONN_UNLOCK_IF(m_noconn);
 316                         return rc;
 317                 }
 318         }
 319 #endif
 320
 321         /* If we still have an incomplete write, try to finish it before
 322          * dealing with the new request. If we don't finish here, return
 323          * LDAP_BUSY and let the caller retry later. We only allow a single
 324          * request to be in WRITING state.
 325          */
 326         rc = 0;
 327         if ( ld->ld_requests &&
 328                 ld->ld_requests->lr_status == LDAP_REQST_WRITING &&
 329                 ldap_int_flush_request( ld, ld->ld_requests ) < 0 )
 330         {
 331                 rc = -1;
 332         }
 333         if ( rc ) {
 334                 LDAP_CONN_UNLOCK_IF(m_noconn);
 335                 return rc;
 336         }
 337
 338         lr = (LDAPRequest *)LDAP_CALLOC( 1, sizeof( LDAPRequest ) );
 339         if ( lr == NULL ) {
 340                 ld->ld_errno = LDAP_NO_MEMORY;
 341                 ldap_free_connection( ld, lc, 0, 0 );
 342                 ber_free( ber, 1 );
 343                 if ( incparent ) {
 344                         /* Forget about the bind */
 345                         --parentreq->lr_outrefcnt;
 346                 }
 347                 LDAP_CONN_UNLOCK_IF(m_noconn);
 348                 return( -1 );
 349         }
 350         lr->lr_msgid = msgid;
 351         lr->lr_status = LDAP_REQST_INPROGRESS;
 352         lr->lr_res_errno = LDAP_SUCCESS;        /* optimistic */
 353         lr->lr_ber = ber;
 354         lr->lr_conn = lc;
 355         if ( parentreq != NULL ) {      /* sub-request */
 356                 if ( !incparent ) {
 357                         /* Increment if we didn't do it before the bind */
 358                         ++parentreq->lr_outrefcnt;
 359                 }
 360                 lr->lr_origid = parentreq->lr_origid;
 361                 lr->lr_parentcnt = ++parentreq->lr_parentcnt;
 362                 lr->lr_parent = parentreq;
 363                 lr->lr_refnext = parentreq->lr_child;
 364                 parentreq->lr_child = lr;
 365         } else {                        /* original request */
 366                 lr->lr_origid = lr->lr_msgid;
 367         }
 368
 369         /* Extract requestDN for future reference */
 370 #ifdef LDAP_CONNECTIONLESS
 371         if ( !LDAP_IS_UDP(ld) )
 372 #endif
 373         {
 374                 BerElement tmpber = *ber;
 375                 ber_int_t       bint;
 376                 ber_tag_t       tag, rtag;
 377
 378                 ber_reset( &tmpber, 1 );
 379                 rtag = ber_scanf( &tmpber, "{it", /*}*/ &bint, &tag );
 380                 switch ( tag ) {
 381                 case LDAP_REQ_BIND:
 382                         rtag = ber_scanf( &tmpber, "{i" /*}*/, &bint );
 383                         break;
 384                 case LDAP_REQ_DELETE:
 385                         break;
 386                 default:
 387                         rtag = ber_scanf( &tmpber, "{" /*}*/ );
 388                 case LDAP_REQ_ABANDON:
 389                         break;
 390                 }
 391                 if ( tag != LDAP_REQ_ABANDON ) {
 392                         ber_skip_tag( &tmpber, &lr->lr_dn.bv_len );
 393                         lr->lr_dn.bv_val = tmpber.ber_ptr;
 394                 }
 395         }
 396
 397         lr->lr_prev = NULL;
 398         lr->lr_next = ld->ld_requests;
 399         if ( lr->lr_next != NULL ) {
 400                 lr->lr_next->lr_prev = lr;
 401         }
 402         ld->ld_requests = lr;
 403
 404         ld->ld_errno = LDAP_SUCCESS;
 405         if ( ldap_int_flush_request( ld, lr ) == -1 ) {
 406                 msgid = -1;
 407         }
 408
 409         LDAP_CONN_UNLOCK_IF(m_noconn);
 410         return( msgid );
 411 }
 412
 413 /* return 0 if no StartTLS ext, 1 if present, 2 if critical */
 414 static int
 415 find_tls_ext( LDAPURLDesc *srv )
 416 {
 417         int i, crit;
 418         char *ext;
 419
 420         if ( !srv->lud_exts )
 421                 return 0;
 422
 423         for (i=0; srv->lud_exts[i]; i++) {
 424                 crit = 0;
 425                 ext = srv->lud_exts[i];
 426                 if ( ext[0] == '!') {
 427                         ext++;
 428                         crit = 1;
 429                 }
 430                 if ( !strcasecmp( ext, "StartTLS" ) ||
 431                         !strcasecmp( ext, "X-StartTLS" ) ||
 432                         !strcmp( ext, LDAP_EXOP_START_TLS )) {
 433                         return crit + 1;
 434                 }
 435         }
 436         return 0;
 437 }
 438
 439 /*
 440  * always protected by conn_mutex
 441  * optionally protected by req_mutex and res_mutex
 442  */
 443 LDAPConn *
 444 ldap_new_connection( LDAP *ld, LDAPURLDesc **srvlist, int use_ldsb,
 445         int connect, LDAPreqinfo *bind, int m_req, int m_res )
 446 {
 447         LDAPConn        *lc;
 448         int             async = 0;
 449
 450         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 451         Debug( LDAP_DEBUG_TRACE, "ldap_new_connection %d %d %d\n",
 452                 use_ldsb, connect, (bind != NULL) );
 453         /*
 454          * make a new LDAP server connection
 455          * XXX open connection synchronously for now
 456          */
 457         lc = (LDAPConn *)LDAP_CALLOC( 1, sizeof( LDAPConn ) );
 458         if ( lc == NULL ) {
 459                 ld->ld_errno = LDAP_NO_MEMORY;
 460                 return( NULL );
 461         }
 462
 463         if ( use_ldsb ) {
 464                 assert( ld->ld_sb != NULL );
 465                 lc->lconn_sb = ld->ld_sb;
 466
 467         } else {
 468                 lc->lconn_sb = ber_sockbuf_alloc();
 469                 if ( lc->lconn_sb == NULL ) {
 470                         LDAP_FREE( (char *)lc );
 471                         ld->ld_errno = LDAP_NO_MEMORY;
 472                         return( NULL );
 473                 }
 474         }
 475
 476         if ( connect ) {
 477                 LDAPURLDesc     **srvp, *srv = NULL;
 478
 479                 async = LDAP_BOOL_GET( &ld->ld_options, LDAP_BOOL_CONNECT_ASYNC );
 480
 481                 for ( srvp = srvlist; *srvp != NULL; srvp = &(*srvp)->lud_next ) {
 482                         int             rc;
 483
 484                         rc = ldap_int_open_connection( ld, lc, *srvp, async );
 485                         if ( rc != -1 ) {
 486                                 srv = *srvp;
 487
 488                                 /* If we fully connected, async is moot */
 489                                 if ( rc == 0 )
 490                                         async = 0;
 491
 492                                 if ( ld->ld_urllist_proc && ( !async || rc != -2 ) ) {
 493                                         ld->ld_urllist_proc( ld, srvlist, srvp, ld->ld_urllist_params );
 494                                 }
 495
 496                                 break;
 497                         }
 498                 }
 499
 500                 if ( srv == NULL ) {
 501                         if ( !use_ldsb ) {
 502                                 ber_sockbuf_free( lc->lconn_sb );
 503                         }
 504                         LDAP_FREE( (char *)lc );
 505                         ld->ld_errno = LDAP_SERVER_DOWN;
 506                         return( NULL );
 507                 }
 508
 509                 lc->lconn_server = ldap_url_dup( srv );
 510                 if ( !lc->lconn_server ) {
 511                         if ( !use_ldsb )
 512                                 ber_sockbuf_free( lc->lconn_sb );
 513                         LDAP_FREE( (char *)lc );
 514                         ld->ld_errno = LDAP_NO_MEMORY;
 515                         return( NULL );
 516                 }
 517         }
 518
 519         lc->lconn_status = async ? LDAP_CONNST_CONNECTING : LDAP_CONNST_CONNECTED;
 520         lc->lconn_next = ld->ld_conns;
 521         ld->ld_conns = lc;
 522
 523         if ( connect ) {
 524 #ifdef HAVE_TLS
 525                 if ( lc->lconn_server->lud_exts ) {
 526                         int rc, ext = find_tls_ext( lc->lconn_server );
 527                         if ( ext ) {
 528                                 LDAPConn        *savedefconn;
 529
 530                                 savedefconn = ld->ld_defconn;
 531                                 ++lc->lconn_refcnt;     /* avoid premature free */
 532                                 ld->ld_defconn = lc;
 533
 534                                 LDAP_REQ_UNLOCK_IF(m_req);
 535                                 LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 536                                 LDAP_RES_UNLOCK_IF(m_res);
 537                                 rc = ldap_start_tls_s( ld, NULL, NULL );
 538                                 LDAP_RES_LOCK_IF(m_res);
 539                                 LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 540                                 LDAP_REQ_LOCK_IF(m_req);
 541                                 ld->ld_defconn = savedefconn;
 542                                 --lc->lconn_refcnt;
 543
 544                                 if ( rc != LDAP_SUCCESS && ext == 2 ) {
 545                                         ldap_free_connection( ld, lc, 1, 0 );
 546                                         return NULL;
 547                                 }
 548                         }
 549                 }
 550 #endif
 551         }
 552
 553         if ( bind != NULL ) {
 554                 int             err = 0;
 555                 LDAPConn        *savedefconn;
 556
 557                 /* Set flag to prevent additional referrals
 558                  * from being processed on this
 559                  * connection until the bind has completed
 560                  */
 561                 lc->lconn_rebind_inprogress = 1;
 562                 /* V3 rebind function */
 563                 if ( ld->ld_rebind_proc != NULL) {
 564                         LDAPURLDesc     *srvfunc;
 565
 566                         srvfunc = ldap_url_dup( *srvlist );
 567                         if ( srvfunc == NULL ) {
 568                                 ld->ld_errno = LDAP_NO_MEMORY;
 569                                 err = -1;
 570                         } else {
 571                                 savedefconn = ld->ld_defconn;
 572                                 ++lc->lconn_refcnt;     /* avoid premature free */
 573                                 ld->ld_defconn = lc;
 574
 575                                 Debug( LDAP_DEBUG_TRACE, "Call application rebind_proc\n", 0, 0, 0);
 576                                 LDAP_REQ_UNLOCK_IF(m_req);
 577                                 LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 578                                 LDAP_RES_UNLOCK_IF(m_res);
 579                                 err = (*ld->ld_rebind_proc)( ld,
 580                                         bind->ri_url, bind->ri_request, bind->ri_msgid,
 581                                         ld->ld_rebind_params );
 582                                 LDAP_RES_LOCK_IF(m_res);
 583                                 LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 584                                 LDAP_REQ_LOCK_IF(m_req);
 585
 586                                 ld->ld_defconn = savedefconn;
 587                                 --lc->lconn_refcnt;
 588
 589                                 if ( err != 0 ) {
 590                                         err = -1;
 591                                         ldap_free_connection( ld, lc, 1, 0 );
 592                                         lc = NULL;
 593                                 }
 594                                 ldap_free_urldesc( srvfunc );
 595                         }
 596
 597                 } else {
 598                         int             msgid, rc;
 599                         struct berval   passwd = BER_BVNULL;
 600
 601                         savedefconn = ld->ld_defconn;
 602                         ++lc->lconn_refcnt;     /* avoid premature free */
 603                         ld->ld_defconn = lc;
 604
 605                         Debug( LDAP_DEBUG_TRACE,
 606                                 "anonymous rebind via ldap_sasl_bind(\"\")\n",
 607                                 0, 0, 0);
 608
 609                         LDAP_REQ_UNLOCK_IF(m_req);
 610                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 611                         LDAP_RES_UNLOCK_IF(m_res);
 612                         rc = ldap_sasl_bind( ld, "", LDAP_SASL_SIMPLE, &passwd,
 613                                 NULL, NULL, &msgid );
 614                         if ( rc != LDAP_SUCCESS ) {
 615                                 err = -1;
 616
 617                         } else {
 618                                 for ( err = 1; err > 0; ) {
 619                                         struct timeval  tv = { 0, 100000 };
 620                                         LDAPMessage     *res = NULL;
 621
 622                                         switch ( ldap_result( ld, msgid, LDAP_MSG_ALL, &tv, &res ) ) {
 623                                         case -1:
 624                                                 err = -1;
 625                                                 break;
 626
 627                                         case 0:
 628 #ifdef LDAP_R_COMPILE
 629                                                 ldap_pvt_thread_yield();
 630 #endif
 631                                                 break;
 632
 633                                         case LDAP_RES_BIND:
 634                                                 rc = ldap_parse_result( ld, res, &err, NULL, NULL, NULL, NULL, 1 );
 635                                                 if ( rc != LDAP_SUCCESS ) {
 636                                                         err = -1;
 637
 638                                                 } else if ( err != LDAP_SUCCESS ) {
 639                                                         err = -1;
 640                                                 }
 641                                                 /* else err == LDAP_SUCCESS == 0 */
 642                                                 break;
 643
 644                                         default:
 645                                                 Debug( LDAP_DEBUG_TRACE,
 646                                                         "ldap_new_connection %p: "
 647                                                         "unexpected response %d "
 648                                                         "from BIND request id=%d\n",
 649                                                         (void *) ld, ldap_msgtype( res ), msgid );
 650                                                 err = -1;
 651                                                 break;
 652                                         }
 653                                 }
 654                         }
 655                         LDAP_RES_LOCK_IF(m_res);
 656                         LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 657                         LDAP_REQ_LOCK_IF(m_req);
 658                         ld->ld_defconn = savedefconn;
 659                         --lc->lconn_refcnt;
 660
 661                         if ( err != 0 ) {
 662                                 ldap_free_connection( ld, lc, 1, 0 );
 663                                 lc = NULL;
 664                         }
 665                 }
 666                 if ( lc != NULL )
 667                         lc->lconn_rebind_inprogress = 0;
 668         }
 669         return( lc );
 670 }
 671
 672
 673 /* protected by ld_conn_mutex */
 674 static LDAPConn *
 675 find_connection( LDAP *ld, LDAPURLDesc *srv, int any )
 676 /*
 677  * return an existing connection (if any) to the server srv
 678  * if "any" is non-zero, check for any server in the "srv" chain
 679  */
 680 {
 681         LDAPConn        *lc;
 682         LDAPURLDesc     *lcu, *lsu;
 683         int lcu_port, lsu_port;
 684         int found = 0;
 685
 686         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 687         for ( lc = ld->ld_conns; lc != NULL; lc = lc->lconn_next ) {
 688                 lcu = lc->lconn_server;
 689                 lcu_port = ldap_pvt_url_scheme_port( lcu->lud_scheme,
 690                         lcu->lud_port );
 691
 692                 for ( lsu = srv; lsu != NULL; lsu = lsu->lud_next ) {
 693                         lsu_port = ldap_pvt_url_scheme_port( lsu->lud_scheme,
 694                                 lsu->lud_port );
 695
 696                         if ( lsu_port == lcu_port
 697                                 && strcmp( lcu->lud_scheme, lsu->lud_scheme ) == 0
 698                                 && lcu->lud_host != NULL && lsu->lud_host != NULL
 699                                 && strcasecmp( lsu->lud_host, lcu->lud_host ) == 0 )
 700                         {
 701                                 found = 1;
 702                                 break;
 703                         }
 704
 705                         if ( !any ) break;
 706                 }
 707                 if ( found )
 708                         break;
 709         }
 710         return lc;
 711 }
 712
 713
 714
 715 /* protected by ld_conn_mutex */
 716 static void
 717 use_connection( LDAP *ld, LDAPConn *lc )
 718 {
 719         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 720         ++lc->lconn_refcnt;
 721         lc->lconn_lastused = time( NULL );
 722 }
 723
 724
 725 /* protected by ld_conn_mutex */
 726 void
 727 ldap_free_connection( LDAP *ld, LDAPConn *lc, int force, int unbind )
 728 {
 729         LDAPConn        *tmplc, *prevlc;
 730
 731         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 732         Debug( LDAP_DEBUG_TRACE,
 733                 "ldap_free_connection %d %d\n",
 734                 force, unbind, 0 );
 735
 736         if ( force || --lc->lconn_refcnt <= 0 ) {
 737                 /* remove from connections list first */
 738
 739                 for ( prevlc = NULL, tmplc = ld->ld_conns;
 740                         tmplc != NULL;
 741                         tmplc = tmplc->lconn_next )
 742                 {
 743                         if ( tmplc == lc ) {
 744                                 if ( prevlc == NULL ) {
 745                                     ld->ld_conns = tmplc->lconn_next;
 746                                 } else {
 747                                     prevlc->lconn_next = tmplc->lconn_next;
 748                                 }
 749                                 if ( ld->ld_defconn == lc ) {
 750                                         ld->ld_defconn = NULL;
 751                                 }
 752                                 break;
 753                         }
 754                         prevlc = tmplc;
 755                 }
 756
 757                 /* process connection callbacks */
 758                 {
 759                         struct ldapoptions *lo;
 760                         ldaplist *ll;
 761                         ldap_conncb *cb;
 762
 763                         lo = &ld->ld_options;
 764                         LDAP_MUTEX_LOCK( &lo->ldo_mutex );
 765                         if ( lo->ldo_conn_cbs ) {
 766                                 for ( ll=lo->ldo_conn_cbs; ll; ll=ll->ll_next ) {
 767                                         cb = ll->ll_data;
 768                                         cb->lc_del( ld, lc->lconn_sb, cb );
 769                                 }
 770                         }
 771                         LDAP_MUTEX_UNLOCK( &lo->ldo_mutex );
 772                         lo = LDAP_INT_GLOBAL_OPT();
 773                         LDAP_MUTEX_LOCK( &lo->ldo_mutex );
 774                         if ( lo->ldo_conn_cbs ) {
 775                                 for ( ll=lo->ldo_conn_cbs; ll; ll=ll->ll_next ) {
 776                                         cb = ll->ll_data;
 777                                         cb->lc_del( ld, lc->lconn_sb, cb );
 778                                 }
 779                         }
 780                         LDAP_MUTEX_UNLOCK( &lo->ldo_mutex );
 781                 }
 782
 783                 if ( lc->lconn_status == LDAP_CONNST_CONNECTED ) {
 784                         ldap_mark_select_clear( ld, lc->lconn_sb );
 785                         if ( unbind ) {
 786                                 ldap_send_unbind( ld, lc->lconn_sb,
 787                                                 NULL, NULL );
 788                         }
 789                 }
 790
 791                 if ( lc->lconn_ber != NULL ) {
 792                         ber_free( lc->lconn_ber, 1 );
 793                 }
 794
 795                 ldap_int_sasl_close( ld, lc );
 796 #ifdef HAVE_GSSAPI
 797                 ldap_int_gssapi_close( ld, lc );
 798 #endif
 799
 800                 ldap_free_urllist( lc->lconn_server );
 801
 802                 /* FIXME: is this at all possible?
 803                  * ldap_ld_free() in unbind.c calls ldap_free_connection()
 804                  * with force == 1 __after__ explicitly calling
 805                  * ldap_free_request() on all requests */
 806                 if ( force ) {
 807                         LDAPRequest     *lr;
 808
 809                         for ( lr = ld->ld_requests; lr; ) {
 810                                 LDAPRequest     *lr_next = lr->lr_next;
 811
 812                                 if ( lr->lr_conn == lc ) {
 813                                         ldap_free_request_int( ld, lr );
 814                                 }
 815
 816                                 lr = lr_next;
 817                         }
 818                 }
 819
 820                 if ( lc->lconn_sb != ld->ld_sb ) {
 821                         ber_sockbuf_free( lc->lconn_sb );
 822                 } else {
 823                         ber_int_sb_close( lc->lconn_sb );
 824                 }
 825
 826                 if ( lc->lconn_rebind_queue != NULL) {
 827                         int i;
 828                         for( i = 0; lc->lconn_rebind_queue[i] != NULL; i++ ) {
 829                                 LDAP_VFREE( lc->lconn_rebind_queue[i] );
 830                         }
 831                         LDAP_FREE( lc->lconn_rebind_queue );
 832                 }
 833
 834                 LDAP_FREE( lc );
 835
 836                 Debug( LDAP_DEBUG_TRACE,
 837                         "ldap_free_connection: actually freed\n",
 838                         0, 0, 0 );
 839
 840         } else {
 841                 lc->lconn_lastused = time( NULL );
 842                 Debug( LDAP_DEBUG_TRACE, "ldap_free_connection: refcnt %d\n",
 843                                 lc->lconn_refcnt, 0, 0 );
 844         }
 845 }
 846
 847
 848 /* Protects self with ld_conn_mutex */
 849 #ifdef LDAP_DEBUG
 850 void
 851 ldap_dump_connection( LDAP *ld, LDAPConn *lconns, int all )
 852 {
 853         LDAPConn        *lc;
 854         char            timebuf[32];
 855
 856         Debug( LDAP_DEBUG_TRACE, "** ld %p Connection%s:\n", (void *)ld, all ? "s" : "", 0 );
 857         LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 858         for ( lc = lconns; lc != NULL; lc = lc->lconn_next ) {
 859                 if ( lc->lconn_server != NULL ) {
 860                         Debug( LDAP_DEBUG_TRACE, "* host: %s  port: %d%s\n",
 861                                 ( lc->lconn_server->lud_host == NULL ) ? "(null)"
 862                                 : lc->lconn_server->lud_host,
 863                                 lc->lconn_server->lud_port, ( lc->lconn_sb ==
 864                                 ld->ld_sb ) ? "  (default)" : "" );
 865                 }
 866                 Debug( LDAP_DEBUG_TRACE, "  refcnt: %d  status: %s\n", lc->lconn_refcnt,
 867                         ( lc->lconn_status == LDAP_CONNST_NEEDSOCKET )
 868                                 ? "NeedSocket" :
 869                                 ( lc->lconn_status == LDAP_CONNST_CONNECTING )
 870                                         ? "Connecting" : "Connected", 0 );
 871                 Debug( LDAP_DEBUG_TRACE, "  last used: %s%s\n",
 872                         ldap_pvt_ctime( &lc->lconn_lastused, timebuf ),
 873                         lc->lconn_rebind_inprogress ? "  rebind in progress" : "", 0 );
 874                 if ( lc->lconn_rebind_inprogress ) {
 875                         if ( lc->lconn_rebind_queue != NULL) {
 876                                 int     i;
 877
 878                                 for ( i = 0; lc->lconn_rebind_queue[i] != NULL; i++ ) {
 879                                         int     j;
 880                                         for( j = 0; lc->lconn_rebind_queue[i][j] != 0; j++ ) {
 881                                                 Debug( LDAP_DEBUG_TRACE, "    queue %d entry %d - %s\n",
 882                                                         i, j, lc->lconn_rebind_queue[i][j] );
 883                                         }
 884                                 }
 885                         } else {
 886                                 Debug( LDAP_DEBUG_TRACE, "    queue is empty\n", 0, 0, 0 );
 887                         }
 888                 }
 889                 Debug( LDAP_DEBUG_TRACE, "\n", 0, 0, 0 );
 890                 if ( !all ) {
 891                         break;
 892                 }
 893         }
 894         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 895 }
 896
 897
 898 /* protected by req_mutex and res_mutex */
 899 void
 900 ldap_dump_requests_and_responses( LDAP *ld )
 901 {
 902         LDAPRequest     *lr;
 903         LDAPMessage     *lm, *l;
 904         int             i;
 905
 906         Debug( LDAP_DEBUG_TRACE, "** ld %p Outstanding Requests:\n",
 907                 (void *)ld, 0, 0 );
 908         lr = ld->ld_requests;
 909         if ( lr == NULL ) {
 910                 Debug( LDAP_DEBUG_TRACE, "   Empty\n", 0, 0, 0 );
 911         }
 912         for ( i = 0; lr != NULL; lr = lr->lr_next, i++ ) {
 913                 Debug( LDAP_DEBUG_TRACE, " * msgid %d,  origid %d, status %s\n",
 914                         lr->lr_msgid, lr->lr_origid,
 915                         ( lr->lr_status == LDAP_REQST_INPROGRESS ) ? "InProgress" :
 916                         ( lr->lr_status == LDAP_REQST_CHASINGREFS ) ? "ChasingRefs" :
 917                         ( lr->lr_status == LDAP_REQST_NOTCONNECTED ) ? "NotConnected" :
 918                         ( lr->lr_status == LDAP_REQST_WRITING ) ? "Writing" :
 919                         ( lr->lr_status == LDAP_REQST_COMPLETED ) ? "RequestCompleted"
 920                                 : "InvalidStatus" );
 921                 Debug( LDAP_DEBUG_TRACE, "   outstanding referrals %d, parent count %d\n",
 922                         lr->lr_outrefcnt, lr->lr_parentcnt, 0 );
 923         }
 924         Debug( LDAP_DEBUG_TRACE, "  ld %p request count %d (abandoned %lu)\n",
 925                 (void *)ld, i, ld->ld_nabandoned );
 926         Debug( LDAP_DEBUG_TRACE, "** ld %p Response Queue:\n", (void *)ld, 0, 0 );
 927         if ( ( lm = ld->ld_responses ) == NULL ) {
 928                 Debug( LDAP_DEBUG_TRACE, "   Empty\n", 0, 0, 0 );
 929         }
 930         for ( i = 0; lm != NULL; lm = lm->lm_next, i++ ) {
 931                 Debug( LDAP_DEBUG_TRACE, " * msgid %d,  type %lu\n",
 932                     lm->lm_msgid, (unsigned long)lm->lm_msgtype, 0 );
 933                 if ( lm->lm_chain != NULL ) {
 934                         Debug( LDAP_DEBUG_TRACE, "   chained responses:\n", 0, 0, 0 );
 935                         for ( l = lm->lm_chain; l != NULL; l = l->lm_chain ) {
 936                                 Debug( LDAP_DEBUG_TRACE,
 937                                         "  * msgid %d,  type %lu\n",
 938                                         l->lm_msgid,
 939                                         (unsigned long)l->lm_msgtype, 0 );
 940                         }
 941                 }
 942         }
 943         Debug( LDAP_DEBUG_TRACE, "  ld %p response count %d\n", (void *)ld, i, 0 );
 944 }
 945 #endif /* LDAP_DEBUG */
 946
 947 /* protected by req_mutex */
 948 static void
 949 ldap_free_request_int( LDAP *ld, LDAPRequest *lr )
 950 {
 951         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
 952         /* if lr_refcnt > 0, the request has been looked up
 953          * by ldap_find_request_by_msgid(); if in the meanwhile
 954          * the request is free()'d by someone else, just decrease
 955          * the reference count and extract it from the request
 956          * list; later on, it will be freed. */
 957         if ( lr->lr_prev == NULL ) {
 958                 if ( lr->lr_refcnt == 0 ) {
 959                         /* free'ing the first request? */
 960                         assert( ld->ld_requests == lr );
 961                 }
 962
 963                 if ( ld->ld_requests == lr ) {
 964                         ld->ld_requests = lr->lr_next;
 965                 }
 966
 967         } else {
 968                 lr->lr_prev->lr_next = lr->lr_next;
 969         }
 970
 971         if ( lr->lr_next != NULL ) {
 972                 lr->lr_next->lr_prev = lr->lr_prev;
 973         }
 974
 975         if ( lr->lr_refcnt > 0 ) {
 976                 lr->lr_refcnt = -lr->lr_refcnt;
 977
 978                 lr->lr_prev = NULL;
 979                 lr->lr_next = NULL;
 980
 981                 return;
 982         }
 983
 984         if ( lr->lr_ber != NULL ) {
 985                 ber_free( lr->lr_ber, 1 );
 986                 lr->lr_ber = NULL;
 987         }
 988
 989         if ( lr->lr_res_error != NULL ) {
 990                 LDAP_FREE( lr->lr_res_error );
 991                 lr->lr_res_error = NULL;
 992         }
 993
 994         if ( lr->lr_res_matched != NULL ) {
 995                 LDAP_FREE( lr->lr_res_matched );
 996                 lr->lr_res_matched = NULL;
 997         }
 998
 999         LDAP_FREE( lr );
1000 }
1001
1002 /* protected by req_mutex */
1003 void
1004 ldap_free_request( LDAP *ld, LDAPRequest *lr )
1005 {
1006         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
1007         Debug( LDAP_DEBUG_TRACE, "ldap_free_request (origid %d, msgid %d)\n",
1008                 lr->lr_origid, lr->lr_msgid, 0 );
1009
1010         /* free all referrals (child requests) */
1011         while ( lr->lr_child ) {
1012                 ldap_free_request( ld, lr->lr_child );
1013         }
1014
1015         if ( lr->lr_parent != NULL ) {
1016                 LDAPRequest     **lrp;
1017
1018                 --lr->lr_parent->lr_outrefcnt;
1019                 for ( lrp = &lr->lr_parent->lr_child;
1020                         *lrp && *lrp != lr;
1021                         lrp = &(*lrp)->lr_refnext );
1022
1023                 if ( *lrp == lr ) {
1024                         *lrp = lr->lr_refnext;
1025                 }
1026         }
1027         ldap_free_request_int( ld, lr );
1028 }
1029
1030 /*
1031  * call first time with *cntp = -1
1032  * when returns *cntp == -1, no referrals are left
1033  *
1034  * NOTE: may replace *refsp, or shuffle the contents
1035  * of the original array.
1036  */
1037 static int ldap_int_nextref(
1038         LDAP                    *ld,
1039         char                    ***refsp,
1040         int                     *cntp,
1041         void                    *params )
1042 {
1043         assert( refsp != NULL );
1044         assert( *refsp != NULL );
1045         assert( cntp != NULL );
1046
1047         if ( *cntp < -1 ) {
1048                 *cntp = -1;
1049                 return -1;
1050         }
1051
1052         (*cntp)++;
1053
1054         if ( (*refsp)[ *cntp ] == NULL ) {
1055                 *cntp = -1;
1056         }
1057
1058         return 0;
1059 }
1060
1061 /*
1062  * Chase v3 referrals
1063  *
1064  * Parameters:
1065  *  (IN) ld = LDAP connection handle
1066  *  (IN) lr = LDAP Request structure
1067  *  (IN) refs = array of pointers to referral strings that we will chase
1068  *              The array will be free'd by this function when no longer needed
1069  *  (IN) sref != 0 if following search reference
1070  *  (OUT) errstrp = Place to return a string of referrals which could not be followed
1071  *  (OUT) hadrefp = 1 if sucessfully followed referral
1072  *
1073  * Return value - number of referrals followed
1074  *
1075  * Protected by res_mutex, conn_mutex and req_mutex     (try_read1msg)
1076  */
1077 int
1078 ldap_chase_v3referrals( LDAP *ld, LDAPRequest *lr, char **refs, int sref, char **errstrp, int *hadrefp )
1079 {
1080         char            *unfollowed;
1081         int              unfollowedcnt = 0;
1082         LDAPRequest     *origreq;
1083         LDAPURLDesc     *srv = NULL;
1084         BerElement      *ber;
1085         char            **refarray = NULL;
1086         LDAPConn        *lc;
1087         int                      rc, count, i, j, id;
1088         LDAPreqinfo  rinfo;
1089         LDAP_NEXTREF_PROC       *nextref_proc = ld->ld_nextref_proc ? ld->ld_nextref_proc : ldap_int_nextref;
1090
1091         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_res_mutex );
1092         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
1093         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
1094         Debug( LDAP_DEBUG_TRACE, "ldap_chase_v3referrals\n", 0, 0, 0 );
1095
1096         ld->ld_errno = LDAP_SUCCESS;    /* optimistic */
1097         *hadrefp = 0;
1098
1099         unfollowed = NULL;
1100         rc = count = 0;
1101
1102         /* If no referrals in array, return */
1103         if ( (refs == NULL) || ( (refs)[0] == NULL) ) {
1104                 rc = 0;
1105                 goto done;
1106         }
1107
1108         /* Check for hop limit exceeded */
1109         if ( lr->lr_parentcnt >= ld->ld_refhoplimit ) {
1110                 Debug( LDAP_DEBUG_ANY,
1111                     "more than %d referral hops (dropping)\n", ld->ld_refhoplimit, 0, 0 );
1112                 ld->ld_errno = LDAP_REFERRAL_LIMIT_EXCEEDED;
1113                 rc = -1;
1114                 goto done;
1115         }
1116
1117         /* find original request */
1118         for ( origreq = lr;
1119                 origreq->lr_parent != NULL;
1120                 origreq = origreq->lr_parent )
1121         {
1122                 /* empty */ ;
1123         }
1124
1125         refarray = refs;
1126         refs = NULL;
1127
1128         /* parse out & follow referrals */
1129         /* NOTE: if nextref_proc == ldap_int_nextref, params is ignored */
1130         i = -1;
1131         for ( nextref_proc( ld, &refarray, &i, ld->ld_nextref_params );
1132                         i != -1;
1133                         nextref_proc( ld, &refarray, &i, ld->ld_nextref_params ) )
1134         {
1135
1136                 /* Parse the referral URL */
1137                 rc = ldap_url_parse_ext( refarray[i], &srv, LDAP_PVT_URL_PARSE_NOEMPTY_DN );
1138                 if ( rc != LDAP_URL_SUCCESS ) {
1139                         /* ldap_url_parse_ext() returns LDAP_URL_* errors
1140                          * which do not map on API errors */
1141                         ld->ld_errno = LDAP_PARAM_ERROR;
1142                         rc = -1;
1143                         goto done;
1144                 }
1145
1146                 if( srv->lud_crit_exts ) {
1147                         int ok = 0;
1148 #ifdef HAVE_TLS
1149                         /* If StartTLS is the only critical ext, OK. */
1150                         if ( find_tls_ext( srv ) == 2 && srv->lud_crit_exts == 1 )
1151                                 ok = 1;
1152 #endif
1153                         if ( !ok ) {
1154                                 /* we do not support any other extensions */
1155                                 ld->ld_errno = LDAP_NOT_SUPPORTED;
1156                                 rc = -1;
1157                                 goto done;
1158                         }
1159                 }
1160
1161                 /* check connection for re-bind in progress */
1162                 if (( lc = find_connection( ld, srv, 1 )) != NULL ) {
1163                         /* See if we've already requested this DN with this conn */
1164                         LDAPRequest *lp;
1165                         int looped = 0;
1166                         ber_len_t len = srv->lud_dn ? strlen( srv->lud_dn ) : 0;
1167                         for ( lp = origreq; lp; ) {
1168                                 if ( lp->lr_conn == lc
1169                                         && len == lp->lr_dn.bv_len
1170                                         && len
1171                                         && strncmp( srv->lud_dn, lp->lr_dn.bv_val, len ) == 0 )
1172                                 {
1173                                         looped = 1;
1174                                         break;
1175                                 }
1176                                 if ( lp == origreq ) {
1177                                         lp = lp->lr_child;
1178                                 } else {
1179                                         lp = lp->lr_refnext;
1180                                 }
1181                         }
1182                         if ( looped ) {
1183                                 ldap_free_urllist( srv );
1184                                 srv = NULL;
1185                                 ld->ld_errno = LDAP_CLIENT_LOOP;
1186                                 rc = -1;
1187                                 continue;
1188                         }
1189
1190                         if ( lc->lconn_rebind_inprogress ) {
1191                                 /* We are already chasing a referral or search reference and a
1192                                  * bind on that connection is in progress.  We must queue
1193                                  * referrals on that connection, so we don't get a request
1194                                  * going out before the bind operation completes. This happens
1195                                  * if two search references come in one behind the other
1196                                  * for the same server with different contexts.
1197                                  */
1198                                 Debug( LDAP_DEBUG_TRACE,
1199                                         "ldap_chase_v3referrals: queue referral \"%s\"\n",
1200                                         refarray[i], 0, 0);
1201                                 if( lc->lconn_rebind_queue == NULL ) {
1202                                         /* Create a referral list */
1203                                         lc->lconn_rebind_queue =
1204                                                 (char ***) LDAP_MALLOC( sizeof(void *) * 2);
1205
1206                                         if( lc->lconn_rebind_queue == NULL) {
1207                                                 ld->ld_errno = LDAP_NO_MEMORY;
1208                                                 rc = -1;
1209                                                 goto done;
1210                                         }
1211
1212                                         lc->lconn_rebind_queue[0] = refarray;
1213                                         lc->lconn_rebind_queue[1] = NULL;
1214                                         refarray = NULL;
1215
1216                                 } else {
1217                                         /* Count how many referral arrays we already have */
1218                                         for( j = 0; lc->lconn_rebind_queue[j] != NULL; j++) {
1219                                                 /* empty */;
1220                                         }
1221
1222                                         /* Add the new referral to the list */
1223                                         lc->lconn_rebind_queue = (char ***) LDAP_REALLOC(
1224                                                 lc->lconn_rebind_queue, sizeof(void *) * (j + 2));
1225
1226                                         if( lc->lconn_rebind_queue == NULL ) {
1227                                                 ld->ld_errno = LDAP_NO_MEMORY;
1228                                                 rc = -1;
1229                                                 goto done;
1230                                         }
1231                                         lc->lconn_rebind_queue[j] = refarray;
1232                                         lc->lconn_rebind_queue[j+1] = NULL;
1233                                         refarray = NULL;
1234                                 }
1235
1236                                 /* We have queued the referral/reference, now just return */
1237                                 rc = 0;
1238                                 *hadrefp = 1;
1239                                 count = 1; /* Pretend we already followed referral */
1240                                 goto done;
1241                         }
1242                 }
1243                 /* Re-encode the request with the new starting point of the search.
1244                  * Note: In the future we also need to replace the filter if one
1245                  * was provided with the search reference
1246                  */
1247
1248                 /* For references we don't want old dn if new dn empty */
1249                 if ( sref && srv->lud_dn == NULL ) {
1250                         srv->lud_dn = LDAP_STRDUP( "" );
1251                 }
1252
1253                 LDAP_NEXT_MSGID( ld, id );
1254                 ber = re_encode_request( ld, origreq->lr_ber, id,
1255                         sref, srv, &rinfo.ri_request );
1256
1257                 if( ber == NULL ) {
1258                         ld->ld_errno = LDAP_ENCODING_ERROR;
1259                         rc = -1;
1260                         goto done;
1261                 }
1262
1263                 Debug( LDAP_DEBUG_TRACE,
1264                         "ldap_chase_v3referral: msgid %d, url \"%s\"\n",
1265                         lr->lr_msgid, refarray[i], 0);
1266
1267                 /* Send the new request to the server - may require a bind */
1268                 rinfo.ri_msgid = origreq->lr_origid;
1269                 rinfo.ri_url = refarray[i];
1270                 rc = ldap_send_server_request( ld, ber, id,
1271                         origreq, &srv, NULL, &rinfo, 0, 1 );
1272                 if ( rc < 0 ) {
1273                         /* Failure, try next referral in the list */
1274                         Debug( LDAP_DEBUG_ANY, "Unable to chase referral \"%s\" (%d: %s)\n",
1275                                 refarray[i], ld->ld_errno, ldap_err2string( ld->ld_errno ) );
1276                         unfollowedcnt += ldap_append_referral( ld, &unfollowed, refarray[i] );
1277                         ldap_free_urllist( srv );
1278                         srv = NULL;
1279                         ld->ld_errno = LDAP_REFERRAL;
1280                 } else {
1281                         /* Success, no need to try this referral list further */
1282                         rc = 0;
1283                         ++count;
1284                         *hadrefp = 1;
1285
1286                         /* check if there is a queue of referrals that came in during bind */
1287                         if ( lc == NULL) {
1288                                 lc = find_connection( ld, srv, 1 );
1289                                 if ( lc == NULL ) {
1290                                         ld->ld_errno = LDAP_OPERATIONS_ERROR;
1291                                         rc = -1;
1292                                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
1293                                         goto done;
1294                                 }
1295                         }
1296
1297                         if ( lc->lconn_rebind_queue != NULL ) {
1298                                 /* Release resources of previous list */
1299                                 LDAP_VFREE( refarray );
1300                                 refarray = NULL;
1301                                 ldap_free_urllist( srv );
1302                                 srv = NULL;
1303
1304                                 /* Pull entries off end of queue so list always null terminated */
1305                                 for( j = 0; lc->lconn_rebind_queue[j] != NULL; j++ )
1306                                         ;
1307                                 refarray = lc->lconn_rebind_queue[j - 1];
1308                                 lc->lconn_rebind_queue[j-1] = NULL;
1309                                 /* we pulled off last entry from queue, free queue */
1310                                 if ( j == 1 ) {
1311                                         LDAP_FREE( lc->lconn_rebind_queue );
1312                                         lc->lconn_rebind_queue = NULL;
1313                                 }
1314                                 /* restart the loop the with new referral list */
1315                                 i = -1;
1316                                 continue;
1317                         }
1318                         break; /* referral followed, break out of for loop */
1319                 }
1320         } /* end for loop */
1321 done:
1322         LDAP_VFREE( refarray );
1323         ldap_free_urllist( srv );
1324         LDAP_FREE( *errstrp );
1325
1326         if( rc == 0 ) {
1327                 *errstrp = NULL;
1328                 LDAP_FREE( unfollowed );
1329                 return count;
1330         } else {
1331                 *errstrp = unfollowed;
1332                 return rc;
1333         }
1334 }
1335
1336 /*
1337  * XXX merging of errors in this routine needs to be improved
1338  * Protected by res_mutex, conn_mutex and req_mutex     (try_read1msg)
1339  */
1340 int
1341 ldap_chase_referrals( LDAP *ld,
1342         LDAPRequest *lr,
1343         char **errstrp,
1344         int sref,
1345         int *hadrefp )
1346 {
1347         int             rc, count, id;
1348         unsigned        len;
1349         char            *p, *ref, *unfollowed;
1350         LDAPRequest     *origreq;
1351         LDAPURLDesc     *srv;
1352         BerElement      *ber;
1353         LDAPreqinfo  rinfo;
1354         LDAPConn        *lc;
1355
1356         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_res_mutex );
1357         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
1358         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
1359         Debug( LDAP_DEBUG_TRACE, "ldap_chase_referrals\n", 0, 0, 0 );
1360
1361         ld->ld_errno = LDAP_SUCCESS;    /* optimistic */
1362         *hadrefp = 0;
1363
1364         if ( *errstrp == NULL ) {
1365                 return( 0 );
1366         }
1367
1368         len = strlen( *errstrp );
1369         for ( p = *errstrp; len >= LDAP_REF_STR_LEN; ++p, --len ) {
1370                 if ( strncasecmp( p, LDAP_REF_STR, LDAP_REF_STR_LEN ) == 0 ) {
1371                         *p = '\0';
1372                         p += LDAP_REF_STR_LEN;
1373                         break;
1374                 }
1375         }
1376
1377         if ( len < LDAP_REF_STR_LEN ) {
1378                 return( 0 );
1379         }
1380
1381         if ( lr->lr_parentcnt >= ld->ld_refhoplimit ) {
1382                 Debug( LDAP_DEBUG_ANY,
1383                     "more than %d referral hops (dropping)\n",
1384                     ld->ld_refhoplimit, 0, 0 );
1385                     /* XXX report as error in ld->ld_errno? */
1386                     return( 0 );
1387         }
1388
1389         /* find original request */
1390         for ( origreq = lr; origreq->lr_parent != NULL;
1391              origreq = origreq->lr_parent ) {
1392                 /* empty */;
1393         }
1394
1395         unfollowed = NULL;
1396         rc = count = 0;
1397
1398         /* parse out & follow referrals */
1399         for ( ref = p; rc == 0 && ref != NULL; ref = p ) {
1400                 p = strchr( ref, '\n' );
1401                 if ( p != NULL ) {
1402                         *p++ = '\0';
1403                 }
1404
1405                 rc = ldap_url_parse_ext( ref, &srv, LDAP_PVT_URL_PARSE_NOEMPTY_DN );
1406                 if ( rc != LDAP_URL_SUCCESS ) {
1407                         Debug( LDAP_DEBUG_TRACE,
1408                                 "ignoring %s referral <%s>\n",
1409                                 ref, rc == LDAP_URL_ERR_BADSCHEME ? "unknown" : "incorrect", 0 );
1410                         rc = ldap_append_referral( ld, &unfollowed, ref );
1411                         *hadrefp = 1;
1412                         continue;
1413                 }
1414
1415                 Debug( LDAP_DEBUG_TRACE,
1416                     "chasing LDAP referral: <%s>\n", ref, 0, 0 );
1417
1418                 *hadrefp = 1;
1419
1420                 /* See if we've already been here */
1421                 if (( lc = find_connection( ld, srv, 1 )) != NULL ) {
1422                         LDAPRequest *lp;
1423                         int looped = 0;
1424                         ber_len_t len = srv->lud_dn ? strlen( srv->lud_dn ) : 0;
1425                         for ( lp = lr; lp; lp = lp->lr_parent ) {
1426                                 if ( lp->lr_conn == lc
1427                                         && len == lp->lr_dn.bv_len )
1428                                 {
1429                                         if ( len && strncmp( srv->lud_dn, lp->lr_dn.bv_val, len ) )
1430                                                         continue;
1431                                         looped = 1;
1432                                         break;
1433                                 }
1434                         }
1435                         if ( looped ) {
1436                                 ldap_free_urllist( srv );
1437                                 ld->ld_errno = LDAP_CLIENT_LOOP;
1438                                 rc = -1;
1439                                 continue;
1440                         }
1441                 }
1442
1443                 LDAP_NEXT_MSGID( ld, id );
1444                 ber = re_encode_request( ld, origreq->lr_ber,
1445                     id, sref, srv, &rinfo.ri_request );
1446
1447                 if ( ber == NULL ) {
1448                         ldap_free_urllist( srv );
1449                         return -1 ;
1450                 }
1451
1452                 /* copy the complete referral for rebind process */
1453                 rinfo.ri_url = LDAP_STRDUP( ref );
1454
1455                 rinfo.ri_msgid = origreq->lr_origid;
1456
1457                 rc = ldap_send_server_request( ld, ber, id,
1458                         lr, &srv, NULL, &rinfo, 0, 1 );
1459                 LDAP_FREE( rinfo.ri_url );
1460
1461                 if( rc >= 0 ) {
1462                         ++count;
1463                 } else {
1464                         Debug( LDAP_DEBUG_ANY,
1465                                 "Unable to chase referral \"%s\" (%d: %s)\n",
1466                                 ref, ld->ld_errno, ldap_err2string( ld->ld_errno ) );
1467                         rc = ldap_append_referral( ld, &unfollowed, ref );
1468                 }
1469
1470                 ldap_free_urllist(srv);
1471         }
1472
1473         LDAP_FREE( *errstrp );
1474         *errstrp = unfollowed;
1475
1476         return(( rc == 0 ) ? count : rc );
1477 }
1478
1479
1480 int
1481 ldap_append_referral( LDAP *ld, char **referralsp, char *s )
1482 {
1483         int     first;
1484
1485         if ( *referralsp == NULL ) {
1486                 first = 1;
1487                 *referralsp = (char *)LDAP_MALLOC( strlen( s ) + LDAP_REF_STR_LEN
1488                     + 1 );
1489         } else {
1490                 first = 0;
1491                 *referralsp = (char *)LDAP_REALLOC( *referralsp,
1492                     strlen( *referralsp ) + strlen( s ) + 2 );
1493         }
1494
1495         if ( *referralsp == NULL ) {
1496                 ld->ld_errno = LDAP_NO_MEMORY;
1497                 return( -1 );
1498         }
1499
1500         if ( first ) {
1501                 strcpy( *referralsp, LDAP_REF_STR );
1502         } else {
1503                 strcat( *referralsp, "\n" );
1504         }
1505         strcat( *referralsp, s );
1506
1507         return( 0 );
1508 }
1509
1510
1511
1512 static BerElement *
1513 re_encode_request( LDAP *ld,
1514         BerElement *origber,
1515         ber_int_t msgid,
1516         int sref,
1517         LDAPURLDesc *srv,
1518         int *type )
1519 {
1520         /*
1521          * XXX this routine knows way too much about how the lber library works!
1522          */
1523         ber_int_t       along;
1524         ber_tag_t       tag;
1525         ber_tag_t       rtag;
1526         ber_int_t       ver;
1527         ber_int_t       scope;
1528         int             rc;
1529         BerElement      tmpber, *ber;
1530         struct berval           dn;
1531
1532         Debug( LDAP_DEBUG_TRACE,
1533             "re_encode_request: new msgid %ld, new dn <%s>\n",
1534             (long) msgid,
1535                 ( srv == NULL || srv->lud_dn == NULL) ? "NONE" : srv->lud_dn, 0 );
1536
1537         tmpber = *origber;
1538
1539         /*
1540          * all LDAP requests are sequences that start with a message id.
1541          * For all except delete, this is followed by a sequence that is
1542          * tagged with the operation code.  For delete, the provided DN
1543          * is not wrapped by a sequence.
1544          */
1545         rtag = ber_scanf( &tmpber, "{it", /*}*/ &along, &tag );
1546
1547         if ( rtag == LBER_ERROR ) {
1548                 ld->ld_errno = LDAP_DECODING_ERROR;
1549                 return( NULL );
1550         }
1551
1552         assert( tag != 0);
1553         if ( tag == LDAP_REQ_BIND ) {
1554                 /* bind requests have a version number before the DN & other stuff */
1555                 rtag = ber_scanf( &tmpber, "{im" /*}*/, &ver, &dn );
1556
1557         } else if ( tag == LDAP_REQ_DELETE ) {
1558                 /* delete requests don't have a DN wrapping sequence */
1559                 rtag = ber_scanf( &tmpber, "m", &dn );
1560
1561         } else if ( tag == LDAP_REQ_SEARCH ) {
1562                 /* search requests need to be re-scope-ed */
1563                 rtag = ber_scanf( &tmpber, "{me" /*"}"*/, &dn, &scope );
1564
1565                 if( srv->lud_scope != LDAP_SCOPE_DEFAULT ) {
1566                         /* use the scope provided in reference */
1567                         scope = srv->lud_scope;
1568
1569                 } else if ( sref ) {
1570                         /* use scope implied by previous operation
1571                          *   base -> base
1572                          *   one -> base
1573                          *   subtree -> subtree
1574                          *   subordinate -> subtree
1575                          */
1576                         switch( scope ) {
1577                         default:
1578                         case LDAP_SCOPE_BASE:
1579                         case LDAP_SCOPE_ONELEVEL:
1580                                 scope = LDAP_SCOPE_BASE;
1581                                 break;
1582                         case LDAP_SCOPE_SUBTREE:
1583                         case LDAP_SCOPE_SUBORDINATE:
1584                                 scope = LDAP_SCOPE_SUBTREE;
1585                                 break;
1586                         }
1587                 }
1588
1589         } else {
1590                 rtag = ber_scanf( &tmpber, "{m" /*}*/, &dn );
1591         }
1592
1593         if( rtag == LBER_ERROR ) {
1594                 ld->ld_errno = LDAP_DECODING_ERROR;
1595                 return NULL;
1596         }
1597
1598         /* restore character zero'd out by ber_scanf*/
1599         dn.bv_val[dn.bv_len] = tmpber.ber_tag;
1600
1601         if (( ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
1602                 return NULL;
1603         }
1604
1605         if ( srv->lud_dn ) {
1606                 ber_str2bv( srv->lud_dn, 0, 0, &dn );
1607         }
1608
1609         if ( tag == LDAP_REQ_BIND ) {
1610                 rc = ber_printf( ber, "{it{iO" /*}}*/, msgid, tag, ver, &dn );
1611         } else if ( tag == LDAP_REQ_DELETE ) {
1612                 rc = ber_printf( ber, "{itON}", msgid, tag, &dn );
1613         } else if ( tag == LDAP_REQ_SEARCH ) {
1614                 rc = ber_printf( ber, "{it{Oe" /*}}*/, msgid, tag, &dn, scope );
1615         } else {
1616                 rc = ber_printf( ber, "{it{O" /*}}*/, msgid, tag, &dn );
1617         }
1618
1619         if ( rc == -1 ) {
1620                 ld->ld_errno = LDAP_ENCODING_ERROR;
1621                 ber_free( ber, 1 );
1622                 return NULL;
1623         }
1624
1625         if ( tag != LDAP_REQ_DELETE && (
1626                 ber_write(ber, tmpber.ber_ptr, ( tmpber.ber_end - tmpber.ber_ptr ), 0)
1627                 != ( tmpber.ber_end - tmpber.ber_ptr ) ||
1628             ber_printf( ber, /*{{*/ "N}N}" ) == -1 ) )
1629         {
1630                 ld->ld_errno = LDAP_ENCODING_ERROR;
1631                 ber_free( ber, 1 );
1632                 return NULL;
1633         }
1634
1635 #ifdef LDAP_DEBUG
1636         if ( ldap_debug & LDAP_DEBUG_PACKETS ) {
1637                 Debug( LDAP_DEBUG_ANY, "re_encode_request new request is:\n",
1638                     0, 0, 0 );
1639                 ber_log_dump( LDAP_DEBUG_BER, ldap_debug, ber, 0 );
1640         }
1641 #endif /* LDAP_DEBUG */
1642
1643         *type = tag;    /* return request type */
1644         return ber;
1645 }
1646
1647
1648 /* protected by req_mutex */
1649 LDAPRequest *
1650 ldap_find_request_by_msgid( LDAP *ld, ber_int_t msgid )
1651 {
1652         LDAPRequest     *lr;
1653
1654         for ( lr = ld->ld_requests; lr != NULL; lr = lr->lr_next ) {
1655                 if ( lr->lr_status == LDAP_REQST_COMPLETED ) {
1656                         continue;       /* Skip completed requests */
1657                 }
1658                 if ( msgid == lr->lr_msgid ) {
1659                         lr->lr_refcnt++;
1660                         break;
1661                 }
1662         }
1663
1664         return( lr );
1665 }
1666
1667 /* protected by req_mutex */
1668 void
1669 ldap_return_request( LDAP *ld, LDAPRequest *lrx, int freeit )
1670 {
1671         LDAPRequest     *lr;
1672
1673         for ( lr = ld->ld_requests; lr != NULL; lr = lr->lr_next ) {
1674                 if ( lr == lrx ) {
1675                         if ( lr->lr_refcnt > 0 ) {
1676                                 lr->lr_refcnt--;
1677
1678                         } else if ( lr->lr_refcnt < 0 ) {
1679                                 lr->lr_refcnt++;
1680                                 if ( lr->lr_refcnt == 0 ) {
1681                                         lr = NULL;
1682                                 }
1683                         }
1684                         break;
1685                 }
1686         }
1687         if ( lr == NULL ) {
1688                 ldap_free_request_int( ld, lrx );
1689
1690         } else if ( freeit ) {
1691                 ldap_free_request( ld, lrx );
1692         }
1693 }