git.sur5r.net Git - openldap/blob - libraries/libldap/request.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2018 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  16  * All rights reserved.
  17  */
  18 /* This notice applies to changes, created by or for Novell, Inc.,
  19  * to preexisting works for which notices appear elsewhere in this file.
  20  *
  21  * Copyright (C) 1999, 2000 Novell, Inc. All Rights Reserved.
  22  *
  23  * THIS WORK IS SUBJECT TO U.S. AND INTERNATIONAL COPYRIGHT LAWS AND TREATIES.
  24  * USE, MODIFICATION, AND REDISTRIBUTION OF THIS WORK IS SUBJECT TO VERSION
  25  * 2.0.1 OF THE OPENLDAP PUBLIC LICENSE, A COPY OF WHICH IS AVAILABLE AT
  26  * HTTP://WWW.OPENLDAP.ORG/LICENSE.HTML OR IN THE FILE "LICENSE" IN THE
  27  * TOP-LEVEL DIRECTORY OF THE DISTRIBUTION. ANY USE OR EXPLOITATION OF THIS
  28  * WORK OTHER THAN AS AUTHORIZED IN VERSION 2.0.1 OF THE OPENLDAP PUBLIC
  29  * LICENSE, OR OTHER PRIOR WRITTEN CONSENT FROM NOVELL, COULD SUBJECT THE
  30  * PERPETRATOR TO CRIMINAL AND CIVIL LIABILITY.
  31  *---
  32  * Modification to OpenLDAP source by Novell, Inc.
  33  * April 2000 sfs  Added code to chase V3 referrals
  34  *  request.c - sending of ldap requests; handling of referrals
  35  *---
  36  * Note: A verbatim copy of version 2.0.1 of the OpenLDAP Public License
  37  * can be found in the file "build/LICENSE-2.0.1" in this distribution
  38  * of OpenLDAP Software.
  39  */
  40
  41 #include "portable.h"
  42
  43 #include <stdio.h>
  44
  45 #include <ac/stdlib.h>
  46
  47 #include <ac/errno.h>
  48 #include <ac/socket.h>
  49 #include <ac/string.h>
  50 #include <ac/time.h>
  51 #include <ac/unistd.h>
  52
  53 #include "ldap-int.h"
  54 #include "lber.h"
  55
  56 /* used by ldap_send_server_request and ldap_new_connection */
  57 #ifdef LDAP_R_COMPILE
  58 #define LDAP_CONN_LOCK_IF(nolock) \
  59         { if (nolock) LDAP_MUTEX_LOCK( &ld->ld_conn_mutex ); }
  60 #define LDAP_CONN_UNLOCK_IF(nolock) \
  61         { if (nolock) LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex ); }
  62 #define LDAP_REQ_LOCK_IF(nolock) \
  63         { if (nolock) LDAP_MUTEX_LOCK( &ld->ld_req_mutex ); }
  64 #define LDAP_REQ_UNLOCK_IF(nolock) \
  65         { if (nolock) LDAP_MUTEX_UNLOCK( &ld->ld_req_mutex ); }
  66 #define LDAP_RES_LOCK_IF(nolock) \
  67         { if (nolock) LDAP_MUTEX_LOCK( &ld->ld_res_mutex ); }
  68 #define LDAP_RES_UNLOCK_IF(nolock) \
  69         { if (nolock) LDAP_MUTEX_UNLOCK( &ld->ld_res_mutex ); }
  70 #else
  71 #define LDAP_CONN_LOCK_IF(nolock)
  72 #define LDAP_CONN_UNLOCK_IF(nolock)
  73 #define LDAP_REQ_LOCK_IF(nolock)
  74 #define LDAP_REQ_UNLOCK_IF(nolock)
  75 #define LDAP_RES_LOCK_IF(nolock)
  76 #define LDAP_RES_UNLOCK_IF(nolock)
  77 #endif
  78
  79 static LDAPConn *find_connection LDAP_P(( LDAP *ld, LDAPURLDesc *srv, int any ));
  80 static void use_connection LDAP_P(( LDAP *ld, LDAPConn *lc ));
  81 static void ldap_free_request_int LDAP_P(( LDAP *ld, LDAPRequest *lr ));
  82
  83 static BerElement *
  84 re_encode_request( LDAP *ld,
  85         BerElement *origber,
  86         ber_int_t msgid,
  87         int sref,
  88         LDAPURLDesc *srv,
  89         int *type );
  90
  91 BerElement *
  92 ldap_alloc_ber_with_options( LDAP *ld )
  93 {
  94         BerElement      *ber;
  95
  96         ber = ber_alloc_t( ld->ld_lberoptions );
  97         if ( ber == NULL ) {
  98                 ld->ld_errno = LDAP_NO_MEMORY;
  99         }
 100
 101         return( ber );
 102 }
 103
 104
 105 void
 106 ldap_set_ber_options( LDAP *ld, BerElement *ber )
 107 {
 108         /* ld_lberoptions is constant, hence no lock */
 109         ber->ber_options = ld->ld_lberoptions;
 110 }
 111
 112
 113 /* sets needed mutexes - no mutexes set to this point */
 114 ber_int_t
 115 ldap_send_initial_request(
 116         LDAP *ld,
 117         ber_tag_t msgtype,
 118         const char *dn,
 119         BerElement *ber,
 120         ber_int_t msgid)
 121 {
 122         int rc = 1;
 123         ber_socket_t sd = AC_SOCKET_INVALID;
 124
 125         Debug( LDAP_DEBUG_TRACE, "ldap_send_initial_request\n", 0, 0, 0 );
 126
 127         LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 128         if ( ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, &sd ) == -1 ) {
 129                 /* not connected yet */
 130                 rc = ldap_open_defconn( ld );
 131                 if ( rc == 0 ) {
 132                         ber_sockbuf_ctrl( ld->ld_defconn->lconn_sb,
 133                                 LBER_SB_OPT_GET_FD, &sd );
 134                 }
 135         }
 136         if ( ld->ld_defconn && ld->ld_defconn->lconn_status == LDAP_CONNST_CONNECTING )
 137                 rc = ldap_int_check_async_open( ld, sd );
 138         if( rc < 0 ) {
 139                 ber_free( ber, 1 );
 140                 LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 141                 return( -1 );
 142         } else if ( rc == 0 ) {
 143                 Debug( LDAP_DEBUG_TRACE,
 144                         "ldap_open_defconn: successful\n",
 145                         0, 0, 0 );
 146         }
 147
 148 #ifdef LDAP_CONNECTIONLESS
 149         if (LDAP_IS_UDP(ld)) {
 150                 if (msgtype == LDAP_REQ_BIND) {
 151                         LDAP_MUTEX_LOCK( &ld->ld_options.ldo_mutex );
 152                         if (ld->ld_options.ldo_cldapdn)
 153                                 ldap_memfree(ld->ld_options.ldo_cldapdn);
 154                         ld->ld_options.ldo_cldapdn = ldap_strdup(dn);
 155                         ber_free( ber, 1 );
 156                         LDAP_MUTEX_UNLOCK( &ld->ld_options.ldo_mutex );
 157                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 158                         return 0;
 159                 }
 160                 if (msgtype != LDAP_REQ_ABANDON && msgtype != LDAP_REQ_SEARCH)
 161                 {
 162                         ber_free( ber, 1 );
 163                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 164                         return LDAP_PARAM_ERROR;
 165                 }
 166         }
 167 #endif
 168         LDAP_MUTEX_LOCK( &ld->ld_req_mutex );
 169         rc = ldap_send_server_request( ld, ber, msgid, NULL,
 170                 NULL, NULL, NULL, 0, 0 );
 171         LDAP_MUTEX_UNLOCK( &ld->ld_req_mutex );
 172         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 173         return(rc);
 174 }
 175
 176
 177 /* protected by conn_mutex */
 178 int
 179 ldap_int_flush_request(
 180         LDAP *ld,
 181         LDAPRequest *lr )
 182 {
 183         LDAPConn *lc = lr->lr_conn;
 184
 185         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 186         if ( ber_flush2( lc->lconn_sb, lr->lr_ber, LBER_FLUSH_FREE_NEVER ) != 0 ) {
 187                 if ( sock_errno() == EAGAIN ) {
 188                         /* need to continue write later */
 189                         lr->lr_status = LDAP_REQST_WRITING;
 190                         ldap_mark_select_write( ld, lc->lconn_sb );
 191                         ld->ld_errno = LDAP_BUSY;
 192                         return -2;
 193                 } else {
 194                         ld->ld_errno = LDAP_SERVER_DOWN;
 195                         ldap_free_request( ld, lr );
 196                         ldap_free_connection( ld, lc, 0, 0 );
 197                         return( -1 );
 198                 }
 199         } else {
 200                 if ( lr->lr_parent == NULL ) {
 201                         lr->lr_ber->ber_end = lr->lr_ber->ber_ptr;
 202                         lr->lr_ber->ber_ptr = lr->lr_ber->ber_buf;
 203                 }
 204                 lr->lr_status = LDAP_REQST_INPROGRESS;
 205
 206                 /* sent -- waiting for a response */
 207                 ldap_mark_select_read( ld, lc->lconn_sb );
 208                 ldap_clear_select_write( ld, lc->lconn_sb );
 209         }
 210         return 0;
 211 }
 212
 213 /*
 214  * protected by req_mutex
 215  * if m_noconn then protect using conn_lock
 216  * else already protected with conn_lock
 217  * if m_res then also protected by res_mutex
 218  */
 219
 220 int
 221 ldap_send_server_request(
 222         LDAP *ld,
 223         BerElement *ber,
 224         ber_int_t msgid,
 225         LDAPRequest *parentreq,
 226         LDAPURLDesc **srvlist,
 227         LDAPConn *lc,
 228         LDAPreqinfo *bind,
 229         int m_noconn,
 230         int m_res )
 231 {
 232         LDAPRequest     *lr;
 233         int             incparent, rc;
 234
 235         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
 236         Debug( LDAP_DEBUG_TRACE, "ldap_send_server_request\n", 0, 0, 0 );
 237
 238         incparent = 0;
 239         ld->ld_errno = LDAP_SUCCESS;    /* optimistic */
 240
 241         LDAP_CONN_LOCK_IF(m_noconn);
 242         if ( lc == NULL ) {
 243                 if ( srvlist == NULL ) {
 244                         lc = ld->ld_defconn;
 245                 } else {
 246                         lc = find_connection( ld, *srvlist, 1 );
 247                         if ( lc == NULL ) {
 248                                 if ( (bind != NULL) && (parentreq != NULL) ) {
 249                                         /* Remember the bind in the parent */
 250                                         incparent = 1;
 251                                         ++parentreq->lr_outrefcnt;
 252                                 }
 253                                 lc = ldap_new_connection( ld, srvlist, 0,
 254                                         1, bind, 1, m_res );
 255                         }
 256                 }
 257         }
 258
 259         /* async connect... */
 260         if ( lc != NULL && lc->lconn_status == LDAP_CONNST_CONNECTING ) {
 261                 ber_socket_t    sd = AC_SOCKET_ERROR;
 262                 struct timeval  tv = { 0 };
 263
 264                 ber_sockbuf_ctrl( lc->lconn_sb, LBER_SB_OPT_GET_FD, &sd );
 265
 266                 /* poll ... */
 267                 switch ( ldap_int_poll( ld, sd, &tv, 1 ) ) {
 268                 case 0:
 269                         /* go on! */
 270                         lc->lconn_status = LDAP_CONNST_CONNECTED;
 271                         break;
 272
 273                 case -2:
 274                         /* async only occurs if a network timeout is set */
 275
 276                         /* honor network timeout */
 277                         LDAP_MUTEX_LOCK( &ld->ld_options.ldo_mutex );
 278                         if ( time( NULL ) - lc->lconn_created <= ld->ld_options.ldo_tm_net.tv_sec )
 279                         {
 280                                 /* caller will have to call again */
 281                                 ld->ld_errno = LDAP_X_CONNECTING;
 282                         }
 283                         LDAP_MUTEX_UNLOCK( &ld->ld_options.ldo_mutex );
 284                         /* fallthru */
 285
 286                 default:
 287                         /* error */
 288                         break;
 289                 }
 290         }
 291
 292         if ( lc == NULL || lc->lconn_status != LDAP_CONNST_CONNECTED ) {
 293                 if ( ld->ld_errno == LDAP_SUCCESS ) {
 294                         ld->ld_errno = LDAP_SERVER_DOWN;
 295                 }
 296
 297                 ber_free( ber, 1 );
 298                 if ( incparent ) {
 299                         /* Forget about the bind */
 300                         --parentreq->lr_outrefcnt;
 301                 }
 302                 LDAP_CONN_UNLOCK_IF(m_noconn);
 303                 return( -1 );
 304         }
 305
 306         use_connection( ld, lc );
 307
 308 #ifdef LDAP_CONNECTIONLESS
 309         if ( LDAP_IS_UDP( ld )) {
 310                 BerElement tmpber = *ber;
 311                 ber_rewind( &tmpber );
 312                 LDAP_MUTEX_LOCK( &ld->ld_options.ldo_mutex );
 313                 rc = ber_write( &tmpber, ld->ld_options.ldo_peer,
 314                         sizeof( struct sockaddr_storage ), 0 );
 315                 LDAP_MUTEX_UNLOCK( &ld->ld_options.ldo_mutex );
 316                 if ( rc == -1 ) {
 317                         ld->ld_errno = LDAP_ENCODING_ERROR;
 318                         ber_free( ber, 1 );
 319                         LDAP_CONN_UNLOCK_IF(m_noconn);
 320                         return rc;
 321                 }
 322         }
 323 #endif
 324
 325         /* If we still have an incomplete write, try to finish it before
 326          * dealing with the new request. If we don't finish here, return
 327          * LDAP_BUSY and let the caller retry later. We only allow a single
 328          * request to be in WRITING state.
 329          */
 330         rc = 0;
 331         if ( ld->ld_requests &&
 332                 ld->ld_requests->lr_status == LDAP_REQST_WRITING &&
 333                 ldap_int_flush_request( ld, ld->ld_requests ) < 0 )
 334         {
 335                 rc = -1;
 336         }
 337         if ( rc ) {
 338                 ber_free( ber, 1 );
 339                 LDAP_CONN_UNLOCK_IF(m_noconn);
 340                 return rc;
 341         }
 342
 343         lr = (LDAPRequest *)LDAP_CALLOC( 1, sizeof( LDAPRequest ) );
 344         if ( lr == NULL ) {
 345                 ld->ld_errno = LDAP_NO_MEMORY;
 346                 ldap_free_connection( ld, lc, 0, 0 );
 347                 ber_free( ber, 1 );
 348                 if ( incparent ) {
 349                         /* Forget about the bind */
 350                         --parentreq->lr_outrefcnt;
 351                 }
 352                 LDAP_CONN_UNLOCK_IF(m_noconn);
 353                 return( -1 );
 354         }
 355         lr->lr_msgid = msgid;
 356         lr->lr_status = LDAP_REQST_INPROGRESS;
 357         lr->lr_res_errno = LDAP_SUCCESS;        /* optimistic */
 358         lr->lr_ber = ber;
 359         lr->lr_conn = lc;
 360         if ( parentreq != NULL ) {      /* sub-request */
 361                 if ( !incparent ) {
 362                         /* Increment if we didn't do it before the bind */
 363                         ++parentreq->lr_outrefcnt;
 364                 }
 365                 lr->lr_origid = parentreq->lr_origid;
 366                 lr->lr_parentcnt = ++parentreq->lr_parentcnt;
 367                 lr->lr_parent = parentreq;
 368                 lr->lr_refnext = parentreq->lr_child;
 369                 parentreq->lr_child = lr;
 370         } else {                        /* original request */
 371                 lr->lr_origid = lr->lr_msgid;
 372         }
 373
 374         /* Extract requestDN for future reference */
 375 #ifdef LDAP_CONNECTIONLESS
 376         if ( !LDAP_IS_UDP(ld) )
 377 #endif
 378         {
 379                 BerElement tmpber = *ber;
 380                 ber_int_t       bint;
 381                 ber_tag_t       tag, rtag;
 382
 383                 ber_reset( &tmpber, 1 );
 384                 rtag = ber_scanf( &tmpber, "{it", /*}*/ &bint, &tag );
 385                 switch ( tag ) {
 386                 case LDAP_REQ_BIND:
 387                         rtag = ber_scanf( &tmpber, "{i" /*}*/, &bint );
 388                         break;
 389                 case LDAP_REQ_DELETE:
 390                         break;
 391                 default:
 392                         rtag = ber_scanf( &tmpber, "{" /*}*/ );
 393                 case LDAP_REQ_ABANDON:
 394                         break;
 395                 }
 396                 if ( tag != LDAP_REQ_ABANDON ) {
 397                         ber_skip_tag( &tmpber, &lr->lr_dn.bv_len );
 398                         lr->lr_dn.bv_val = tmpber.ber_ptr;
 399                 }
 400         }
 401
 402         lr->lr_prev = NULL;
 403         lr->lr_next = ld->ld_requests;
 404         if ( lr->lr_next != NULL ) {
 405                 lr->lr_next->lr_prev = lr;
 406         }
 407         ld->ld_requests = lr;
 408
 409         ld->ld_errno = LDAP_SUCCESS;
 410         if ( ldap_int_flush_request( ld, lr ) == -1 ) {
 411                 msgid = -1;
 412         }
 413
 414         LDAP_CONN_UNLOCK_IF(m_noconn);
 415         return( msgid );
 416 }
 417
 418 /* return 0 if no StartTLS ext, 1 if present, 2 if critical */
 419 static int
 420 find_tls_ext( LDAPURLDesc *srv )
 421 {
 422         int i, crit;
 423         char *ext;
 424
 425         if ( !srv->lud_exts )
 426                 return 0;
 427
 428         for (i=0; srv->lud_exts[i]; i++) {
 429                 crit = 0;
 430                 ext = srv->lud_exts[i];
 431                 if ( ext[0] == '!') {
 432                         ext++;
 433                         crit = 1;
 434                 }
 435                 if ( !strcasecmp( ext, "StartTLS" ) ||
 436                         !strcasecmp( ext, "X-StartTLS" ) ||
 437                         !strcmp( ext, LDAP_EXOP_START_TLS )) {
 438                         return crit + 1;
 439                 }
 440         }
 441         return 0;
 442 }
 443
 444 /*
 445  * always protected by conn_mutex
 446  * optionally protected by req_mutex and res_mutex
 447  */
 448 LDAPConn *
 449 ldap_new_connection( LDAP *ld, LDAPURLDesc **srvlist, int use_ldsb,
 450         int connect, LDAPreqinfo *bind, int m_req, int m_res )
 451 {
 452         LDAPConn        *lc;
 453         int             async = 0;
 454
 455         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 456         Debug( LDAP_DEBUG_TRACE, "ldap_new_connection %d %d %d\n",
 457                 use_ldsb, connect, (bind != NULL) );
 458         /*
 459          * make a new LDAP server connection
 460          * XXX open connection synchronously for now
 461          */
 462         lc = (LDAPConn *)LDAP_CALLOC( 1, sizeof( LDAPConn ) );
 463         if ( lc == NULL ) {
 464                 ld->ld_errno = LDAP_NO_MEMORY;
 465                 return( NULL );
 466         }
 467
 468         if ( use_ldsb ) {
 469                 assert( ld->ld_sb != NULL );
 470                 lc->lconn_sb = ld->ld_sb;
 471
 472         } else {
 473                 lc->lconn_sb = ber_sockbuf_alloc();
 474                 if ( lc->lconn_sb == NULL ) {
 475                         LDAP_FREE( (char *)lc );
 476                         ld->ld_errno = LDAP_NO_MEMORY;
 477                         return( NULL );
 478                 }
 479         }
 480
 481         if ( connect ) {
 482                 LDAPURLDesc     **srvp, *srv = NULL;
 483
 484                 async = LDAP_BOOL_GET( &ld->ld_options, LDAP_BOOL_CONNECT_ASYNC );
 485
 486                 for ( srvp = srvlist; *srvp != NULL; srvp = &(*srvp)->lud_next ) {
 487                         int             rc;
 488
 489                         rc = ldap_int_open_connection( ld, lc, *srvp, async );
 490                         if ( rc != -1 ) {
 491                                 srv = *srvp;
 492
 493                                 /* If we fully connected, async is moot */
 494                                 if ( rc == 0 )
 495                                         async = 0;
 496
 497                                 if ( ld->ld_urllist_proc && ( !async || rc != -2 ) ) {
 498                                         ld->ld_urllist_proc( ld, srvlist, srvp, ld->ld_urllist_params );
 499                                 }
 500
 501                                 break;
 502                         }
 503                 }
 504
 505                 if ( srv == NULL ) {
 506                         if ( !use_ldsb ) {
 507                                 ber_sockbuf_free( lc->lconn_sb );
 508                         }
 509                         LDAP_FREE( (char *)lc );
 510                         ld->ld_errno = LDAP_SERVER_DOWN;
 511                         return( NULL );
 512                 }
 513
 514                 lc->lconn_server = ldap_url_dup( srv );
 515                 if ( !lc->lconn_server ) {
 516                         if ( !use_ldsb )
 517                                 ber_sockbuf_free( lc->lconn_sb );
 518                         LDAP_FREE( (char *)lc );
 519                         ld->ld_errno = LDAP_NO_MEMORY;
 520                         return( NULL );
 521                 }
 522         }
 523
 524         lc->lconn_status = async ? LDAP_CONNST_CONNECTING : LDAP_CONNST_CONNECTED;
 525         lc->lconn_next = ld->ld_conns;
 526         ld->ld_conns = lc;
 527
 528         if ( connect ) {
 529 #ifdef HAVE_TLS
 530                 if ( lc->lconn_server->lud_exts ) {
 531                         int rc, ext = find_tls_ext( lc->lconn_server );
 532                         if ( ext ) {
 533                                 LDAPConn        *savedefconn;
 534
 535                                 savedefconn = ld->ld_defconn;
 536                                 ++lc->lconn_refcnt;     /* avoid premature free */
 537                                 ld->ld_defconn = lc;
 538
 539                                 LDAP_REQ_UNLOCK_IF(m_req);
 540                                 LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 541                                 LDAP_RES_UNLOCK_IF(m_res);
 542                                 rc = ldap_start_tls_s( ld, NULL, NULL );
 543                                 LDAP_RES_LOCK_IF(m_res);
 544                                 LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 545                                 LDAP_REQ_LOCK_IF(m_req);
 546                                 ld->ld_defconn = savedefconn;
 547                                 --lc->lconn_refcnt;
 548
 549                                 if ( rc != LDAP_SUCCESS && ext == 2 ) {
 550                                         ldap_free_connection( ld, lc, 1, 0 );
 551                                         return NULL;
 552                                 }
 553                         }
 554                 }
 555 #endif
 556         }
 557
 558         if ( bind != NULL ) {
 559                 int             err = 0;
 560                 LDAPConn        *savedefconn;
 561
 562                 /* Set flag to prevent additional referrals
 563                  * from being processed on this
 564                  * connection until the bind has completed
 565                  */
 566                 lc->lconn_rebind_inprogress = 1;
 567                 /* V3 rebind function */
 568                 if ( ld->ld_rebind_proc != NULL) {
 569                         LDAPURLDesc     *srvfunc;
 570
 571                         srvfunc = ldap_url_dup( *srvlist );
 572                         if ( srvfunc == NULL ) {
 573                                 ld->ld_errno = LDAP_NO_MEMORY;
 574                                 err = -1;
 575                         } else {
 576                                 savedefconn = ld->ld_defconn;
 577                                 ++lc->lconn_refcnt;     /* avoid premature free */
 578                                 ld->ld_defconn = lc;
 579
 580                                 Debug( LDAP_DEBUG_TRACE, "Call application rebind_proc\n", 0, 0, 0);
 581                                 LDAP_REQ_UNLOCK_IF(m_req);
 582                                 LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 583                                 LDAP_RES_UNLOCK_IF(m_res);
 584                                 err = (*ld->ld_rebind_proc)( ld,
 585                                         bind->ri_url, bind->ri_request, bind->ri_msgid,
 586                                         ld->ld_rebind_params );
 587                                 LDAP_RES_LOCK_IF(m_res);
 588                                 LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 589                                 LDAP_REQ_LOCK_IF(m_req);
 590
 591                                 ld->ld_defconn = savedefconn;
 592                                 --lc->lconn_refcnt;
 593
 594                                 if ( err != 0 ) {
 595                                         err = -1;
 596                                         ldap_free_connection( ld, lc, 1, 0 );
 597                                         lc = NULL;
 598                                 }
 599                                 ldap_free_urldesc( srvfunc );
 600                         }
 601
 602                 } else {
 603                         int             msgid, rc;
 604                         struct berval   passwd = BER_BVNULL;
 605
 606                         savedefconn = ld->ld_defconn;
 607                         ++lc->lconn_refcnt;     /* avoid premature free */
 608                         ld->ld_defconn = lc;
 609
 610                         Debug( LDAP_DEBUG_TRACE,
 611                                 "anonymous rebind via ldap_sasl_bind(\"\")\n",
 612                                 0, 0, 0);
 613
 614                         LDAP_REQ_UNLOCK_IF(m_req);
 615                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 616                         LDAP_RES_UNLOCK_IF(m_res);
 617                         rc = ldap_sasl_bind( ld, "", LDAP_SASL_SIMPLE, &passwd,
 618                                 NULL, NULL, &msgid );
 619                         if ( rc != LDAP_SUCCESS ) {
 620                                 err = -1;
 621
 622                         } else {
 623                                 for ( err = 1; err > 0; ) {
 624                                         struct timeval  tv = { 0, 100000 };
 625                                         LDAPMessage     *res = NULL;
 626
 627                                         switch ( ldap_result( ld, msgid, LDAP_MSG_ALL, &tv, &res ) ) {
 628                                         case -1:
 629                                                 err = -1;
 630                                                 break;
 631
 632                                         case 0:
 633 #ifdef LDAP_R_COMPILE
 634                                                 ldap_pvt_thread_yield();
 635 #endif
 636                                                 break;
 637
 638                                         case LDAP_RES_BIND:
 639                                                 rc = ldap_parse_result( ld, res, &err, NULL, NULL, NULL, NULL, 1 );
 640                                                 if ( rc != LDAP_SUCCESS ) {
 641                                                         err = -1;
 642
 643                                                 } else if ( err != LDAP_SUCCESS ) {
 644                                                         err = -1;
 645                                                 }
 646                                                 /* else err == LDAP_SUCCESS == 0 */
 647                                                 break;
 648
 649                                         default:
 650                                                 Debug( LDAP_DEBUG_TRACE,
 651                                                         "ldap_new_connection %p: "
 652                                                         "unexpected response %d "
 653                                                         "from BIND request id=%d\n",
 654                                                         (void *) ld, ldap_msgtype( res ), msgid );
 655                                                 err = -1;
 656                                                 break;
 657                                         }
 658                                 }
 659                         }
 660                         LDAP_RES_LOCK_IF(m_res);
 661                         LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 662                         LDAP_REQ_LOCK_IF(m_req);
 663                         ld->ld_defconn = savedefconn;
 664                         --lc->lconn_refcnt;
 665
 666                         if ( err != 0 ) {
 667                                 ldap_free_connection( ld, lc, 1, 0 );
 668                                 lc = NULL;
 669                         }
 670                 }
 671                 if ( lc != NULL )
 672                         lc->lconn_rebind_inprogress = 0;
 673         }
 674         return( lc );
 675 }
 676
 677
 678 /* protected by ld_conn_mutex */
 679 static LDAPConn *
 680 find_connection( LDAP *ld, LDAPURLDesc *srv, int any )
 681 /*
 682  * return an existing connection (if any) to the server srv
 683  * if "any" is non-zero, check for any server in the "srv" chain
 684  */
 685 {
 686         LDAPConn        *lc;
 687         LDAPURLDesc     *lcu, *lsu;
 688         int lcu_port, lsu_port;
 689         int found = 0;
 690
 691         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 692         for ( lc = ld->ld_conns; lc != NULL; lc = lc->lconn_next ) {
 693                 lcu = lc->lconn_server;
 694                 lcu_port = ldap_pvt_url_scheme_port( lcu->lud_scheme,
 695                         lcu->lud_port );
 696
 697                 for ( lsu = srv; lsu != NULL; lsu = lsu->lud_next ) {
 698                         lsu_port = ldap_pvt_url_scheme_port( lsu->lud_scheme,
 699                                 lsu->lud_port );
 700
 701                         if ( lsu_port == lcu_port
 702                                 && strcmp( lcu->lud_scheme, lsu->lud_scheme ) == 0
 703                                 && lcu->lud_host != NULL && lsu->lud_host != NULL
 704                                 && strcasecmp( lsu->lud_host, lcu->lud_host ) == 0 )
 705                         {
 706                                 found = 1;
 707                                 break;
 708                         }
 709
 710                         if ( !any ) break;
 711                 }
 712                 if ( found )
 713                         break;
 714         }
 715         return lc;
 716 }
 717
 718
 719
 720 /* protected by ld_conn_mutex */
 721 static void
 722 use_connection( LDAP *ld, LDAPConn *lc )
 723 {
 724         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 725         ++lc->lconn_refcnt;
 726         lc->lconn_lastused = time( NULL );
 727 }
 728
 729
 730 /* protected by ld_conn_mutex */
 731 void
 732 ldap_free_connection( LDAP *ld, LDAPConn *lc, int force, int unbind )
 733 {
 734         LDAPConn        *tmplc, *prevlc;
 735
 736         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
 737         Debug( LDAP_DEBUG_TRACE,
 738                 "ldap_free_connection %d %d\n",
 739                 force, unbind, 0 );
 740
 741         if ( force || --lc->lconn_refcnt <= 0 ) {
 742                 /* remove from connections list first */
 743
 744                 for ( prevlc = NULL, tmplc = ld->ld_conns;
 745                         tmplc != NULL;
 746                         tmplc = tmplc->lconn_next )
 747                 {
 748                         if ( tmplc == lc ) {
 749                                 if ( prevlc == NULL ) {
 750                                     ld->ld_conns = tmplc->lconn_next;
 751                                 } else {
 752                                     prevlc->lconn_next = tmplc->lconn_next;
 753                                 }
 754                                 if ( ld->ld_defconn == lc ) {
 755                                         ld->ld_defconn = NULL;
 756                                 }
 757                                 break;
 758                         }
 759                         prevlc = tmplc;
 760                 }
 761
 762                 /* process connection callbacks */
 763                 {
 764                         struct ldapoptions *lo;
 765                         ldaplist *ll;
 766                         ldap_conncb *cb;
 767
 768                         lo = &ld->ld_options;
 769                         LDAP_MUTEX_LOCK( &lo->ldo_mutex );
 770                         if ( lo->ldo_conn_cbs ) {
 771                                 for ( ll=lo->ldo_conn_cbs; ll; ll=ll->ll_next ) {
 772                                         cb = ll->ll_data;
 773                                         cb->lc_del( ld, lc->lconn_sb, cb );
 774                                 }
 775                         }
 776                         LDAP_MUTEX_UNLOCK( &lo->ldo_mutex );
 777                         lo = LDAP_INT_GLOBAL_OPT();
 778                         LDAP_MUTEX_LOCK( &lo->ldo_mutex );
 779                         if ( lo->ldo_conn_cbs ) {
 780                                 for ( ll=lo->ldo_conn_cbs; ll; ll=ll->ll_next ) {
 781                                         cb = ll->ll_data;
 782                                         cb->lc_del( ld, lc->lconn_sb, cb );
 783                                 }
 784                         }
 785                         LDAP_MUTEX_UNLOCK( &lo->ldo_mutex );
 786                 }
 787
 788                 if ( lc->lconn_status == LDAP_CONNST_CONNECTED ) {
 789                         ldap_mark_select_clear( ld, lc->lconn_sb );
 790                         if ( unbind ) {
 791                                 ldap_send_unbind( ld, lc->lconn_sb,
 792                                                 NULL, NULL );
 793                         }
 794                 }
 795
 796                 if ( lc->lconn_ber != NULL ) {
 797                         ber_free( lc->lconn_ber, 1 );
 798                 }
 799
 800                 ldap_int_sasl_close( ld, lc );
 801 #ifdef HAVE_GSSAPI
 802                 ldap_int_gssapi_close( ld, lc );
 803 #endif
 804
 805                 ldap_free_urllist( lc->lconn_server );
 806
 807                 /* FIXME: is this at all possible?
 808                  * ldap_ld_free() in unbind.c calls ldap_free_connection()
 809                  * with force == 1 __after__ explicitly calling
 810                  * ldap_free_request() on all requests */
 811                 if ( force ) {
 812                         LDAPRequest     *lr;
 813
 814                         for ( lr = ld->ld_requests; lr; ) {
 815                                 LDAPRequest     *lr_next = lr->lr_next;
 816
 817                                 if ( lr->lr_conn == lc ) {
 818                                         ldap_free_request_int( ld, lr );
 819                                 }
 820
 821                                 lr = lr_next;
 822                         }
 823                 }
 824
 825                 if ( lc->lconn_sb != ld->ld_sb ) {
 826                         ber_sockbuf_free( lc->lconn_sb );
 827                 } else {
 828                         ber_int_sb_close( lc->lconn_sb );
 829                 }
 830
 831                 if ( lc->lconn_rebind_queue != NULL) {
 832                         int i;
 833                         for( i = 0; lc->lconn_rebind_queue[i] != NULL; i++ ) {
 834                                 LDAP_VFREE( lc->lconn_rebind_queue[i] );
 835                         }
 836                         LDAP_FREE( lc->lconn_rebind_queue );
 837                 }
 838
 839                 LDAP_FREE( lc );
 840
 841                 Debug( LDAP_DEBUG_TRACE,
 842                         "ldap_free_connection: actually freed\n",
 843                         0, 0, 0 );
 844
 845         } else {
 846                 lc->lconn_lastused = time( NULL );
 847                 Debug( LDAP_DEBUG_TRACE, "ldap_free_connection: refcnt %d\n",
 848                                 lc->lconn_refcnt, 0, 0 );
 849         }
 850 }
 851
 852
 853 /* Protects self with ld_conn_mutex */
 854 #ifdef LDAP_DEBUG
 855 void
 856 ldap_dump_connection( LDAP *ld, LDAPConn *lconns, int all )
 857 {
 858         LDAPConn        *lc;
 859         char            timebuf[32];
 860
 861         Debug( LDAP_DEBUG_TRACE, "** ld %p Connection%s:\n", (void *)ld, all ? "s" : "", 0 );
 862         LDAP_MUTEX_LOCK( &ld->ld_conn_mutex );
 863         for ( lc = lconns; lc != NULL; lc = lc->lconn_next ) {
 864                 if ( lc->lconn_server != NULL ) {
 865                         Debug( LDAP_DEBUG_TRACE, "* host: %s  port: %d%s\n",
 866                                 ( lc->lconn_server->lud_host == NULL ) ? "(null)"
 867                                 : lc->lconn_server->lud_host,
 868                                 lc->lconn_server->lud_port, ( lc->lconn_sb ==
 869                                 ld->ld_sb ) ? "  (default)" : "" );
 870                 }
 871                 Debug( LDAP_DEBUG_TRACE, "  refcnt: %d  status: %s\n", lc->lconn_refcnt,
 872                         ( lc->lconn_status == LDAP_CONNST_NEEDSOCKET )
 873                                 ? "NeedSocket" :
 874                                 ( lc->lconn_status == LDAP_CONNST_CONNECTING )
 875                                         ? "Connecting" : "Connected", 0 );
 876                 Debug( LDAP_DEBUG_TRACE, "  last used: %s%s\n",
 877                         ldap_pvt_ctime( &lc->lconn_lastused, timebuf ),
 878                         lc->lconn_rebind_inprogress ? "  rebind in progress" : "", 0 );
 879                 if ( lc->lconn_rebind_inprogress ) {
 880                         if ( lc->lconn_rebind_queue != NULL) {
 881                                 int     i;
 882
 883                                 for ( i = 0; lc->lconn_rebind_queue[i] != NULL; i++ ) {
 884                                         int     j;
 885                                         for( j = 0; lc->lconn_rebind_queue[i][j] != 0; j++ ) {
 886                                                 Debug( LDAP_DEBUG_TRACE, "    queue %d entry %d - %s\n",
 887                                                         i, j, lc->lconn_rebind_queue[i][j] );
 888                                         }
 889                                 }
 890                         } else {
 891                                 Debug( LDAP_DEBUG_TRACE, "    queue is empty\n", 0, 0, 0 );
 892                         }
 893                 }
 894                 Debug( LDAP_DEBUG_TRACE, "\n", 0, 0, 0 );
 895                 if ( !all ) {
 896                         break;
 897                 }
 898         }
 899         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 900 }
 901
 902
 903 /* protected by req_mutex and res_mutex */
 904 void
 905 ldap_dump_requests_and_responses( LDAP *ld )
 906 {
 907         LDAPRequest     *lr;
 908         LDAPMessage     *lm, *l;
 909         int             i;
 910
 911         Debug( LDAP_DEBUG_TRACE, "** ld %p Outstanding Requests:\n",
 912                 (void *)ld, 0, 0 );
 913         lr = ld->ld_requests;
 914         if ( lr == NULL ) {
 915                 Debug( LDAP_DEBUG_TRACE, "   Empty\n", 0, 0, 0 );
 916         }
 917         for ( i = 0; lr != NULL; lr = lr->lr_next, i++ ) {
 918                 Debug( LDAP_DEBUG_TRACE, " * msgid %d,  origid %d, status %s\n",
 919                         lr->lr_msgid, lr->lr_origid,
 920                         ( lr->lr_status == LDAP_REQST_INPROGRESS ) ? "InProgress" :
 921                         ( lr->lr_status == LDAP_REQST_CHASINGREFS ) ? "ChasingRefs" :
 922                         ( lr->lr_status == LDAP_REQST_NOTCONNECTED ) ? "NotConnected" :
 923                         ( lr->lr_status == LDAP_REQST_WRITING ) ? "Writing" :
 924                         ( lr->lr_status == LDAP_REQST_COMPLETED ) ? "RequestCompleted"
 925                                 : "InvalidStatus" );
 926                 Debug( LDAP_DEBUG_TRACE, "   outstanding referrals %d, parent count %d\n",
 927                         lr->lr_outrefcnt, lr->lr_parentcnt, 0 );
 928         }
 929         Debug( LDAP_DEBUG_TRACE, "  ld %p request count %d (abandoned %lu)\n",
 930                 (void *)ld, i, ld->ld_nabandoned );
 931         Debug( LDAP_DEBUG_TRACE, "** ld %p Response Queue:\n", (void *)ld, 0, 0 );
 932         if ( ( lm = ld->ld_responses ) == NULL ) {
 933                 Debug( LDAP_DEBUG_TRACE, "   Empty\n", 0, 0, 0 );
 934         }
 935         for ( i = 0; lm != NULL; lm = lm->lm_next, i++ ) {
 936                 Debug( LDAP_DEBUG_TRACE, " * msgid %d,  type %lu\n",
 937                     lm->lm_msgid, (unsigned long)lm->lm_msgtype, 0 );
 938                 if ( lm->lm_chain != NULL ) {
 939                         Debug( LDAP_DEBUG_TRACE, "   chained responses:\n", 0, 0, 0 );
 940                         for ( l = lm->lm_chain; l != NULL; l = l->lm_chain ) {
 941                                 Debug( LDAP_DEBUG_TRACE,
 942                                         "  * msgid %d,  type %lu\n",
 943                                         l->lm_msgid,
 944                                         (unsigned long)l->lm_msgtype, 0 );
 945                         }
 946                 }
 947         }
 948         Debug( LDAP_DEBUG_TRACE, "  ld %p response count %d\n", (void *)ld, i, 0 );
 949 }
 950 #endif /* LDAP_DEBUG */
 951
 952 /* protected by req_mutex */
 953 static void
 954 ldap_free_request_int( LDAP *ld, LDAPRequest *lr )
 955 {
 956         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
 957         /* if lr_refcnt > 0, the request has been looked up
 958          * by ldap_find_request_by_msgid(); if in the meanwhile
 959          * the request is free()'d by someone else, just decrease
 960          * the reference count and extract it from the request
 961          * list; later on, it will be freed. */
 962         if ( lr->lr_prev == NULL ) {
 963                 if ( lr->lr_refcnt == 0 ) {
 964                         /* free'ing the first request? */
 965                         assert( ld->ld_requests == lr );
 966                 }
 967
 968                 if ( ld->ld_requests == lr ) {
 969                         ld->ld_requests = lr->lr_next;
 970                 }
 971
 972         } else {
 973                 lr->lr_prev->lr_next = lr->lr_next;
 974         }
 975
 976         if ( lr->lr_next != NULL ) {
 977                 lr->lr_next->lr_prev = lr->lr_prev;
 978         }
 979
 980         if ( lr->lr_refcnt > 0 ) {
 981                 lr->lr_refcnt = -lr->lr_refcnt;
 982
 983                 lr->lr_prev = NULL;
 984                 lr->lr_next = NULL;
 985
 986                 return;
 987         }
 988
 989         if ( lr->lr_ber != NULL ) {
 990                 ber_free( lr->lr_ber, 1 );
 991                 lr->lr_ber = NULL;
 992         }
 993
 994         if ( lr->lr_res_error != NULL ) {
 995                 LDAP_FREE( lr->lr_res_error );
 996                 lr->lr_res_error = NULL;
 997         }
 998
 999         if ( lr->lr_res_matched != NULL ) {
1000                 LDAP_FREE( lr->lr_res_matched );
1001                 lr->lr_res_matched = NULL;
1002         }
1003
1004         LDAP_FREE( lr );
1005 }
1006
1007 /* protected by req_mutex */
1008 void
1009 ldap_free_request( LDAP *ld, LDAPRequest *lr )
1010 {
1011         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
1012         Debug( LDAP_DEBUG_TRACE, "ldap_free_request (origid %d, msgid %d)\n",
1013                 lr->lr_origid, lr->lr_msgid, 0 );
1014
1015         /* free all referrals (child requests) */
1016         while ( lr->lr_child ) {
1017                 ldap_free_request( ld, lr->lr_child );
1018         }
1019
1020         if ( lr->lr_parent != NULL ) {
1021                 LDAPRequest     **lrp;
1022
1023                 --lr->lr_parent->lr_outrefcnt;
1024                 for ( lrp = &lr->lr_parent->lr_child;
1025                         *lrp && *lrp != lr;
1026                         lrp = &(*lrp)->lr_refnext );
1027
1028                 if ( *lrp == lr ) {
1029                         *lrp = lr->lr_refnext;
1030                 }
1031         }
1032         ldap_free_request_int( ld, lr );
1033 }
1034
1035 /*
1036  * call first time with *cntp = -1
1037  * when returns *cntp == -1, no referrals are left
1038  *
1039  * NOTE: may replace *refsp, or shuffle the contents
1040  * of the original array.
1041  */
1042 static int ldap_int_nextref(
1043         LDAP                    *ld,
1044         char                    ***refsp,
1045         int                     *cntp,
1046         void                    *params )
1047 {
1048         assert( refsp != NULL );
1049         assert( *refsp != NULL );
1050         assert( cntp != NULL );
1051
1052         if ( *cntp < -1 ) {
1053                 *cntp = -1;
1054                 return -1;
1055         }
1056
1057         (*cntp)++;
1058
1059         if ( (*refsp)[ *cntp ] == NULL ) {
1060                 *cntp = -1;
1061         }
1062
1063         return 0;
1064 }
1065
1066 /*
1067  * Chase v3 referrals
1068  *
1069  * Parameters:
1070  *  (IN) ld = LDAP connection handle
1071  *  (IN) lr = LDAP Request structure
1072  *  (IN) refs = array of pointers to referral strings that we will chase
1073  *              The array will be free'd by this function when no longer needed
1074  *  (IN) sref != 0 if following search reference
1075  *  (OUT) errstrp = Place to return a string of referrals which could not be followed
1076  *  (OUT) hadrefp = 1 if successfully followed referral
1077  *
1078  * Return value - number of referrals followed
1079  *
1080  * Protected by res_mutex, conn_mutex and req_mutex     (try_read1msg)
1081  */
1082 int
1083 ldap_chase_v3referrals( LDAP *ld, LDAPRequest *lr, char **refs, int sref, char **errstrp, int *hadrefp )
1084 {
1085         char            *unfollowed;
1086         int              unfollowedcnt = 0;
1087         LDAPRequest     *origreq;
1088         LDAPURLDesc     *srv = NULL;
1089         BerElement      *ber;
1090         char            **refarray = NULL;
1091         LDAPConn        *lc;
1092         int                      rc, count, i, j, id;
1093         LDAPreqinfo  rinfo;
1094         LDAP_NEXTREF_PROC       *nextref_proc = ld->ld_nextref_proc ? ld->ld_nextref_proc : ldap_int_nextref;
1095
1096         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_res_mutex );
1097         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
1098         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
1099         Debug( LDAP_DEBUG_TRACE, "ldap_chase_v3referrals\n", 0, 0, 0 );
1100
1101         ld->ld_errno = LDAP_SUCCESS;    /* optimistic */
1102         *hadrefp = 0;
1103
1104         unfollowed = NULL;
1105         rc = count = 0;
1106
1107         /* If no referrals in array, return */
1108         if ( (refs == NULL) || ( (refs)[0] == NULL) ) {
1109                 rc = 0;
1110                 goto done;
1111         }
1112
1113         /* Check for hop limit exceeded */
1114         if ( lr->lr_parentcnt >= ld->ld_refhoplimit ) {
1115                 Debug( LDAP_DEBUG_ANY,
1116                     "more than %d referral hops (dropping)\n", ld->ld_refhoplimit, 0, 0 );
1117                 ld->ld_errno = LDAP_REFERRAL_LIMIT_EXCEEDED;
1118                 rc = -1;
1119                 goto done;
1120         }
1121
1122         /* find original request */
1123         for ( origreq = lr;
1124                 origreq->lr_parent != NULL;
1125                 origreq = origreq->lr_parent )
1126         {
1127                 /* empty */ ;
1128         }
1129
1130         refarray = refs;
1131         refs = NULL;
1132
1133         /* parse out & follow referrals */
1134         /* NOTE: if nextref_proc == ldap_int_nextref, params is ignored */
1135         i = -1;
1136         for ( nextref_proc( ld, &refarray, &i, ld->ld_nextref_params );
1137                         i != -1;
1138                         nextref_proc( ld, &refarray, &i, ld->ld_nextref_params ) )
1139         {
1140
1141                 /* Parse the referral URL */
1142                 rc = ldap_url_parse_ext( refarray[i], &srv, LDAP_PVT_URL_PARSE_NOEMPTY_DN );
1143                 if ( rc != LDAP_URL_SUCCESS ) {
1144                         /* ldap_url_parse_ext() returns LDAP_URL_* errors
1145                          * which do not map on API errors */
1146                         ld->ld_errno = LDAP_PARAM_ERROR;
1147                         rc = -1;
1148                         goto done;
1149                 }
1150
1151                 if( srv->lud_crit_exts ) {
1152                         int ok = 0;
1153 #ifdef HAVE_TLS
1154                         /* If StartTLS is the only critical ext, OK. */
1155                         if ( find_tls_ext( srv ) == 2 && srv->lud_crit_exts == 1 )
1156                                 ok = 1;
1157 #endif
1158                         if ( !ok ) {
1159                                 /* we do not support any other extensions */
1160                                 ld->ld_errno = LDAP_NOT_SUPPORTED;
1161                                 rc = -1;
1162                                 goto done;
1163                         }
1164                 }
1165
1166                 /* check connection for re-bind in progress */
1167                 if (( lc = find_connection( ld, srv, 1 )) != NULL ) {
1168                         /* See if we've already requested this DN with this conn */
1169                         LDAPRequest *lp;
1170                         int looped = 0;
1171                         ber_len_t len = srv->lud_dn ? strlen( srv->lud_dn ) : 0;
1172                         for ( lp = origreq; lp; ) {
1173                                 if ( lp->lr_conn == lc
1174                                         && len == lp->lr_dn.bv_len
1175                                         && len
1176                                         && strncmp( srv->lud_dn, lp->lr_dn.bv_val, len ) == 0 )
1177                                 {
1178                                         looped = 1;
1179                                         break;
1180                                 }
1181                                 if ( lp == origreq ) {
1182                                         lp = lp->lr_child;
1183                                 } else {
1184                                         lp = lp->lr_refnext;
1185                                 }
1186                         }
1187                         if ( looped ) {
1188                                 ldap_free_urllist( srv );
1189                                 srv = NULL;
1190                                 ld->ld_errno = LDAP_CLIENT_LOOP;
1191                                 rc = -1;
1192                                 continue;
1193                         }
1194
1195                         if ( lc->lconn_rebind_inprogress ) {
1196                                 /* We are already chasing a referral or search reference and a
1197                                  * bind on that connection is in progress.  We must queue
1198                                  * referrals on that connection, so we don't get a request
1199                                  * going out before the bind operation completes. This happens
1200                                  * if two search references come in one behind the other
1201                                  * for the same server with different contexts.
1202                                  */
1203                                 Debug( LDAP_DEBUG_TRACE,
1204                                         "ldap_chase_v3referrals: queue referral \"%s\"\n",
1205                                         refarray[i], 0, 0);
1206                                 if( lc->lconn_rebind_queue == NULL ) {
1207                                         /* Create a referral list */
1208                                         lc->lconn_rebind_queue =
1209                                                 (char ***) LDAP_MALLOC( sizeof(void *) * 2);
1210
1211                                         if( lc->lconn_rebind_queue == NULL) {
1212                                                 ld->ld_errno = LDAP_NO_MEMORY;
1213                                                 rc = -1;
1214                                                 goto done;
1215                                         }
1216
1217                                         lc->lconn_rebind_queue[0] = refarray;
1218                                         lc->lconn_rebind_queue[1] = NULL;
1219                                         refarray = NULL;
1220
1221                                 } else {
1222                                         /* Count how many referral arrays we already have */
1223                                         for( j = 0; lc->lconn_rebind_queue[j] != NULL; j++) {
1224                                                 /* empty */;
1225                                         }
1226
1227                                         /* Add the new referral to the list */
1228                                         lc->lconn_rebind_queue = (char ***) LDAP_REALLOC(
1229                                                 lc->lconn_rebind_queue, sizeof(void *) * (j + 2));
1230
1231                                         if( lc->lconn_rebind_queue == NULL ) {
1232                                                 ld->ld_errno = LDAP_NO_MEMORY;
1233                                                 rc = -1;
1234                                                 goto done;
1235                                         }
1236                                         lc->lconn_rebind_queue[j] = refarray;
1237                                         lc->lconn_rebind_queue[j+1] = NULL;
1238                                         refarray = NULL;
1239                                 }
1240
1241                                 /* We have queued the referral/reference, now just return */
1242                                 rc = 0;
1243                                 *hadrefp = 1;
1244                                 count = 1; /* Pretend we already followed referral */
1245                                 goto done;
1246                         }
1247                 }
1248                 /* Re-encode the request with the new starting point of the search.
1249                  * Note: In the future we also need to replace the filter if one
1250                  * was provided with the search reference
1251                  */
1252
1253                 /* For references we don't want old dn if new dn empty */
1254                 if ( sref && srv->lud_dn == NULL ) {
1255                         srv->lud_dn = LDAP_STRDUP( "" );
1256                 }
1257
1258                 LDAP_NEXT_MSGID( ld, id );
1259                 ber = re_encode_request( ld, origreq->lr_ber, id,
1260                         sref, srv, &rinfo.ri_request );
1261
1262                 if( ber == NULL ) {
1263                         ld->ld_errno = LDAP_ENCODING_ERROR;
1264                         rc = -1;
1265                         goto done;
1266                 }
1267
1268                 Debug( LDAP_DEBUG_TRACE,
1269                         "ldap_chase_v3referral: msgid %d, url \"%s\"\n",
1270                         lr->lr_msgid, refarray[i], 0);
1271
1272                 /* Send the new request to the server - may require a bind */
1273                 rinfo.ri_msgid = origreq->lr_origid;
1274                 rinfo.ri_url = refarray[i];
1275                 rc = ldap_send_server_request( ld, ber, id,
1276                         origreq, &srv, NULL, &rinfo, 0, 1 );
1277                 if ( rc < 0 ) {
1278                         /* Failure, try next referral in the list */
1279                         Debug( LDAP_DEBUG_ANY, "Unable to chase referral \"%s\" (%d: %s)\n",
1280                                 refarray[i], ld->ld_errno, ldap_err2string( ld->ld_errno ) );
1281                         unfollowedcnt += ldap_append_referral( ld, &unfollowed, refarray[i] );
1282                         ldap_free_urllist( srv );
1283                         srv = NULL;
1284                         ld->ld_errno = LDAP_REFERRAL;
1285                 } else {
1286                         /* Success, no need to try this referral list further */
1287                         rc = 0;
1288                         ++count;
1289                         *hadrefp = 1;
1290
1291                         /* check if there is a queue of referrals that came in during bind */
1292                         if ( lc == NULL) {
1293                                 lc = find_connection( ld, srv, 1 );
1294                                 if ( lc == NULL ) {
1295                                         ld->ld_errno = LDAP_OPERATIONS_ERROR;
1296                                         rc = -1;
1297                                         LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
1298                                         goto done;
1299                                 }
1300                         }
1301
1302                         if ( lc->lconn_rebind_queue != NULL ) {
1303                                 /* Release resources of previous list */
1304                                 LDAP_VFREE( refarray );
1305                                 refarray = NULL;
1306                                 ldap_free_urllist( srv );
1307                                 srv = NULL;
1308
1309                                 /* Pull entries off end of queue so list always null terminated */
1310                                 for( j = 0; lc->lconn_rebind_queue[j] != NULL; j++ )
1311                                         ;
1312                                 refarray = lc->lconn_rebind_queue[j - 1];
1313                                 lc->lconn_rebind_queue[j-1] = NULL;
1314                                 /* we pulled off last entry from queue, free queue */
1315                                 if ( j == 1 ) {
1316                                         LDAP_FREE( lc->lconn_rebind_queue );
1317                                         lc->lconn_rebind_queue = NULL;
1318                                 }
1319                                 /* restart the loop the with new referral list */
1320                                 i = -1;
1321                                 continue;
1322                         }
1323                         break; /* referral followed, break out of for loop */
1324                 }
1325         } /* end for loop */
1326 done:
1327         LDAP_VFREE( refarray );
1328         ldap_free_urllist( srv );
1329         LDAP_FREE( *errstrp );
1330
1331         if( rc == 0 ) {
1332                 *errstrp = NULL;
1333                 LDAP_FREE( unfollowed );
1334                 return count;
1335         } else {
1336                 *errstrp = unfollowed;
1337                 return rc;
1338         }
1339 }
1340
1341 /*
1342  * XXX merging of errors in this routine needs to be improved
1343  * Protected by res_mutex, conn_mutex and req_mutex     (try_read1msg)
1344  */
1345 int
1346 ldap_chase_referrals( LDAP *ld,
1347         LDAPRequest *lr,
1348         char **errstrp,
1349         int sref,
1350         int *hadrefp )
1351 {
1352         int             rc, count, id;
1353         unsigned        len;
1354         char            *p, *ref, *unfollowed;
1355         LDAPRequest     *origreq;
1356         LDAPURLDesc     *srv;
1357         BerElement      *ber;
1358         LDAPreqinfo  rinfo;
1359         LDAPConn        *lc;
1360
1361         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_res_mutex );
1362         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_conn_mutex );
1363         LDAP_ASSERT_MUTEX_OWNER( &ld->ld_req_mutex );
1364         Debug( LDAP_DEBUG_TRACE, "ldap_chase_referrals\n", 0, 0, 0 );
1365
1366         ld->ld_errno = LDAP_SUCCESS;    /* optimistic */
1367         *hadrefp = 0;
1368
1369         if ( *errstrp == NULL ) {
1370                 return( 0 );
1371         }
1372
1373         len = strlen( *errstrp );
1374         for ( p = *errstrp; len >= LDAP_REF_STR_LEN; ++p, --len ) {
1375                 if ( strncasecmp( p, LDAP_REF_STR, LDAP_REF_STR_LEN ) == 0 ) {
1376                         *p = '\0';
1377                         p += LDAP_REF_STR_LEN;
1378                         break;
1379                 }
1380         }
1381
1382         if ( len < LDAP_REF_STR_LEN ) {
1383                 return( 0 );
1384         }
1385
1386         if ( lr->lr_parentcnt >= ld->ld_refhoplimit ) {
1387                 Debug( LDAP_DEBUG_ANY,
1388                     "more than %d referral hops (dropping)\n",
1389                     ld->ld_refhoplimit, 0, 0 );
1390                     /* XXX report as error in ld->ld_errno? */
1391                     return( 0 );
1392         }
1393
1394         /* find original request */
1395         for ( origreq = lr; origreq->lr_parent != NULL;
1396              origreq = origreq->lr_parent ) {
1397                 /* empty */;
1398         }
1399
1400         unfollowed = NULL;
1401         rc = count = 0;
1402
1403         /* parse out & follow referrals */
1404         for ( ref = p; rc == 0 && ref != NULL; ref = p ) {
1405                 p = strchr( ref, '\n' );
1406                 if ( p != NULL ) {
1407                         *p++ = '\0';
1408                 }
1409
1410                 rc = ldap_url_parse_ext( ref, &srv, LDAP_PVT_URL_PARSE_NOEMPTY_DN );
1411                 if ( rc != LDAP_URL_SUCCESS ) {
1412                         Debug( LDAP_DEBUG_TRACE,
1413                                 "ignoring %s referral <%s>\n",
1414                                 ref, rc == LDAP_URL_ERR_BADSCHEME ? "unknown" : "incorrect", 0 );
1415                         rc = ldap_append_referral( ld, &unfollowed, ref );
1416                         *hadrefp = 1;
1417                         continue;
1418                 }
1419
1420                 Debug( LDAP_DEBUG_TRACE,
1421                     "chasing LDAP referral: <%s>\n", ref, 0, 0 );
1422
1423                 *hadrefp = 1;
1424
1425                 /* See if we've already been here */
1426                 if (( lc = find_connection( ld, srv, 1 )) != NULL ) {
1427                         LDAPRequest *lp;
1428                         int looped = 0;
1429                         ber_len_t len = srv->lud_dn ? strlen( srv->lud_dn ) : 0;
1430                         for ( lp = lr; lp; lp = lp->lr_parent ) {
1431                                 if ( lp->lr_conn == lc
1432                                         && len == lp->lr_dn.bv_len )
1433                                 {
1434                                         if ( len && strncmp( srv->lud_dn, lp->lr_dn.bv_val, len ) )
1435                                                         continue;
1436                                         looped = 1;
1437                                         break;
1438                                 }
1439                         }
1440                         if ( looped ) {
1441                                 ldap_free_urllist( srv );
1442                                 ld->ld_errno = LDAP_CLIENT_LOOP;
1443                                 rc = -1;
1444                                 continue;
1445                         }
1446                 }
1447
1448                 LDAP_NEXT_MSGID( ld, id );
1449                 ber = re_encode_request( ld, origreq->lr_ber,
1450                     id, sref, srv, &rinfo.ri_request );
1451
1452                 if ( ber == NULL ) {
1453                         ldap_free_urllist( srv );
1454                         return -1 ;
1455                 }
1456
1457                 /* copy the complete referral for rebind process */
1458                 rinfo.ri_url = LDAP_STRDUP( ref );
1459
1460                 rinfo.ri_msgid = origreq->lr_origid;
1461
1462                 rc = ldap_send_server_request( ld, ber, id,
1463                         lr, &srv, NULL, &rinfo, 0, 1 );
1464                 LDAP_FREE( rinfo.ri_url );
1465
1466                 if( rc >= 0 ) {
1467                         ++count;
1468                 } else {
1469                         Debug( LDAP_DEBUG_ANY,
1470                                 "Unable to chase referral \"%s\" (%d: %s)\n",
1471                                 ref, ld->ld_errno, ldap_err2string( ld->ld_errno ) );
1472                         rc = ldap_append_referral( ld, &unfollowed, ref );
1473                 }
1474
1475                 ldap_free_urllist(srv);
1476         }
1477
1478         LDAP_FREE( *errstrp );
1479         *errstrp = unfollowed;
1480
1481         return(( rc == 0 ) ? count : rc );
1482 }
1483
1484
1485 int
1486 ldap_append_referral( LDAP *ld, char **referralsp, char *s )
1487 {
1488         int     first;
1489
1490         if ( *referralsp == NULL ) {
1491                 first = 1;
1492                 *referralsp = (char *)LDAP_MALLOC( strlen( s ) + LDAP_REF_STR_LEN
1493                     + 1 );
1494         } else {
1495                 first = 0;
1496                 *referralsp = (char *)LDAP_REALLOC( *referralsp,
1497                     strlen( *referralsp ) + strlen( s ) + 2 );
1498         }
1499
1500         if ( *referralsp == NULL ) {
1501                 ld->ld_errno = LDAP_NO_MEMORY;
1502                 return( -1 );
1503         }
1504
1505         if ( first ) {
1506                 strcpy( *referralsp, LDAP_REF_STR );
1507         } else {
1508                 strcat( *referralsp, "\n" );
1509         }
1510         strcat( *referralsp, s );
1511
1512         return( 0 );
1513 }
1514
1515
1516
1517 static BerElement *
1518 re_encode_request( LDAP *ld,
1519         BerElement *origber,
1520         ber_int_t msgid,
1521         int sref,
1522         LDAPURLDesc *srv,
1523         int *type )
1524 {
1525         /*
1526          * XXX this routine knows way too much about how the lber library works!
1527          */
1528         ber_int_t       along;
1529         ber_tag_t       tag;
1530         ber_tag_t       rtag;
1531         ber_int_t       ver;
1532         ber_int_t       scope;
1533         int             rc;
1534         BerElement      tmpber, *ber;
1535         struct berval           dn;
1536
1537         Debug( LDAP_DEBUG_TRACE,
1538             "re_encode_request: new msgid %ld, new dn <%s>\n",
1539             (long) msgid,
1540                 ( srv == NULL || srv->lud_dn == NULL) ? "NONE" : srv->lud_dn, 0 );
1541
1542         tmpber = *origber;
1543
1544         /*
1545          * all LDAP requests are sequences that start with a message id.
1546          * For all except delete, this is followed by a sequence that is
1547          * tagged with the operation code.  For delete, the provided DN
1548          * is not wrapped by a sequence.
1549          */
1550         rtag = ber_scanf( &tmpber, "{it", /*}*/ &along, &tag );
1551
1552         if ( rtag == LBER_ERROR ) {
1553                 ld->ld_errno = LDAP_DECODING_ERROR;
1554                 return( NULL );
1555         }
1556
1557         assert( tag != 0);
1558         if ( tag == LDAP_REQ_BIND ) {
1559                 /* bind requests have a version number before the DN & other stuff */
1560                 rtag = ber_scanf( &tmpber, "{im" /*}*/, &ver, &dn );
1561
1562         } else if ( tag == LDAP_REQ_DELETE ) {
1563                 /* delete requests don't have a DN wrapping sequence */
1564                 rtag = ber_scanf( &tmpber, "m", &dn );
1565
1566         } else if ( tag == LDAP_REQ_SEARCH ) {
1567                 /* search requests need to be re-scope-ed */
1568                 rtag = ber_scanf( &tmpber, "{me" /*"}"*/, &dn, &scope );
1569
1570                 if( srv->lud_scope != LDAP_SCOPE_DEFAULT ) {
1571                         /* use the scope provided in reference */
1572                         scope = srv->lud_scope;
1573
1574                 } else if ( sref ) {
1575                         /* use scope implied by previous operation
1576                          *   base -> base
1577                          *   one -> base
1578                          *   subtree -> subtree
1579                          *   subordinate -> subtree
1580                          */
1581                         switch( scope ) {
1582                         default:
1583                         case LDAP_SCOPE_BASE:
1584                         case LDAP_SCOPE_ONELEVEL:
1585                                 scope = LDAP_SCOPE_BASE;
1586                                 break;
1587                         case LDAP_SCOPE_SUBTREE:
1588                         case LDAP_SCOPE_SUBORDINATE:
1589                                 scope = LDAP_SCOPE_SUBTREE;
1590                                 break;
1591                         }
1592                 }
1593
1594         } else {
1595                 rtag = ber_scanf( &tmpber, "{m" /*}*/, &dn );
1596         }
1597
1598         if( rtag == LBER_ERROR ) {
1599                 ld->ld_errno = LDAP_DECODING_ERROR;
1600                 return NULL;
1601         }
1602
1603         /* restore character zero'd out by ber_scanf*/
1604         dn.bv_val[dn.bv_len] = tmpber.ber_tag;
1605
1606         if (( ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
1607                 return NULL;
1608         }
1609
1610         if ( srv->lud_dn ) {
1611                 ber_str2bv( srv->lud_dn, 0, 0, &dn );
1612         }
1613
1614         if ( tag == LDAP_REQ_BIND ) {
1615                 rc = ber_printf( ber, "{it{iO" /*}}*/, msgid, tag, ver, &dn );
1616         } else if ( tag == LDAP_REQ_DELETE ) {
1617                 rc = ber_printf( ber, "{itON}", msgid, tag, &dn );
1618         } else if ( tag == LDAP_REQ_SEARCH ) {
1619                 rc = ber_printf( ber, "{it{Oe" /*}}*/, msgid, tag, &dn, scope );
1620         } else {
1621                 rc = ber_printf( ber, "{it{O" /*}}*/, msgid, tag, &dn );
1622         }
1623
1624         if ( rc == -1 ) {
1625                 ld->ld_errno = LDAP_ENCODING_ERROR;
1626                 ber_free( ber, 1 );
1627                 return NULL;
1628         }
1629
1630         if ( tag != LDAP_REQ_DELETE && (
1631                 ber_write(ber, tmpber.ber_ptr, ( tmpber.ber_end - tmpber.ber_ptr ), 0)
1632                 != ( tmpber.ber_end - tmpber.ber_ptr ) ||
1633             ber_printf( ber, /*{{*/ "N}N}" ) == -1 ) )
1634         {
1635                 ld->ld_errno = LDAP_ENCODING_ERROR;
1636                 ber_free( ber, 1 );
1637                 return NULL;
1638         }
1639
1640 #ifdef LDAP_DEBUG
1641         if ( ldap_debug & LDAP_DEBUG_PACKETS ) {
1642                 Debug( LDAP_DEBUG_ANY, "re_encode_request new request is:\n",
1643                     0, 0, 0 );
1644                 ber_log_dump( LDAP_DEBUG_BER, ldap_debug, ber, 0 );
1645         }
1646 #endif /* LDAP_DEBUG */
1647
1648         *type = tag;    /* return request type */
1649         return ber;
1650 }
1651
1652
1653 /* protected by req_mutex */
1654 LDAPRequest *
1655 ldap_find_request_by_msgid( LDAP *ld, ber_int_t msgid )
1656 {
1657         LDAPRequest     *lr;
1658
1659         for ( lr = ld->ld_requests; lr != NULL; lr = lr->lr_next ) {
1660                 if ( lr->lr_status == LDAP_REQST_COMPLETED ) {
1661                         continue;       /* Skip completed requests */
1662                 }
1663                 if ( msgid == lr->lr_msgid ) {
1664                         lr->lr_refcnt++;
1665                         break;
1666                 }
1667         }
1668
1669         return( lr );
1670 }
1671
1672 /* protected by req_mutex */
1673 void
1674 ldap_return_request( LDAP *ld, LDAPRequest *lrx, int freeit )
1675 {
1676         LDAPRequest     *lr;
1677
1678         for ( lr = ld->ld_requests; lr != NULL; lr = lr->lr_next ) {
1679                 if ( lr == lrx ) {
1680                         if ( lr->lr_refcnt > 0 ) {
1681                                 lr->lr_refcnt--;
1682
1683                         } else if ( lr->lr_refcnt < 0 ) {
1684                                 lr->lr_refcnt++;
1685                                 if ( lr->lr_refcnt == 0 ) {
1686                                         lr = NULL;
1687                                 }
1688                         }
1689                         break;
1690                 }
1691         }
1692         if ( lr == NULL ) {
1693                 ldap_free_request_int( ld, lrx );
1694
1695         } else if ( freeit ) {
1696                 ldap_free_request( ld, lrx );
1697         }
1698 }