Changeset 745 for trunk/server/source3/lib/tldap.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/lib/tldap.c (modified) (17 diffs)

trunk/server/source3/lib/tldap.c

@@ -19 +19 @@
 
 #include "includes.h"
+
+
+
+
+
+
 
 bool tevent_req_is_ldap_error(struct tevent_req *req, int *perr)
@@ -419 +425 @@
         }
 
-        state->iov.iov_base = blob.data;
+        state->iov.iov_base = blob.data;
         state->iov.iov_len = blob.length;
 
@@ -506 +512 @@
 
         /*
-         * We're the first ones, add the read_ldap request that waits for the
+         * We're the first one, add the read_ldap request that waits for the
          * answer from the server
          */
@@ -555 +561 @@
         struct tevent_req *req;
         struct tldap_msg_state *state;
-        struct tevent_context *ev;
         struct asn1_data *data;
         uint8_t *inbuf;
@@ -614 +619 @@
         state->data = talloc_move(state, &data);
 
-        ev = state->ev;
-
         talloc_set_destructor(req, NULL);
         tldap_msg_unset_pending(req);
@@ -734 +737 @@
 {
         char *result = talloc_array(mem_ctx, char, blob.length+1);
+
+
+
+
+
         memcpy(result, blob.data, blob.length);
         result[blob.length] = '\0';
@@ -741 +749 @@
 static bool asn1_read_OctetString_talloc(TALLOC_CTX *mem_ctx,
                                          struct asn1_data *data,
-                                         char **result)
+                                         char **result)
 {
         DATA_BLOB string;
+
         if (!asn1_read_OctetString(data, mem_ctx, &string))
                 return false;
-        *result = blob2string_talloc(mem_ctx, string);
+
+        result = blob2string_talloc(mem_ctx, string);
+
         data_blob_free(&string);
+
+
+
+
+
         return true;
 }
@@ -869 +885 @@
 int tldap_sasl_bind_recv(struct tevent_req *req)
 {
-        int err;
-
-        if (tevent_req_is_ldap_error(req, &err)) {
-                return err;
-        }
-        return TLDAP_SUCCESS;
+        return tldap_simple_recv(req);
 }
 
@@ -957 +968 @@
 /*****************************************************************************/
 
-/*
- * This piece has a dependency on ldb, the ldb_parse_tree() function is used.
- * In case we want to separate out tldap, we need to copy or rewrite it.
+/* can't use isalpha() as only a strict set is valid for LDAP */
+
+static bool tldap_is_alpha(char c)
+{
+        return (((c >= 'a') && (c <= 'z')) || \
+                ((c >= 'A') && (c <= 'Z')));
+}
+
+static bool tldap_is_adh(char c)
+{
+        return tldap_is_alpha(c) || isdigit(c) || (c == '-');
+}
+
+#define TLDAP_FILTER_AND  ASN1_CONTEXT(0)
+#define TLDAP_FILTER_OR   ASN1_CONTEXT(1)
+#define TLDAP_FILTER_NOT  ASN1_CONTEXT(2)
+#define TLDAP_FILTER_EQ   ASN1_CONTEXT(3)
+#define TLDAP_FILTER_SUB  ASN1_CONTEXT(4)
+#define TLDAP_FILTER_LE   ASN1_CONTEXT(5)
+#define TLDAP_FILTER_GE   ASN1_CONTEXT(6)
+#define TLDAP_FILTER_PRES ASN1_CONTEXT_SIMPLE(7)
+#define TLDAP_FILTER_APX  ASN1_CONTEXT(8)
+#define TLDAP_FILTER_EXT  ASN1_CONTEXT(9)
+
+#define TLDAP_SUB_INI ASN1_CONTEXT_SIMPLE(0)
+#define TLDAP_SUB_ANY ASN1_CONTEXT_SIMPLE(1)
+#define TLDAP_SUB_FIN ASN1_CONTEXT_SIMPLE(2)
+
+
+/* oid's should be numerical only in theory,
+ * but apparently some broken servers may have alphanum aliases instead.
+ * Do like openldap libraries and allow alphanum aliases for oids, but
+ * do not allow Tagging options in that case.
  */
-
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
-
-static bool ldap_push_filter(struct asn1_data *data,
-                             struct ldb_parse_tree *tree)
-{
+static bool tldap_is_attrdesc(const char *s, int len, bool no_tagopts)
+{
+        bool is_oid = false;
+        bool dot = false;
         int i;
 
-        switch (tree->operation) {
-        case LDB_OP_AND:
-        case LDB_OP_OR:
-                asn1_push_tag(data,
-                              ASN1_CONTEXT(tree->operation==LDB_OP_AND?0:1));
-                for (i=0; i<tree->u.list.num_elements; i++) {
-                        if (!ldap_push_filter(data,
-                                              tree->u.list.elements[i])) {
+        /* first char has stricter rules */
+        if (isdigit(*s)) {
+                is_oid = true;
+        } else if (!tldap_is_alpha(*s)) {
+                /* bad first char */
+                return false;
+        }
+
+        for (i = 1; i < len; i++) {
+
+                if (is_oid) {
+                        if (isdigit(s[i])) {
+                                dot = false;
+                                continue;
+                        }
+                        if (s[i] == '.') {
+                                if (dot) {
+                                        /* malformed */
+                                        return false;
+                                }
+                                dot = true;
+                                continue;
+                        }
+                } else {
+                        if (tldap_is_adh(s[i])) {
+                                continue;
+                        }
+                }
+
+                if (s[i] == ';') {
+                        if (no_tagopts) {
+                                /* no tagging options */
                                 return false;
                         }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
                 }
                 asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_NOT:
-                asn1_push_tag(data, ASN1_CONTEXT(2));
-                if (!ldap_push_filter(data, tree->u.isnot.child)) {
+                goto done;
+
+        case '(':
+        case ')':
+                tldap_debug(ld, TLDAP_DEBUG_ERROR,
+                            "Invalid parenthesis '%c'\n", *s);
+                return false;
+
+        case '\0':
+                tldap_debug(ld, TLDAP_DEBUG_ERROR,
+                            "Invalid filter termination\n");
+                return false;
+
+        default:
+                ret = tldap_push_filter_basic(ld, data, &s);
+                if (!ret) {
                         return false;
                 }
+
+
+
+
+
+
+
+
                 asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_EQUALITY:
-                /* equality test */
-                asn1_push_tag(data, ASN1_CONTEXT(3));
-                asn1_write_OctetString(data, tree->u.equality.attr,
-                                      strlen(tree->u.equality.attr));
-                asn1_write_OctetString(data, tree->u.equality.value.data,
-                                      tree->u.equality.value.length);
-                asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_SUBSTRING:
-                /*
-                  SubstringFilter ::= SEQUENCE {
-                          type            AttributeDescription,
-                          -- at least one must be present
-                          substrings      SEQUENCE OF CHOICE {
-                                  initial [0] LDAPString,
-                                  any     [1] LDAPString,
-                                  final   [2] LDAPString } }
-                */
-                asn1_push_tag(data, ASN1_CONTEXT(4));
-                asn1_write_OctetString(data, tree->u.substring.attr,
-                                       strlen(tree->u.substring.attr));
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
-                i = 0;
-                if (!tree->u.substring.start_with_wildcard) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
-                        asn1_write_DATA_BLOB_LDAPString(
-                                data, tree->u.substring.chunks[i]);
+                goto done;
+        }
+
+        while (*s) {
+                ret = tldap_push_filter_int(ld, data, &s);
+                if (!ret) {
+                        return false;
+                }
+
+                if (*s == ')') {
+                        /* end of list, return */
                         asn1_pop_tag(data);
-                        i++;
-                }
-                while (tree->u.substring.chunks[i]) {
-                        int ctx;
-
-                        if ((!tree->u.substring.chunks[i + 1]) &&
-                            (tree->u.substring.end_with_wildcard == 0)) {
-                                ctx = 2;
+                        break;
+                }
+        }
+
+done:
+        if (*s != ')') {
+                tldap_debug(ld, TLDAP_DEBUG_ERROR,
+                            "Incomplete or malformed filter\n");
+                return false;
+        }
+        s++;
+
+        if (data->has_error) {
+                return false;
+        }
+
+        *_s = s;
+        return true;
+}
+
+
+static bool tldap_push_filter_basic(struct tldap_context *ld,
+                                    struct asn1_data *data,
+                                    const char **_s)
+{
+        TALLOC_CTX *tmpctx = talloc_tos();
+        const char *s = *_s;
+        const char *e;
+        const char *eq;
+        const char *val;
+        const char *type;
+        const char *dn;
+        const char *rule;
+        const char *star;
+        size_t type_len = 0;
+        char *uval;
+        size_t uval_len;
+        bool write_octect = true;
+        bool ret;
+
+        eq = strchr(s, '=');
+        if (!eq) {
+                tldap_debug(ld, TLDAP_DEBUG_ERROR,
+                            "Invalid filter, missing equal sign\n");
+                return false;
+        }
+
+        val = eq + 1;
+        e = eq - 1;
+
+        switch (*e) {
+        case '<':
+                asn1_push_tag(data, TLDAP_FILTER_LE);
+                break;
+
+        case '>':
+                asn1_push_tag(data, TLDAP_FILTER_GE);
+                break;
+
+        case '~':
+                asn1_push_tag(data, TLDAP_FILTER_APX);
+                break;
+
+        case ':':
+                asn1_push_tag(data, TLDAP_FILTER_EXT);
+                write_octect = false;
+
+                type = NULL;
+                dn = NULL;
+                rule = NULL;
+
+                if (*s == ':') { /* [:dn]:rule:= value */
+                        if (s == e) {
+                                /* malformed filter */
+                                return false;
+                        }
+                        dn = s;
+                } else { /* type[:dn][:rule]:= value */
+                        type = s;
+                        dn = strchr(s, ':');
+                        type_len = dn - type;
+                        if (dn == e) { /* type:= value */
+                                dn = NULL;
+                        }
+                }
+                if (dn) {
+                        dn++;
+
+                        rule = strchr(dn, ':');
+                        if ((rule == dn + 1) || rule + 1 == e) {
+                                /* malformed filter, contains "::" */
+                                return false;
+                        }
+
+                        if (StrnCaseCmp(dn, "dn:", 3) != 0) {
+                                if (rule == e) {
+                                        rule = dn;
+                                        dn = NULL;
+                                } else {
+                                        /* malformed filter. With two
+                                         * optionals, the first must be "dn"
+                                         */
+                                        return false;
+                                }
                         } else {
-                                ctx = 1;
+                                if (rule == e) {
+                                        rule = NULL;
+                                } else {
+                                        rule++;
+                                }
                         }
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(ctx));
-                        asn1_write_DATA_BLOB_LDAPString(
-                                data, tree->u.substring.chunks[i]);
-                        asn1_pop_tag(data);
-                        i++;
-                }
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_GREATER:
-                /* greaterOrEqual test */
-                asn1_push_tag(data, ASN1_CONTEXT(5));
-                asn1_write_OctetString(data, tree->u.comparison.attr,
-                                      strlen(tree->u.comparison.attr));
-                asn1_write_OctetString(data, tree->u.comparison.value.data,
-                                      tree->u.comparison.value.length);
-                asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_LESS:
-                /* lessOrEqual test */
-                asn1_push_tag(data, ASN1_CONTEXT(6));
-                asn1_write_OctetString(data, tree->u.comparison.attr,
-                                      strlen(tree->u.comparison.attr));
-                asn1_write_OctetString(data, tree->u.comparison.value.data,
-                                      tree->u.comparison.value.length);
-                asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_PRESENT:
-                /* present test */
-                asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(7));
-                asn1_write_LDAPString(data, tree->u.present.attr);
-                asn1_pop_tag(data);
-                return !data->has_error;
-
-        case LDB_OP_APPROX:
-                /* approx test */
-                asn1_push_tag(data, ASN1_CONTEXT(8));
-                asn1_write_OctetString(data, tree->u.comparison.attr,
-                                      strlen(tree->u.comparison.attr));
-                asn1_write_OctetString(data, tree->u.comparison.value.data,
-                                      tree->u.comparison.value.length);
-                asn1_pop_tag(data);
-                break;
-
-        case LDB_OP_EXTENDED:
+                }
+
+                if (!type && !dn && !rule) {
+                        /* malformed filter, there must be at least one */
+                        return false;
+                }
+
                 /*
                   MatchingRuleAssertion ::= SEQUENCE {
                   matchingRule    [1] MatchingRuleID OPTIONAL,
-                  type            [2] AttributeDescription OPTIONAL,
+                  type    [2] AttributeDescription OPTIONAL,
                   matchValue      [3] AssertionValue,
                   dnAttributes    [4] BOOLEAN DEFAULT FALSE
                   }
                 */
-                asn1_push_tag(data, ASN1_CONTEXT(9));
-                if (tree->u.extended.rule_id) {
+
+                /* check and add rule */
+                if (rule) {
+                        ret = tldap_is_attrdesc(rule, e - rule, true);
+                        if (!ret) {
+                                return false;
+                        }
                         asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1));
-                        asn1_write_LDAPString(data, tree->u.extended.rule_id);
+                        asn1_write);
                         asn1_pop_tag(data);
                 }
-                if (tree->u.extended.attr) {
+
+                /* check and add type */
+                if (type) {
+                        ret = tldap_is_attrdesc(type, type_len, false);
+                        if (!ret) {
+                                return false;
+                        }
                         asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2));
-                        asn1_write_LDAPString(data, tree->u.extended.attr);
+                        asn1_write);
                         asn1_pop_tag(data);
                 }
+
+
+
+
+
+
+
+
+
+
+
                 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3));
-                asn1_write_DATA_BLOB_LDAPString(data, &tree->u.extended.value);
+                asn1_write);
                 asn1_pop_tag(data);
+
                 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4));
-                asn1_write_uint8(data, tree->u.extended.dnAttributes);
+                asn1_write_uint8(data, );
                 asn1_pop_tag(data);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
                 asn1_pop_tag(data);
-                break;
-
-        default:
+
+                val = star + 1;
+
+        } while (*star == '*');
+
+        *_s = star;
+
+        /* end of sequence */
+        asn1_pop_tag(data);
+        return true;
+}
+
+/* NOTE: although openldap libraries allow for spaces in some places, mosly
+ * around parenthesis, we do not allow any spaces (except in values of
+ * course) as I couldn't fine any place in RFC 4512 or RFC 4515 where
+ * leading or trailing spaces where allowed.
+ */
+static bool tldap_push_filter(struct tldap_context *ld,
+                              struct asn1_data *data,
+                              const char *filter)
+{
+        const char *s = filter;
+        bool ret;
+
+        ret = tldap_push_filter_int(ld, data, &s);
+        if (ret && *s) {
+                tldap_debug(ld, TLDAP_DEBUG_ERROR,
+                            "Incomplete or malformed filter\n");
                 return false;
         }
-        return !data->has_error;
-}
-
-static bool tldap_push_filter(struct asn1_data *data, const char *filter)
-{
-        struct ldb_parse_tree *tree;
-        bool ret;
-
-        tree = ldb_parse_tree(talloc_tos(), filter);
-        if (tree == NULL) {
-                return false;
-        }
-        ret = ldap_push_filter(data, tree);
-        TALLOC_FREE(tree);
         return ret;
 }
@@ -1166 +1663 @@
         asn1_write_BOOLEAN(state->out, attrsonly);
 
-        if (!tldap_push_filter(state->out, filter)) {
+        if (!tldap_push_filter(state->out, filter)) {
                 goto encoding_error;
         }
@@ -1345 +1842 @@
         tevent_req_set_callback(req, tldap_search_cb, &state);
 
+
+
+
+
+
+
+
         while (tevent_req_is_in_progress(req)
                && (state.rc == TLDAP_SUCCESS)) {
@@ -1455 +1959 @@
 }
 
-bool tldap_entry_attributes(struct tldap_message *msg, int *num_attributes,
-                            struct tldap_attribute **attributes)
+bool tldap_entry_attributes(struct tldap_message *msg,
+                            struct tldap_attribute **attributes,
+                            int *num_attributes)
 {
         if ((msg->dn == NULL) && (!tldap_parse_search_entry(msg))) {
@@ -1628 +2133 @@
 
 int tldap_add(struct tldap_context *ld, const char *dn,
-              int num_attributes, struct tldap_mod *attributes,
+              attributes,
               struct tldap_control *sctrls, int num_sctrls,
               struct tldap_control *cctrls, int num_cctrls)
@@ -1668 +2173 @@
                                      struct tldap_context *ld,
                                      const char *dn,
-                                     int num_mods, struct tldap_mod *mods,
+                                     mods,
                                      struct tldap_control *sctrls,
                                      int num_sctrls,
@@ -1728 +2233 @@
 
 int tldap_modify(struct tldap_context *ld, const char *dn,
-                 int num_mods, struct tldap_mod *mods,
+                 mods,
                  struct tldap_control *sctrls, int num_sctrls,
                  struct tldap_control *cctrls, int num_cctrls)
@@ -1743 +2248 @@
         }
 
-        req = tldap_modify_send(frame, ev, ld, dn, num_mods, mods,
+        req = tldap_modify_send(frame, ev, ld, dn, mods,
                                 sctrls, num_sctrls, cctrls, num_cctrls);
         if (req == NULL) {
@@ -1878 +2383 @@
                 *sctrls = NULL;
                 *num_sctrls = 0;
+
         }
         *sctrls = msg->res_sctrls;