/*

   myldap.c - simple interface to do LDAP requests

   Parts of this file were part of the nss_ldap library (as ldap-nss.c)

   which has been forked into the nss-pam-ldapd library.

   Copyright (C) 1997-2006 Luke Howard

   Copyright (C) 2006-2007 West Consulting

   Copyright (C) 2006-2017 Arthur de Jong

   This library is free software; you can redistribute it and/or

   modify it under the terms of the GNU Lesser General Public

   License as published by the Free Software Foundation; either

   version 2.1 of the License, or (at your option) any later version.

   This library is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public

   License along with this library; if not, write to the Free Software

   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

   02110-1301 USA

*/

/*

   This library expects to use an LDAP library to provide the real

   functionality and only provides a convenient wrapper.

   Some pointers for more information on the LDAP API:

     http://tools.ietf.org/id/draft-ietf-ldapext-ldap-c-api-05.txt

     http://www.mozilla.org/directory/csdk-docs/function.htm

     http://publib.boulder.ibm.com/infocenter/iseries/v5r3/topic/apis/dirserv1.htm

     http://www.openldap.org/software/man.cgi?query=ldap

*/

#include "config.h"

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <string.h>

#include <strings.h>

#include <sys/time.h>

#include <time.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <errno.h>

#include <lber.h>

#include <ldap.h>

#ifdef HAVE_LDAP_SSL_H

#include <ldap_ssl.h>

#endif

#ifdef HAVE_GSSLDAP_H

#include <gssldap.h>

#endif

#ifdef HAVE_GSSSASL_H

#include <gsssasl.h>

#endif

#ifdef HAVE_SASL_SASL_H

#include <sasl/sasl.h>

#endif

#ifdef HAVE_SASL_H

#include <sasl.h>

#endif

#include <ctype.h>

#include <pthread.h>

#include <stdarg.h>

#include "myldap.h"

#include "common.h"

#include "log.h"

#include "cfg.h"

#include "common/set.h"

#include "compat/ldap_compat.h"

#include "attmap.h"

/* the maximum number of searches per session */

#define MAX_SEARCHES_IN_SESSION 4

/* the maximum number of dn's to log to the debug log for each search */

#define MAX_DEBUG_LOG_DNS 10

/* a fake scope that is used to not perform an actual search but only

   simulate the handling of the search (used for authentication) */

#define MYLDAP_SCOPE_BINDONLY 0x1972  /* magic number: should never be a real scope */

/* This refers to a current LDAP session that contains the connection

   information. */

struct ldap_session {

  /* the connection */

  LDAP *ld;

  /* timestamp of last activity */

  time_t lastactivity;

  /* index into uris: currently connected LDAP uri */

  int current_uri;

  /* a list of searches registered with this session */

  struct myldap_search *searches[MAX_SEARCHES_IN_SESSION];

  /* the username to bind with */

  char binddn[BUFLEN_DN];

  /* the password to bind with if any */

  char bindpw[BUFLEN_PASSWORD];

  /* the authentication result (NSLCD_PAM_* code) */

  int policy_response;

  /* the authentication message */

  char policy_message[BUFLEN_MESSAGE];

};

/* A search description set as returned by myldap_search(). */

struct myldap_search {

  /* reference to the session */

  MYLDAP_SESSION *session;

  /* indicator that the search is still valid */

  int valid;

  /* the parameters descibing the search */

  const char *base;

  int scope;

  const char *filter;

  char **attrs;

  /* a pointer to the current result entry, used for

     freeing resource allocated with that entry */

  MYLDAP_ENTRY *entry;

  /* LDAP message id for the search, -1 indicates absense of an active search */

  int msgid;

  /* the last result that was returned by ldap_result() */

  LDAPMessage *msg;

  /* cookie for paged searches */

  struct berval *cookie;

  /* to indicate that we can retry the search from myldap_get_entry() */

  int may_retry_search;

  /* the number of resutls returned so far */

  int count;

};

/* The maximum number of calls to myldap_get_values() that may be

   done per returned entry. */

#define MAX_ATTRIBUTES_PER_ENTRY 16

/* The maximum number of buffers (used for ranged attribute values and

   values returned by bervalues_to_values()) that may be stored per entry. */

#define MAX_BUFFERS_PER_ENTRY 8

/* A single entry from the LDAP database as returned by

   myldap_get_entry(). */

struct myldap_entry {

  /* reference to the search to be used to get parameters

     (e.g. LDAP connection) for other calls */

  MYLDAP_SEARCH *search;

  /* the DN */

  const char *dn;

  /* a cached version of the exploded rdn */

  char **exploded_rdn;

  /* a cache of attribute to value list */

  char **attributevalues[MAX_ATTRIBUTES_PER_ENTRY];

  /* a reference to buffers so we can free() them later on */

  char **buffers[MAX_BUFFERS_PER_ENTRY];

};

/* Flag to record first search operation */

int first_search = 1;

static void myldap_err(int pri, LDAP *ld, int rc, const char *format, ...)

{

  char message[BUFLEN_MESSAGE];

  char *msg_ldap = NULL;

  char *msg_diag = NULL;

  char *msg_errno = NULL;

  va_list ap;

  /* make the message */

  va_start(ap, format);

  vsnprintf(message, sizeof(message), format, ap);

  message[sizeof(message) - 1] = '\0';

  va_end(ap);

  /* get the various error message */

  if (rc != LDAP_SUCCESS)

  {

    msg_ldap = ldap_err2string(rc);

    /* get the diagnostic information */

#ifdef LDAP_OPT_DIAGNOSTIC_MESSAGE

    if (ld != NULL)

      ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, &msg_diag);

#endif /* LDAP_OPT_DIAGNOSTIC_MESSAGE */

  }

  if (errno != 0)

    msg_errno = strerror(errno);

  /* log the message */

  log_log(pri, "%s%s%s%s%s%s%s", message,

          (msg_ldap == NULL) ? "" : ": ", (msg_ldap == NULL) ? "" : msg_ldap,

          (msg_diag == NULL) ? "" : ": ", (msg_diag == NULL) ? "" : msg_diag,

          (msg_errno == NULL) ? "" : ": ", (msg_errno == NULL) ? "" : msg_errno);

  /* free diagnostic message */

  if (msg_diag != NULL)

    ldap_memfree(msg_diag);

}

static MYLDAP_ENTRY *myldap_entry_new(MYLDAP_SEARCH *search)

{

  MYLDAP_ENTRY *entry;

  int i;

  /* Note: as an alternative we could embed the myldap_entry into the

     myldap_search struct to save on malloc() and free() calls. */

  /* allocate new entry */

  entry = (MYLDAP_ENTRY *)malloc(sizeof(struct myldap_entry));

  if (entry == NULL)

  {

    log_log(LOG_CRIT, "myldap_entry_new(): malloc() failed to allocate memory");

    exit(EXIT_FAILURE);

  }

  /* fill in fields */

  entry->search = search;

  entry->dn = NULL;

  entry->exploded_rdn = NULL;

  for (i = 0; i < MAX_ATTRIBUTES_PER_ENTRY; i++)

    entry->attributevalues[i] = NULL;

  for (i = 0; i < MAX_BUFFERS_PER_ENTRY; i++)

    entry->buffers[i] = NULL;

  /* return the fresh entry */

  return entry;

}

static void myldap_entry_free(MYLDAP_ENTRY *entry)

{

  int i;

  /* free the DN */

  if (entry->dn != NULL)

    ldap_memfree((char *)entry->dn);

  /* free the exploded RDN */

  if (entry->exploded_rdn != NULL)

    ldap_value_free(entry->exploded_rdn);

  /* free all attribute values */

  for (i = 0; i < MAX_ATTRIBUTES_PER_ENTRY; i++)

    if (entry->attributevalues[i] != NULL)

      ldap_value_free(entry->attributevalues[i]);

  /* free all buffers */

  for (i = 0; i < MAX_BUFFERS_PER_ENTRY; i++)

    if (entry->buffers[i] != NULL)

      free(entry->buffers[i]);

  /* we don't need the result anymore, ditch it. */

  ldap_msgfree(entry->search->msg);

  entry->search->msg = NULL;

  /* free the actual memory for the struct */

  free(entry);

}

static MYLDAP_SEARCH *myldap_search_new(MYLDAP_SESSION *session,

                                        const char *base, int scope,

                                        const char *filter,

                                        const char **attrs)

{

  char *buffer;

  MYLDAP_SEARCH *search;

  int i;

  size_t sz;

  /* figure out size for new memory block to allocate

     this has the advantage that we can free the whole lot with one call */

  sz = sizeof(struct myldap_search);

  sz += strlen(base) + 1 + strlen(filter) + 1;

  for (i = 0; attrs[i] != NULL; i++)

    sz += strlen(attrs[i]) + 1;

  sz += (i + 1) * sizeof(char *);

  /* allocate new results memory region */

  buffer = (char *)malloc(sz);

  if (buffer == NULL)

  {

    log_log(LOG_CRIT, "myldap_search_new(): malloc() failed to allocate memory");

    exit(EXIT_FAILURE);

  }

  /* initialize struct */

  search = (MYLDAP_SEARCH *)(void *)(buffer);

  buffer += sizeof(struct myldap_search);

  /* save pointer to session */

  search->session = session;

  /* flag as valid search */

  search->valid = 1;

  /* initialize array of attributes */

  search->attrs = (char **)(void *)buffer;

  buffer += (i + 1) * sizeof(char *);

  /* copy base */

  strcpy(buffer, base);

  search->base = buffer;

  buffer += strlen(base) + 1;

  /* just plainly store scope */

  search->scope = scope;

  /* copy filter */

  strcpy(buffer, filter);

  search->filter = buffer;

  buffer += strlen(filter) + 1;

  /* copy attributes themselves */

  for (i = 0; attrs[i] != NULL; i++)

  {

    strcpy(buffer, attrs[i]);

    search->attrs[i] = buffer;

    buffer += strlen(attrs[i]) + 1;

  }

  search->attrs[i] = NULL;

  /* initialize context */

  search->cookie = NULL;

  search->msg = NULL;

  search->msgid = -1;

  search->may_retry_search = 1;

  /* clear result entry */

  search->entry = NULL;

  search->count = 0;

  /* return the new search struct */

  return search;

}

static MYLDAP_SESSION *myldap_session_new(void)

{

  MYLDAP_SESSION *session;

  int i;

  /* allocate memory for the session storage */

  session = (struct ldap_session *)malloc(sizeof(struct ldap_session));

  if (session == NULL)

  {

    log_log(LOG_CRIT, "myldap_session_new(): malloc() failed to allocate memory");

    exit(EXIT_FAILURE);

  }

  /* initialize the session */

  session->ld = NULL;

  session->lastactivity = 0;

  session->current_uri = 0;

  for (i = 0; i < MAX_SEARCHES_IN_SESSION; i++)

    session->searches[i] = NULL;

  session->binddn[0] = '\0';

  memset(session->bindpw, 0, sizeof(session->bindpw));

  session->bindpw[0] = '\0';

  session->policy_response = NSLCD_PAM_SUCCESS;

  session->policy_message[0] = '\0';

  /* return the new session */

  return session;

}

PURE static inline int is_valid_entry(MYLDAP_ENTRY *entry)

{

 return (entry != NULL) && (entry->search != NULL) &&

        (entry->search->session != NULL) && (entry->search->session->ld != NULL) &&

        (entry->search->msg != NULL);

}

#ifdef HAVE_SASL_INTERACT_T

/* this is registered with ldap_sasl_interactive_bind_s() in do_bind() */

static int do_sasl_interact(LDAP UNUSED(*ld), unsigned UNUSED(flags),

                            void *defaults, void *_interact)

{

  struct ldap_config *cfg = defaults;

  sasl_interact_t *interact = _interact;

  while (interact->id != SASL_CB_LIST_END)

  {

    switch (interact->id)

    {

      case SASL_CB_GETREALM:

        if (cfg->sasl_realm)

        {

          log_log(LOG_DEBUG, "do_sasl_interact(): returning sasl_realm \"%s\"",

                  cfg->sasl_realm);

          interact->result = cfg->sasl_realm;

          interact->len = strlen(cfg->sasl_realm);

        }

        else

          log_log(LOG_DEBUG, "do_sasl_interact(): were asked for sasl_realm but we don't have any");

        break;

      case SASL_CB_AUTHNAME:

        if (cfg->sasl_authcid)

        {

          log_log(LOG_DEBUG, "do_sasl_interact(): returning sasl_authcid \"%s\"",

                  cfg->sasl_authcid);

          interact->result = cfg->sasl_authcid;

          interact->len = strlen(cfg->sasl_authcid);

        }

        else

          log_log(LOG_DEBUG, "do_sasl_interact(): were asked for sasl_authcid but we don't have any");

        break;

      case SASL_CB_USER:

        if (cfg->sasl_authzid)

        {

          log_log(LOG_DEBUG, "do_sasl_interact(): returning sasl_authzid \"%s\"",

                  cfg->sasl_authzid);

          interact->result = cfg->sasl_authzid;

          interact->len = strlen(cfg->sasl_authzid);

        }

        else

          log_log(LOG_DEBUG, "do_sasl_interact(): were asked for sasl_authzid but we don't have any");

        break;

      case SASL_CB_PASS:

        if (cfg->bindpw)

        {

          log_log(LOG_DEBUG, "do_sasl_interact(): returning bindpw \"***\"");

          interact->result = cfg->bindpw;

          interact->len = strlen(cfg->bindpw);

        }

        else

          log_log(LOG_DEBUG, "do_sasl_interact(): were asked for bindpw but we don't have any");

        break;

      default:

        /* just ignore */

        break;

    }

    interact++;

  }

  return LDAP_SUCCESS;

}

#endif /* HAVE_SASL_INTERACT_T */

#define LDAP_SET_OPTION(ld, option, invalue)                                \

  rc = ldap_set_option(ld, option, invalue);                                \

  if (rc != LDAP_SUCCESS)                                                   \

  {                                                                         \

    myldap_err(LOG_ERR, ld, rc, "ldap_set_option(" #option ") failed");     \

    return rc;                                                              \

  }

#if defined(HAVE_LDAP_SASL_BIND) && defined(LDAP_SASL_SIMPLE)

static void print_ppolicy_expiry(MYLDAP_SESSION *session, unsigned int sec)

{

  unsigned int days = 0;

  unsigned int hours = 0;

  unsigned int minutes = 0;

  /* return this warning so PAM can present it to the user */

  if (strlen(session->policy_message) != 0)

    return;

  if (sec > 24 * 3600)

  {

    days = sec / (24 * 3600);

    sec -= days * 24 * 3600;

  }

  if (sec > 3600)

  {

    hours = sec / 3600;

    sec -= (hours * 3600);

  }

  if (sec > 60)

  {

    minutes = sec / 60;

    sec -= minutes * 60;

  }

  if (days > 1)

    mysnprintf(session->policy_message, sizeof(session->policy_message),

               "Password will expires in %u days", days);

  else if (days > 0)

    mysnprintf(session->policy_message, sizeof(session->policy_message),

               "Password will expires in %u hours", hours + 24);

  else if (hours > 1)

  {

    if (minutes > 1)

      mysnprintf(session->policy_message, sizeof(session->policy_message),

                 "Password will expires in %u hours and %u minutes",

                 hours, minutes);

    else

      mysnprintf(session->policy_message, sizeof(session->policy_message),

                 "Password will expires in %u hours", hours);

  }

  else if (hours > 0)

    mysnprintf(session->policy_message, sizeof(session->policy_message),

               "Password will expires in %u minutes", minutes + 60);

  else if (minutes > 1)

  {

    if (sec > 1)

      mysnprintf(session->policy_message, sizeof(session->policy_message),

                 "Password will expires in %u minutes and %u seconds",

                 minutes, sec);

    else

      mysnprintf(session->policy_message, sizeof(session->policy_message),

                 "Password will expires in %u minutes", minutes);

  }

  else

    mysnprintf(session->policy_message, sizeof(session->policy_message),

               "Password will expires in %u seconds", sec);

}

static void handle_ppolicy_controls(MYLDAP_SESSION *session, LDAP *ld, LDAPControl **ctrls)

{

  int i;

  int rc;

  /* clear policy response information in session */

  session->policy_response = NSLCD_PAM_SUCCESS;

  strncpy(session->policy_message, "", sizeof(session->policy_message));

  for (i = 0; ctrls[i] != NULL; i++)

  {

    if (strcmp(ctrls[i]->ldctl_oid, LDAP_CONTROL_PWEXPIRED) == 0)

    {

      /* check for expired control: force the user to change their password */

      log_log(LOG_DEBUG, "got LDAP_CONTROL_PWEXPIRED (password expired, user should change)");

      if (session->policy_response == NSLCD_PAM_SUCCESS)

        session->policy_response = NSLCD_PAM_NEW_AUTHTOK_REQD;

    }

    else if (strcmp(ctrls[i]->ldctl_oid, LDAP_CONTROL_PWEXPIRING) == 0)

    {

      /* check for password expiration warning control: the password is about

         to expire (returns the number of seconds remaining until the password

         expires) */

      char seconds[32];

      long int sec;

      mysnprintf(seconds, sizeof(seconds), "%.*s", (int)ctrls[i]->ldctl_value.bv_len,

                 ctrls[i]->ldctl_value.bv_val);

      sec = atol(seconds);

      log_log(LOG_DEBUG, "got LDAP_CONTROL_PWEXPIRING (password will expire in %ld seconds)",

              sec);

      print_ppolicy_expiry(session, (unsigned int)sec);

    }

    else if (strcmp(ctrls[i]->ldctl_oid, LDAP_CONTROL_PASSWORDPOLICYRESPONSE) == 0)

    {

      /* check for password policy control */

      int expire = 0, grace = 0;

      LDAPPasswordPolicyError error = -1;

      rc = ldap_parse_passwordpolicy_control(ld, ctrls[i], &expire, &grace, &error);

      if (rc != LDAP_SUCCESS)

        myldap_err(LOG_WARNING, ld, rc, "ldap_parse_passwordpolicy_control() failed (ignored)");

      else

      {

        /* log returned control information */

        log_log(LOG_DEBUG, "got LDAP_CONTROL_PASSWORDPOLICYRESPONSE (%s)",

                ldap_passwordpolicy_err2txt(error));

        if (expire >= 0)

          log_log(LOG_DEBUG, "got LDAP_CONTROL_PASSWORDPOLICYRESPONSE (password will expire in %d seconds)",

                  expire);

        if (grace >= 0)

          log_log(LOG_DEBUG, "got LDAP_CONTROL_PASSWORDPOLICYRESPONSE (%d grace logins left)",

                  grace);

        /* return this information to PAM */

        if ((error == PP_passwordExpired) &&

            ((session->policy_response == NSLCD_PAM_SUCCESS) ||

             (session->policy_response == NSLCD_PAM_NEW_AUTHTOK_REQD)))

        {

          /* this means that the password has expired and must be reset */

          session->policy_response = NSLCD_PAM_NEW_AUTHTOK_REQD;

          mysnprintf(session->policy_message, sizeof(session->policy_message),

                     "%s", ldap_passwordpolicy_err2txt(error));

        }

        else if ((error == PP_accountLocked) &&

                 ((session->policy_response == NSLCD_PAM_SUCCESS) ||

                  (session->policy_response == NSLCD_PAM_NEW_AUTHTOK_REQD)))

        {

          /* this means that the account is locked and the user cannot log

             in (the bind probably failed already) */

          session->policy_response = NSLCD_PAM_ACCT_EXPIRED;

          mysnprintf(session->policy_message, sizeof(session->policy_message),

                     "%s", ldap_passwordpolicy_err2txt(error));

        }

        else if ((error == PP_changeAfterReset) &&

                 (session->policy_response == NSLCD_PAM_SUCCESS))

        {

          /* this indicates that the password must be changed before the

             user is allowed to perform any other operation */

          session->policy_response = NSLCD_PAM_NEW_AUTHTOK_REQD;

          mysnprintf(session->policy_message, sizeof(session->policy_message),

                     "%s", ldap_passwordpolicy_err2txt(error));

        }

        else if ((error != PP_noError) &&

                 ((session->policy_response == NSLCD_PAM_SUCCESS) ||

                  (session->policy_response == NSLCD_PAM_NEW_AUTHTOK_REQD)))

        {

          /* any other error is assumed to mean that the operation failed */

          session->policy_response = NSLCD_PAM_PERM_DENIED;

          mysnprintf(session->policy_message, sizeof(session->policy_message),

                     "%s", ldap_passwordpolicy_err2txt(error));

        }

        /* both expire and grace should just be warnings to the user */

        if ((expire >= 0) && (strlen(session->policy_message) == 0))

        {

          /* if no other error has happened, this indicates that the password

             will soon expire (number of seconds) */

          print_ppolicy_expiry(session, (unsigned int)expire);

        }

        else if ((grace >= 0) && (strlen(session->policy_message) == 0))

        {

          /* this indicates the number of grace logins that are left before

             no further login attempts will be allowed */

          mysnprintf(session->policy_message, sizeof(session->policy_message),

                     "Password expired, %d grace logins left", grace);

        }

      }

    }

    /* ignore any other controls */

  }

}

static int do_ppolicy_bind(MYLDAP_SESSION *session, LDAP *ld, const char *uri)

{

  int rc, parserc;

  struct berval cred;

  LDAPControl passwd_policy_req;

  LDAPControl *requestctrls[2];

  LDAPControl **responsectrls;

  int msgid;

  struct timeval timeout;

  LDAPMessage *result;

  /* build policy request if pam_authc_ppolicy is set */

  if (nslcd_cfg->pam_authc_ppolicy)

  {

    passwd_policy_req.ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST;

    passwd_policy_req.ldctl_value.bv_val = NULL; /* none */

    passwd_policy_req.ldctl_value.bv_len = 0;

    passwd_policy_req.ldctl_iscritical = 0; /* not critical */

    requestctrls[0] = &passwd_policy_req;

  }

  else

    requestctrls[0] = NULL;

  requestctrls[1] = NULL;

  /* build password berval */

  cred.bv_val = (char *)session->bindpw;

  cred.bv_len = strlen(session->bindpw);

  /* do a SASL simple bind with the binddn and bindpw */

  log_log(LOG_DEBUG, "ldap_sasl_bind(\"%s\",%s) (uri=\"%s\") (ppolicy=%s)",

          session->binddn, (session->bindpw[0] != '\0') ? "\"***\"" : "\"\"",

          uri, (requestctrls[0] == NULL) ? "no" : "yes");

  rc = ldap_sasl_bind(ld, session->binddn, LDAP_SASL_SIMPLE, &cred, requestctrls, NULL, &msgid);

  if (rc != LDAP_SUCCESS)

    return rc;

  if (msgid == -1)

  {

    myldap_err(LOG_WARNING, ld, rc,"ldap_sasl_bind() failed (msgid=-1, uri=%s)", uri);

    return LDAP_OPERATIONS_ERROR;

  }

  /* get the result from the bind operation */

  timeout.tv_sec = nslcd_cfg->bind_timelimit;

  timeout.tv_usec = 0;

  result = NULL;

  rc = ldap_result(ld, msgid, LDAP_MSG_ALL, &timeout, &result);

  if (rc == -1) /* some error */

  {

    if (ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &rc) != LDAP_SUCCESS)

      rc = LDAP_UNAVAILABLE;

    myldap_err(LOG_ERR, ld, rc, "ldap_result() failed");

    if (result != NULL)

      ldap_msgfree(result);

    return LDAP_LOCAL_ERROR;

  }

  if (rc == 0) /* the timeout expired */

  {

    log_log(LOG_ERR, "ldap_result() timed out");

    if (result != NULL)

      ldap_msgfree(result);

    return LDAP_TIMEOUT;

  }

  responsectrls = NULL;

  /* ignore any response controls unless we're interested in ppolicy */

  if (nslcd_cfg->pam_authc_ppolicy)

  {

    /* parse the result from the bind operation (frees result, gets controls) */

    parserc = ldap_parse_result(ld, result, &rc, NULL, NULL, NULL, &responsectrls, 1);

    if (parserc != LDAP_SUCCESS)

    {

      myldap_err(LOG_ERR, ld, parserc, "ldap_parse_result() failed");

      if (responsectrls != NULL)

        ldap_controls_free(responsectrls);

      return parserc;

    }

    /* handle any returned controls */

    if (responsectrls != NULL)

    {

      handle_ppolicy_controls(session, ld, responsectrls);

      ldap_controls_free(responsectrls);

    }

  }

  /* return the result of the BIND operation */

  if (rc != LDAP_SUCCESS)

  {

    myldap_err(LOG_DEBUG, ld, rc, "ldap_parse_result() result");

    return rc;

  }

  /* check the returned controls */

  return LDAP_SUCCESS;

}

#endif /* no SASL, so no ppolicy */

/* This function performs the authentication phase of opening a connection.

   The binddn and bindpw parameters may be used to override the authentication

   mechanism defined in the configuration.  This returns an LDAP result

   code. */

static int do_bind(MYLDAP_SESSION *session, LDAP *ld, const char *uri)

{

  int rc;

#ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S

#ifndef HAVE_SASL_INTERACT_T

  struct berval cred;

#endif /* not HAVE_SASL_INTERACT_T */

#endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */

#ifdef LDAP_OPT_X_TLS

  /* check if StartTLS is requested */

  if (nslcd_cfg->ssl == SSL_START_TLS)

  {

    log_log(LOG_DEBUG, "ldap_start_tls_s()");

    errno = 0;

    rc = ldap_start_tls_s(ld, NULL, NULL);

    if (rc != LDAP_SUCCESS)

    {

      myldap_err(LOG_WARNING, ld, rc, "ldap_start_tls_s() failed (uri=%s)",

                 uri);

      return rc;

    }

  }

#endif /* LDAP_OPT_X_TLS */

  /* check if the binddn and bindpw are overwritten in the session */

  if (session->binddn[0] != '\0')

  {

#if defined(HAVE_LDAP_SASL_BIND) && defined(LDAP_SASL_SIMPLE)

    return do_ppolicy_bind(session, ld, uri);

#else /* no SASL, so no ppolicy */

    /* do a simple bind */

    log_log(LOG_DEBUG, "ldap_simple_bind_s(\"%s\",%s) (uri=\"%s\")",

            session->binddn,

            (session->bindpw[0] != '\0') ? "\"***\"" : "\"\"",

            uri);

    return ldap_simple_bind_s(ld, session->binddn, session->bindpw);

#endif

  }

  /* perform SASL bind if requested and available on platform */

#ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S

  /* TODO: store this information in the session */

  if (nslcd_cfg->sasl_mech != NULL)

  {

    /* do a SASL bind */

    if (nslcd_cfg->sasl_secprops != NULL)

    {

      log_log(LOG_DEBUG, "ldap_set_option(LDAP_OPT_X_SASL_SECPROPS,\"%s\")",

              nslcd_cfg->sasl_secprops);

      LDAP_SET_OPTION(ld, LDAP_OPT_X_SASL_SECPROPS, (void *)nslcd_cfg->sasl_secprops);

    }

#ifdef HAVE_SASL_INTERACT_T

    if (nslcd_cfg->binddn != NULL)

      log_log(LOG_DEBUG, "ldap_sasl_interactive_bind_s(\"%s\",\"%s\") (uri=\"%s\")",

              nslcd_cfg->binddn, nslcd_cfg->sasl_mech, uri);

    else

      log_log(LOG_DEBUG, "ldap_sasl_interactive_bind_s(NULL,\"%s\") (uri=\"%s\")",

              nslcd_cfg->sasl_mech, uri);

    return ldap_sasl_interactive_bind_s(ld, nslcd_cfg->binddn,

                                        nslcd_cfg->sasl_mech, NULL, NULL,

                                        LDAP_SASL_QUIET, do_sasl_interact,

                                        (void *)nslcd_cfg);

#else /* HAVE_SASL_INTERACT_T */

    if (nslcd_cfg->bindpw != NULL)

    {

      cred.bv_val = nslcd_cfg->bindpw;

      cred.bv_len = strlen(nslcd_cfg->bindpw);

    }

    else

    {

      cred.bv_val = "";

      cred.bv_len = 0;

    }

    if (nslcd_cfg->binddn != NULL)

      log_log(LOG_DEBUG, "ldap_sasl_bind_s(\"%s\",\"%s\",%s) (uri=\"%s\")",

              nslcd_cfg->binddn, nslcd_cfg->sasl_mech,

              nslcd_cfg->bindpw ? "\"***\"" : "NULL", uri);

    else

      log_log(LOG_DEBUG, "ldap_sasl_bind_s(NULL,\"%s\",%s) (uri=\"%s\")",

              nslcd_cfg->sasl_mech,

              nslcd_cfg->bindpw ? "\"***\"" : "NULL", uri);

    return ldap_sasl_bind_s(ld, nslcd_cfg->binddn,

                            nslcd_cfg->sasl_mech, &cred, NULL, NULL, NULL);

#endif /* not HAVE_SASL_INTERACT_T */

  }

#endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */

  /* do a simple bind */

  if (nslcd_cfg->binddn)

    log_log(LOG_DEBUG, "ldap_simple_bind_s(\"%s\",%s) (uri=\"%s\")",

            nslcd_cfg->binddn, nslcd_cfg->bindpw ? "\"***\"" : "NULL",

            uri);

  else

    log_log(LOG_DEBUG, "ldap_simple_bind_s(NULL,%s) (uri=\"%s\")",

            nslcd_cfg->bindpw ? "\"***\"" : "NULL", uri);

  return ldap_simple_bind_s(ld, nslcd_cfg->binddn, nslcd_cfg->bindpw);

}

#ifdef HAVE_LDAP_SET_REBIND_PROC

/* This function is called by the LDAP library when chasing referrals.

   It is configured with the ldap_set_rebind_proc() below. */

#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)

static int do_rebind(LDAP *ld, LDAP_CONST char *url,

                     ber_tag_t UNUSED(request),

                     ber_int_t UNUSED(msgid), void *arg)

{

  MYLDAP_SESSION *session = (MYLDAP_SESSION *)arg;

  log_log(LOG_DEBUG, "rebinding to %s", url);

  return do_bind(session, ld, url);

}

#else /* not recent OpenLDAP */

static int do_rebind(LDAP *ld, char **dnp, char **passwdp, int *authmethodp,

                     int freeit, void *arg)

{

  MYLDAP_SESSION *session = (MYLDAP_SESSION *)arg;

  if (freeit)

  {

    free(*dnp);

    memset(*passwdp, 0, strlen(*passwdp));

    free(*passwdp);

  }

  else

  {

    log_log(LOG_DEBUG, "rebinding");

    *dnp = strdup(session->binddn);

    *passwdp = strdup(session->bindpw);

    *authmethodp = LDAP_AUTH_SIMPLE;

    if ((*dnp == NULL) || (*passwdp == NULL))

    {

      if (*dnp != NULL)

        free(*dnp);

      log_log(LOG_CRIT, "do_rebind(): strdup() failed to allocate memory");

      return LDAP_NO_MEMORY;

    }

  }

  return LDAP_SUCCESS;

}

#endif /* not recent OpenLDAP */

#endif /* HAVE_LDAP_SET_REBIND_PROC */

/* set a recieve and send timeout on a socket */

static int set_socket_timeout(LDAP *ld, time_t sec, suseconds_t usec)

{

  struct timeval tv;

  int rc = LDAP_SUCCESS;

  int sd;

  log_log(LOG_DEBUG, "set_socket_timeout(%lu,%lu)",

          (unsigned long)sec, (unsigned long)usec);

  /* get the socket */

  if ((rc = ldap_get_option(ld, LDAP_OPT_DESC, &sd)) != LDAP_SUCCESS)

  {

    myldap_err(LOG_ERR, ld, rc, "ldap_get_option(LDAP_OPT_DESC) failed");

    return rc;

  }

  /* ignore invalid (probably closed) file descriptors */

  if (sd <= 0)

    return LDAP_SUCCESS;

  /* set timeouts */

  memset(&tv, 0, sizeof(tv));

  tv.tv_sec = sec;

  tv.tv_usec = usec;

  if (setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, (void *)&tv, sizeof(tv)))

  {

    log_log(LOG_ERR, "setsockopt(%d,SO_RCVTIMEO) failed: %s",

            sd, strerror(errno));

    rc = LDAP_LOCAL_ERROR;

  }

  if (setsockopt(sd, SOL_SOCKET, SO_SNDTIMEO, (void *)&tv, sizeof(tv)))

  {

    log_log(LOG_ERR, "setsockopt(%d,SO_RCVTIMEO) failed: %s",

            sd, strerror(errno));

    rc = LDAP_LOCAL_ERROR;

  }

  return rc;

}

#ifdef LDAP_OPT_CONNECT_CB

/* This function is called by the LDAP library once a connection was made to the server. We

   set a timeout on the socket here, to catch network timeouts during the ssl

   handshake phase. It is configured with LDAP_OPT_CONNECT_CB. */

static int connect_cb(LDAP *ld, Sockbuf UNUSED(*sb),

                      LDAPURLDesc UNUSED(*srv), struct sockaddr UNUSED(*addr),

                      struct ldap_conncb UNUSED(*ctx))

{

  /* set timeout options on socket to avoid hang in some cases (a little

     more than the normal timeout so this should only be triggered in cases

     where the library behaves incorrectly) */

  if (nslcd_cfg->timelimit)

    set_socket_timeout(ld, nslcd_cfg->timelimit, 500000);

  return LDAP_SUCCESS;

}

/* We have an empty disconnect callback because LDAP_OPT_CONNECT_CB expects

   both functions to be available. */

static void disconnect_cb(LDAP UNUSED(*ld), Sockbuf UNUSED(*sb),

                          struct ldap_conncb UNUSED(*ctx))

{

}

#endif /* LDAP_OPT_CONNECT_CB */

/* This function sets a number of properties on the connection, based

   what is configured in the configfile. This function returns an

   LDAP status code. */

static int do_set_options(MYLDAP_SESSION *session)

{

  int rc;

  struct timeval tv;

#ifdef LDAP_OPT_CONNECT_CB

  /* make this static because OpenLDAP doesn't make its own copy */

  static struct ldap_conncb cb;

#endif /* LDAP_OPT_CONNECT_CB */

#ifdef LDAP_OPT_X_TLS

  int i;

#endif /* LDAP_OPT_X_TLS */