security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

dirmngr: Support new gpgNtds parameter in LDAP keyserver URLs.

Browse source 
* dirmngr/ldap-parse-uri.c (ldap_parse_uri): Support a new gpgNtds
extension.
* dirmngr/ks-engine-ldap.c (my_ldap_connect): Do ldap_init always with
hostname - which is NULL and thus the same if not given.  Fix minor
error in error code handling.
--

Note that "gpgNtds" is per RFC-4512 case insensitive and has not yet
been officially regisetered.  Thus for correctness the OID can be
used:

  1.3.6.1.4.1.11591.2.5          LDAP URL extensions
  1.3.6.1.4.1.11591.2.5.1          gpgNtds=1 (auth. with current user)

Note that the value must be 1; all other values won't enable AD
authentication and are resevered for future use.

This has been cherry-picked from the 2.2 branch,
commit 55f46b33df

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2021-02-17 17:31:36 +01:00
parent 3fa1fa747b
commit ab7dc4b524
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
5 changed files with 40 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

19
dirmngr/ks-engine-ldap.c
View file

@ -519,18 +519,12 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
#endif
}
if (uri->ad_current)
ldap_conn = ldap_init (NULL, uri->port);
else
ldap_conn = ldap_init (uri->host, uri->port);
ldap_conn = ldap_init (uri->host, uri->port);
if (!ldap_conn)
{
err = gpg_err_code_from_syserror ();
if (uri->ad_current)
log_error ("error initializing LDAP for current user\n");
else
log_error ("error initializing LDAP for (%s://%s:%d)\n",
uri->scheme, uri->host, uri->port);
log_error ("error initializing LDAP for (%s://%s:%d)\n",
uri->scheme, uri->host, uri->port);
goto out;
}
@ -611,15 +605,16 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
npth_unprotect ();
err = ldap_bind_s (ldap_conn, NULL, NULL, LDAP_AUTH_NEGOTIATE);
npth_protect ();
#else
err = gpg_error (GPG_ERR_NOT_SUPPORTED);
#endif
if (err != LDAP_SUCCESS)
{
log_error ("error binding to LDAP via AD: %s\n",
ldap_err2string (err));
goto out;
}
#else
err = gpg_error (GPG_ERR_NOT_SUPPORTED);
goto out;
#endif
}
else if (uri->auth)
{

18
dirmngr/ldap-parse-uri.c
View file

@ -71,6 +71,7 @@ ldap_parse_uri (parsed_uri_t *purip, const char *uri)
char *dn = NULL;
char *bindname = NULL;
char *password = NULL;
char *gpg_ntds = NULL;
char **s;
@ -107,6 +108,15 @@ ldap_parse_uri (parsed_uri_t *purip, const char *uri)
else
password = *s + 9;
}
else if (!ascii_strncasecmp (*s, "gpgNtds=", 8)
|| !strncmp (*s, "1.3.6.1.4.1.11591.2.5.1=", 24))
{
if (gpg_ntds)
log_error ("gpgNtds given multiple times in URL '%s', ignoring.\n",
uri);
else
gpg_ntds = *s + (**s == 'g'? 8 : 24);
}
else
log_error ("Unhandled extension (%s) in URL '%s', ignoring.",
*s, uri);
@ -167,10 +177,14 @@ ldap_parse_uri (parsed_uri_t *purip, const char *uri)
puri->port = lud->lud_port;
/* On Windows detect whether this is ldap:// or ldaps:// to indicate
* that authentication via AD and the current user is requested. */
* that authentication via AD and the current user is requested.
* This is shortform of adding "gpgNtDs=1" as extension parameter to
* the URL. */
puri->ad_current = 0;
if (gpg_ntds && atoi (gpg_ntds) == 1)
puri->ad_current = 1;
#ifdef HAVE_W32_SYSTEM
if ((!puri->host || !*puri->host)
else if ((!puri->host || !*puri->host)
&& (!puri->path || !*puri->path)
&& (!puri->auth || !*puri->auth)
&& !password