gnupg/dirmngr/ldap-parse-uri.c

/* ldap-parse-uri.c - Parse an LDAP URI.
 * Copyright (C) 2015  g10 Code GmbH
 *
 * This file is part of GnuPG.
 *
 * GnuPG is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * GnuPG is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <https://www.gnu.org/licenses/>.
 */

#include <config.h>

#include <gpg-error.h>

#ifdef HAVE_W32_SYSTEM
# include "ldap-url.h"
#else
# include <ldap.h>
#endif

#include "../common/util.h"
#include "http.h"

/* Returns 1 if the string is an LDAP URL (begins with ldap:, ldaps:
   or ldapi:).  */
int
ldap_uri_p (const char *url)
{
  char *colon = strchr (url, ':');

  if (!colon)
    return 0;
  else
    {
      int offset = (uintptr_t) colon - (uintptr_t) url;

      if (   (offset == 4 && !ascii_memcasecmp (url, "ldap", 4))
	  || (offset == 5 && (!ascii_memcasecmp (url, "ldaps", 5)
                              || !ascii_memcasecmp (url, "ldapi", 5))))
	return 1;
      return 0;
    }
}

/* Parse a URI and put the result into *purip.  On success the
   caller must use http_release_parsed_uri() to releases the resources.

   uri->path is the base DN (or NULL for the default).
   uri->auth is the bindname (or NULL for none).
   The uri->query variable "password" is the password.

   Note: any specified scope, any attributes, any filter and any
   unknown extensions are simply ignored.  */
gpg_error_t
ldap_parse_uri (parsed_uri_t *purip, const char *uri)
{
  gpg_err_code_t err = 0;
  parsed_uri_t puri = NULL;

  int result;
  LDAPURLDesc *lud = NULL;

  char *scheme = NULL;
  char *host = NULL;
  char *dn = NULL;
  char *bindname = NULL;
  char *password = NULL;
  char *gpg_ntds = NULL;

  char **s;

  char *buffer;
  int len;

  result = ldap_url_parse (uri, &lud);
  if (result != 0)
    {
      log_error ("Unable to parse LDAP uri '%s'\n", uri);
      err = GPG_ERR_GENERAL;
      goto out;
    }

  scheme = lud->lud_scheme;
  host = lud->lud_host;
  dn = lud->lud_dn;

  for (s = lud->lud_exts; s && *s; s ++)
    {
      if (strncmp (*s, "bindname=", 9) == 0)
	{
	  if (bindname)
	    log_error ("bindname given multiple times in URL '%s', ignoring.\n",
		       uri);
	  else
	    bindname = *s + 9;
	}
      else if (strncmp (*s, "password=", 9) == 0)
	{
	  if (password)
	    log_error ("password given multiple times in URL '%s', ignoring.\n",
		       uri);
	  else
	    password = *s + 9;
	}
      else if (!ascii_strncasecmp (*s, "gpgNtds=", 8)
              || !strncmp (*s, "1.3.6.1.4.1.11591.2.5.1=", 24))
	{
	  if (gpg_ntds)
	    log_error ("gpgNtds given multiple times in URL '%s', ignoring.\n",
		       uri);
	  else
	    gpg_ntds = *s + (**s == 'g'? 8 : 24);
	}
      else
	log_error ("Unhandled extension (%s) in URL '%s', ignoring.",
		   *s, uri);
    }

  len = 0;

#define add(s) do { if (s) len += strlen (s) + 1; } while (0)

  add (scheme);
  add (host);
  add (dn);
  add (bindname);
  add (password);

  puri = xtrycalloc (1, sizeof *puri + len);
  if (! puri)
    {
      err = gpg_err_code_from_syserror ();
      goto out;
    }

  buffer = puri->buffer;

#define copy(to, s)				\
  do						\
    {						\
      if (s)					\
	{					\
	  to = buffer;				\
	  buffer = stpcpy (buffer, s) + 1;	\
	}					\
    }						\
  while (0)

  copy (puri->scheme, scheme);
  /* Make sure the scheme is lower case.  */
  ascii_strlwr (puri->scheme);

  copy (puri->host, host);
  copy (puri->path, dn);
  copy (puri->auth, bindname);

  if (password)
    {
      puri->query = calloc (sizeof (*puri->query), 1);
      if (!puri->query)
        {
          err = gpg_err_code_from_syserror ();
          goto out;
        }
      puri->query->name = "password";
      copy (puri->query->value, password);
      puri->query->valuelen = strlen (password) + 1;
    }

  puri->use_tls = !strcmp (puri->scheme, "ldaps");
  puri->port = lud->lud_port;

  /* On Windows detect whether this is ldap:// or ldaps:// to indicate
   * that authentication via AD and the current user is requested.
   * This is shortform of adding "gpgNtDs=1" as extension parameter to
   * the URL.  */
  puri->ad_current = 0;
  if (gpg_ntds && atoi (gpg_ntds) == 1)
    puri->ad_current = 1;
#ifdef HAVE_W32_SYSTEM
  else if ((!puri->host || !*puri->host)
      && (!puri->path || !*puri->path)
      && (!puri->auth || !*puri->auth)
      && !password
      )
    puri->ad_current = 1;
#endif

 out:
  if (lud)
    ldap_free_urldesc (lud);

  if (err)
    {
      if (puri)
	http_release_parsed_uri (puri);
    }
  else
    *purip = puri;

  return gpg_err_make (default_errsource, err);
}

/* The following characters need to be escaped to be part of an LDAP
   filter: *, (, ), \, NUL and /.  Note: we don't handle NUL, since a
   NUL can't be part of a C string.

   This function always allocates a new string on success.  It is the
   caller's responsibility to free it.
*/
char *
ldap_escape_filter (const char *filter)
{
  int l = strcspn (filter, "*()\\/");
  if (l == strlen (filter))
    /* Nothing to escape.  */
    return xstrdup (filter);

  {
    /* In the worst case we need to escape every letter.  */
    char *escaped = xmalloc (1 + 3 * strlen (filter));

    /* Indices into filter and escaped.  */
    int filter_i = 0;
    int escaped_i = 0;

    for (filter_i = 0; filter_i < strlen (filter); filter_i ++)
      {
	switch (filter[filter_i])
	  {
	  case '*':
	  case '(':
	  case ')':
	  case '\\':
	  case '/':
	    snprintf (&escaped[escaped_i], 4, "%%%02x",
                     ((const unsigned char *)filter)[filter_i]);
	    escaped_i += 3;
	    break;

	  default:
	    escaped[escaped_i ++] = filter[filter_i];
	    break;
	  }
      }
    /* NUL terminate it.  */
    escaped[escaped_i] = 0;

    /* We could shrink escaped to be just escaped_i bytes, but the
       result will probably be freed very quickly anyways.  */
    return escaped;
  }
}