int _LDAP_initialization(LDAP **ld, PyObject *url) {
int rc;
int portnum;
char *hoststr = NULL;
const int version = LDAP_VERSION3;
PyObject *scheme = PyObject_GetAttrString(url, "scheme");
PyObject *host = PyObject_GetAttrString(url, "host");
PyObject *port = PyObject_GetAttrString(url, "port");
if (scheme == NULL || host == NULL || port == NULL) return -1;
hoststr = PyObject2char(host);
portnum = PyLong_AsLong(port);
Py_DECREF(host);
Py_DECREF(port);
if (hoststr == NULL) return -1;
if (PyUnicode_CompareWithASCIIString(scheme, "ldaps") == 0) {
*ld = ldap_sslinit(hoststr, portnum, 1);
} else {
*ld = ldap_init(hoststr, portnum);
}
Py_DECREF(scheme);
if (ld == NULL) return -1;
ldap_set_option(*ld, LDAP_OPT_PROTOCOL_VERSION, &version);
rc = ldap_connect(*ld, NULL);
return rc;
}
/**
* APR LDAP initialise function
*
* This function is responsible for initialising an LDAP
* connection in a toolkit independant way. It does the
* job of ldap_init() from the C api.
*
* It handles both the SSL and non-SSL case, and attempts
* to hide the complexity setup from the user. This function
* assumes that any certificate setup necessary has already
* been done.
*
* If SSL or STARTTLS needs to be enabled, and the underlying
* toolkit supports it, the following values are accepted for
* secure:
*
* APR_LDAP_NONE: No encryption
* APR_LDAP_SSL: SSL encryption (ldaps://)
* APR_LDAP_STARTTLS: Force STARTTLS on ldap://
*/
APU_DECLARE_LDAP(int) apr_ldap_init(apr_pool_t *pool,
LDAP **ldap,
const char *hostname,
int portno,
int secure,
apr_ldap_err_t **result_err)
{
apr_ldap_err_t *result = (apr_ldap_err_t *)apr_pcalloc(pool, sizeof(apr_ldap_err_t));
*result_err = result;
#if APR_HAS_LDAPSSL_INIT
*ldap = ldapssl_init(hostname, portno, 0);
#elif APR_HAS_LDAP_SSLINIT
*ldap = ldap_sslinit((char *)hostname, portno, 0);
#else
*ldap = ldap_init((char *)hostname, portno);
#endif
if (*ldap != NULL) {
return apr_ldap_set_option(pool, *ldap, APR_LDAP_OPT_TLS, &secure, result_err);
}
else {
/* handle the error case */
apr_ldap_err_t *result = (apr_ldap_err_t *)apr_pcalloc(pool, sizeof(apr_ldap_err_t));
*result_err = result;
result->reason = "APR LDAP: Unable to initialize the LDAP connection";
result->rc = -1;
return APR_EGENERAL;
}
}
static LDAP *ldap_init_and_bind (const char *host,
#ifdef WIN32
gboolean use_ssl,
#endif
const char *user_dn,
const char *password)
{
LDAP *ld;
int res;
int desired_version = LDAP_VERSION3;
#ifndef WIN32
res = ldap_initialize (&ld, host);
if (res != LDAP_SUCCESS) {
ccnet_warning ("ldap_initialize failed: %s.\n", ldap_err2string(res));
return NULL;
}
#else
char *host_copy = g_strdup (host);
if (!use_ssl)
ld = ldap_init (host_copy, LDAP_PORT);
else
ld = ldap_sslinit (host_copy, LDAP_SSL_PORT, 1);
g_free (host_copy);
if (!ld) {
ccnet_warning ("ldap_init failed: %ul.\n", LdapGetLastError());
return NULL;
}
#endif
/* set the LDAP version to be 3 */
res = ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version);
if (res != LDAP_OPT_SUCCESS) {
ccnet_warning ("ldap_set_option failed: %s.\n", ldap_err2string(res));
return NULL;
}
if (user_dn) {
#ifndef WIN32
res = ldap_bind_s (ld, user_dn, password, LDAP_AUTH_SIMPLE);
#else
char *dn_copy = g_strdup(user_dn);
char *password_copy = g_strdup(password);
res = ldap_bind_s (ld, dn_copy, password_copy, LDAP_AUTH_SIMPLE);
g_free (dn_copy);
g_free (password_copy);
#endif
if (res != LDAP_SUCCESS ) {
ccnet_warning ("ldap_bind failed: %s.\n", ldap_err2string(res));
ldap_unbind_s (ld);
return NULL;
}
}
return ld;
}
bool AD::InitSSL()
{
std::wstring hostname;
if(ldap != NULL)
{
ldap_unbind(ldap);
}
if(DNS::IsIPv4((PWCHAR)host.c_str()))
{
DNS::IPToHostname((PWCHAR)host.c_str(), &hostname);
wprintf(L"hostname = %s\n", hostname.c_str());
ldap = ldap_sslinit((PWCHAR)hostname.c_str(), LDAP_SSL_PORT, 1);
}
else
{
ldap = ldap_sslinit((PWCHAR)host.c_str(), LDAP_SSL_PORT, 1);
}
return ldap == NULL ? false : true;
}
/**
* APR LDAP initialise function
*
* This function is responsible for initialising an LDAP
* connection in a toolkit independant way. It does the
* job of ldap_init() from the C api.
*
* It handles both the SSL and non-SSL case, and attempts
* to hide the complexity setup from the user. This function
* assumes that any certificate setup necessary has already
* been done.
*
* If SSL or STARTTLS needs to be enabled, and the underlying
* toolkit supports it, the following values are accepted for
* secure:
*
* APR_LDAP_NONE: No encryption
* APR_LDAP_SSL: SSL encryption (ldaps://)
* APR_LDAP_STARTTLS: Force STARTTLS on ldap://
*/
APU_DECLARE_LDAP(int) apr_ldap_init(apr_pool_t *pool,
LDAP **ldap,
const char *hostname,
int portno,
int secure,
apr_ldap_err_t **result_err)
{
apr_ldap_err_t *result = (apr_ldap_err_t *)apr_pcalloc(pool, sizeof(apr_ldap_err_t));
*result_err = result;
#if APR_HAS_LDAPSSL_INIT
#if APR_HAS_SOLARIS_LDAPSDK
/*
* Using the secure argument should aways be possible. But as LDAP SDKs
* tend to have different quirks and bugs, this needs to be tested for
* for each of them, first. For Solaris LDAP it works, and the method
* with ldap_set_option doesn't.
*/
*ldap = ldapssl_init(hostname, portno, secure == APR_LDAP_SSL);
#else
*ldap = ldapssl_init(hostname, portno, 0);
#endif
#elif APR_HAS_LDAP_SSLINIT
*ldap = ldap_sslinit((char *)hostname, portno, 0);
#else
*ldap = ldap_init((char *)hostname, portno);
#endif
if (*ldap != NULL) {
#if APR_HAS_SOLARIS_LDAPSDK
if (secure == APR_LDAP_SSL)
return APR_SUCCESS;
else
#endif
return apr_ldap_set_option(pool, *ldap, APR_LDAP_OPT_TLS, &secure, result_err);
}
else {
/* handle the error case */
apr_ldap_err_t *result = (apr_ldap_err_t *)apr_pcalloc(pool, sizeof(apr_ldap_err_t));
*result_err = result;
result->reason = "APR LDAP: Unable to initialize the LDAP connection";
result->rc = -1;
return APR_EGENERAL;
}
}
int _LDAP_initialization(LDAP **ld, PyObject *url, int tls_option) {
int rc;
int portnum;
char *hoststr = NULL;
const int version = LDAP_VERSION3;
const int tls_settings = SCH_CRED_MANUAL_CRED_VALIDATION | SCH_CRED_NO_SERVERNAME_CHECK;
PyObject *scheme = PyObject_GetAttrString(url, "scheme");
PyObject *host = PyObject_GetAttrString(url, "host");
PyObject *port = PyObject_GetAttrString(url, "port");
if (scheme == NULL || host == NULL || port == NULL) return -1;
hoststr = PyObject2char(host);
portnum = PyLong_AsLong(port);
Py_DECREF(host);
Py_DECREF(port);
if (hoststr == NULL) return -1;
if (PyUnicode_CompareWithASCIIString(scheme, "ldaps") == 0) {
*ld = ldap_sslinit(hoststr, portnum, 1);
} else {
*ld = ldap_init(hoststr, portnum);
}
Py_DECREF(scheme);
if (ld == NULL) return -1;
ldap_set_option(*ld, LDAP_OPT_PROTOCOL_VERSION, &version);
switch (tls_option) {
case -1:
/* Cert policy is not set, nothing to do.*/
break;
case 2:
case 4:
/* Cert policy is demand or try, then standard procedure. */
break;
case 0:
case 3:
/* Cert policy is never or allow, then set TLS settings. */
ldap_set_option(*ld, 0x43, &tls_settings);
ldap_set_option(*ld, LDAP_OPT_SERVER_CERTIFICATE, &noverify);
break;
}
rc = ldap_connect(*ld, NULL);
return rc;
}
static CURLcode Curl_ldap(struct connectdata *conn, bool *done)
{
CURLcode result = CURLE_OK;
int rc = 0;
LDAP *server = NULL;
LDAPURLDesc *ludp = NULL;
LDAPMessage *ldapmsg = NULL;
LDAPMessage *entryIterator;
int num = 0;
struct SessionHandle *data=conn->data;
int ldap_proto = LDAP_VERSION3;
int ldap_ssl = 0;
char *val_b64 = NULL;
size_t val_b64_sz = 0;
curl_off_t dlsize = 0;
#ifdef LDAP_OPT_NETWORK_TIMEOUT
struct timeval ldap_timeout = {10,0}; /* 10 sec connection/search timeout */
#endif
*done = TRUE; /* unconditionally */
infof(data, "LDAP local: LDAP Vendor = %s ; LDAP Version = %d\n",
LDAP_VENDOR_NAME, LDAP_VENDOR_VERSION);
infof(data, "LDAP local: %s\n", data->change.url);
#ifdef HAVE_LDAP_URL_PARSE
rc = ldap_url_parse(data->change.url, &ludp);
#else
rc = _ldap_url_parse(conn, &ludp);
#endif
if(rc != 0) {
failf(data, "LDAP local: %s", ldap_err2string(rc));
result = CURLE_LDAP_INVALID_URL;
goto quit;
}
/* Get the URL scheme ( either ldap or ldaps ) */
if(conn->given->flags & PROTOPT_SSL)
ldap_ssl = 1;
infof(data, "LDAP local: trying to establish %s connection\n",
ldap_ssl ? "encrypted" : "cleartext");
#ifdef LDAP_OPT_NETWORK_TIMEOUT
ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
#endif
ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
if(ldap_ssl) {
#ifdef HAVE_LDAP_SSL
#ifdef CURL_LDAP_WIN
/* Win32 LDAP SDK doesn't support insecure mode without CA! */
server = ldap_sslinit(conn->host.name, (int)conn->port, 1);
ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
#else
int ldap_option;
char* ldap_ca = data->set.str[STRING_SSL_CAFILE];
#if defined(CURL_HAS_NOVELL_LDAPSDK)
rc = ldapssl_client_init(NULL, NULL);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ldapssl_client_init %s", ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
if(data->set.ssl.verifypeer) {
/* Novell SDK supports DER or BASE64 files. */
int cert_type = LDAPSSL_CERT_FILETYPE_B64;
if((data->set.str[STRING_CERT_TYPE]) &&
(Curl_raw_equal(data->set.str[STRING_CERT_TYPE], "DER")))
cert_type = LDAPSSL_CERT_FILETYPE_DER;
if(!ldap_ca) {
failf(data, "LDAP local: ERROR %s CA cert not set!",
(cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
infof(data, "LDAP local: using %s CA cert '%s'\n",
(cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
ldap_ca);
rc = ldapssl_add_trusted_cert(ldap_ca, cert_type);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting %s CA cert: %s",
(cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
ldap_option = LDAPSSL_VERIFY_SERVER;
}
else
ldap_option = LDAPSSL_VERIFY_NONE;
rc = ldapssl_set_verify_mode(ldap_option);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting cert verify mode: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
server = ldapssl_init(conn->host.name, (int)conn->port, 1);
if(server == NULL) {
failf(data, "LDAP local: Cannot connect to %s:%ld",
conn->host.name, conn->port);
result = CURLE_COULDNT_CONNECT;
goto quit;
}
#elif defined(LDAP_OPT_X_TLS)
if(data->set.ssl.verifypeer) {
/* OpenLDAP SDK supports BASE64 files. */
if((data->set.str[STRING_CERT_TYPE]) &&
(!Curl_raw_equal(data->set.str[STRING_CERT_TYPE], "PEM"))) {
failf(data, "LDAP local: ERROR OpenLDAP only supports PEM cert-type!");
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
if(!ldap_ca) {
failf(data, "LDAP local: ERROR PEM CA cert not set!");
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
infof(data, "LDAP local: using PEM CA cert: %s\n", ldap_ca);
rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
ldap_option = LDAP_OPT_X_TLS_DEMAND;
}
else
ldap_option = LDAP_OPT_X_TLS_NEVER;
rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting cert verify mode: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
server = ldap_init(conn->host.name, (int)conn->port);
if(server == NULL) {
failf(data, "LDAP local: Cannot connect to %s:%ld",
conn->host.name, conn->port);
result = CURLE_COULDNT_CONNECT;
goto quit;
}
ldap_option = LDAP_OPT_X_TLS_HARD;
rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting SSL/TLS mode: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
/*
rc = ldap_start_tls_s(server, NULL, NULL);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
*/
#else
/* we should probably never come up to here since configure
should check in first place if we can support LDAP SSL/TLS */
failf(data, "LDAP local: SSL/TLS not supported with this version "
"of the OpenLDAP toolkit\n");
result = CURLE_SSL_CERTPROBLEM;
goto quit;
#endif
#endif
#endif /* CURL_LDAP_USE_SSL */
}
else {
server = ldap_init(conn->host.name, (int)conn->port);
if(server == NULL) {
failf(data, "LDAP local: Cannot connect to %s:%ld",
conn->host.name, conn->port);
result = CURLE_COULDNT_CONNECT;
goto quit;
}
}
#ifdef CURL_LDAP_WIN
ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
#endif
rc = ldap_simple_bind_s(server,
conn->bits.user_passwd ? conn->user : NULL,
conn->bits.user_passwd ? conn->passwd : NULL);
if(!ldap_ssl && rc != 0) {
ldap_proto = LDAP_VERSION2;
ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
rc = ldap_simple_bind_s(server,
conn->bits.user_passwd ? conn->user : NULL,
conn->bits.user_passwd ? conn->passwd : NULL);
}
if(rc != 0) {
failf(data, "LDAP local: ldap_simple_bind_s %s", ldap_err2string(rc));
result = CURLE_LDAP_CANNOT_BIND;
goto quit;
}
rc = ldap_search_s(server, ludp->lud_dn, ludp->lud_scope,
ludp->lud_filter, ludp->lud_attrs, 0, &ldapmsg);
if(rc != 0 && rc != LDAP_SIZELIMIT_EXCEEDED) {
failf(data, "LDAP remote: %s", ldap_err2string(rc));
result = CURLE_LDAP_SEARCH_FAILED;
goto quit;
}
for(num = 0, entryIterator = ldap_first_entry(server, ldapmsg);
entryIterator;
entryIterator = ldap_next_entry(server, entryIterator), num++) {
BerElement *ber = NULL;
char *attribute; /*! suspicious that this isn't 'const' */
char *dn = ldap_get_dn(server, entryIterator);
int i;
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"DN: ", 4);
if(result)
goto quit;
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)dn, 0);
if(result)
goto quit;
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 1);
if(result)
goto quit;
dlsize += strlen(dn)+5;
for(attribute = ldap_first_attribute(server, entryIterator, &ber);
attribute;
attribute = ldap_next_attribute(server, entryIterator, ber)) {
BerValue **vals = ldap_get_values_len(server, entryIterator, attribute);
if(vals != NULL) {
for(i = 0; (vals[i] != NULL); i++) {
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\t", 1);
if(result)
goto quit;
result = Curl_client_write(conn, CLIENTWRITE_BODY,
(char *)attribute, 0);
if(result)
goto quit;
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)": ", 2);
if(result)
goto quit;
dlsize += strlen(attribute)+3;
if((strlen(attribute) > 7) &&
(strcmp(";binary",
(char *)attribute +
(strlen((char *)attribute) - 7)) == 0)) {
/* Binary attribute, encode to base64. */
CURLcode error = Curl_base64_encode(data,
vals[i]->bv_val,
vals[i]->bv_len,
&val_b64,
&val_b64_sz);
if(error) {
ldap_value_free_len(vals);
ldap_memfree(attribute);
ldap_memfree(dn);
if(ber)
ber_free(ber, 0);
result = error;
goto quit;
}
if(val_b64_sz > 0) {
result = Curl_client_write(conn, CLIENTWRITE_BODY, val_b64,
val_b64_sz);
free(val_b64);
if(result)
goto quit;
dlsize += val_b64_sz;
}
}
else {
result = Curl_client_write(conn, CLIENTWRITE_BODY, vals[i]->bv_val,
vals[i]->bv_len);
if(result)
goto quit;
dlsize += vals[i]->bv_len;
}
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
if(result)
goto quit;
dlsize++;
}
/* Free memory used to store values */
ldap_value_free_len(vals);
}
result = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 1);
if(result)
goto quit;
dlsize++;
Curl_pgrsSetDownloadCounter(data, dlsize);
ldap_memfree(attribute);
}
ldap_memfree(dn);
if(ber)
ber_free(ber, 0);
}
quit:
if(ldapmsg) {
ldap_msgfree(ldapmsg);
LDAP_TRACE (("Received %d entries\n", num));
}
if(rc == LDAP_SIZELIMIT_EXCEEDED)
infof(data, "There are more than %d entries\n", num);
if(ludp)
ldap_free_urldesc(ludp);
if(server)
ldap_unbind_s(server);
#if defined(HAVE_LDAP_SSL) && defined(CURL_HAS_NOVELL_LDAPSDK)
if(ldap_ssl)
ldapssl_client_deinit();
#endif /* HAVE_LDAP_SSL && CURL_HAS_NOVELL_LDAPSDK */
/* no data to transfer */
Curl_setup_transfer(conn, -1, -1, FALSE, NULL, -1, NULL);
connclose(conn, "LDAP connection always disable re-use");
return result;
}
STDMETHODIMP CLDAPQuery::connect(
/* [in] */ BSTR username,
/* [in] */ BSTR password,
/* [in] */ BSTR host,
/* [in] */ VARIANT_BOOL usessl,
/* [retval][out] */ LONG *connect_id)
{
m_errorCode = 0L;
const ULONG no_limit = LDAP_NO_LIMIT;
PLDAP ld = NULL;
bool useSSL = (usessl==VARIANT_TRUE)? true : false;
bool canFindFromRoot = true;
CAttributesSchema *attrsSchema = NULL;
ULONG ulPort = useSSL?LDAP_SSL_PORT:LDAP_PORT;
PTCHAR port = NULL;
CString defaultNamingContext;
CString csHost = host;
CString hostname = _tcstok_s(csHost.GetBuffer(), _T(":"), &port);
if(port && _tcslen(port) > 0)
ulPort = _tcstol(port, NULL, 10);
csHost.ReleaseBuffer();
try
{
if (useSSL)
{
if((ld = ldap_sslinit(hostname.GetBuffer(), ulPort, 1))==NULL)
{
m_errorCode = LdapGetLastError();
return S_FALSE;
}
m_errorCode = ldap_set_option(ld, LDAP_OPT_SERVER_CERTIFICATE, &CertRoutine);
if (m_errorCode != LDAP_SUCCESS)
throw _T("error LDAP_OPT_SERVER_CERTIFICATE");
}
else
{
if((ld = ldap_init(hostname.GetBuffer(), ulPort))==NULL)
{
m_errorCode = LdapGetLastError();
return S_FALSE;
}
}
const ULONG version = LDAP_VERSION3;
m_errorCode = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, (void*)&version);
if (m_errorCode != LDAP_SUCCESS)
throw _T("error LDAP_OPT_PROTOCOL_VERSION");
m_errorCode = ldap_set_option(ld, LDAP_OPT_SIZELIMIT, (void*)&no_limit);
if (m_errorCode != LDAP_SUCCESS)
throw _T("error LDAP_OPT_SIZELIMIT");
ld->ld_sizelimit = no_limit;
m_errorCode = ldap_set_option(ld, LDAP_OPT_TIMELIMIT, (void*)&no_limit);
if (m_errorCode != LDAP_SUCCESS)
throw _T("error LDAP_OPT_TIMELIMIT");
ld->ld_timelimit = no_limit;
m_errorCode = ldap_connect(ld, 0);
if (m_errorCode != LDAP_SUCCESS )
throw _T("error ldap_connect");
m_errorCode = ldap_bind_s(ld, CString(username).GetBuffer(), CString(password).GetBuffer(), LDAP_AUTH_SIMPLE);
if (m_errorCode != LDAP_SUCCESS)
throw _T("error LDAP_AUTH_SIMPLE");
/* Get the RootDSE and BaseDN attribute (add checks on use this code).*/
CSimpleArray<PTCHAR> a;
a.Add(_T("defaultNamingContext"));
a.Add(_T("subschemaSubentry"));
a.Add(NULL);
PLDAPMessage pBaseMsg = NULL;
if(ldap_search_s(ld, _T(""), LDAP_SCOPE_BASE, _T("(objectClass=*)"), a.GetData(), 0, &pBaseMsg) == LDAP_SUCCESS)
{
PLDAPMessage const entry = ldap_first_entry(ld, pBaseMsg);
if(entry)
{
PTCHAR * const pschema = ldap_get_values(ld, entry, _T("subschemaSubentry"));
if(pschema)
{
attrsSchema = new CAttributesSchema(ld, *pschema);
ldap_value_free(pschema);
}
//try to find one item in subtree from root, if found it is Global Catalog search
PLDAPSearch const pPages = ldap_search_init_page(ld, NULL, LDAP_SCOPE_SUBTREE, _T("(objectClass=*)"), NULL, 0, NULL, NULL, no_limit, 1, NULL);
if(pPages)
{
PLDAPMessage pMsg = NULL;
canFindFromRoot = (ldap_get_next_page_s(ld, pPages, NULL, 1, NULL, &pMsg) == LDAP_SUCCESS);
if(pMsg)
ldap_msgfree(pMsg);
ldap_search_abandon_page(ld, pPages);
}
PTCHAR * const pDefaultNamingContext = ldap_get_values(ld, entry, _T("defaultNamingContext"));
if(pDefaultNamingContext)
{
defaultNamingContext = *pDefaultNamingContext;
ldap_value_free(pDefaultNamingContext);
}
}
ldap_msgfree(pBaseMsg);
}
ÑConnectInfo * const cinfo = new ÑConnectInfo(ld, attrsSchema, defaultNamingContext, canFindFromRoot);
*connect_id = ++m_maxConnectionId;
m_connections.Add(*connect_id, cinfo);
}
catch (PTCHAR /*e*/)
{
if (ld)
ldap_unbind_s(ld);
*connect_id = -1;
return S_FALSE;
}
return S_OK;
}
//------------------------------------
// LdapUtils implementation
//------------------------------------
LDAP* LdapUtils::LdapInit(const char* protocol, const char* host, int port, int secure_port)
{
LDAP* ld = NULL;
if(stricmp(protocol, "ldaps") == 0)
{
#ifdef _WIN32
ld = ldap_sslinit((char*)host, secure_port, 1);
if (ld == NULL )
throw MakeStringException(-1, "ldap_sslinit error" );
int rc = 0;
unsigned long version = LDAP_VERSION3;
long lv = 0;
rc = ldap_set_option(ld,
LDAP_OPT_PROTOCOL_VERSION,
(void*)&version);
if (rc != LDAP_SUCCESS)
throw MakeStringException(-1, "ldap_set_option error - %s", ldap_err2string(rc));
rc = ldap_get_option(ld,LDAP_OPT_SSL,(void*)&lv);
if (rc != LDAP_SUCCESS)
throw MakeStringException(-1, "ldap_get_option error - %s", ldap_err2string(rc));
// If SSL is not enabled, enable it.
if ((void*)lv != LDAP_OPT_ON)
{
rc = ldap_set_option(ld, LDAP_OPT_SSL, LDAP_OPT_ON);
if (rc != LDAP_SUCCESS)
throw MakeStringException(-1, "ldap_set_option error - %s", ldap_err2string(rc));
}
ldap_set_option(ld, LDAP_OPT_SERVER_CERTIFICATE, verifyServerCert);
#else
// Initialize an LDAP session for TLS/SSL
#ifndef HAVE_TLS
//throw MakeStringException(-1, "openldap client library libldap not compiled with TLS support");
#endif
StringBuffer uri("ldaps://");
uri.appendf("%s:%d", host, secure_port);
DBGLOG("connecting to %s", uri.str());
int rc = LDAP_INIT(&ld, uri.str());
if(rc != LDAP_SUCCESS)
{
throw MakeStringException(-1, "ldap_initialize error %s", ldap_err2string(rc));
}
int reqcert = LDAP_OPT_X_TLS_NEVER;
ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert);
#endif
}
else
{
// Initialize an LDAP session
DBGLOG("connecting to ldap://%s:%d", host, port);
#ifdef _WIN32
ld = LDAP_INIT(host, port);
if(NULL == ld)
{
throw MakeStringException(-1, "ldap_init(%s,%d) error %s", host, port, ldap_err2string(LdapGetLastError()));
}
#else
StringBuffer uri("ldap://");
uri.appendf("%s:%d", host, port);
int rc = LDAP_INIT(&ld, uri.str());
if(rc != LDAP_SUCCESS)
{
throw MakeStringException(-1, "ldap_initialize(%s,%d) error %s", host, port, ldap_err2string(rc));
}
#endif
}
return ld;
}
