library/adldap.c - master - githubmirror/adcli

library/adldap.c
562 строки12 KB
Sumit Bose
coverity: add missing NULL checks
02 июн 2021, 14:39
02 июн 2021, 14:393c65291
/*
 * adcli
 *
 * Copyright (C) 2012 Red Hat Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 * MA 02110-1301 USA
 *
 * Author: Stef Walter <stefw@gnome.org>
 */

#include "config.h"

#include "adcli.h"
#include "adprivate.h"

#include <gssapi/gssapi_krb5.h>
#include <krb5/krb5.h>
#include <ldap.h>
#include <sasl/sasl.h>

#include <assert.h>
#include <ctype.h>

adcli_result
_adcli_ldap_handle_failure (LDAP *ldap,
                            adcli_result defres,
                            const char *desc,
                            ...)
{
	va_list va;
	char *message;
	char *info;
	int code;

	if (ldap_get_option (ldap, LDAP_OPT_RESULT_CODE, &code) != 0)
		return_unexpected_if_reached ();

	if (code == LDAP_NO_MEMORY)
		return_unexpected_if_reached ();

	if (ldap_get_option (ldap, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*)&info) != 0)
		info = NULL;

	va_start (va, desc);
	if (vasprintf (&message, desc, va) < 0)
		return_unexpected_if_reached ();
	va_end (va);

	_adcli_err ("%s: %s",
	            message,
	            info ? info : ldap_err2string (code));

	free (message);
	return defres;
}

char *
_adcli_ldap_parse_sid (LDAP *ldap,
                         LDAPMessage *results,
                         const char *attr_name)
{
	LDAPMessage *entry;
	struct berval **bvs;
	char *val = NULL;

	entry = ldap_first_entry (ldap, results);
	if (entry != NULL) {
		bvs = ldap_get_values_len (ldap, entry, attr_name);
		if (bvs != NULL) {
			if (bvs[0]) {
				val = _adcli_bin_sid_to_str ( (uint8_t *) bvs[0]->bv_val,
				                              bvs[0]->bv_len);
				return_val_if_fail (val != NULL, NULL);
			}
			ldap_value_free_len (bvs);
		}
	}

	return val;
}

char *
_adcli_ldap_parse_value (LDAP *ldap,
                         LDAPMessage *results,
                         const char *attr_name)
{
	LDAPMessage *entry;
	struct berval **bvs;
	char *val = NULL;

	entry = ldap_first_entry (ldap, results);
	if (entry != NULL) {
		bvs = ldap_get_values_len (ldap, entry, attr_name);
		if (bvs != NULL) {
			if (bvs[0]) {
				val = _adcli_str_dupn (bvs[0]->bv_val, bvs[0]->bv_len);
				return_val_if_fail (val != NULL, NULL);
			}
			ldap_value_free_len (bvs);
		}
	}

	return val;
}

char **
_adcli_ldap_parse_values (LDAP *ldap,
                          LDAPMessage *results,
                          const char *attr_name)
{
	LDAPMessage *entry;
	struct berval **bvs;
	char **vals = NULL;
	int length = 0;
	char *val;
	int i;

	entry = ldap_first_entry (ldap, results);
	if (entry != NULL) {
		bvs = ldap_get_values_len (ldap, entry, attr_name);
		if (bvs != NULL) {
			for (i = 0; bvs[i] != NULL; i++) {
				val = _adcli_str_dupn (bvs[i]->bv_val,
				                       bvs[i]->bv_len);
				if (val != NULL)
					vals = _adcli_strv_add (vals, val, &length);
			}
			ldap_value_free_len (bvs);
		}
	}

	return vals;
}

char *
_adcli_ldap_parse_dn (LDAP *ldap,
                      LDAPMessage *results)
{
	LDAPMessage *entry;
	const char *dn;
	char *ret = NULL;

	entry = ldap_first_entry (ldap, results);
	if (entry != NULL) {
		dn = ldap_get_dn (ldap, entry);
		if (dn != NULL) {
			ret = strdup (dn);
			return_val_if_fail (ret != NULL, NULL);
		}
	}

	return ret;
}

int
_adcli_ldap_ber_case_equal (struct berval *one,
                            struct berval *two)
{
	int i;

	if (one->bv_len != two->bv_len)
		return 0;

	for (i = 0; i < one->bv_len; i++) {
		if (toupper (one->bv_val[i]) != toupper (two->bv_val[i]))
			return 0;
	}

	return 1;
}

int
_adcli_ldap_have_vals (struct berval **want,
                       struct berval **have)
{
	int i, j;

	for (i = 0; want[i] != NULL; i++) {
		int found = 0;
		for (j = 0; have[j] != NULL; j++) {
			if (_adcli_ldap_ber_case_equal (want[i], have[j])) {
				found = 1;
				break;
			}
		}
		if (!found)
			return 0;
	}

	return 1;
}

int
_adcli_ldap_have_in_mod (LDAPMod *mod,
                         struct berval **have)
{
	struct berval *vals;
	struct berval **pvals;
	int count = 0;
	int count_have = 0;
	int i;
	int ret;

	/* Count number of values */
	for (i = 0; mod->mod_vals.modv_strvals[i] != 0; i++)
		count++;
	for (i = 0; have[i] != 0; i++)
		count_have++;

	/* If numbers different something has to be added or removed */
	if (count != count_have) {
		return 0;
	}

	/* Already in berval format, just compare */
	if (mod->mod_op & LDAP_MOD_BVALUES)
		return _adcli_ldap_have_vals (mod->mod_vals.modv_bvals, have);

	vals = malloc (sizeof (struct berval) * (count + 1));
	pvals = malloc (sizeof (struct berval *) * (count + 1));
	if (vals == NULL || pvals == NULL) {
		_adcli_err ("Memory allocation failed, assuming attribute must be updated.");
		free (vals);
		free (pvals);
		return 0;
	}

	for (i = 0; i < count; i++) {
		vals[i].bv_val = mod->mod_vals.modv_strvals[i];
		vals[i].bv_len = strlen (vals[i].bv_val);
		pvals[i] = vals + i;
	}

	pvals[count] = NULL;
	ret = _adcli_ldap_have_vals (pvals, have);
	free (vals);
	free (pvals);

	return ret;
}

int
_adcli_ldap_filter_for_add (void *unused,
                            void *value)
{
	LDAPMod *mod = value;

	/* No need to care about this */
	if ((mod->mod_op & LDAP_MOD_OP) == LDAP_MOD_DELETE)
		return -1;

	if (mod->mod_op & LDAP_MOD_BVALUES) {
		if (mod->mod_vals.modv_bvals == NULL ||
		    mod->mod_vals.modv_bvals[0] == NULL)
			return -1;
		mod->mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
	} else {
		if (mod->mod_vals.modv_strvals == NULL ||
		    mod->mod_vals.modv_strvals[0] == NULL)
			return -1;
		mod->mod_op = LDAP_MOD_ADD;
	}

	return 0;
}

#define LDAP_NO_ESCAPE "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-_0123456789"
#define LDAP_HEX "0123456789abcdef"

char *
_adcli_ldap_escape_filter (const char *value)
{
	const char *in;
	char *out, *result;
	size_t pos;
	size_t len;

	assert (value != NULL);

	len = strlen (value);
	result = malloc ((len * 3) + 1);
	return_val_if_fail (result != NULL, NULL);

	in = value;
	out = result;

	while (*in != '\0') {
		pos = strspn (in, LDAP_NO_ESCAPE);
		if (pos > 0) {
			memcpy (out, in, pos);
			in += pos;
			out += pos;
		}

		while (*in != '\0' && !strchr (LDAP_NO_ESCAPE, *in)) {
			*(out++) = '\\';
			*(out++) = LDAP_HEX[*in >> 4 & 0xf];
			*(out++) = LDAP_HEX[*in & 0xf];
			in++;
		}
	}

	*out = 0;
	return result;
}

static int
berval_case_equals (const struct berval *v1,
                    const struct berval *v2)
{
	return (v1->bv_len == v2->bv_len &&
	        strncasecmp (v1->bv_val, v2->bv_val, v1->bv_len) == 0);
}

int
_adcli_ldap_dn_has_ancestor (const char *dn,
                             const char *ancestor)
{
	LDAPDN ld_dn;
	LDAPDN ld_suffix;
	LDAPRDN r_dn;
	LDAPRDN r_suffix;
	int ln_dn;
	int ln_suffix;
	int match = 0;
	int rc;
	int i, j;

	rc = ldap_str2dn (dn, &ld_dn, LDAP_DN_FORMAT_LDAPV3);
	return_val_if_fail (rc == LDAP_SUCCESS, 0);

	/* This is usually provided by user, be less whiny about formatting issues */
	rc = ldap_str2dn (ancestor, &ld_suffix, LDAP_DN_FORMAT_LDAPV3);
	if (rc != LDAP_SUCCESS)
		return 0;

	/* Calculate length of both */
	for (i = 0, ln_dn = 0; ld_dn[i] != NULL; i++)
		ln_dn++;
	for (i = 0, ln_suffix = 0; ld_suffix[i] != NULL; i++)
		ln_suffix++;

	match = (ln_suffix < ln_dn);
	for (i = 1; match && i <= ln_suffix; i++) {
		r_dn = ld_dn[ln_dn - i];
		r_suffix = ld_suffix[ln_suffix - i];
		for (j = 0; match && r_dn[j] != NULL && r_suffix[j] != NULL; j++) {
			if (!berval_case_equals (&(r_dn[j]->la_attr), &(r_suffix[j]->la_attr)) ||
			    !berval_case_equals (&(r_dn[j]->la_value), &(r_suffix[j]->la_value)))
				match = 0;
		}
	}

	ldap_dnfree (ld_dn);
	ldap_dnfree (ld_suffix);

	return match;
}

int
_adcli_ldap_mod_compar (void *match,
                        void *mod)
{
	return strcmp (((LDAPMod *)match)->mod_type,
	               ((LDAPMod *)mod)->mod_type);
}

LDAPMod *
_adcli_ldap_mod_new (int mod_op,
                     const char *type,
                     const char **values)
{
	LDAPMod *mod;

	mod = calloc (1, sizeof (LDAPMod));
	return_val_if_fail (mod != NULL, NULL);

	mod->mod_op = mod_op;
	mod->mod_type = strdup (type);
	return_val_if_fail (mod->mod_type != NULL, NULL);

	if (values) {
		mod->mod_vals.modv_strvals = _adcli_strv_dup ((char **)values);
		return_val_if_fail (mod->mod_vals.modv_strvals != NULL, NULL);
	}

	return mod;
}

LDAPMod *
_adcli_ldap_mod_new1 (int mod_op,
                      const char *type,
                      const char *value)
{
	const char *values[] = { value, NULL };
	return _adcli_ldap_mod_new (mod_op, type, values);
}

void
_adcli_ldap_mod_free (void *value)
{
	LDAPMod *mod = value;

	if (mod == NULL)
		return;

	free (mod->mod_type);

	if (mod->mod_op & LDAP_MOD_BVALUES)
		ldap_value_free_len (mod->mod_vals.modv_bvals);
	else
		_adcli_strv_free (mod->mod_vals.modv_strvals);
	free (mod);
}

char *
_adcli_ldap_mods_to_string (LDAPMod **mods)
{
	char **names;
	int names_len;
	char *string;
	int i;

	names = NULL;
	names_len = 0;

	for (i = 0; mods[i] != NULL; i++)
		names = _adcli_strv_add (names, strdup (mods[i]->mod_type), &names_len);
	string = _adcli_strv_join (names, ", ");

	_adcli_strv_free (names);
	return string;
}

#ifdef LDAP_TESTS

#include "seq.h"
#include "test.h"

static void
test_compar (void)
{
	LDAPMod one = { LDAP_MOD_ADD, "one" };
	LDAPMod two = { LDAP_MOD_ADD, "two" };
	LDAPMod same = { LDAP_MOD_REPLACE, "one" };

	assert (_adcli_ldap_mod_compar (&one, &two) < 0);
	assert (_adcli_ldap_mod_compar (&two, &one) > 0);
	assert (_adcli_ldap_mod_compar (&one, &one) == 0);
	assert (_adcli_ldap_mod_compar (&one, &same) == 0);
}

static void
test_new_free (void)
{
	const char *values[] = { "value", "two", "three", NULL };
	LDAPMod *mod;

	mod = _adcli_ldap_mod_new (LDAP_MOD_ADD, "test", values);
	assert (mod != NULL);

	assert (mod->mod_op == LDAP_MOD_ADD);
	assert_str_eq (mod->mod_type, "test");
	assert_num_eq (seq_count (mod->mod_vals.modv_strvals), 3);
	assert_str_eq (mod->mod_vals.modv_strvals[0], "value");
	assert_str_eq (mod->mod_vals.modv_strvals[1], "two");
	assert_str_eq (mod->mod_vals.modv_strvals[2], "three");
	assert (mod->mod_vals.modv_strvals[3] == NULL);

	_adcli_ldap_mod_free (mod);
}

static void
test_new1 (void)
{
	LDAPMod *mod;

	mod = _adcli_ldap_mod_new1 (LDAP_MOD_ADD, "test", "one");
	assert (mod != NULL);

	assert (mod->mod_op == LDAP_MOD_ADD);
	assert_str_eq (mod->mod_type, "test");
	assert_num_eq (seq_count (mod->mod_vals.modv_strvals), 1);
	assert_str_eq (mod->mod_vals.modv_strvals[0], "one");
	assert (mod->mod_vals.modv_strvals[1] == NULL);

	_adcli_ldap_mod_free (mod);
}

static void
test_new_null (void)
{
	LDAPMod *mod;

	mod = _adcli_ldap_mod_new (LDAP_MOD_ADD, "test", NULL);
	assert (mod != NULL);

	assert (mod->mod_op == LDAP_MOD_ADD);
	assert_str_eq (mod->mod_type, "test");
	assert_num_eq (seq_count (mod->mod_vals.modv_strvals), 0);
	assert (mod->mod_vals.modv_strvals == NULL);

	_adcli_ldap_mod_free (mod);
}

static void
test_free_null (void)
{
	_adcli_ldap_mod_free (NULL);
}

static void
test_to_string (void)
{
	char *vals_objectClass[] = { "computer", NULL };
	LDAPMod objectClass = { 0, "objectClass", { vals_objectClass, } };
	char *vals_sAMAccountName[] = { "value", NULL };
	LDAPMod sAMAccountName = { 0, "sAMAccountName", { vals_sAMAccountName, } };
	char *vals_userAccountControl[] = { "69632", NULL };
	LDAPMod userAccountControl = { 0, "userAccountControl", { vals_userAccountControl, } };

	LDAPMod *mods[] = {
		&objectClass,
		&sAMAccountName,
		&userAccountControl,
		NULL,
	};

	char *string;

	string = _adcli_ldap_mods_to_string (mods);
	assert_str_eq (string, "objectClass, sAMAccountName, userAccountControl");
	free (string);
}

int
main (int argc,
      char *argv[])
{
	test_func (test_compar, "/ldap/compar");
	test_func (test_new_free, "/ldap/new_free");
	test_func (test_new1, "/ldap/new1");
	test_func (test_new_null, "/ldap/new_null");
	test_func (test_free_null, "/ldap/free_null");
	test_func (test_to_string, "/ldap/to_string");
	return test_run (argc, argv);
}

#endif /* LDAP_TESTS */