luna - curl/lib/openldap.c

   1/***************************************************************************
   2 *                      _   _ ____  _
   3 *  Project         ___| | | |  _ \| |
   4 *                 / __| | | | |_) | |
   5 *                | (__| |_| |  _ <| |___
   6 *                 \___|\___/|_| \_\_____|
   7 *
   8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
   9 * Copyright (C) Howard Chu, <hyc@openldap.org>
  10 *
  11 * This software is licensed as described in the file COPYING, which
  12 * you should have received as part of this distribution. The terms
  13 * are also available at https://curl.se/docs/copyright.html.
  14 *
  15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16 * copies of the Software, and permit persons to whom the Software is
  17 * furnished to do so, under the terms of the COPYING file.
  18 *
  19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20 * KIND, either express or implied.
  21 *
  22 * SPDX-License-Identifier: curl
  23 *
  24 ***************************************************************************/
  25#include "curl_setup.h"
  26
  27#if !defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP)
  28
  29/*
  30 * Notice that USE_OPENLDAP is only a source code selection switch. When
  31 * libcurl is built with USE_OPENLDAP defined the libcurl source code that
  32 * gets compiled is the code from openldap.c, otherwise the code that gets
  33 * compiled is the code from ldap.c.
  34 *
  35 * When USE_OPENLDAP is defined a recent version of the OpenLDAP library
  36 * might be required for compilation and runtime. In order to use ancient
  37 * OpenLDAP library versions, USE_OPENLDAP shall not be defined.
  38 */
  39
  40#include <ldap.h>
  41
  42#include "urldata.h"
  43#include "url.h"
  44#include "sendf.h"
  45#include "curl_trc.h"
  46#include "vtls/vtls.h"
  47#include "transfer.h"
  48#include "curl_ldap.h"
  49#include "curlx/base64.h"
  50#include "cfilters.h"
  51#include "connect.h"
  52#include "curl_sasl.h"
  53#include "strcase.h"
  54#include "bufref.h"
  55
  56/*
  57 * Uncommenting this will enable the built-in debug logging of the openldap
  58 * library. The debug log level can be set using the CURL_OPENLDAP_TRACE
  59 * environment variable. The debug output is written to stderr.
  60 *
  61 * The library supports the following debug flags:
  62 * LDAP_DEBUG_NONE         0x0000
  63 * LDAP_DEBUG_TRACE        0x0001
  64 * LDAP_DEBUG_CONSTRUCT    0x0002
  65 * LDAP_DEBUG_DESTROY      0x0004
  66 * LDAP_DEBUG_PARAMETER    0x0008
  67 * LDAP_DEBUG_ANY          0xffff
  68 *
  69 * For example, use CURL_OPENLDAP_TRACE=0 for no debug,
  70 * CURL_OPENLDAP_TRACE=2 for LDAP_DEBUG_CONSTRUCT messages only,
  71 * CURL_OPENLDAP_TRACE=65535 for all debug message levels.
  72 */
  73/* #define CURL_OPENLDAP_DEBUG */
  74
  75/* Machine states. */
  76typedef enum {
  77  OLDAP_STOP,           /* Do nothing state, stops the state machine */
  78  OLDAP_SSL,            /* Performing SSL handshake. */
  79  OLDAP_STARTTLS,       /* STARTTLS request sent. */
  80  OLDAP_TLS,            /* Performing TLS handshake. */
  81  OLDAP_MECHS,          /* Get SASL authentication mechanisms. */
  82  OLDAP_SASL,           /* SASL binding reply. */
  83  OLDAP_BIND,           /* Simple bind reply. */
  84  OLDAP_BINDV2,         /* Simple bind reply in protocol version 2. */
  85  OLDAP_LAST            /* Never used */
  86} ldapstate;
  87
  88#ifndef _LDAP_PVT_H
  89extern int ldap_pvt_url_scheme2proto(const char *);
  90extern int ldap_init_fd(ber_socket_t fd, int proto, const char *url,
  91                        LDAP **ld);
  92#endif
  93
  94static Curl_recv oldap_recv;
  95
  96struct ldapconninfo {
  97  struct SASL sasl;          /* SASL-related parameters */
  98  LDAP *ld;                  /* Openldap connection handle. */
  99  Curl_recv *recv;           /* For stacking SSL handler */
 100  Curl_send *send;
 101  struct berval *servercred; /* SASL data from server. */
 102  ldapstate state;           /* Current machine state. */
 103  int proto;                 /* LDAP_PROTO_TCP/LDAP_PROTO_UDP/LDAP_PROTO_IPC */
 104  int msgid;                 /* Current message id. */
 105};
 106
 107struct ldapreqinfo {
 108  int msgid;
 109  int nument;
 110};
 111
 112/* meta key for storing ldapconninfo at easy handle */
 113#define CURL_META_LDAP_EASY   "meta:proto:ldap:easy"
 114/* meta key for storing ldapconninfo at connection */
 115#define CURL_META_LDAP_CONN   "meta:proto:ldap:conn"
 116
 117/*
 118 * oldap_state()
 119 *
 120 * This is the ONLY way to change LDAP state!
 121 */
 122static void oldap_state(struct Curl_easy *data, struct ldapconninfo *li,
 123                        ldapstate newstate)
 124{
 125#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
 126  /* for debug purposes */
 127  static const char * const names[] = {
 128    "STOP",
 129    "SSL",
 130    "STARTTLS",
 131    "TLS",
 132    "MECHS",
 133    "SASL",
 134    "BIND",
 135    "BINDV2",
 136    /* LAST */
 137  };
 138
 139  if(li->state != newstate)
 140    infof(data, "LDAP %p state change from %s to %s",
 141          (void *)li, names[li->state], names[newstate]);
 142#else
 143  (void)data;
 144#endif
 145  li->state = newstate;
 146}
 147
 148/* Map some particular LDAP error codes to CURLcode values. */
 149static CURLcode oldap_map_error(int rc, CURLcode result)
 150{
 151  switch(rc) {
 152  case LDAP_NO_MEMORY:
 153    return CURLE_OUT_OF_MEMORY;
 154  case LDAP_INVALID_CREDENTIALS:
 155    return CURLE_LOGIN_DENIED;
 156  case LDAP_PROTOCOL_ERROR:
 157    return CURLE_UNSUPPORTED_PROTOCOL;
 158  case LDAP_INSUFFICIENT_ACCESS:
 159    return CURLE_REMOTE_ACCESS_DENIED;
 160  }
 161  return result;
 162}
 163
 164static CURLcode oldap_url_parse(struct Curl_easy *data, LDAPURLDesc **ludp)
 165{
 166  CURLcode result = CURLE_OK;
 167  int rc = LDAP_URL_ERR_BADURL;
 168  static const char * const url_errs[] = {
 169    "success",
 170    "out of memory",
 171    "bad parameter",
 172    "unrecognized scheme",
 173    "unbalanced delimiter",
 174    "bad URL",
 175    "bad host or port",
 176    "bad or missing attributes",
 177    "bad or missing scope",
 178    "bad or missing filter",
 179    "bad or missing extensions"
 180  };
 181
 182  *ludp = NULL;
 183  if(!data->state.up.user && !data->state.up.password &&
 184     !data->state.up.options)
 185    rc = ldap_url_parse(Curl_bufref_ptr(&data->state.url), ludp);
 186  if(rc != LDAP_URL_SUCCESS) {
 187    const char *msg = "url parsing problem";
 188
 189    result = rc == LDAP_URL_ERR_MEM ? CURLE_OUT_OF_MEMORY :
 190      CURLE_URL_MALFORMAT;
 191    rc -= LDAP_URL_SUCCESS;
 192    if((size_t)rc < CURL_ARRAYSIZE(url_errs))
 193      msg = url_errs[rc];
 194    failf(data, "LDAP local: %s", msg);
 195  }
 196  return result;
 197}
 198
 199/* Parse the login options. */
 200static CURLcode oldap_parse_login_options(struct connectdata *conn)
 201{
 202  CURLcode result = CURLE_OK;
 203  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 204  const char *ptr = conn->options;
 205
 206  DEBUGASSERT(li);
 207  if(!li)
 208    return CURLE_FAILED_INIT;
 209
 210  while(!result && ptr && *ptr) {
 211    const char *key = ptr;
 212    const char *value;
 213
 214    while(*ptr && *ptr != '=')
 215      ptr++;
 216
 217    value = ptr + 1;
 218
 219    while(*ptr && *ptr != ';')
 220      ptr++;
 221
 222    if(checkprefix("AUTH=", key))
 223      result = Curl_sasl_parse_url_auth_option(&li->sasl, value, ptr - value);
 224    else
 225      result = CURLE_SETOPT_OPTION_SYNTAX;
 226
 227    if(*ptr == ';')
 228      ptr++;
 229  }
 230
 231  return result == CURLE_URL_MALFORMAT ? CURLE_SETOPT_OPTION_SYNTAX : result;
 232}
 233
 234static CURLcode oldap_setup_connection(struct Curl_easy *data,
 235                                       struct connectdata *conn)
 236{
 237  CURLcode result;
 238  LDAPURLDesc *lud;
 239  (void)conn;
 240
 241  /* Early URL syntax check. */
 242  result = oldap_url_parse(data, &lud);
 243  ldap_free_urldesc(lud);
 244
 245  return result;
 246}
 247
 248/*
 249 * Get the SASL authentication challenge from the server credential buffer.
 250 */
 251static CURLcode oldap_get_message(struct Curl_easy *data, struct bufref *out)
 252{
 253  struct ldapconninfo *li =
 254    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
 255  struct berval *servercred = li ? li->servercred : NULL;
 256  DEBUGASSERT(li);
 257  if(!li)
 258    return CURLE_FAILED_INIT;
 259
 260  if(!servercred || !servercred->bv_val)
 261    return CURLE_WEIRD_SERVER_REPLY;
 262  Curl_bufref_set(out, servercred->bv_val, servercred->bv_len, NULL);
 263  return CURLE_OK;
 264}
 265
 266/*
 267 * Sends an initial SASL bind request to the server.
 268 */
 269static CURLcode oldap_perform_auth(struct Curl_easy *data, const char *mech,
 270                                   const struct bufref *initresp)
 271{
 272  struct connectdata *conn = data->conn;
 273  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 274  struct berval cred;
 275  struct berval *pcred = &cred;
 276  int rc;
 277
 278  DEBUGASSERT(li);
 279  if(!li)
 280    return CURLE_FAILED_INIT;
 281  cred.bv_val = (char *)CURL_UNCONST(Curl_bufref_ptr(initresp));
 282  cred.bv_len = Curl_bufref_len(initresp);
 283  if(!cred.bv_val)
 284    pcred = NULL;
 285  rc = ldap_sasl_bind(li->ld, NULL, mech, pcred, NULL, NULL, &li->msgid);
 286  if(rc != LDAP_SUCCESS)
 287    return oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
 288  return CURLE_OK;
 289}
 290
 291/*
 292 * Sends SASL continuation.
 293 */
 294static CURLcode oldap_continue_auth(struct Curl_easy *data, const char *mech,
 295                                    const struct bufref *resp)
 296{
 297  struct connectdata *conn = data->conn;
 298  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 299  struct berval cred;
 300  struct berval *pcred = &cred;
 301  int rc;
 302
 303  if(!li)
 304    return CURLE_FAILED_INIT;
 305  cred.bv_val = (char *)CURL_UNCONST(Curl_bufref_ptr(resp));
 306  cred.bv_len = Curl_bufref_len(resp);
 307  if(!cred.bv_val)
 308    pcred = NULL;
 309  rc = ldap_sasl_bind(li->ld, NULL, mech, pcred, NULL, NULL, &li->msgid);
 310  if(rc != LDAP_SUCCESS)
 311    return oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
 312  return CURLE_OK;
 313}
 314
 315/*
 316 * Sends SASL bind cancellation.
 317 */
 318static CURLcode oldap_cancel_auth(struct Curl_easy *data, const char *mech)
 319{
 320  struct ldapconninfo *li =
 321    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
 322  int rc;
 323
 324  (void)mech;
 325  if(!li)
 326    return CURLE_FAILED_INIT;
 327  rc = ldap_sasl_bind(li->ld, NULL, LDAP_SASL_NULL, NULL, NULL, NULL,
 328                      &li->msgid);
 329  if(rc != LDAP_SUCCESS)
 330    return oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
 331  return CURLE_OK;
 332}
 333
 334/* Starts LDAP simple bind. */
 335static CURLcode oldap_perform_bind(struct Curl_easy *data, ldapstate newstate)
 336{
 337  struct connectdata *conn = data->conn;
 338  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 339  const char *binddn = NULL;
 340  struct berval passwd;
 341  int rc;
 342
 343  if(!li)
 344    return CURLE_FAILED_INIT;
 345  passwd.bv_val = NULL;
 346  passwd.bv_len = 0;
 347
 348  if(conn->creds) {
 349    binddn = Curl_creds_user(conn->creds);
 350    passwd.bv_val = CURL_UNCONST(Curl_creds_passwd(conn->creds));
 351    passwd.bv_len = strlen(passwd.bv_val);
 352  }
 353
 354  rc = ldap_sasl_bind(li->ld, binddn, LDAP_SASL_SIMPLE, &passwd,
 355                      NULL, NULL, &li->msgid);
 356  if(rc != LDAP_SUCCESS)
 357    return oldap_map_error(rc,
 358                           data->state.creds ?
 359                           CURLE_LOGIN_DENIED : CURLE_LDAP_CANNOT_BIND);
 360  oldap_state(data, li, newstate);
 361  return CURLE_OK;
 362}
 363
 364/* Query the supported SASL authentication mechanisms. */
 365static CURLcode oldap_perform_mechs(struct Curl_easy *data)
 366{
 367  struct ldapconninfo *li =
 368    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
 369  int rc;
 370  static const char * const supportedSASLMechanisms[] = {
 371    "supportedSASLMechanisms",
 372    NULL
 373  };
 374
 375  if(!li)
 376    return CURLE_FAILED_INIT;
 377  /* Casting away the const for the 3rd parameter that the LDAP API expects as
 378     a non-const char ** is potentially unsafe but we believe the lack of
 379     const in the API was an oversight and that no LDAP implementation
 380     actually modifies the input. */
 381  rc = ldap_search_ext(li->ld, "", LDAP_SCOPE_BASE, "(objectclass=*)",
 382                       (char **)CURL_UNCONST(supportedSASLMechanisms), 0,
 383                       NULL, NULL, NULL, 0, &li->msgid);
 384  if(rc != LDAP_SUCCESS)
 385    return oldap_map_error(rc, CURLE_LOGIN_DENIED);
 386  oldap_state(data, li, OLDAP_MECHS);
 387  return CURLE_OK;
 388}
 389
 390/* Starts SASL bind. */
 391static CURLcode oldap_perform_sasl(struct Curl_easy *data)
 392{
 393  struct ldapconninfo *li =
 394    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
 395  saslprogress progress = SASL_IDLE;
 396  CURLcode result;
 397
 398  if(!li)
 399    return CURLE_FAILED_INIT;
 400  result = Curl_sasl_start(&li->sasl, data, TRUE, &progress);
 401
 402  oldap_state(data, li, OLDAP_SASL);
 403  if(!result && progress != SASL_INPROGRESS)
 404    result = Curl_sasl_is_blocked(&li->sasl, data);
 405  return result;
 406}
 407
 408#ifdef USE_SSL
 409static int ldapsb_tls_setup(Sockbuf_IO_Desc *sbiod, void *arg)
 410{
 411  sbiod->sbiod_pvt = arg;
 412  return 0;
 413}
 414
 415static int ldapsb_tls_remove(Sockbuf_IO_Desc *sbiod)
 416{
 417  sbiod->sbiod_pvt = NULL;
 418  return 0;
 419}
 420
 421/* We do not need to do anything because libcurl does it already */
 422static int ldapsb_tls_close(Sockbuf_IO_Desc *sbiod)
 423{
 424  (void)sbiod;
 425  return 0;
 426}
 427
 428static int ldapsb_tls_ctrl(Sockbuf_IO_Desc *sbiod, int opt, void *arg)
 429{
 430  (void)arg;
 431  if(opt == LBER_SB_OPT_DATA_READY) {
 432    struct Curl_easy *data = sbiod->sbiod_pvt;
 433    return Curl_conn_data_pending(data, FIRSTSOCKET);
 434  }
 435  return 0;
 436}
 437
 438static ber_slen_t ldapsb_tls_read(Sockbuf_IO_Desc *sbiod, void *buf,
 439                                  ber_len_t len)
 440{
 441  struct Curl_easy *data = sbiod->sbiod_pvt;
 442  ber_slen_t ret = 0;
 443  if(data) {
 444    struct connectdata *conn = data->conn;
 445    if(conn) {
 446      struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 447      CURLcode result = CURLE_RECV_ERROR;
 448      size_t nread;
 449
 450      if(!li) {
 451        SET_SOCKERRNO(SOCKEINVAL);
 452        return -1;
 453      }
 454      result = (li->recv)(data, FIRSTSOCKET, buf, len, &nread);
 455      if(result == CURLE_AGAIN) {
 456        SET_SOCKERRNO(SOCKEWOULDBLOCK);
 457      }
 458      ret = result ? -1 : (ber_slen_t)nread;
 459    }
 460  }
 461  return ret;
 462}
 463
 464static ber_slen_t ldapsb_tls_write(Sockbuf_IO_Desc *sbiod, void *buf,
 465                                   ber_len_t len)
 466{
 467  struct Curl_easy *data = sbiod->sbiod_pvt;
 468  ber_slen_t ret = 0;
 469  if(data) {
 470    struct connectdata *conn = data->conn;
 471    if(conn) {
 472      struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 473      CURLcode result = CURLE_SEND_ERROR;
 474      size_t nwritten;
 475
 476      if(!li) {
 477        SET_SOCKERRNO(SOCKEINVAL);
 478        return -1;
 479      }
 480      result = (li->send)(data, FIRSTSOCKET, buf, len, FALSE, &nwritten);
 481      if(result == CURLE_AGAIN) {
 482        SET_SOCKERRNO(SOCKEWOULDBLOCK);
 483      }
 484      ret = result ? -1 : (ber_slen_t)nwritten;
 485    }
 486  }
 487  return ret;
 488}
 489
 490static Sockbuf_IO ldapsb_tls = {
 491  ldapsb_tls_setup,
 492  ldapsb_tls_remove,
 493  ldapsb_tls_ctrl,
 494  ldapsb_tls_read,
 495  ldapsb_tls_write,
 496  ldapsb_tls_close
 497};
 498
 499static bool ssl_installed(struct connectdata *conn)
 500{
 501  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 502  return li && li->recv != NULL;
 503}
 504
 505static CURLcode oldap_ssl_connect(struct Curl_easy *data, ldapstate newstate)
 506{
 507  struct connectdata *conn = data->conn;
 508  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 509  bool ssldone = FALSE;
 510  CURLcode result;
 511
 512  if(!li)
 513    return CURLE_FAILED_INIT;
 514  result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
 515  if(result)
 516    return result;
 517  oldap_state(data, li, newstate);
 518
 519  if(ssldone) {
 520    Sockbuf *sb;
 521
 522    /* Install the libcurl SSL handlers into the sockbuf. */
 523    if((ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS) ||
 524       ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data))
 525      return CURLE_FAILED_INIT;
 526    li->recv = conn->recv[FIRSTSOCKET];
 527    li->send = conn->send[FIRSTSOCKET];
 528  }
 529
 530  return result;
 531}
 532
 533/* Send the STARTTLS request */
 534static CURLcode oldap_perform_starttls(struct Curl_easy *data)
 535{
 536  struct ldapconninfo *li =
 537    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
 538  int rc;
 539
 540  if(!li)
 541    return CURLE_FAILED_INIT;
 542  rc = ldap_start_tls(li->ld, NULL, NULL, &li->msgid);
 543  if(rc != LDAP_SUCCESS)
 544    return oldap_map_error(rc, CURLE_USE_SSL_FAILED);
 545  oldap_state(data, li, OLDAP_STARTTLS);
 546  return CURLE_OK;
 547}
 548#endif
 549
 550static void oldap_easy_dtor(void *key, size_t klen, void *entry)
 551{
 552  struct ldapreqinfo *lr = entry;
 553  (void)key;
 554  (void)klen;
 555  curlx_free(lr);
 556}
 557
 558static void oldap_conn_dtor(void *key, size_t klen, void *entry)
 559{
 560  struct ldapconninfo *li = entry;
 561  (void)key;
 562  (void)klen;
 563  if(li->ld) {
 564    ldap_unbind_ext(li->ld, NULL, NULL);
 565    li->ld = NULL;
 566  }
 567  curlx_free(li);
 568}
 569
 570/* SASL parameters for the ldap protocol */
 571static const struct SASLproto saslldap = {
 572  "ldap",                     /* The service name */
 573  oldap_perform_auth,         /* Send authentication command */
 574  oldap_continue_auth,        /* Send authentication continuation */
 575  oldap_cancel_auth,          /* Send authentication cancellation */
 576  oldap_get_message,          /* Get SASL response message */
 577  0,                          /* Maximum initial response length (no max) */
 578  LDAP_SASL_BIND_IN_PROGRESS, /* Code received when continuation is expected */
 579  LDAP_SUCCESS,               /* Code to receive upon authentication success */
 580  SASL_AUTH_NONE,             /* Default mechanisms */
 581  0                           /* Configuration flags */
 582};
 583
 584static CURLcode oldap_connect(struct Curl_easy *data, bool *done)
 585{
 586  struct connectdata *conn = data->conn;
 587  struct ldapconninfo *li;
 588  static const int version = LDAP_VERSION3;
 589  char *hosturl = NULL;
 590  CURLcode result;
 591  int rc;
 592#ifdef CURL_OPENLDAP_DEBUG
 593  static int do_trace = -1;
 594#endif
 595
 596  (void)done;
 597
 598  li = curlx_calloc(1, sizeof(struct ldapconninfo));
 599  if(!li) {
 600    result = CURLE_OUT_OF_MEMORY;
 601    goto out;
 602  }
 603
 604  result = Curl_conn_meta_set(conn, CURL_META_LDAP_CONN, li, oldap_conn_dtor);
 605  if(result)
 606    goto out;
 607
 608  li->proto = ldap_pvt_url_scheme2proto(data->state.up.scheme);
 609
 610  /* Initialize the SASL storage */
 611  Curl_sasl_init(&li->sasl, data, &saslldap);
 612
 613  result = oldap_parse_login_options(conn);
 614  if(result)
 615    goto out;
 616
 617  hosturl = curl_maprintf("%s://%s:%d",
 618                          conn->scheme->name,
 619                          (data->state.up.hostname[0] == '[') ?
 620                          data->state.up.hostname : conn->origin->hostname,
 621                          conn->origin->port);
 622  if(!hosturl) {
 623    result = CURLE_OUT_OF_MEMORY;
 624    goto out;
 625  }
 626
 627  rc = ldap_init_fd(conn->sock[FIRSTSOCKET], li->proto, hosturl, &li->ld);
 628  if(rc) {
 629    failf(data, "LDAP local: Cannot connect to %s, %s",
 630          hosturl, ldap_err2string(rc));
 631    result = CURLE_COULDNT_CONNECT;
 632    goto out;
 633  }
 634
 635#ifdef CURL_OPENLDAP_DEBUG
 636  if(do_trace < 0) {
 637    const char *env = getenv("CURL_OPENLDAP_TRACE");
 638    curl_off_t e = 0;
 639    if(!curlx_str_number(&env, &e, INT_MAX))
 640      do_trace = e > 0;
 641  }
 642  if(do_trace)
 643    ldap_set_option(li->ld, LDAP_OPT_DEBUG_LEVEL, &do_trace);
 644#endif
 645
 646  /* Try version 3 first. */
 647  ldap_set_option(li->ld, LDAP_OPT_PROTOCOL_VERSION, &version);
 648
 649  /* Do not chase referrals. */
 650  ldap_set_option(li->ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
 651
 652  {
 653    ber_len_t max = 256 * 1024;
 654    Sockbuf *sb;
 655    if((ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS) ||
 656       /* Set the maximum allowed size of an incoming message, which to
 657          OpenLDAP means that it will malloc() memory up to this size. If not
 658          set, there is no limit and we instead risk a malloc() failure. */
 659       !ber_sockbuf_ctrl(sb, LBER_SB_OPT_SET_MAX_INCOMING, &max)) {
 660      result = CURLE_FAILED_INIT;
 661      goto out;
 662    }
 663  }
 664
 665#ifdef USE_SSL
 666  if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
 667    result = oldap_ssl_connect(data, OLDAP_SSL);
 668    goto out;
 669  }
 670
 671  if(data->set.use_ssl) {
 672    result = oldap_perform_starttls(data);
 673    if(!result || data->set.use_ssl != CURLUSESSL_TRY)
 674      goto out;
 675  }
 676#endif
 677
 678  if(li->sasl.prefmech != SASL_AUTH_NONE) {
 679    result = oldap_perform_mechs(data);
 680    goto out;
 681  }
 682
 683  /* Force bind even if anonymous bind is not needed in protocol version 3
 684     to detect missing version 3 support. */
 685  result = oldap_perform_bind(data, OLDAP_BIND);
 686
 687out:
 688  curlx_free(hosturl);
 689  return result;
 690}
 691
 692/* Handle the supported SASL mechanisms query response */
 693static CURLcode oldap_state_mechs_resp(struct Curl_easy *data,
 694                                       LDAPMessage *msg, int code)
 695{
 696  struct connectdata *conn;
 697  struct ldapconninfo *li;
 698  int rc;
 699  BerElement *ber = NULL;
 700  CURLcode result = CURLE_OK;
 701  struct berval bv, *bvals;
 702
 703  if(!data)
 704    return CURLE_FAILED_INIT;
 705
 706  conn = data->conn;
 707  li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 708
 709  if(!li)
 710    return CURLE_FAILED_INIT;
 711  switch(ldap_msgtype(msg)) {
 712  case LDAP_RES_SEARCH_ENTRY:
 713    /* Got a list of supported SASL mechanisms. */
 714    if(code != LDAP_SUCCESS && code != LDAP_NO_RESULTS_RETURNED)
 715      return CURLE_LOGIN_DENIED;
 716
 717    rc = ldap_get_dn_ber(li->ld, msg, &ber, &bv);
 718    if(rc < 0)
 719      return oldap_map_error(rc, CURLE_BAD_CONTENT_ENCODING);
 720    for(rc = ldap_get_attribute_ber(li->ld, msg, ber, &bv, &bvals);
 721        rc == LDAP_SUCCESS;
 722        rc = ldap_get_attribute_ber(li->ld, msg, ber, &bv, &bvals)) {
 723      int i;
 724
 725      if(!bv.bv_val)
 726        break;
 727
 728      if(bvals) {
 729        for(i = 0; bvals[i].bv_val; i++) {
 730          size_t llen;
 731          unsigned short mech =
 732            Curl_sasl_decode_mech((const char *)bvals[i].bv_val,
 733                                  bvals[i].bv_len, &llen);
 734          if(bvals[i].bv_len == llen)
 735            li->sasl.authmechs |= mech;
 736        }
 737        ber_memfree(bvals);
 738      }
 739    }
 740    ber_free(ber, 0);
 741    break;
 742
 743  case LDAP_RES_SEARCH_RESULT:
 744    switch(code) {
 745    case LDAP_SIZELIMIT_EXCEEDED:
 746      infof(data, "Too many authentication mechanisms");
 747      FALLTHROUGH();
 748    case LDAP_SUCCESS:
 749    case LDAP_NO_RESULTS_RETURNED:
 750      if(Curl_sasl_can_authenticate(&li->sasl, data))
 751        result = oldap_perform_sasl(data);
 752      else
 753        result = CURLE_LOGIN_DENIED;
 754      break;
 755    default:
 756      result = oldap_map_error(code, CURLE_LOGIN_DENIED);
 757      break;
 758    }
 759    break;
 760  default:
 761    break;
 762  }
 763  return result;
 764}
 765
 766/* Handle a SASL bind response. */
 767static CURLcode oldap_state_sasl_resp(struct Curl_easy *data,
 768                                      LDAPMessage *msg, int code)
 769{
 770  struct connectdata *conn = data->conn;
 771  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 772  CURLcode result = CURLE_OK;
 773  saslprogress progress;
 774  int rc;
 775
 776  if(!li)
 777    return CURLE_FAILED_INIT;
 778  li->servercred = NULL;
 779  rc = ldap_parse_sasl_bind_result(li->ld, msg, &li->servercred, 0);
 780  if(rc != LDAP_SUCCESS) {
 781    failf(data, "LDAP local: sasl ldap_parse_result %s", ldap_err2string(rc));
 782    result = oldap_map_error(rc, CURLE_LOGIN_DENIED);
 783  }
 784  else {
 785    result = Curl_sasl_continue(&li->sasl, data, code, &progress);
 786    if(!result && progress != SASL_INPROGRESS)
 787      oldap_state(data, li, OLDAP_STOP);
 788  }
 789
 790  if(li->servercred)
 791    ber_bvfree(li->servercred);
 792  return result;
 793}
 794
 795/* Handle a simple bind response. */
 796static CURLcode oldap_state_bind_resp(struct Curl_easy *data, LDAPMessage *msg,
 797                                      int code)
 798{
 799  struct connectdata *conn = data->conn;
 800  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 801  CURLcode result = CURLE_OK;
 802  struct berval *bv = NULL;
 803  int rc;
 804
 805  if(!li)
 806    return CURLE_FAILED_INIT;
 807
 808  if(code != LDAP_SUCCESS)
 809    return oldap_map_error(code, CURLE_LDAP_CANNOT_BIND);
 810
 811  rc = ldap_parse_sasl_bind_result(li->ld, msg, &bv, 0);
 812  if(rc != LDAP_SUCCESS) {
 813    failf(data, "LDAP local: bind ldap_parse_sasl_bind_result %s",
 814          ldap_err2string(rc));
 815    result = oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
 816  }
 817  else
 818    oldap_state(data, li, OLDAP_STOP);
 819
 820  if(bv)
 821    ber_bvfree(bv);
 822  return result;
 823}
 824
 825static CURLcode oldap_connecting(struct Curl_easy *data, bool *done)
 826{
 827  CURLcode result = CURLE_OK;
 828  struct connectdata *conn = data->conn;
 829  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 830  LDAPMessage *msg = NULL;
 831  struct timeval tv = { 0, 0 };
 832  int code = LDAP_SUCCESS;
 833  int rc;
 834
 835  if(!li)
 836    return CURLE_FAILED_INIT;
 837
 838  if(li->state != OLDAP_SSL && li->state != OLDAP_TLS) {
 839    /* Get response to last command. */
 840    rc = ldap_result(li->ld, li->msgid, LDAP_MSG_ONE, &tv, &msg);
 841    switch(rc) {
 842    case 0:                               /* Timed out. */
 843      return CURLE_OK;
 844    case LDAP_RES_SEARCH_ENTRY:
 845    case LDAP_RES_SEARCH_REFERENCE:
 846      break;
 847    default:
 848      li->msgid = 0;                      /* Nothing to abandon upon error. */
 849      if(rc < 0) {
 850        failf(data, "LDAP local: connecting ldap_result %s",
 851              ldap_err2string(rc));
 852        return oldap_map_error(rc, CURLE_COULDNT_CONNECT);
 853      }
 854      break;
 855    }
 856
 857    /* Get error code from message. */
 858    rc = ldap_parse_result(li->ld, msg, &code, NULL, NULL, NULL, NULL, 0);
 859    if(rc)
 860      code = rc;
 861    else {
 862      /* store the latest code for later retrieval */
 863      data->info.httpcode = code;
 864    }
 865
 866    /* If protocol version 3 is not supported, fallback to version 2. */
 867    if(code == LDAP_PROTOCOL_ERROR && li->state != OLDAP_BINDV2 &&
 868#ifdef USE_SSL
 869       (ssl_installed(conn) || data->set.use_ssl <= CURLUSESSL_TRY) &&
 870#endif
 871       li->sasl.prefmech == SASL_AUTH_NONE) {
 872      static const int version = LDAP_VERSION2;
 873
 874      ldap_set_option(li->ld, LDAP_OPT_PROTOCOL_VERSION, &version);
 875      ldap_msgfree(msg);
 876      return oldap_perform_bind(data, OLDAP_BINDV2);
 877    }
 878  }
 879
 880  /* Handle response message according to current state. */
 881  switch(li->state) {
 882
 883#ifdef USE_SSL
 884  case OLDAP_SSL:
 885    result = oldap_ssl_connect(data, OLDAP_SSL);
 886    if(!result && ssl_installed(conn)) {
 887      if(li->sasl.prefmech != SASL_AUTH_NONE)
 888        result = oldap_perform_mechs(data);
 889      else
 890        result = oldap_perform_bind(data, OLDAP_BIND);
 891    }
 892    break;
 893  case OLDAP_STARTTLS:
 894    if(code != LDAP_SUCCESS) {
 895      if(data->set.use_ssl != CURLUSESSL_TRY)
 896        result = oldap_map_error(code, CURLE_USE_SSL_FAILED);
 897      else if(li->sasl.prefmech != SASL_AUTH_NONE)
 898        result = oldap_perform_mechs(data);
 899      else
 900        result = oldap_perform_bind(data, OLDAP_BIND);
 901      break;
 902    }
 903    result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
 904    if(result)
 905      break;
 906    FALLTHROUGH();
 907  case OLDAP_TLS:
 908    result = oldap_ssl_connect(data, OLDAP_TLS);
 909    if(result)
 910      result = oldap_map_error(code, CURLE_USE_SSL_FAILED);
 911    else if(ssl_installed(conn)) {
 912      if(li->sasl.prefmech != SASL_AUTH_NONE)
 913        result = oldap_perform_mechs(data);
 914      else if(data->state.creds)
 915        result = oldap_perform_bind(data, OLDAP_BIND);
 916      else {
 917        /* Version 3 supported: no bind required */
 918        oldap_state(data, li, OLDAP_STOP);
 919        result = CURLE_OK;
 920      }
 921    }
 922    break;
 923#endif
 924
 925  case OLDAP_MECHS:
 926    result = oldap_state_mechs_resp(data, msg, code);
 927    break;
 928  case OLDAP_SASL:
 929    result = oldap_state_sasl_resp(data, msg, code);
 930    break;
 931  case OLDAP_BIND:
 932  case OLDAP_BINDV2:
 933    result = oldap_state_bind_resp(data, msg, code);
 934    break;
 935  default:
 936    /* internal error */
 937    result = CURLE_COULDNT_CONNECT;
 938    break;
 939  }
 940
 941  ldap_msgfree(msg);
 942
 943  *done = li->state == OLDAP_STOP;
 944  if(*done)
 945    conn->recv[FIRSTSOCKET] = oldap_recv;
 946
 947  if(result && li->msgid) {
 948    ldap_abandon_ext(li->ld, li->msgid, NULL, NULL);
 949    li->msgid = 0;
 950  }
 951  return result;
 952}
 953
 954static CURLcode oldap_disconnect(struct Curl_easy *data,
 955                                 struct connectdata *conn,
 956                                 bool dead_connection)
 957{
 958  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 959  (void)dead_connection;
 960#ifndef USE_SSL
 961  (void)data;
 962#endif
 963
 964  if(li && li->ld) {
 965#ifdef USE_SSL
 966    if(ssl_installed(conn)) {
 967      Sockbuf *sb;
 968      if(ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS ||
 969         ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data))
 970        return CURLE_FAILED_INIT;
 971    }
 972#endif
 973    ldap_unbind_ext(li->ld, NULL, NULL);
 974    li->ld = NULL;
 975  }
 976  return CURLE_OK;
 977}
 978
 979static CURLcode oldap_do(struct Curl_easy *data, bool *done)
 980{
 981  struct connectdata *conn = data->conn;
 982  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
 983  struct ldapreqinfo *lr;
 984  CURLcode result;
 985  int rc;
 986  LDAPURLDesc *lud;
 987  int msgid;
 988
 989  if(!li)
 990    return CURLE_FAILED_INIT;
 991
 992  infof(data, "LDAP local: %s", Curl_bufref_ptr(&data->state.url));
 993
 994  result = oldap_url_parse(data, &lud);
 995  if(result)
 996    goto out;
 997
 998#ifdef USE_SSL
 999  if(ssl_installed(conn)) {
1000    Sockbuf *sb;
1001    /* re-install the libcurl SSL handlers into the sockbuf. */
1002    if((ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS) ||
1003       ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data)) {
1004      ldap_free_urldesc(lud);
1005      return CURLE_FAILED_INIT;
1006    }
1007  }
1008#endif
1009
1010  rc = ldap_search_ext(li->ld, lud->lud_dn, lud->lud_scope,
1011                       lud->lud_filter, lud->lud_attrs, 0,
1012                       NULL, NULL, NULL, 0, &msgid);
1013  ldap_free_urldesc(lud);
1014  if(rc != LDAP_SUCCESS) {
1015    failf(data, "LDAP local: ldap_search_ext %s", ldap_err2string(rc));
1016    result = CURLE_LDAP_SEARCH_FAILED;
1017    goto out;
1018  }
1019
1020  lr = curlx_calloc(1, sizeof(struct ldapreqinfo));
1021  if(!lr ||
1022     Curl_meta_set(data, CURL_META_LDAP_EASY, lr, oldap_easy_dtor)) {
1023    ldap_abandon_ext(li->ld, msgid, NULL, NULL);
1024    result = CURLE_OUT_OF_MEMORY;
1025    goto out;
1026  }
1027
1028  lr->msgid = msgid;
1029  Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
1030  *done = TRUE;
1031
1032out:
1033  return result;
1034}
1035
1036static CURLcode oldap_done(struct Curl_easy *data, CURLcode res,
1037                           bool premature)
1038{
1039  struct connectdata *conn = data->conn;
1040  struct ldapreqinfo *lr = Curl_meta_get(data, CURL_META_LDAP_EASY);
1041
1042  (void)res;
1043  (void)premature;
1044
1045  if(lr) {
1046    /* if there was a search in progress, abandon it */
1047    if(lr->msgid) {
1048      struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
1049      if(li && li->ld) {
1050        ldap_abandon_ext(li->ld, lr->msgid, NULL, NULL);
1051      }
1052      lr->msgid = 0;
1053    }
1054    Curl_meta_remove(data, CURL_META_LDAP_EASY);
1055  }
1056
1057  return CURLE_OK;
1058}
1059
1060static CURLcode client_write(struct Curl_easy *data,
1061                             const char *prefix, size_t plen,
1062                             const char *value, size_t len,
1063                             const char *suffix, size_t slen)
1064{
1065  CURLcode result = CURLE_OK;
1066
1067  if(prefix) {
1068    /* If we have a zero-length value and the prefix ends with a space
1069       separator, drop the latter. */
1070    if(!len && plen && prefix[plen - 1] == ' ')
1071      plen--;
1072    result = Curl_client_write(data, CLIENTWRITE_BODY, prefix, plen);
1073  }
1074  if(!result && value) {
1075    result = Curl_client_write(data, CLIENTWRITE_BODY, value, len);
1076  }
1077  if(!result && suffix) {
1078    result = Curl_client_write(data, CLIENTWRITE_BODY, suffix, slen);
1079  }
1080  return result;
1081}
1082
1083static CURLcode oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
1084                           size_t len, size_t *pnread)
1085{
1086  struct connectdata *conn = data->conn;
1087  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
1088  struct ldapreqinfo *lr = Curl_meta_get(data, CURL_META_LDAP_EASY);
1089  int rc;
1090  LDAPMessage *msg = NULL;
1091  BerElement *ber = NULL;
1092  struct timeval tv = { 0, 0 };
1093  struct berval bv, *bvals;
1094  CURLcode result = CURLE_AGAIN;
1095  int code;
1096  char *info = NULL;
1097
1098  (void)len;
1099  (void)buf;
1100  (void)sockindex;
1101  *pnread = 0;
1102  if(!li || !lr)
1103    return CURLE_FAILED_INIT;
1104
1105  rc = ldap_result(li->ld, lr->msgid, LDAP_MSG_ONE, &tv, &msg);
1106  if(rc < 0) {
1107    failf(data, "LDAP local: search ldap_result %s", ldap_err2string(rc));
1108    result = CURLE_RECV_ERROR;
1109  }
1110
1111  /* error or timed out */
1112  if(!msg)
1113    return result;
1114
1115  result = CURLE_OK;
1116
1117  switch(ldap_msgtype(msg)) {
1118  case LDAP_RES_SEARCH_RESULT:
1119    lr->msgid = 0;
1120    rc = ldap_parse_result(li->ld, msg, &code, NULL, &info, NULL, NULL, 0);
1121    if(rc) {
1122      failf(data, "LDAP local: search ldap_parse_result %s",
1123            ldap_err2string(rc));
1124      result = CURLE_LDAP_SEARCH_FAILED;
1125      break;
1126    }
1127
1128    /* store the latest code for later retrieval */
1129    data->info.httpcode = code;
1130
1131    switch(code) {
1132    case LDAP_SIZELIMIT_EXCEEDED:
1133      infof(data, "There are more than %d entries", lr->nument);
1134      FALLTHROUGH();
1135    case LDAP_SUCCESS:
1136      data->req.size = data->req.bytecount;
1137      break;
1138    default:
1139      failf(data, "LDAP remote: search failed %s %s", ldap_err2string(code),
1140            info ? info : "");
1141      result = CURLE_LDAP_SEARCH_FAILED;
1142      break;
1143    }
1144    if(info)
1145      ldap_memfree(info);
1146    break;
1147  case LDAP_RES_SEARCH_ENTRY:
1148    lr->nument++;
1149    rc = ldap_get_dn_ber(li->ld, msg, &ber, &bv);
1150    if(rc < 0) {
1151      result = CURLE_RECV_ERROR;
1152      break;
1153    }
1154
1155    result = client_write(data, STRCONST("DN: "), bv.bv_val, bv.bv_len,
1156                          STRCONST("\n"));
1157    if(result)
1158      break;
1159
1160    for(rc = ldap_get_attribute_ber(li->ld, msg, ber, &bv, &bvals);
1161        rc == LDAP_SUCCESS;
1162        rc = ldap_get_attribute_ber(li->ld, msg, ber, &bv, &bvals)) {
1163      int i;
1164      bool binary;
1165
1166      if(!bv.bv_val)
1167        break;
1168
1169      if(!bvals) {
1170        result = client_write(data, STRCONST("\t"), bv.bv_val, bv.bv_len,
1171                              STRCONST(":\n"));
1172        if(result)
1173          break;
1174        continue;
1175      }
1176
1177      binary = bv.bv_len > 7 &&
1178        curl_strnequal(bv.bv_val + bv.bv_len - 7, ";binary", 7);
1179
1180      for(i = 0; bvals[i].bv_val != NULL; i++) {
1181        bool binval = FALSE;
1182
1183        result = client_write(data, STRCONST("\t"), bv.bv_val, bv.bv_len,
1184                              STRCONST(":"));
1185        if(result)
1186          break;
1187
1188        if(!binary) {
1189          /* check for leading or trailing whitespace */
1190          if(bvals[i].bv_len &&
1191             (ISBLANK(bvals[i].bv_val[0]) ||
1192              ISBLANK(bvals[i].bv_val[bvals[i].bv_len - 1])))
1193            binval = TRUE;
1194          else {
1195            /* check for unprintable characters */
1196            unsigned int j;
1197            for(j = 0; j < bvals[i].bv_len; j++)
1198              if(!ISPRINT(bvals[i].bv_val[j])) {
1199                binval = TRUE;
1200                break;
1201              }
1202          }
1203        }
1204        if(binary || binval) {
1205          char *val_b64 = NULL;
1206          size_t val_b64_sz = 0;
1207
1208          /* Binary value, encode to base64. */
1209          if(bvals[i].bv_len)
1210            result = curlx_base64_encode((uint8_t *)bvals[i].bv_val,
1211                                         bvals[i].bv_len,
1212                                         &val_b64, &val_b64_sz);
1213          if(!result)
1214            result = client_write(data, STRCONST(": "), val_b64, val_b64_sz,
1215                                  STRCONST("\n"));
1216          curlx_free(val_b64);
1217        }
1218        else
1219          result = client_write(data, STRCONST(" "),
1220                                bvals[i].bv_val, bvals[i].bv_len,
1221                                STRCONST("\n"));
1222        if(result)
1223          break;
1224      }
1225
1226      ber_memfree(bvals);
1227      bvals = NULL;
1228      if(!result)
1229        result = client_write(data, STRCONST("\n"), NULL, 0, NULL, 0);
1230      if(result)
1231        break;
1232    }
1233
1234    if(!result)
1235      result = client_write(data, STRCONST("\n"), NULL, 0, NULL, 0);
1236    if(!result)
1237      result = CURLE_AGAIN;
1238    break;
1239  }
1240
1241  ber_free(ber, 0);
1242  ldap_msgfree(msg);
1243  return result;
1244}
1245
1246void Curl_ldap_version(char *buf, size_t bufsz)
1247{
1248  LDAPAPIInfo api;
1249  api.ldapai_info_version = LDAP_API_INFO_VERSION;
1250
1251  if(ldap_get_option(NULL, LDAP_OPT_API_INFO, &api) == LDAP_OPT_SUCCESS) {
1252    unsigned int patch = (unsigned int)(api.ldapai_vendor_version % 100);
1253    unsigned int major = (unsigned int)(api.ldapai_vendor_version / 10000);
1254    unsigned int minor =
1255      (((unsigned int)api.ldapai_vendor_version - (major * 10000))
1256       - patch) / 100;
1257    curl_msnprintf(buf, bufsz, "%s/%u.%u.%u",
1258                   api.ldapai_vendor_name, major, minor, patch);
1259    ldap_memfree(api.ldapai_vendor_name);
1260    ber_memvfree((void **)api.ldapai_extensions);
1261  }
1262  else
1263    curl_msnprintf(buf, bufsz, "OpenLDAP");
1264}
1265
1266/*
1267 * LDAP protocol handler.
1268 */
1269const struct Curl_protocol Curl_protocol_ldap = {
1270  oldap_setup_connection,               /* setup_connection */
1271  oldap_do,                             /* do_it */
1272  oldap_done,                           /* done */
1273  ZERO_NULL,                            /* do_more */
1274  oldap_connect,                        /* connect_it */
1275  oldap_connecting,                     /* connecting */
1276  ZERO_NULL,                            /* doing */
1277  ZERO_NULL,                            /* proto_pollset */
1278  ZERO_NULL,                            /* doing_pollset */
1279  ZERO_NULL,                            /* domore_pollset */
1280  ZERO_NULL,                            /* perform_pollset */
1281  oldap_disconnect,                     /* disconnect */
1282  ZERO_NULL,                            /* write_resp */
1283  ZERO_NULL,                            /* write_resp_hd */
1284  ZERO_NULL,                            /* connection_is_dead */
1285  ZERO_NULL,                            /* attach connection */
1286  ZERO_NULL,                            /* follow */
1287};
1288
1289#endif /* !CURL_DISABLE_LDAP && USE_OPENLDAP */
1290
1291/* The LDAP scheme structs are in ldap.c */