1 files changed, 121 insertions, 143 deletions

diff --git a/crypto/heimdal/lib/hdb/hdb-ldap.c b/crypto/heimdal/lib/hdb/hdb-ldap.c
index db321cb..a92285c 100644
--- a/crypto/heimdal/lib/hdb/hdb-ldap.c
+++ b/crypto/heimdal/lib/hdb/hdb-ldap.c
@@ -32,7 +32,7 @@
 
 #include "hdb_locl.h"
 
-RCSID("$Id: hdb-ldap.c,v 1.8 2001/03/26 00:59:37 assar Exp $");
+RCSID("$Id: hdb-ldap.c,v 1.9 2001/08/31 18:19:49 joda Exp $");
 
 #ifdef OPENLDAP
 
@@ -335,6 +335,7 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry * ent,
     if (ent->kvno != orig.kvno) {
 	rc = asprintf(&tmp, "%d", ent->kvno);
 	if (rc < 0) {
+	    krb5_set_error_string(context, "asprintf: out of memory");
 	    ret = ENOMEM;
 	    goto out;
 	}
@@ -390,6 +391,7 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry * ent,
 	    || (*(ent->max_life) != *(orig.max_life))) {
 	    rc = asprintf(&tmp, "%d", *(ent->max_life));
 	    if (rc < 0) {
+		krb5_set_error_string(context, "asprintf: out of memory");
 		ret = ENOMEM;
 		goto out;
 	    }
@@ -406,6 +408,7 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry * ent,
 	    || (*(ent->max_renew) != *(orig.max_renew))) {
 	    rc = asprintf(&tmp, "%d", *(ent->max_renew));
 	    if (rc < 0) {
+		krb5_set_error_string(context, "asprintf: out of memory");
 		ret = ENOMEM;
 		goto out;
 	    }
@@ -426,6 +429,7 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry * ent,
     if (memcmp(&oflags, &nflags, sizeof(HDBFlags))) {
 	rc = asprintf(&tmp, "%lu", nflags);
 	if (rc < 0) {
+	    krb5_set_error_string(context, "asprintf: out of memory");
 	    ret = ENOMEM;
 	    goto out;
 	}
@@ -457,6 +461,7 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry * ent,
 	len = length_Key(&new);
 	buf = malloc(len);
 	if (buf == NULL) {
+	    krb5_set_error_string(context, "malloc: out of memory");
 	    ret = ENOMEM;
 	    free_Key(&new);
 	    goto out;
@@ -487,6 +492,7 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry * ent,
 	for (i = 0; i < ent->etypes->len; i++) {
 	    rc = asprintf(&tmp, "%d", ent->etypes->val[i]);
 	    if (rc < 0) {
+		krb5_set_error_string(context, "asprintf: out of memory");
 		ret = ENOMEM;
 		goto out;
 	    }
@@ -524,17 +530,22 @@ LDAP_dn2principal(krb5_context context, HDB * db, const char *dn,
 		  krb5_principal * principal)
 {
     krb5_error_code ret;
-    int rc;
+    int rc, limit = 1;
     char **values;
     LDAPMessage *res = NULL, *e;
 
-    rc = 1;
-    (void) ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, &rc);
-    rc = ldap_search_s((LDAP *) db->db, db->name, LDAP_SCOPE_BASE,
+    rc = ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, (const void *)&limit);
+    if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_set_option: %s", ldap_err2string(rc));
+	ret = HDB_ERR_BADVERSION;
+	goto out;
+     }
+
+    rc = ldap_search_s((LDAP *) db->db, dn, LDAP_SCOPE_BASE,
 		       "(objectclass=krb5Principal)", krb5principal_attrs,
 		       0, &res);
-
     if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_search_s: %s", ldap_err2string(rc));
 	ret = HDB_ERR_NOENTRY;
 	goto out;
     }
@@ -566,7 +577,7 @@ LDAP__lookup_princ(krb5_context context, HDB * db, const char *princname,
 		   LDAPMessage ** msg)
 {
     krb5_error_code ret;
-    int rc;
+    int rc, limit = 1;
     char *filter = NULL;
 
     (void) LDAP__connect(context, db);
@@ -576,16 +587,22 @@ LDAP__lookup_princ(krb5_context context, HDB * db, const char *princname,
 		 "(&(objectclass=krb5KDCEntry)(krb5PrincipalName=%s))",
 		 princname);
     if (rc < 0) {
+	krb5_set_error_string(context, "asprintf: out of memory");
 	ret = ENOMEM;
 	goto out;
     }
 
-    rc = 1;
-    (void) ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, (void *) &rc);
+    rc = ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, (const void *)&limit);
+    if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_set_option: %s", ldap_err2string(rc));
+	ret = HDB_ERR_BADVERSION;
+	goto out;
+    }
 
     rc = ldap_search_s((LDAP *) db->db, db->name, LDAP_SCOPE_ONELEVEL, filter, 
 		       krb5kdcentry_attrs, 0, msg);
     if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_search_s: %s", ldap_err2string(rc));
 	ret = HDB_ERR_NOENTRY;
 	goto out;
     }
@@ -659,6 +676,11 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
 	ent->keys.len = ldap_count_values_len(keys);
 	ent->keys.val = (Key *) calloc(ent->keys.len, sizeof(Key));
+	if (ent->keys.val == NULL) {
+	    krb5_set_error_string(context, "calloc: out of memory");
+	    ret = ENOMEM;
+	    goto out;
+	}
 	for (i = 0; i < ent->keys.len; i++) {
 	    decode_Key((unsigned char *) keys[i]->bv_val,
 		       (size_t) keys[i]->bv_len, &ent->keys.val[i], &l);
@@ -699,6 +721,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
     ent->modified_by = (Event *) malloc(sizeof(Event));
     if (ent->modified_by == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	ret = ENOMEM;
 	goto out;
     }
@@ -719,6 +742,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
     if ((ent->valid_start = (KerberosTime *) malloc(sizeof(KerberosTime)))
 	== NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	ret = ENOMEM;
 	goto out;
     }
@@ -732,7 +756,9 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     }
 
     if ((ent->valid_end = (KerberosTime *) malloc(sizeof(KerberosTime))) ==
-	NULL) {ret = ENOMEM;
+	NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
+	ret = ENOMEM;
 	goto out;
     }
     ret =
@@ -745,7 +771,9 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     }
 
     if ((ent->pw_end = (KerberosTime *) malloc(sizeof(KerberosTime))) ==
-	NULL) {ret = ENOMEM;
+	NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
+	ret = ENOMEM;
 	goto out;
     }
     ret =
@@ -759,6 +787,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
     ent->max_life = (int *) malloc(sizeof(int));
     if (ent->max_life == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	ret = ENOMEM;
 	goto out;
     }
@@ -770,6 +799,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
     ent->max_renew = (int *) malloc(sizeof(int));
     if (ent->max_renew == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	ret = ENOMEM;
 	goto out;
     }
@@ -783,6 +813,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     if (values != NULL) {
 	tmp = strtoul(values[0], (char **) NULL, 10);
 	if (tmp == ULONG_MAX && errno == ERANGE) {
+	    krb5_set_error_string(context, "strtoul: could not convert flag");
 	    ret = ERANGE;
 	    goto out;
 	}
@@ -797,6 +828,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
 	ent->etypes = malloc(sizeof(*(ent->etypes)));
 	if (ent->etypes == NULL) {
+	    krb5_set_error_string(context, "malloc: out of memory");
 	    ret = ENOMEM;
 	    goto out;
 	}
@@ -825,10 +857,9 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
 static krb5_error_code LDAP_close(krb5_context context, HDB * db)
 {
-    LDAP *ld = (LDAP *) db->db;
-
-    ldap_unbind(ld);
+    ldap_unbind_ext((LDAP *) db->db, NULL, NULL);
     db->db = NULL;
+
     return 0;
 }
 
@@ -870,6 +901,7 @@ LDAP_seq(krb5_context context, HDB * db, unsigned flags, hdb_entry * entry)
 				  NULL, NULL, 1);
 	    if (parserc != LDAP_SUCCESS
 		&& parserc != LDAP_MORE_RESULTS_TO_RETURN) {
+	        krb5_set_error_string(context, "ldap_parse_result: %s", ldap_err2string(parserc));
 		ldap_abandon((LDAP *) db->db, msgid);
 	    }
 	    ret = HDB_ERR_NOENTRY;
@@ -902,12 +934,15 @@ static krb5_error_code
 LDAP_firstkey(krb5_context context, HDB * db, unsigned flags,
 	      hdb_entry * entry)
 {
-    int msgid;
+    int msgid, limit = LDAP_NO_LIMIT, rc;
 
     (void) LDAP__connect(context, db);
 
-    msgid = LDAP_NO_LIMIT;
-    (void) ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, &msgid);
+    rc = ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, (const void *)&limit);
+    if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_set_option: %s", ldap_err2string(rc));
+	return HDB_ERR_BADVERSION;
+    }
 
     msgid = ldap_search((LDAP *) db->db, db->name,
 			LDAP_SCOPE_ONELEVEL, "(objectclass=krb5KDCEntry)",
@@ -934,33 +969,9 @@ LDAP_rename(krb5_context context, HDB * db, const char *new_name)
     return HDB_ERR_DB_INUSE;
 }
 
-static krb5_boolean LDAP__is_user_namingcontext(const char *ctx,
-						char *const *subschema)
-{
-    char *const *p;
-
-    if (!strcasecmp(ctx, "CN=MONITOR")
-	|| !strcasecmp(ctx, "CN=CONFIG")) {
-	return FALSE;
-    }
-
-    if (subschema != NULL) {
-	for (p = subschema; *p != NULL; p++) {
-	    if (!strcasecmp(ctx, *p)) {
-		return FALSE;
-	    }
-	}
-    }
-
-    return TRUE;
-}
-
 static krb5_error_code LDAP__connect(krb5_context context, HDB * db)
 {
-    int rc;
-    krb5_error_code ret;
-    char *attrs[] = { "namingContexts", "subschemaSubentry", NULL };
-    LDAPMessage *res = NULL, *e;
+    int rc, version = LDAP_VERSION3;
 
     if (db->db != NULL) {
 	/* connection has been opened. ping server. */
@@ -982,111 +993,38 @@ static krb5_error_code LDAP__connect(krb5_context context, HDB * db)
 
     rc = ldap_initialize((LDAP **) & db->db, "ldapi:///");
     if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_initialize: %s", ldap_err2string(rc));
 	return HDB_ERR_NOENTRY;
     }
 
-    rc = LDAP_VERSION3;
-    (void) ldap_set_option((LDAP *) db->db, LDAP_OPT_PROTOCOL_VERSION, &rc);
-
-    /* XXX set db->name to the search base */
-    rc = ldap_search_s((LDAP *) db->db, "", LDAP_SCOPE_BASE,
-		       "(objectclass=*)", attrs, 0, &res);
+    rc = ldap_set_option((LDAP *) db->db, LDAP_OPT_PROTOCOL_VERSION, (const void *)&version);
     if (rc != LDAP_SUCCESS) {
-	ret = HDB_ERR_BADVERSION;
-	goto out;
-    }
-
-    e = ldap_first_entry((LDAP *) db->db, res);
-    if (e == NULL) {
-	ret = HDB_ERR_NOENTRY;
-	goto out;
+	krb5_set_error_string(context, "ldap_set_option: %s", ldap_err2string(rc));
+	ldap_unbind_ext((LDAP *) db->db, NULL, NULL);
+	db->db = NULL;
+	return HDB_ERR_BADVERSION;
     }
 
-    if (db->name == NULL) {
-	char **contexts = NULL, **schema_contexts, **p;
-
-	contexts = ldap_get_values((LDAP *) db->db, e, "namingContexts");
-	if (contexts == NULL) {
-	    ret = HDB_ERR_NOENTRY;
-	    goto out;
-	}
-
-	schema_contexts =
-	    ldap_get_values((LDAP *) db->db, e, "subschemaSubentry");
-
-	if (db->name != NULL) {
-	    free(db->name);
-	    db->name = NULL;
-	}
-
-	for (p = contexts; *p != NULL; p++) {
-	    if (LDAP__is_user_namingcontext(*p, schema_contexts)) {
-		break;
-	    }
-	}
-
-	db->name = strdup(*p);
-	if (db->name == NULL) {
-	    ldap_value_free(contexts);
-	    ret = ENOMEM;
-	    goto out;
-	}
-
-	ldap_value_free(contexts);
-	if (schema_contexts != NULL) {
-	    ldap_value_free(schema_contexts);
-	}
-    }
-
-    ret = 0;
-
-  out:
-
-    if (res != NULL) {
-	ldap_msgfree(res);
-    }
-
-    if (ret != 0) {
-	if (db->db != NULL) {
-	    ldap_unbind((LDAP *) db->db);
-	    db->db = NULL;
-	}
-    }
-
-    return ret;
+    return 0;
 }
 
 static krb5_error_code
 LDAP_open(krb5_context context, HDB * db, int flags, mode_t mode)
 {
-    krb5_error_code ret;
-
     /* Not the right place for this. */
 #ifdef HAVE_SIGACTION
-    {
-	struct sigaction sa;
+    struct sigaction sa;
 
-	sa.sa_flags = 0;
-	sa.sa_handler = SIG_IGN;
-	sigemptyset(&sa.sa_mask);
+    sa.sa_flags = 0;
+    sa.sa_handler = SIG_IGN;
+    sigemptyset(&sa.sa_mask);
 
-	sigaction(SIGPIPE, &sa, NULL);
-    }
+    sigaction(SIGPIPE, &sa, NULL);
 #else
     signal(SIGPIPE, SIG_IGN);
-#endif
-
-    if (db->name != NULL) {
-	free(db->name);
-	db->name = NULL;
-    }
+#endif /* HAVE_SIGACTION */
 
-    ret = LDAP__connect(context, db);
-    if (ret != 0) {
-	return ret;
-    }
-
-    return ret;
+    return LDAP__connect(context, db);
 }
 
 static krb5_error_code
@@ -1128,6 +1066,8 @@ LDAP_store(krb5_context context, HDB * db, unsigned flags,
 {
     LDAPMod **mods = NULL;
     krb5_error_code ret;
+    const char *errfn;
+    int rc;
     LDAPMessage *msg = NULL, *e = NULL;
     char *dn = NULL, *name = NULL;
 
@@ -1142,8 +1082,9 @@ LDAP_store(krb5_context context, HDB * db, unsigned flags,
     }
 
     ret = hdb_seal_keys(context, db, entry);
-    if (ret)
+    if (ret != 0) {
 	goto out;
+    }
 
     /* turn new entry into LDAPMod array */
     ret = LDAP_entry2mods(context, db, entry, e, &mods);
@@ -1178,8 +1119,14 @@ LDAP_store(krb5_context context, HDB * db, unsigned flags,
 	    goto out;
 	}
 
-	ret = asprintf(&dn, "cn=%s,%s", name, db->name);
+	if (db->name != NULL) {
+	    ret = asprintf(&dn, "cn=%s,%s", name, db->name);
+	} else {
+	    /* A bit bogus, but we don't have a search base */
+	    ret = asprintf(&dn, "cn=%s", name, db->name);
+	}
 	if (ret < 0) {
+	    krb5_set_error_string(context, "asprintf: out of memory");
 	    ret = ENOMEM;
 	    goto out;
 	}
@@ -1195,15 +1142,18 @@ LDAP_store(krb5_context context, HDB * db, unsigned flags,
     /* write entry into directory */
     if (e == NULL) {
 	/* didn't exist before */
-	ret = ldap_add_s((LDAP *) db->db, dn, mods);
+	rc = ldap_add_s((LDAP *) db->db, dn, mods);
+	errfn = "ldap_add_s";
     } else {
 	/* already existed, send deltas only */
-	ret = ldap_modify_s((LDAP *) db->db, dn, mods);
+	rc = ldap_modify_s((LDAP *) db->db, dn, mods);
+	errfn = "ldap_modify_s";
     }
 
-    if (ret == LDAP_SUCCESS) {
+    if (rc == LDAP_SUCCESS) {
 	ret = 0;
     } else {
+	krb5_set_error_string(context, "%s: %s", errfn, ldap_err2string(rc));
 	ret = HDB_ERR_CANT_LOCK_DB;
     }
 
@@ -1234,6 +1184,7 @@ LDAP_remove(krb5_context context, HDB * db, hdb_entry * entry)
     krb5_error_code ret;
     LDAPMessage *msg, *e;
     char *dn = NULL;
+    int rc, limit = LDAP_NO_LIMIT;
 
     ret = LDAP_principal2message(context, db, entry->principal, &msg);
     if (ret != 0) {
@@ -1252,13 +1203,18 @@ LDAP_remove(krb5_context context, HDB * db, hdb_entry * entry)
 	goto out;
     }
 
-    ret = LDAP_NO_LIMIT;
-    (void) ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, &ret);
+    rc = ldap_set_option((LDAP *) db->db, LDAP_OPT_SIZELIMIT, (const void *)&limit);
+    if (rc != LDAP_SUCCESS) {
+	krb5_set_error_string(context, "ldap_set_option: %s", ldap_err2string(rc));
+	ret = HDB_ERR_BADVERSION;
+	goto out;
+    }
 
-    ret = ldap_delete_s((LDAP *) db->db, dn);
-    if (ret == LDAP_SUCCESS) {
+    rc = ldap_delete_s((LDAP *) db->db, dn);
+    if (rc == LDAP_SUCCESS) {
 	ret = 0;
     } else {
+	krb5_set_error_string(context, "ldap_delete_s: %s", ldap_err2string(rc));
 	ret = HDB_ERR_CANT_LOCK_DB;
     }
 
@@ -1304,22 +1260,44 @@ static krb5_error_code LDAP_destroy(krb5_context context, HDB * db)
     krb5_error_code ret;
 
     ret = hdb_clear_master_key(context, db);
-    free(db->name);
+    if (db->name != NULL) {
+	free(db->name);
+    }
     free(db);
 
     return ret;
 }
 
 krb5_error_code
-hdb_ldap_create(krb5_context context, HDB ** db, const char *filename)
+hdb_ldap_create(krb5_context context, HDB ** db, const char *arg)
 {
     *db = malloc(sizeof(**db));
-    if (*db == NULL)
+    if (*db == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
 
     (*db)->db = NULL;
-/*    (*db)->name = strdup(filename); */
-    (*db)->name = NULL;
+
+    if (arg == NULL || arg[0] == '\0') {
+	/*
+	 * if no argument specified in the configuration file
+	 * then use NULL, which tells OpenLDAP to look in
+	 * the ldap.conf file. This doesn't work for
+	 * writing entries because we don't know where to
+	 * put new principals.
+	 */
+	(*db)->name = NULL;
+    } else {
+	(*db)->name = strdup(arg); 
+	if ((*db)->name == NULL) {
+	    krb5_set_error_string(context, "strdup: out of memory");
+	    free(*db);
+	    *db = NULL;
+	    return ENOMEM;
+	}
+    }
+
     (*db)->master_key_set = 0;
     (*db)->openp = 0;
     (*db)->open = LDAP_open;