diff options
| author | Arthur de Jong <arthur@arthurdejong.org> | 2021-11-19 12:11:15 +0100 |
|---|---|---|
| committer | Arthur de Jong <arthur@arthurdejong.org> | 2021-11-19 12:11:15 +0100 |
| commit | 6e7e878f3e7ebf7aa66b82b1857bfdb8325f1288 (patch) | |
| tree | f884358d177d49158e872abe666855ce6efec296 | |
| parent | 70819ae3d1736783472a747d542cef2052a4fc28 (diff) | |
Support DNSLDAPS in uri
This supports both `uri DNSLDAPS` and `uri DNSLDAPS:some.domain`
variants alongside the pre-existing `uri DNS` that was already supported
generating ldaps URIs for all SRV records found.
| -rw-r--r-- | man/nslcd.conf.5.xml | 11 | ||||
| -rw-r--r-- | nslcd/cfg.c | 32 |
2 files changed, 33 insertions, 10 deletions
diff --git a/man/nslcd.conf.5.xml b/man/nslcd.conf.5.xml index c8f98b6..aafb700 100644 --- a/man/nslcd.conf.5.xml +++ b/man/nslcd.conf.5.xml @@ -157,17 +157,20 @@ <acronym>SRV</acronym> records. <!-- since 0.5 --> By default the current domain is used but another domain can be queried by using the - <literal>DNS:</literal><replaceable>DOMAIN</replaceable> syntax. + <literal>DNS:DOMAIN</literal> syntax. <!-- since 0.8.4 --> + To convert <acronym>SRV</acronym> records for port 389 into an + <literal>ldaps://</literal> <acronym>URI</acronym>, <literal>DNSLDAPS</literal> + can be used. <!-- since 0.9.12 --> </para> <para> - When using the ldapi scheme, %2f should be used to escape slashes - (e.g. ldapi://%2fvar%2frun%2fslapd%2fldapi/), although most of the + When using the <literal>ldapi</literal> scheme, <literal>%2f</literal> should be used to escape slashes + (e.g. <literal>ldapi://%2fvar%2frun%2fslapd%2fldapi/</literal>), although most of the time this should not be needed. </para> <para> This option may be specified multiple times and/or with more - URIs on the line, separated by space. Normally, only the first + URIs on the line, separated by spaces. Normally, only the first server will be used with the following servers as fall-back (see <option>bind_timelimit</option> below). </para> diff --git a/nslcd/cfg.c b/nslcd/cfg.c index 772f0f6..86917d5 100644 --- a/nslcd/cfg.c +++ b/nslcd/cfg.c @@ -421,11 +421,12 @@ static const char *cfg_getdomainname(const char *filename, int lnr) /* add URIs by doing DNS queries for SRV records */ static void add_uris_from_dns(const char *filename, int lnr, - struct ldap_config *cfg, const char *domain) + struct ldap_config *cfg, const char *domain, + int force_ldaps) { int rc; char *hostlist = NULL, *nxt; - char buf[BUFLEN_HOSTNAME + sizeof("ldap://")]; + char buf[BUFLEN_HOSTNAME + sizeof("ldaps://")]; log_log(LOG_DEBUG, "query %s for SRV records", domain); rc = ldap_domain2hostlist(domain, &hostlist); if (rc != LDAP_SUCCESS) @@ -467,7 +468,7 @@ static void add_uris_from_dns(const char *filename, int lnr, /* strip default port number */ if ((strlen(hostlist) > 4) && (strcmp(hostlist + strlen(hostlist) - 4, ":389") == 0)) hostlist[strlen(hostlist) - 4] = '\0'; - if (mysnprintf(buf, sizeof(buf), "ldap://%s", hostlist)) + if (mysnprintf(buf, sizeof(buf), "ldap%s://%s", force_ldaps ? "s" : "", hostlist)) { log_log(LOG_ERR, "add_uris_from_dns(): buf buffer too small (%lu required)", (unsigned long) strlen(hostlist) + 7); @@ -1389,8 +1390,7 @@ static void cfg_read(const char *filename, struct ldap_config *cfg) if (strcasecmp(token, "dns") == 0) { #ifdef HAVE_LDAP_DOMAIN2HOSTLIST - add_uris_from_dns(filename, lnr, cfg, - cfg_getdomainname(filename, lnr)); + add_uris_from_dns(filename, lnr, cfg, cfg_getdomainname(filename, lnr), 0); #else /* not HAVE_LDAP_DOMAIN2HOSTLIST */ log_log(LOG_ERR, "%s:%d: value %s not supported on platform", filename, lnr, token); @@ -1400,7 +1400,27 @@ static void cfg_read(const char *filename, struct ldap_config *cfg) else if (strncasecmp(token, "dns:", 4) == 0) { #ifdef HAVE_LDAP_DOMAIN2HOSTLIST - add_uris_from_dns(filename, lnr, cfg, strdup(token + 4)); + add_uris_from_dns(filename, lnr, cfg, strdup(token + 4), 0); +#else /* not HAVE_LDAP_DOMAIN2HOSTLIST */ + log_log(LOG_ERR, "%s:%d: value %s not supported on platform", + filename, lnr, token); + exit(EXIT_FAILURE); +#endif /* not HAVE_LDAP_DOMAIN2HOSTLIST */ + } + else if (strcasecmp(token, "dnsldaps") == 0) + { +#ifdef HAVE_LDAP_DOMAIN2HOSTLIST + add_uris_from_dns(filename, lnr, cfg, cfg_getdomainname(filename, lnr), 1); +#else /* not HAVE_LDAP_DOMAIN2HOSTLIST */ + log_log(LOG_ERR, "%s:%d: value %s not supported on platform", + filename, lnr, token); + exit(EXIT_FAILURE); +#endif /* not HAVE_LDAP_DOMAIN2HOSTLIST */ + } + else if (strncasecmp(token, "dnsldaps:", 9) == 0) + { +#ifdef HAVE_LDAP_DOMAIN2HOSTLIST + add_uris_from_dns(filename, lnr, cfg, strdup(token + 9), 1); #else /* not HAVE_LDAP_DOMAIN2HOSTLIST */ log_log(LOG_ERR, "%s:%d: value %s not supported on platform", filename, lnr, token); |