LDAPFunctions.cpp

Go to the documentation of this file.

#include "LDAP_URL_Header.h"
#include "ToolkitUtils.h"

struct PKIFLDAP::lber_options ber_int_options;

#include "CLDAPConnectionInfo.h"
#include "CSingletonLDAPConnection.h"
#include "ASN1Helper.h"
#include "PKIX1Implicit88.h"
#include "PKIX1Explicit88.h"
#include "Certificate.h"
#include "CRL.h"
#include "GottaMatch.h"
#include "PKIFCertificateNodeEntry.h"
#include <string>


#include "boost/numeric/conversion/cast.hpp"
#include "boost/numeric/conversion/bounds.hpp"
#include "boost/limits.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;

// Added during porting task.
/*#if defined(_WIN32) || defined(WIN32)
#define STRCASECMP stricmp
#else
#define STRCASECMP strcasecmp
#endif*/

using namespace std;
//using namespace PKIFLDAP;

//#define _DEBUG_URI_DUMP 1
#ifdef _DEBUG_URI_DUMP
#include <fstream>
ofstream g_uriLogFile;
#endif

static int ldap_int_unhex( int c );
static int str2scope( const char *p );

CSingletonLDAPConnection* CSingletonLDAPConnection::m_instance = NULL;
int GetCertfromLDAPURL(
    const char *url_in, 
    CPKIFCertificateNodeList& certNodeList,
    PathBuildingDirection pbd)
{
#undef CLEANUP
#define CLEANUP \
{ \
    if(NULL != binaryValuesPtr)\
    { ldap_value_free_len(binaryValuesPtr);binaryValuesPtr = NULL;}\
    if(NULL != tempAttrName)\
    { ldap_memfree(tempAttrName);tempAttrName = NULL;}\
    if(NULL != ber_temp)\
    { ber_free(ber_temp, 0);ber_temp = NULL;}\
    if(NULL != results)\
    { ldap_msgfree(results); results = NULL;}\
} 
#undef RETURN
#ifdef _DEBUG_URI_DUMP
#define RETURN(err) \
{ \
    CLEANUP\
    g_uriLogFile << GetTickCount() - __ticks << " milliseconds elapsed retrieving from " << url_in << endl; \
    return err;\
} 
#else
#define RETURN(err) \
{ \
    CLEANUP\
    if(ldapInfo != NULL){PKIFLDAP::ldap_free_urldesc( ldapInfo );ldapInfo = NULL;}\
    return err;\
} 
#endif

#ifdef _DEBUG_URI_DUMP
    if(!g_uriLogFile.is_open())
    {
        g_uriLogFile.open("_DEBUG_URI_DUMP_URILog.txt", ios::out);
    }
    DWORD __ticks = GetTickCount();
#endif

    int err = 0;
    int connectCount = 0;
    int bindCount = 0;

    PKIFLDAP::LDAPURLDesc *ldapInfo = NULL;
    LDAP* ldapStruct = NULL;
    LDAPMessage* results = NULL;    
    LDAPMessage* curEntry = NULL;       
    BerElement *ber_temp = NULL;
    struct berval **binaryValuesPtr = NULL;
    struct berval *tmpPtr = NULL;

    char* tempAttrName = NULL;

    int multiAttrIndex = 0;

    const char* filter = "objectclass=*";
    char* certAttrName = "caCertificate;binary";
    char* crossCertAttrName = "crosscertificatepair;binary";
    char* certAttrName2 = "caCertificate";
    char* crossCertAttrName2 = "crosscertificatepair";
    char* userCertAttrName = "userCertificate"; //added these two to permit discovery of crl issuers 7/18
    char* userCertAttrName2 = "userCertificate;binary";

    char* attrsOfInterest[] = {certAttrName, crossCertAttrName, certAttrName2, crossCertAttrName2, userCertAttrName, userCertAttrName2, NULL};

    std::string strUrl = url_in;
    err = PKIFLDAP::ldap_url_parse(url_in, &ldapInfo);
    if (0!=err)
    {
        RETURN(err);
    }

    CSingletonLDAPConnection* slc = CSingletonLDAPConnection::Instance();
    string lud_hostString = "";
    if(0 != ldapInfo->lud_host)
    {
        lud_hostString = ldapInfo->lud_host;
    }
    if(PKIFLDAP::IsBlacklisted(lud_hostString))
    {
        err = ERR_LDAP_CONNECTION;
        RETURN(err);
    }
    ldapStruct = slc->GetConnection(lud_hostString/*string(ldapInfo->lud_host)*/, ldapInfo->lud_port);

    if(!ldapStruct)
    {
        do
        {
            ldapStruct = ldap_open(ldapInfo->lud_host, ldapInfo->lud_port);
            if(NULL != ldapStruct) 
                connectCount = 5;
            else
            {
                SLEEP(10);
                ++connectCount;
            }
        }while(5 > connectCount);
        if(NULL == ldapStruct) 
        {
            PKIFLDAP::AddBlacklistedServer(lud_hostString);

            err = ERR_LDAP_CONNECTION;
            RETURN(err);
        }
        do
        {
            ULONG timeout = 30;
            ldap_set_option(ldapStruct, LDAP_OPT_TIMELIMIT, &timeout);

            err = ldap_simple_bind_s(ldapStruct, NULL, NULL);
            if(0 == err)
                bindCount = 5;
            else
            {
                //added 06/06/2005  Armen
                if(LDAP_PROTOCOL_ERROR == err)
                {
                    int opt = LDAP_VERSION3;
                    ldap_set_option(ldapStruct, LDAP_OPT_PROTOCOL_VERSION, &opt);
                }

                SLEEP(10);
                ++bindCount;
            }
        }while( 5 > bindCount);
        if(0 != err)
        {
            err = ERR_LDAP_CONNECTION;
            RETURN(err);
        }
        else
        {
            if(ldapInfo->lud_host) 
            {
                string lud_hostString(ldapInfo->lud_host);
                slc->PushConnection(lud_hostString/*string(ldapInfo->lud_host)*/, ldapInfo->lud_port, ldapStruct);
            }
        }
    }

    ldap_set_option(ldapStruct, LDAP_OPT_REFERRALS, LDAP_OPT_ON);


    if(ldapInfo->lud_attrs == NULL)
    {
        err = ldap_search_s(ldapStruct, ldapInfo->lud_dn, LDAP_SCOPE_BASE, (char *)filter, attrsOfInterest, 0, &results);
    }
    else
    {
        err = ldap_search_s(ldapStruct, ldapInfo->lud_dn, LDAP_SCOPE_BASE, (char *)filter, ldapInfo->lud_attrs, 0, &results);
    }
    if(0 != err || NULL == results)
    {
        CLEANUP
        err = ERR_LDAP_QUERY;
        RETURN(err);
    }

    curEntry = ldap_first_entry(ldapStruct, results);
    if(NULL == curEntry)
    {
        CLEANUP
        err = ERR_LDAP_QUERY;
        RETURN(err);
    }

    tempAttrName = ldap_first_attribute(ldapStruct, curEntry, &ber_temp);
    if(NULL == curEntry || NULL == tempAttrName)
    {
        CLEANUP
        err = ERR_LDAP_QUERY;
        RETURN(err);
    }

    do
    {

        if(0 == stricmp(crossCertAttrName, tempAttrName) ||
           0 == stricmp(crossCertAttrName2, tempAttrName))
        {
            multiAttrIndex = 0;
            if(NULL != binaryValuesPtr)
            {
                ldap_value_free_len(binaryValuesPtr); binaryValuesPtr = NULL;
            }
            binaryValuesPtr = ldap_get_values_len(ldapStruct, curEntry, tempAttrName);
            const int entryCount = ldap_count_values_len(binaryValuesPtr);
            if(0 != entryCount && NULL != binaryValuesPtr && NULL != binaryValuesPtr[multiAttrIndex])
            {
                while(multiAttrIndex < entryCount)
                {
                    tmpPtr = binaryValuesPtr[multiAttrIndex];
                    if(NULL == tmpPtr)
                    {
                        break;
                    }

                    try
                    {
                        CACASNWRAPPER_CREATE(CACX509V3CertificatePair, objPDU);
                        objPDU.Decode((unsigned char*)tmpPtr->bv_val, tmpPtr->bv_len);

                        if((objPDU->m.forwardPresent && PBD_FORWARD == pbd) ||
                            (objPDU->m.reversePresent && PBD_REVERSE == pbd))
                        {
                            OOCTXT ctxt;
                            initContext (&ctxt);
                            unsigned char* buf = new unsigned char[tmpPtr->bv_len];
                            setBEREncBufPtr(&ctxt, buf, tmpPtr->bv_len);
                            if(objPDU->m.forwardPresent && PBD_FORWARD == pbd)
                                BEREncCACX509V3Certificate(&ctxt, &objPDU->forward, ASN1EXPL);
                            else if(objPDU->m.reversePresent && PBD_REVERSE == pbd)
                                BEREncCACX509V3Certificate(&ctxt, &objPDU->reverse, ASN1EXPL);

                            CPKIFCertificatePtr tmpCert(new CPKIFCertificate);
                            try
                            {
                                int iCertLen = 0;
                                try 
                                {
                                    iCertLen = numeric_cast<int>(ctxt.buffer.size - ctxt.buffer.byteIndex - 1);
                                }
                                catch(bad_numeric_cast &) 
                                {
                                    throw CPKIFException(TOOLKIT_CACHE, COMMON_INVALID_INPUT, "Certificate size is larger than maximum integer size.");
                                }
                                tmpCert->Decode(ctxt.buffer.data + ctxt.buffer.byteIndex, iCertLen);

                                CPKIFCertificateNodeEntryPtr tmpCertNode(new CPKIFCertificateNodeEntry(tmpCert));
                                GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
                                gm.SetRHS(tmpCertNode);
                                if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
                                {
                                    tmpCertNode->SetSource(REMOTE);
                                    tmpCertNode->AddSource(strUrl);
                                    tmpCertNode->SetState(PAS_AVAILABLE);
                                    certNodeList.push_back(tmpCertNode);
                                }
                            }
                            catch(CPKIFException& e)
                            {

                                //ignore entries that fail to parse
                                std::string logStr = "Failed to parse certificate from cross-certificate found in entry for ";
                                logStr.append(url_in);
                                LOG_STRING_ERROR(logStr.c_str(), TOOLKIT_UTILS, e.GetErrorCode(), NULL);
                            }

                            freeEncodeBuffer(&ctxt);
                            memFreeAll(&ctxt);
                            delete[] buf;
                        }
                    }
                    catch(CPKIFException& e)
                    {
                        //ignore entries that do not parse
                        std::string logStr = "Failed to parse cross-certificate certificate found in entry for ";
                        logStr.append(url_in);
                        LOG_STRING_ERROR(logStr.c_str(), TOOLKIT_UTILS, e.GetErrorCode(), NULL);
                    }

                    multiAttrIndex++;
                }
            }
        }                       //compare the current attribute name to the certificate attribute name
        else //(0 == /*stricmp*/ STRCASECMP(certAttrName, tempAttrName))
        {
            multiAttrIndex = 0;
            if(NULL != binaryValuesPtr)
            {
                ldap_value_free_len(binaryValuesPtr); binaryValuesPtr = NULL;
            }

            binaryValuesPtr = ldap_get_values_len(ldapStruct, curEntry, tempAttrName);
            const int entryCount = ldap_count_values_len(binaryValuesPtr);
            if(0 != entryCount && NULL != binaryValuesPtr && NULL != binaryValuesPtr[multiAttrIndex])
            {
                //iterate over all of the values
                while(multiAttrIndex < entryCount)
                {
                    tmpPtr = binaryValuesPtr[multiAttrIndex];
                    if(NULL == tmpPtr)
                    {
                        break;
                    }

                    //create cert using tmpPtr->bv_val, tmpPtr->bv_len
                    CPKIFCertificatePtr tmpCert(new CPKIFCertificate());
                    try
                    {
                        tmpCert->Decode((unsigned char*)tmpPtr->bv_val, tmpPtr->bv_len);                        
                        CPKIFCertificateNodeEntryPtr tmpCertNode(new CPKIFCertificateNodeEntry(tmpCert));
                        GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
                        gm.SetRHS(tmpCertNode);
                        if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
                        {
                            tmpCertNode->SetSource(REMOTE);
                            tmpCertNode->AddSource(strUrl);
                            tmpCertNode->SetState(PAS_AVAILABLE);
                            certNodeList.push_back(tmpCertNode);
                        }
                    }
                    catch(CPKIFException& e)
                    {
                        //ignore entries that fail to parse
                        std::string logStr = "Failed to parse certificate found in entry for ";
                        logStr.append(url_in);                          
                        LOG_STRING_ERROR(logStr.c_str(), TOOLKIT_UTILS, e.GetErrorCode(), NULL);
                    }

                    multiAttrIndex++;
                }
            }
        }

        //inspect the next attribute
        ldap_memfree(tempAttrName); tempAttrName = NULL;
        tempAttrName = ldap_next_attribute(ldapStruct, curEntry, ber_temp);

    }while(NULL != tempAttrName);

    //if(ldapStruct != NULL)
    //{ 
    //  ldap_unbind(ldapStruct); 
    //  ldapStruct = NULL;
    //}

    RETURN(err);
}
int GetCRLfromLDAPURL(
    const char *url_in,
    CPKIFCRLList& crlList)
{
#undef CLEANUP
#define CLEANUP \
{ \
    if(NULL != binaryValuesPtr)\
    { ldap_value_free_len(binaryValuesPtr);binaryValuesPtr = NULL;}\
    if(NULL != tempAttrName)\
    { ldap_memfree(tempAttrName);tempAttrName = NULL;}\
    if(NULL != ber_temp)\
    { ber_free(ber_temp, 0);ber_temp = NULL;}\
    if(NULL != results)\
    { ldap_msgfree(results); results = NULL;}\
} 
#undef RETURN
#ifdef _DEBUG_URI_DUMP
#define RETURN(err) \
{ \
    CLEANUP\
    g_uriLogFile << GetTickCount() - __ticks << " milliseconds elapsed retrieving from " << url_in << endl; \
    return err;\
} 
#else
#define RETURN(err) \
{ \
    CLEANUP\
    if(ldapInfo != NULL){PKIFLDAP::ldap_free_urldesc( ldapInfo );ldapInfo = NULL;}\
    return err;\
} 
#endif

    int err = 0;
    int connectCount = 0;
    int bindCount = 0;

    PKIFLDAP::LDAPURLDesc *ldapInfo = NULL;
    LDAP* ldapStruct = NULL;
    LDAPMessage* results = NULL;    
    LDAPMessage* curEntry = NULL;       
    BerElement *ber_temp = NULL;
    struct berval **binaryValuesPtr = NULL;
    struct berval *tmpPtr = NULL;

    char* tempAttrName = NULL;

    int multiAttrIndex = 0;

    const char* filter = "objectclass=*";
    char* crlName = "certificateRevocationList;binary";
    char* arlName = "authorityRevocationList;binary";
    char* crlName2 = "certificateRevocationList";
    char* arlName2 = "authorityRevocationList";
    char* deltaName = "deltaRevocationList;binary";
    char* deltaName2 = "deltaRevocationList";

    char* attrsOfInterest[] = {crlName, arlName, crlName2, arlName2, deltaName, deltaName2, NULL};

#ifdef _DEBUG_URI_DUMP
    if(!g_uriLogFile.is_open())
    {
        g_uriLogFile.open("_DEBUG_URI_DUMP_URILog.txt", ios::out);
    }
    DWORD __ticks = GetTickCount();
#endif

    err = PKIFLDAP::ldap_url_parse(url_in, &ldapInfo);
    if (0!=err)
    {
        RETURN(err);
    }

    CSingletonLDAPConnection* slc = CSingletonLDAPConnection::Instance();
    string lud_hostString = "";
    if(0 != ldapInfo->lud_host)
    {
        lud_hostString = ldapInfo->lud_host;
    }
    if(PKIFLDAP::IsBlacklisted(lud_hostString))
    {
        err = ERR_LDAP_CONNECTION;
        RETURN(err);
    }

    ldapStruct = slc->GetConnection(lud_hostString/*string(ldapInfo->lud_host)*/, ldapInfo->lud_port);

    if(!ldapStruct)
    {
        do
        {
            ldapStruct = ldap_open(ldapInfo->lud_host, ldapInfo->lud_port);
            if(NULL != ldapStruct) 
                connectCount = 5;
            else
            {
                SLEEP(10);
                ++connectCount;
            }
        }while(5 > connectCount);
        if(NULL == ldapStruct) 
        {
            err = ERR_LDAP_CONNECTION;
            RETURN(err);
        }
        do
        {
            ULONG timeout = 30;
            ldap_set_option(ldapStruct, LDAP_OPT_TIMELIMIT, &timeout);

            err = ldap_simple_bind_s(ldapStruct, NULL, NULL);
            if(0 == err)
                bindCount = 5;
            else
            {
                //added 06/06/2005  Armen
                if(LDAP_PROTOCOL_ERROR == err)
                {
                    int opt = LDAP_VERSION3;
                    ldap_set_option(ldapStruct, LDAP_OPT_PROTOCOL_VERSION, &opt);
                }
                SLEEP(10);
                ++bindCount;
            }
        }while( 5 > bindCount);
        if(0 != err)
        {
            CLEANUP
            PKIFLDAP::AddBlacklistedServer(lud_hostString);
            err = ERR_LDAP_CONNECTION;
            RETURN(err);
        }
        else
        {
            if(ldapInfo->lud_host) {
                string lud_hostString(ldapInfo->lud_host);
                slc->PushConnection(lud_hostString/*string(ldapInfo->lud_host)*/, ldapInfo->lud_port, ldapStruct);
            }
        }
    }

    ldap_set_option(ldapStruct, LDAP_OPT_REFERRALS, LDAP_OPT_ON);


    if(ldapInfo->lud_attrs == NULL)
    {
        err = ldap_search_s(ldapStruct, ldapInfo->lud_dn, LDAP_SCOPE_BASE, (char *)filter, attrsOfInterest, 0, &results);
    }
    else
    {
        err = ldap_search_s(ldapStruct, ldapInfo->lud_dn, LDAP_SCOPE_BASE, (char *)filter, ldapInfo->lud_attrs, 0, &results);
    }
    if(0 != err || NULL == results)
    {
        CLEANUP
        err = ERR_LDAP_QUERY;
        RETURN(err);
    }

    curEntry = ldap_first_entry(ldapStruct, results);
    if(NULL == curEntry)
    {
        CLEANUP
        err = ERR_LDAP_QUERY;
        RETURN(err);
    }

    tempAttrName = ldap_first_attribute(ldapStruct, curEntry, &ber_temp);
    if(NULL == curEntry || NULL == tempAttrName)
    {
        CLEANUP
        err = ERR_LDAP_QUERY;
        RETURN(err);
    }

    do
    {
            
            multiAttrIndex = 0;
            if(NULL != binaryValuesPtr)
            {
                ldap_value_free_len(binaryValuesPtr);binaryValuesPtr = NULL;
            }
            binaryValuesPtr = ldap_get_values_len(ldapStruct, curEntry, tempAttrName);
            const int entryCount = ldap_count_values_len(binaryValuesPtr);
            if(0 == entryCount || NULL == binaryValuesPtr || NULL == binaryValuesPtr[multiAttrIndex])
            {
                //throw CPKIFException();
            }

            while(multiAttrIndex < entryCount)
            {
                tmpPtr = binaryValuesPtr[multiAttrIndex];
                if(NULL == tmpPtr)
                {
                    break;
                }

                CPKIFCRLPtr tmpCRL(new CPKIFCRL());
                try
                {
                    tmpCRL->Decode((unsigned char*)tmpPtr->bv_val, tmpPtr->bv_len);
                    GottaMatch<CPKIFCRLPtr> gm;
                    gm.SetRHS(tmpCRL);
                    if(crlList.end() == find_if(crlList.begin(), crlList.end(), gm))
                        crlList.push_back(tmpCRL);
                }
                catch(CPKIFException&)
                {
                    //delete e;
                }

                multiAttrIndex++;
            }
        

            ldap_memfree(tempAttrName); tempAttrName = NULL;
            tempAttrName = ldap_next_attribute(ldapStruct, curEntry, ber_temp);
    }while(NULL != tempAttrName);

    //if(ldapStruct != NULL)
    //{ 
    //  ldap_unbind(ldapStruct); 
    //  ldapStruct = NULL;
    //}

    RETURN(err);
}

int PKIFLDAP::ldap_url_parse( 
    const char *url_in,
    LDAPURLDesc **ludpp )
{
    int rc = ldap_url_parse_ext( url_in, ludpp );

    if( rc != LDAP_URL_SUCCESS ) {
        return rc;
    }

    if ((*ludpp)->lud_scope == LDAP_SCOPE_DEFAULT) {
        (*ludpp)->lud_scope = LDAP_SCOPE_BASE;
    }

    if ((*ludpp)->lud_host != NULL && *(*ludpp)->lud_host == '\0') {
        LDAP_FREE( (*ludpp)->lud_host );
        (*ludpp)->lud_host = NULL;
    }

    if ((*ludpp)->lud_port == 0) {
        if( strcmp((*ludpp)->lud_scheme, "ldap") == 0 ) {
            (*ludpp)->lud_port = LDAP_PORT;
#ifdef LDAP_CONNECTIONLESS
        } else if( strcmp((*ludpp)->lud_scheme, "cldap") == 0 ) {
            (*ludpp)->lud_port = LDAP_PORT;
#endif
        } else if( strcmp((*ludpp)->lud_scheme, "ldaps") == 0 ) {
            (*ludpp)->lud_port = LDAPS_PORT;
        }
    }

    return rc;
}

int PKIFLDAP::ldap_url_parse_ext( 
    const char *url_in,
    LDAPURLDesc **ludpp )
{
/*
 *  Pick apart the pieces of an LDAP URL.
 */

    LDAPURLDesc *ludp;
    char    *p, *q, *r;
    int     i, enclosed;
    const char *scheme = NULL;
    const char *url_tmp;
    char *url;

    if( url_in == NULL || ludpp == NULL ) {
        return LDAP_URL_ERR_PARAM;
    }


    *ludpp = NULL;  

    url_tmp = skip_url_prefix( url_in, &enclosed, &scheme );

    if ( url_tmp == NULL ) {
        return LDAP_URL_ERR_BADSCHEME;
    }

//  ASSERT( scheme );

    /* make working copy of the remainder of the URL */
    url = LDAP_STRDUP( url_tmp );
    if ( url == NULL ) {
        return LDAP_URL_ERR_MEM;
    }

    if ( enclosed ) {
        p = &url[strlen(url)-1];

        if( *p != '>' ) {
            LDAP_FREE( url );
            return LDAP_URL_ERR_BADENCLOSURE;
        }

        *p = '\0';
    }

    /* allocate return struct */
    ludp = (LDAPURLDesc *)LDAP_CALLOC( 1, sizeof( LDAPURLDesc ));

    if ( ludp == NULL ) {
        LDAP_FREE( url );
        return LDAP_URL_ERR_MEM;
    }

    ludp->lud_next = NULL;
    ludp->lud_host = NULL;
    ludp->lud_port = 0;
    ludp->lud_dn = NULL;
    ludp->lud_attrs = NULL;
    ludp->lud_filter = NULL;
    ludp->lud_scope = LDAP_SCOPE_DEFAULT;
    ludp->lud_filter = NULL;
    ludp->lud_exts = NULL;

    ludp->lud_scheme = LDAP_STRDUP( scheme );

    if ( ludp->lud_scheme == NULL ) {
        LDAP_FREE( url );
        PKIFLDAP::ldap_free_urldesc( ludp );
        return LDAP_URL_ERR_MEM;
    }

        /* scan forward for '/' that marks end of hostport and begin. of dn */
    p = strchr( url, '/' );

    if( p != NULL ) {
        /* terminate hostport; point to start of dn */
        *p++ = '\0';
    }

    /* IPv6 syntax with [ip address]:port */
    if ( *url == '[' ) {
        r = strchr( url, ']' );
        if ( r == NULL ) {
            LDAP_FREE( url );
            PKIFLDAP::ldap_free_urldesc( ludp );
            return LDAP_URL_ERR_BADURL;
        }
        *r++ = '\0';
        q = strchr( r, ':' );
    } else {
        q = strchr( url, ':' );
    }
    if ( q != NULL ) {
        *q++ = '\0';
        ldap_pvt_hex_unescape( q );

        if( *q == '\0' ) {
            LDAP_FREE( url );
            PKIFLDAP::ldap_free_urldesc( ludp );
            return LDAP_URL_ERR_BADURL;
        }

        ludp->lud_port = atoi( q );
    }

    ldap_pvt_hex_unescape( url );

    /* If [ip address]:port syntax, url is [ip and we skip the [ */
    ludp->lud_host = LDAP_STRDUP( url + ( *url == '[' ) );

    if( ludp->lud_host == NULL ) {
        LDAP_FREE( url );
        PKIFLDAP::ldap_free_urldesc( ludp );
        return LDAP_URL_ERR_MEM;
    }
    /*
     * Kludge.  ldap://111.222.333.444:389??cn=abc,o=company
     *
     * On early Novell releases, search references/referrals were returned
     * in this format, i.e., the dn was kind of in the scope position,
     * but the required slash is missing. The whole thing is illegal syntax,
     * but we need to account for it. Fortunately it can't be confused with
     * anything real.
     */
    if( (p == NULL) && (q != NULL) && ((q = strchr( q, '?')) != NULL)) {
        q++;        
        /* ? immediately followed by question */
        if( *q == '?') {
            q++;
            if( *q != '\0' ) {
                /* parse dn part */
                ldap_pvt_hex_unescape( q );
                ludp->lud_dn = LDAP_STRDUP( q );
            } else {
                ludp->lud_dn = LDAP_STRDUP( "" );
            }

            if( ludp->lud_dn == NULL ) {
                LDAP_FREE( url );
                PKIFLDAP::ldap_free_urldesc( ludp );
                return LDAP_URL_ERR_MEM;
            }
        }
    }
    if( p == NULL ) {
        LDAP_FREE( url );
        *ludpp = ludp;
        return LDAP_URL_SUCCESS;
    }

    /* scan forward for '?' that may marks end of dn */
    q = strchr( p, '?' );

    if( q != NULL ) {
        /* terminate dn part */
        *q++ = '\0';
    }

    if( *p != '\0' ) {
        /* parse dn part */
        ldap_pvt_hex_unescape( p );
        ludp->lud_dn = LDAP_STRDUP( p );
    } else {
        ludp->lud_dn = LDAP_STRDUP( "" );
    }

    if( ludp->lud_dn == NULL ) {
        LDAP_FREE( url );
        PKIFLDAP::ldap_free_urldesc( ludp );
        return LDAP_URL_ERR_MEM;
    }

    if( q == NULL ) {
        /* no more */
        LDAP_FREE( url );
        *ludpp = ludp;
        return LDAP_URL_SUCCESS;
    }

    /* scan forward for '?' that may marks end of attributes */
    p = q;
    q = strchr( p, '?' );

    if( q != NULL ) {
        /* terminate attributes part */
        *q++ = '\0';
    }

    if( *p != '\0' ) {
        /* parse attributes */
        ldap_pvt_hex_unescape( p );
        ludp->lud_attrs = ldap_str2charray( p, "," );

        if( ludp->lud_attrs == NULL ) {
            LDAP_FREE( url );
            PKIFLDAP::ldap_free_urldesc( ludp );
            return LDAP_URL_ERR_BADATTRS;
        }
    }

    if ( q == NULL ) {
        /* no more */
        LDAP_FREE( url );
        *ludpp = ludp;
        return LDAP_URL_SUCCESS;
    }

    /* scan forward for '?' that may marks end of scope */
    p = q;
    q = strchr( p, '?' );

    if( q != NULL ) {
        /* terminate the scope part */
        *q++ = '\0';
    }

    if( *p != '\0' ) {
        /* parse the scope */
        ldap_pvt_hex_unescape( p );
        ludp->lud_scope = str2scope( p );

        if( ludp->lud_scope == -1 ) {
            LDAP_FREE( url );
            PKIFLDAP::ldap_free_urldesc( ludp );
            return LDAP_URL_ERR_BADSCOPE;
        }
    }

    if ( q == NULL ) {
        /* no more */
        LDAP_FREE( url );
        *ludpp = ludp;
        return LDAP_URL_SUCCESS;
    }

    /* scan forward for '?' that may marks end of filter */
    p = q;
    q = strchr( p, '?' );

    if( q != NULL ) {
        /* terminate the filter part */
        *q++ = '\0';
    }

    if( *p != '\0' ) {
        /* parse the filter */
        ldap_pvt_hex_unescape( p );

        if( ! *p ) {
            /* missing filter */
            LDAP_FREE( url );
            PKIFLDAP::ldap_free_urldesc( ludp );
            return LDAP_URL_ERR_BADFILTER;
        }

        LDAP_FREE( ludp->lud_filter );
        ludp->lud_filter = LDAP_STRDUP( p );

        if( ludp->lud_filter == NULL ) {
            LDAP_FREE( url );
            PKIFLDAP::ldap_free_urldesc( ludp );
            return LDAP_URL_ERR_MEM;
        }
    }

    if ( q == NULL ) {
        /* no more */
        LDAP_FREE( url );
        *ludpp = ludp;
        return LDAP_URL_SUCCESS;
    }

    /* scan forward for '?' that may marks end of extensions */
    p = q;
    q = strchr( p, '?' );

    if( q != NULL ) {
        /* extra '?' */
        LDAP_FREE( url );
        PKIFLDAP::ldap_free_urldesc( ludp );
        return LDAP_URL_ERR_BADURL;
    }

    /* parse the extensions */
    ludp->lud_exts = ldap_str2charray( p, "," );

    if( ludp->lud_exts == NULL ) {
        LDAP_FREE( url );
        PKIFLDAP::ldap_free_urldesc( ludp );
        return LDAP_URL_ERR_BADEXTS;
    }

    for( i=0; ludp->lud_exts[i] != NULL; i++ ) {
        ldap_pvt_hex_unescape( ludp->lud_exts[i] );

        if( *ludp->lud_exts[i] == '!' ) {
            /* count the number of critical extensions */
            ludp->lud_crit_exts++;
        }
    }

    if( i == 0 ) {
        /* must have 1 or more */
        LDAP_FREE( url );
        PKIFLDAP::ldap_free_urldesc( ludp );
        return LDAP_URL_ERR_BADEXTS;
    }

    /* no more */
    *ludpp = ludp;
    LDAP_FREE( url );

    return LDAP_URL_SUCCESS;
}


const char* PKIFLDAP::skip_url_prefix(const char *url,int *enclosedp,const char **scheme )
{
    /*
     * return non-zero if this looks like a LDAP URL; zero if not
     * if non-zero returned, *urlp will be moved past "ldap://" part of URL
     */
    const char *p;

    if ( url == NULL ) {
        return( NULL );
    }

    p = url;

    /* skip leading '<' (if any) */
    if ( *p == '<' ) {
        *enclosedp = 1;
        ++p;
    } else {
        *enclosedp = 0;
    }

    /* skip leading "URL:" (if any) */
    if ( strnicmp( p, LDAP_URL_URLCOLON, LDAP_URL_URLCOLON_LEN ) == 0 ) {
        p += LDAP_URL_URLCOLON_LEN;
    }

    /* skip leading "URL=" (if any) */
    if ( strnicmp( p, LDAP_URL_URLEQUALTO, LDAP_URL_URLEQUALTO_LEN ) == 0 ) {
        p += LDAP_URL_URLEQUALTO_LEN;
    }


    /* check for "ldap://" prefix */
    if ( strnicmp( p, LDAP_URL_PREFIX, LDAP_URL_PREFIX_LEN ) == 0 ) {
        /* skip over "ldap://" prefix and return success */
        p += LDAP_URL_PREFIX_LEN;
        *scheme = "ldap";
        return( p );
    }

    /* check for "ldaps://" prefix */
    if ( strnicmp( p, LDAPS_URL_PREFIX, LDAPS_URL_PREFIX_LEN ) == 0 ) {
        /* skip over "ldaps://" prefix and return success */
        p += LDAPS_URL_PREFIX_LEN;
        *scheme = "ldaps";
        return( p );
    }

    /* check for "ldapi://" prefix */
    if ( strnicmp( p, LDAPI_URL_PREFIX, LDAPI_URL_PREFIX_LEN ) == 0 ) {
        /* skip over "ldapi://" prefix and return success */
        p += LDAPI_URL_PREFIX_LEN;
        *scheme = "ldapi";
        return( p );
    }

#ifdef LDAP_CONNECTIONLESS
    /* check for "cldap://" prefix */
    if ( strnicmp( p, LDAPC_URL_PREFIX, LDAPC_URL_PREFIX_LEN ) == 0 ) {
        /* skip over "cldap://" prefix and return success */
        p += LDAPC_URL_PREFIX_LEN;
        *scheme = "cldap";
        return( p );
    }
#endif

    return( NULL );
}

void PKIFLDAP::ldap_free_urldesc(
    LDAPURLDesc *ludp )
{
    if ( ludp == NULL ) {
        return;
    }
    
    if ( ludp->lud_scheme != NULL ) {
        LDAP_FREE( ludp->lud_scheme );
    }

    if ( ludp->lud_host != NULL ) {
        LDAP_FREE( ludp->lud_host );
    }

    if ( ludp->lud_dn != NULL ) {
        LDAP_FREE( ludp->lud_dn );
    }

    if ( ludp->lud_filter != NULL ) {
        LDAP_FREE( ludp->lud_filter);
    }

    if ( ludp->lud_attrs != NULL ) {
        LDAP_VFREE( ludp->lud_attrs );
    }

    if ( ludp->lud_exts != NULL ) {
        LDAP_VFREE( ludp->lud_exts );
    }

    LDAP_FREE( ludp );
}

void PKIFLDAP::ber_memvfree( void **vec )
{
    int i;

    ber_int_options.lbo_valid = LBER_INITIALIZED;

    if( vec == NULL ) {
        return;
    }

    BER_MEM_VALID( vec );

    for ( i = 0; vec[i] != NULL; i++ ) {
        LBER_FREE( vec[i] );
    }

    LBER_FREE( vec );
}

void PKIFLDAP::ldap_pvt_hex_unescape( 
    char *s )
{
    /*
     * Remove URL hex escapes from s... done in place.  The basic concept for
     * this routine is borrowed from the WWW library HTUnEscape() routine.
     */
    char    *p;

    for ( p = s; *s != '\0'; ++s ) {
        if ( *s == '%' ) {
            if ( *++s == '\0' ) {
                break;
            }
            *p = ldap_int_unhex( *s ) << 4;
            if ( *++s == '\0' ) {
                break;
            }
            *p++ += ldap_int_unhex( *s );
        } else {
            *p++ = *s;
        }
    }

    *p = '\0';
}
static int ldap_int_unhex( int c )
{
    return( c >= '0' && c <= '9' ? c - '0'
        : c >= 'A' && c <= 'F' ? c - 'A' + 10
        : c - 'a' + 10 );
}
static int str2scope( const char *p )
{
    if ( stricmp( p, "one" ) == 0 ) {
        return LDAP_SCOPE_ONELEVEL;

    } else if ( stricmp( p, "onetree" ) == 0 ) {
        return LDAP_SCOPE_ONELEVEL;

    } else if ( stricmp( p, "base" ) == 0 ) {
        return LDAP_SCOPE_BASE;

    } else if ( stricmp( p, "sub" ) == 0 ) {
        return LDAP_SCOPE_SUBTREE;

    } else if ( stricmp( p, "subtree" ) == 0 ) {
        return LDAP_SCOPE_SUBTREE;
    }

    return( -1 );
}
char ** PKIFLDAP::ldap_str2charray( const char *str_in, const char *brkstr )
{
    char    **res;
    char    *str, *s;
    char    *lasts;
    int i;

    /* protect the input string from strtok */
    str = LDAP_STRDUP( str_in );
    if( str == NULL ) {
        return NULL;
    }

    i = 1;
    for ( s = str; *s; s++ ) {
        if ( ldap_utf8_strchr( brkstr, s ) != NULL ) {
            i++;
        }
    }

    res = (char **) LDAP_MALLOC( (i + 1) * sizeof(char *) );

    if( res == NULL ) {
        LDAP_FREE( str );
        return NULL;
    }

    i = 0;

    for ( s = ldap_utf8_strtok( str, brkstr, &lasts );
        s != NULL;
        s = ldap_utf8_strtok( NULL, brkstr, &lasts ) )
    {
        res[i] = LDAP_STRDUP( s );

        if(res[i] == NULL) {
            for( --i ; i >= 0 ; i-- ) {
                LDAP_FREE( res[i] );
            }
            LDAP_FREE( res );
            LDAP_FREE( str );
            return NULL;
        }

        i++;
    }

    res[i] = NULL;

    LDAP_FREE( str );
    return( res );
}


/* like strtok_r(), not strtok() */
char *(PKIFLDAP::ldap_utf8_strtok)(char *str, const char *sep, char **last)
{
    char *begin;
    char *end;

    if( last == NULL ) return NULL;

    begin = str ? str : *last;

    begin += ldap_utf8_strspn( begin, sep );

    if( *begin == '\0' ) {
        *last = NULL;
        return NULL;
    }

    end = &begin[ ldap_utf8_strcspn( begin, sep ) ];

    if( *end != '\0' ) {
        char *next = LDAP_UTF8_NEXT( end );
        *end = '\0';
        end = next;
    }

    *last = end;
    return begin;
}
char * (PKIFLDAP::ldap_utf8_strchr)( const char *str, const char *chr )
{
    for( ; *str != '\0'; LDAP_UTF8_INCR(str) ) {
        if( ldap_x_utf8_to_ucs4( str ) == ldap_x_utf8_to_ucs4( chr ) ) {
            return (char *) str;
        } 
    }

    return NULL;
}

/* like strcspn() but returns number of bytes, not characters */
PKIFLDAP::ber_len_t (PKIFLDAP::ldap_utf8_strcspn)( const char *str, const char *set )
{
    const char *cstr;
    const char *cset;

    for( cstr = str; *cstr != '\0'; LDAP_UTF8_INCR(cstr) ) {
        for( cset = set; *cset != '\0'; LDAP_UTF8_INCR(cset) ) {
            if( ldap_x_utf8_to_ucs4( cstr ) == ldap_x_utf8_to_ucs4( cset ) ) {
                return static_cast<PKIFLDAP::ber_len_t>(cstr - str);
            } 
        }
    }

    //reviewed this and above - 4/25 - pointer is 4 bytes, difference fits in unsigned long
    return static_cast<PKIFLDAP::ber_len_t>(cstr - str);
}

/* like strspn() but returns number of bytes, not characters */
PKIFLDAP::ber_len_t (PKIFLDAP::ldap_utf8_strspn)( const char *str, const char *set )
{
    const char *cstr;
    const char *cset;

    for( cstr = str; *cstr != '\0'; LDAP_UTF8_INCR(cstr) ) {
        for( cset = set; ; LDAP_UTF8_INCR(cset) ) {
            if( *cset == '\0' ) {
                return static_cast<PKIFLDAP::ber_len_t>(cstr - str);
            }

            if( ldap_x_utf8_to_ucs4( cstr ) == ldap_x_utf8_to_ucs4( cset ) ) {
                break;
            } 
        }
    }

    //reviewed this and above - 4/25 - pointer is 4 bytes, difference fits in unsigned long
    return static_cast<PKIFLDAP::ber_len_t>(cstr - str);
}

/* conv UTF-8 to UCS-4, useful for comparisons */
PKIFLDAP::ldap_ucs4_t PKIFLDAP::ldap_x_utf8_to_ucs4( const char * p )
{
    const unsigned char *c = (const unsigned char *)p;
    ldap_ucs4_t ch;
    int len, i;
    static unsigned char mask[] = {
        0, 0x7f, 0x1f, 0x0f, 0x07, 0x03, 0x01 };

    len = LDAP_UTF8_CHARLEN2(p, len);

    if( len == 0 ) return LDAP_UCS4_INVALID;

    ch = c[0] & mask[len];

    for(i=1; i < len; i++) {
        if ((c[i] & 0xc0) != 0x80) {
            return LDAP_UCS4_INVALID;
        }

        ch <<= 6;
        ch |= c[i] & 0x3f;
    }

    return ch;
}
char* PKIFLDAP::ldap_utf8_next( const char * p )
{
    int i;
    const unsigned char *u = (const unsigned char *)p;

    if( LDAP_UTF8_ISASCII(u) ) {
        return (char *) &p[1];
    }

    for( i=1; i<6; i++ ) {
        if ( ( u[i] & 0xc0 ) != 0x80 ) {
            return (char *) &p[i];
        }
    }

    return (char *) &p[i];
}