On 29 Jun 2015, at 09:48, Michael Ströder <michael@stroeder.com> wrote:
Arran Cudbard-Bell wrote:
On 29 Jun 2015, at 05:01, Michael Ströder <michael@stroeder.com> wrote:
HI!
Testing git v3.1.x 36e1b02e926df5cd75d4d548694401535c607ca9 I noticed that something's wrong with LDAPI URLs containing a URL-encoded path.
This does not work:
server = 'ldapi://%2Ftmp%2Fopenldap-socket'
leads to:
rlm_ldap (ldap): Bind with uid=radiusd,ou=sys,dc=stroeder,dc=local to ldapi:///tmp/openldap-socket failed: Can't contact LDAP server
I'm not sure whether radiusd URL-decodes the path and passes "ldapi:///tmp/openldap-socket" to libldap or whether the decoding simply happens when writing the log line.
It should *not* do URL-decoding because parsing the LDAP URL "ldapi:///tmp/openldap-socket" in libldap won't work since the first "/" after the "hostport" part is the next separator to the DN portion.
It's actually ldap_url_parse doing more than what's claimed in the man page entry:
ldap_url_parse() breaks down an LDAP URL passed in url into its component pieces. If successful, zero is returned, an LDAP URL description is allocated, filled in, and ludpp is set to point to it. If an error occurs, a non-zero URL error code is returned.
In addition to breaking the components down, it also url unescapes them *sigh*.
Yes, it has to for using the URI components later.
It's a public function, for breaking a url into components, it should do what its man page entry says it should do. There's an internal version which accepts compatibility flags, if they need the components unescaped for internal use they could of used that. Breaking the URL into its components does not require unescaping. The component separators '/' and '?' are not escaped. See here: https://tools.ietf.org/html/rfc2255#section-3
That's what module ldapurl in python-ldap also does. Unparsing the components to a valid LDAP URL is more.
OK.
So the solution is to re-escape the host portion. I'll push a fix in a bit.
Hmm, I'd prefer you to simply pass the configured original string to libldap and use result code of ldap_url_parse() just as proof that it's a valid LDAP URI.
base_dn, filter, scope and attributes need stripping. We don't support specifying them via the URL. I guess we could error out if any of those components were found -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2