# $Id$ # # LDAP PDU support classes # # #---------------------------------------------------------------------------- # # Copyright (C) 2006 by Francis Cianfrocca. All Rights Reserved. # # Gmail: garbagecat10 # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA # #--------------------------------------------------------------------------- # module Net class LdapPduError < Exception; end class LdapPdu BindRequest = 0 BindResult = 1 UnbindRequest = 2 SearchRequest = 3 SearchReturnedData = 4 SearchResult = 5 ModifyResponse = 7 AddResponse = 9 DeleteResponse = 11 ModifyRDNResponse = 13 SearchResultReferral = 19 ExtendedRequest = 23 ExtendedResponse = 24 attr_reader :msg_id, :app_tag attr_reader :search_dn, :search_attributes, :search_entry attr_reader :search_referrals attr_reader :search_parameters, :bind_parameters # # initialize # An LDAP PDU always looks like a BerSequence with # at least two elements: an integer (message-id number), and # an application-specific sequence. # Some LDAPv3 packets also include an optional # third element, which is a sequence of "controls" # (See RFC 2251, section 4.1.12). # The application-specific tag in the sequence tells # us what kind of packet it is, and each kind has its # own format, defined in RFC-1777. # Observe that many clients (such as ldapsearch) # do not necessarily enforce the expected application # tags on received protocol packets. This implementation # does interpret the RFC strictly in this regard, and # it remains to be seen whether there are servers out # there that will not work well with our approach. # # Added a controls-processor to SearchResult. # Didn't add it everywhere because it just _feels_ # like it will need to be refactored. # def initialize ber_object begin @msg_id = ber_object[0].to_i # Modified 25Nov06. We want to "un-decorate" the ber-identifier # of the incoming packet. Originally we did this by subtracting 0x60, # which ASSUMES the identifier is a constructed app-specific value. # But at least one value (UnbindRequest) is app-specific primitive. # So it makes more sense just to grab the bottom five bits. #@app_tag = ber_object[1].ber_identifier - 0x60 @app_tag = ber_object[1].ber_identifier & 31 rescue # any error becomes a data-format error raise LdapPduError.new( "ldap-pdu format error" ) end case @app_tag when BindResult parse_bind_response ber_object[1] when SearchReturnedData parse_search_return ber_object[1] when SearchResultReferral parse_search_referral ber_object[1] when SearchResult parse_ldap_result ber_object[1] parse_controls(ber_object[2]) if ber_object[2] when ModifyResponse parse_ldap_result ber_object[1] when AddResponse parse_ldap_result ber_object[1] when DeleteResponse parse_ldap_result ber_object[1] when ModifyRDNResponse parse_ldap_result ber_object[1] when SearchRequest parse_ldap_search_request ber_object[1] when BindRequest parse_bind_request ber_object[1] when UnbindRequest parse_unbind_request ber_object[1] when ExtendedResponse parse_ldap_result ber_object[1] else raise LdapPduError.new( "unknown pdu-type: #{@app_tag}" ) end end # Returns a hash which (usually) defines the members :resultCode, :errorMessage, and :matchedDN. # These values come directly from an LDAP response packet returned by the remote peer. # See #result_code for a sugaring. # def result @ldap_result || {} end # # result_code # This returns an LDAP result code taken from the PDU, # but it will be nil if there wasn't a result code. # That can easily happen depending on the type of packet. # def result_code code = :resultCode @ldap_result and @ldap_result[code] end # Return RFC-2251 Controls if any. # Messy. Does this functionality belong somewhere else? def result_controls @ldap_controls || [] end # Return serverSaslCreds, which are only present in BindResponse packets. # Messy. Does this functionality belong somewhere else? # We ought to refactor the accessors of this class before they get any kludgier. def result_server_sasl_creds @ldap_result && @ldap_result[:serverSaslCreds] end # # parse_ldap_result # def parse_ldap_result sequence sequence.length >= 3 or raise LdapPduError @ldap_result = {:resultCode => sequence[0], :matchedDN => sequence[1], :errorMessage => sequence[2]} end private :parse_ldap_result # # parse_bind_response # A Bind Response may have an additional field, ID [7], serverSaslCreds, per RFC 2251 pgh 4.2.3. # def parse_bind_response sequence sequence.length >= 3 or raise LdapPduError @ldap_result = {:resultCode => sequence[0], :matchedDN => sequence[1], :errorMessage => sequence[2]} @ldap_result[:serverSaslCreds] = sequence[3] if sequence.length >= 4 @ldap_result end private :parse_bind_response # # parse_search_return # Definition from RFC 1777 (we're handling application-4 here) # # Search Response ::= # CHOICE { # entry [APPLICATION 4] SEQUENCE { # objectName LDAPDN, # attributes SEQUENCE OF SEQUENCE { # AttributeType, # SET OF AttributeValue # } # }, # resultCode [APPLICATION 5] LDAPResult # } # # We concoct a search response that is a hash of the returned attribute values. # NOW OBSERVE CAREFULLY: WE ARE DOWNCASING THE RETURNED ATTRIBUTE NAMES. # This is to make them more predictable for user programs, but it # may not be a good idea. Maybe this should be configurable. # ALTERNATE IMPLEMENTATION: In addition to @search_dn and @search_attributes, # we also return @search_entry, which is an LDAP::Entry object. # If that works out well, then we'll remove the first two. # # Provisionally removed obsolete search_attributes and search_dn, 04May06. # def parse_search_return sequence sequence.length >= 2 or raise LdapPduError @search_entry = LDAP::Entry.new( sequence[0] ) sequence[1].each {|seq| @search_entry[seq[0]] = seq[1] } end # # A search referral is a sequence of one or more LDAP URIs. # Any number of search-referral replies can be returned by the server, interspersed # with normal replies in any order. # Until I can think of a better way to do this, we'll return the referrals as an array. # It'll be up to higher-level handlers to expose something reasonable to the client. def parse_search_referral uris @search_referrals = uris end # Per RFC 2251, an LDAP "control" is a sequence of tuples, each consisting # of an OID, a boolean criticality flag defaulting FALSE, and an OPTIONAL # Octet String. If only two fields are given, the second one may be # either criticality or data, since criticality has a default value. # Someday we may want to come back here and add support for some of # more-widely used controls. RFC-2696 is a good example. # def parse_controls sequence @ldap_controls = sequence.map do |control| o = OpenStruct.new o.oid,o.criticality,o.value = control[0],control[1],control[2] if o.criticality and o.criticality.is_a?(String) o.value = o.criticality o.criticality = false end o end end private :parse_controls # (provisional, must document) def parse_ldap_search_request sequence s = OpenStruct.new s.base_object, s.scope, s.deref_aliases, s.size_limit, s.time_limit, s.types_only, s.filter, s.attributes = sequence @search_parameters = s end # (provisional, must document) def parse_bind_request sequence s = OpenStruct.new s.version, s.name, s.authentication = sequence @bind_parameters = s end # (provisional, must document) # UnbindRequest has no content so this is a no-op. def parse_unbind_request sequence end end end # module Net