Re: [exim] LDAP problem - Fix & patch to exim

Αρχική Σελίδα
Delete this message
Reply to this message
Συντάκτης: Alain Williams
Ημερομηνία:  
Προς: exim-users
Παλιά Θέματα: [exim] LDAP problem
Αντικείμενο: Re: [exim] LDAP problem - Fix & patch to exim
On Wed, Jul 12, 2006 at 07:46:25PM +0100, Alain Williams wrote:
> Hi,
>
> I am trying to use LDAP from exim to determine which (MS Exchange) machine to deliver mail to.
> This is in a largish (1500) company with multiple sites. I am querying the local MS Active Directory servers.
> My Linux box is relegated to the DMZ and is restricted to what it can see.
> ....


I have now found and fixed this problem. The LDAP servers (MS Active Directory) all had the
full database (through replication) but insisted on sending referrals back to the client;
the client (exim) was unable to reach these other servers due to firewall/... restrictions.

There is a standard LDAP library option to not follow referrals, exim does not allow this to
be set (it allows DEREFERENCEing) which is different. Please find attached a patch that adds this
to exim; the default is the standard LDAP default of following referrals - so existing configurations
should not break.

I have tested this on my client's box (RedHat enterprise 4 (openldap-2.2.13), with MS Active
Directory LDAP servers) and it works for me. It *should* work elsewhere. If it does not
compile, try surrounding my additions with:
    #ifdef LDAP_OPT_REFERRALS


--
Alain Williams
Parliament Hill Computers Ltd.
Linux Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256 http://www.phcomp.co.uk/

#include <std_disclaimer.h>
--- src/lookups/ldap.c.old    2006-04-28 11:32:22.000000000 +0100
+++ src/lookups/ldap.c    2006-07-13 08:46:03.233143808 +0100
@@ -132,6 +132,8 @@
   tcplimit      max time for network activity, e.g. connect, or 0 for OS default
   deference     the dereference option, which is one of
                   LDAP_DEREF_{NEVER,SEARCHING,FINDING,ALWAYS}
+  referrals     Specifies whether referrals returned by LDAP servers will be followed,
+                  one of: LDAP_OPT_ON or LDAP_OPT_OFF


 Returns:        OK or FAIL or DEFER
                 FAIL is given only if a lookup was performed successfully, but
@@ -141,7 +143,7 @@
 static int
 perform_ldap_search(uschar *ldap_url, uschar *server, int s_port, int search_type,
   uschar **res, uschar **errmsg, BOOL *defer_break, uschar *user, uschar *password,
-  int sizelimit, int timelimit, int tcplimit, int dereference)
+  int sizelimit, int timelimit, int tcplimit, int dereference, void* referrals)
 {
 LDAPURLDesc     *ludp = NULL;
 LDAPMessage     *result = NULL;
@@ -551,6 +553,9 @@
 ldap_set_option(lcp->ld, LDAP_OPT_DEREF, (void *)&dereference);
 #endif


+/* Should the library follow referrals that the LDAP server may return: */
+ldap_set_option( lcp->ld, LDAP_OPT_REFERRALS, referrals);
+
/* Start the search on the server. */

DEBUG(D_lookup) debug_printf("Start search\n");
@@ -973,6 +978,7 @@
int sizelimit = LDAP_NO_LIMIT;
int tcplimit = 0;
int dereference = LDAP_DEREF_NEVER;
+void* referrals = LDAP_OPT_ON;
int sep = 0;
uschar *url = ldap_url;
uschar *p;
@@ -1030,6 +1036,19 @@

       #endif


+      else if (strncmpic(name, US"REFERRALS=", namelen) == 0)
+        {
+        if (strcmpic(value, US"follow") == 0) referrals = LDAP_OPT_ON;
+        else if (strcmpic(value, US"nofollow") == 0)
+          referrals = LDAP_OPT_OFF;
+        else
+          {
+          *errmsg = string_sprintf("LDAP option REFERRALS not given value follow or nofollow");
+          DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
+          return DEFER;
+          }
+        }
+
       else
         {
         *errmsg =
@@ -1076,8 +1095,8 @@


 DEBUG(D_lookup)
   debug_printf("LDAP parameters: user=%s pass=%s size=%d time=%d connect=%d "
-    "dereference=%d\n", user, password, sizelimit, timelimit, tcplimit,
-    dereference);
+    "dereference=%d referrals=%s\n", user, password, sizelimit, timelimit, tcplimit,
+    dereference, (referrals == LDAP_OPT_ON ? "on" : "off"));


 /* If the request is just to check authentication, some credentials must
 be given. The password must not be empty because LDAP binds with an empty
@@ -1114,7 +1133,7 @@
 if (eldap_default_servers == NULL || p[3] != '/')
   {
   return perform_ldap_search(url, NULL, 0, search_type, res, errmsg,
-    &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference);
+    &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference, referrals);
   }


 /* Loop through the default servers until OK or FAIL */
@@ -1131,7 +1150,7 @@
     port = Uatoi(colon+1);
     }
   rc = perform_ldap_search(url, server, port, search_type, res, errmsg,
-    &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference);
+    &defer_break, user, password, sizelimit, timelimit, tcplimit, dereference, referrals);
   if (rc != DEFER || defer_break) return rc;
   }


--- doc/spec.txt.old    2006-04-28 11:32:23.000000000 +0100
+++ doc/spec.txt    2006-07-13 10:05:36.521493680 +0100
@@ -6291,10 +6291,27 @@
 PASS         set the password, likewise
 SIZE         set the limit for the number of entries returned
 TIME         set the maximum waiting time for a query
+REFERRALS    set if referrals to other LDAP servers are to be followed


The value of the DEREFERENCE parameter must be one of the words "never",
"searching", "finding", or "always".

+The value of the REFERRALS parameter must be one of the words "follow" or
+"nofollow", the default is "follow". If there are several LDAP servers the
+first one queried may return the addresses of other LDAP servers of which the
+client (ie exim) may ask the same question. This referral to other LDAP
+servers makes sense in a distributed environment where no one server may have
+all of the answers. This is likely to be returned where the baseDN only covers
+part of the domain - so the referrals suggest where to find out about other
+parts of the domain - this is termed following a referral and is the default
+action of the LDAP library. In a redundent system each LDAP server may be master
+of it's part of the domain but also keeps the information for the entire domain;
+so in spite of it knowing (and returning) all the answers it may still refer
+to other servers (Microsoft Active Directory does this). A problem may arise
+if the other servers are not available, in which case exim may loop in the
+LDAP library trying to access the other servers. NETTIME does not help since
+it is the timeout for accessing an individual server.
+
The name CONNECT is an obsolete name for NETTIME, retained for backwards
compatibility. This timeout (specified as a number of seconds) is enforced from
the client end for operations that can be carried out over a network.