[exim-dev] LDAP multiline attribute oddity

Top Page

Reply to this message
Author: Graeme Fowler
Date:  
To: exim-dev
Subject: [exim-dev] LDAP multiline attribute oddity
Hi folks

My "not being a programmer" problem has reared its head again, and I need some help debugging a (possibly esoteric) problem in 4.86 onwards (I haven't checked before that).

Long and short of it (code in lookups/ldap.c):

At work (courtesy of some sterling work by Mike Cardwell some time ago), we have a method of looking up the MS Exchange blocked/safe senders via LDAP and comparing sender addresses against them - this can avoid us backscattering by moving the rejection "up the stack" to our border MX farm.

However, someone has recently raised a case with us that email sent by a sender which has been added to their blocked senders list is still being delivered. Here's where the problem lies - this user has hundreds of addresses in their blocked (and safe) senders list, which in turn is exposed as a multi-line (note NOT multi-value, nor multi-instance) attribute by the LDAP query. Mine, however, is very short and returns a single line attribute.

In my case, Exim looks it up and all is well. This is the expected behaviour.

In the multiline case, we get an empty result despite being able to see the data on the wire/in strace. This, self-evidently, is not what I expect to happen!

Using ltrace, the issue appears to be with the call to ldap_get_values, which I suspect is not being handed the full response (or is being handed a response with newlines in and doesn't like that) and subsequently returns a value of 0.

In both cases the call flow is:

ldap_search
ldap_result
ldap_first_entry
ldap_get_dn
ldap_first_attribute
ldap_get_values

The divergence happens with the response to the last call. Unfortunately I'm now at something of a loss as to how to fix this.

Any ideas, folks? Especially those which stop me making things crash, or fail to build altogether!

Graeme