aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--dirmngr/dirmngr.h1
-rw-r--r--dirmngr/dirmngr_ldap.c15
-rw-r--r--dirmngr/ks-engine-ldap.c20
-rw-r--r--dirmngr/ldap.c10
-rw-r--r--dirmngr/ldapserver.c5
-rw-r--r--doc/dirmngr.texi3
6 files changed, 51 insertions, 3 deletions
diff --git a/dirmngr/dirmngr.h b/dirmngr/dirmngr.h
index 369102d54..66a710e39 100644
--- a/dirmngr/dirmngr.h
+++ b/dirmngr/dirmngr.h
@@ -54,6 +54,7 @@ struct ldap_server_s
unsigned int starttls:1; /* Use STARTTLS. */
unsigned int ldap_over_tls:1; /* Use LDAP over an TLS tunnel */
unsigned int ntds:1; /* Use Active Directory authentication. */
+ unsigned int areconly:1; /* Set LDAP_OPT_AREC_EXCLUSIVE. */
};
typedef struct ldap_server_s *ldap_server_t;
diff --git a/dirmngr/dirmngr_ldap.c b/dirmngr/dirmngr_ldap.c
index ea0da6c9d..10bf1ac84 100644
--- a/dirmngr/dirmngr_ldap.c
+++ b/dirmngr/dirmngr_ldap.c
@@ -92,6 +92,7 @@ enum
oStartTLS,
oLdapTLS,
oNtds,
+ oARecOnly,
oOnlySearchTimeout,
oLogWithPID
@@ -110,6 +111,7 @@ static ARGPARSE_OPTS opts[] = {
{ oStartTLS, "starttls", 0, "use STARTLS for the conenction"},
{ oLdapTLS, "ldaptls", 0, "use a TLS for the connection"},
{ oNtds, "ntds", 0, "authenticate using AD"},
+ { oARecOnly, "areconly", 0, "do only an A record lookup"},
{ oHost, "host", 2, "|NAME|connect to host NAME"},
{ oPort, "port", 1, "|N|connect to port N"},
{ oUser, "user", 2, "|NAME|use NAME for authentication"},
@@ -135,6 +137,7 @@ static struct
int starttls;
int ldaptls;
int ntds;
+ int areconly;
estream_t outstream; /* Send output to this stream. */
@@ -235,6 +238,7 @@ main (int argc, char **argv)
case oStartTLS: opt.starttls = 1; opt.ldaptls = 0; break;
case oLdapTLS: opt.starttls = 0; opt.ldaptls = 1; break;
case oNtds: opt.ntds = 1; break;
+ case oARecOnly: opt.areconly = 1; break;
case oMulti: opt.multi = 1; break;
case oUser: opt.user = pargs.r.ret_str; break;
case oPass: opt.pass = pargs.r.ret_str; break;
@@ -437,6 +441,17 @@ connect_ldap (LDAP **r_ld)
opt.host, opt.port, ldap_err2string (lerr));
goto leave;
}
+ if (opt.areconly)
+ {
+ lerr = ldap_set_option (ld, LDAP_OPT_AREC_EXCLUSIVE, LDAP_OPT_ON);
+ if (lerr != LDAP_SUCCESS)
+ {
+ log_error ("ldap: unable to set AREC_EXLUSIVE: %s\n",
+ ldap_err2string (lerr));
+ err = ldap_err_to_gpg_err (lerr);
+ goto leave;
+ }
+ }
#else /* Unix */
tmpstr = xtryasprintf ("%s://%s:%d",
opt.ldaptls? "ldaps" : "ldap",
diff --git a/dirmngr/ks-engine-ldap.c b/dirmngr/ks-engine-ldap.c
index 6bf19cb1f..3a71af2d8 100644
--- a/dirmngr/ks-engine-ldap.c
+++ b/dirmngr/ks-engine-ldap.c
@@ -338,6 +338,7 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
int port; /* Port to use. */
int use_tls; /* 1 = starttls, 2 = ldap-over-tls */
int use_ntds; /* Use Active Directory authentication. */
+ int use_areconly; /* Lookup only via A record (Windows). */
const char *bindname;
const char *password;
const char *basedn_arg;
@@ -365,6 +366,7 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
basedn_arg = server->base;
use_tls = server->starttls? 1 : server->ldap_over_tls? 2 : 0;
use_ntds = server->ntds;
+ use_areconly = server->areconly;
}
else
{
@@ -375,6 +377,7 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
basedn_arg = uri->path;
use_tls = uri->use_tls ? 1 : 0;
use_ntds = uri->ad_current;
+ use_areconly = 0;
}
if (!port)
@@ -392,13 +395,14 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
}
if (opt.verbose)
- log_info ("ldap connect to '%s:%d:%s:%s:%s:%s%s'\n",
+ log_info ("ldap connect to '%s:%d:%s:%s:%s:%s%s%s'\n",
host, port,
basedn_arg ? basedn_arg : "",
bindname ? bindname : "",
password ? "*****" : "",
use_tls == 1? "starttls" : use_tls == 2? "ldaptls" : "plain",
- use_ntds ? ",ntds":"");
+ use_ntds ? ",ntds":"",
+ use_areconly? ",areconly":"");
/* If the uri specifies a secure connection and we don't support
@@ -427,6 +431,18 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
host, port, ldap_err2string (lerr));
goto out;
}
+ if (use_areconly)
+ {
+ lerr = ldap_set_option (ldap_conn, LDAP_OPT_AREC_EXCLUSIVE, LDAP_OPT_ON);
+ if (lerr != LDAP_SUCCESS)
+ {
+ log_error ("ks-ldap: unable to set LDAP_OPT_AREC_EXLUSIVE: %s\n",
+ ldap_err2string (lerr));
+ err = ldap_err_to_gpg_err (lerr);
+ goto out;
+ }
+ }
+
#else /* Unix */
tmpstr = xtryasprintf ("%s://%s:%d",
use_tls == 2? "ldaps" : "ldap",
diff --git a/dirmngr/ldap.c b/dirmngr/ldap.c
index 86c2060f2..e1f1d7f1c 100644
--- a/dirmngr/ldap.c
+++ b/dirmngr/ldap.c
@@ -119,13 +119,14 @@ run_ldap_wrapper (ctrl_t ctrl,
int multi_mode,
int tls_mode,
int ntds,
+ int areconly,
const char *proxy,
const char *host, int port,
const char *user, const char *pass,
const char *base, const char *filter, const char *attr,
ksba_reader_t *reader)
{
- const char *argv[50];
+ const char *argv[51];
int argc;
char portbuf[30], timeoutbuf[30];
@@ -156,6 +157,9 @@ run_ldap_wrapper (ctrl_t ctrl,
if (ntds)
argv[argc++] = "--ntds";
+ if (areconly)
+ argv[argc++] = "--areconly";
+
if (opt.ldaptimeout)
{
snprintf (timeoutbuf, sizeof timeoutbuf, "%u", opt.ldaptimeout);
@@ -246,6 +250,7 @@ url_fetch_ldap (ctrl_t ctrl, const char *url, ksba_reader_t *reader)
0, /* No Multi-mode. */
tls_mode,
0, /* No AD authentication. */
+ 0, /* No areconly. */
opt.ldap_proxy,
ludp->lud_host, ludp->lud_port,
NULL, NULL, /* user, password */
@@ -292,6 +297,7 @@ url_fetch_ldap (ctrl_t ctrl, const char *url, ksba_reader_t *reader)
0, /* No Multi-mode */
tls_mode,
server->ntds,
+ server->areconly,
NULL,
server->host, server->port,
server->user, server->pass,
@@ -342,6 +348,7 @@ attr_fetch_ldap (ctrl_t ctrl,
0,
tls_mode,
server->ntds,
+ server->areconly,
opt.ldap_proxy,
server->host, server->port,
server->user, server->pass,
@@ -609,6 +616,7 @@ start_cacert_fetch_ldap (ctrl_t ctrl, cert_fetch_context_t *r_context,
1, /* --multi (record format) */
0, /* No TLS */
0, /* No AD authentication. */
+ server->areconly,
opt.ldap_proxy,
server->host, server->port,
server->user, server->pass,
diff --git a/dirmngr/ldapserver.c b/dirmngr/ldapserver.c
index 7d101c52e..0f859539e 100644
--- a/dirmngr/ldapserver.c
+++ b/dirmngr/ldapserver.c
@@ -64,6 +64,7 @@ ldapserver_list_free (ldap_server_t servers)
plain := Switch to plain unsecured LDAP.
(The last of these 3 flags is the effective one)
ntds := Use Active Directory authentication
+ areconly := Use option LDAP_OPT_AREC_EXCLUSIVE
FILENAME and LINENO are used for diagnostic purposes only.
*/
@@ -175,6 +176,10 @@ ldapserver_parse_one (char *line,
{
server->ntds = 1;
}
+ else if (!ascii_strcasecmp (s, "areconly"))
+ {
+ server->areconly = 1;
+ }
else
{
if (filename)
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index e47f39c0b..d6ef37581 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -485,6 +485,9 @@ Tunnel LDAP through a TLS connection; the default port is 636.
@item ntds
On Windows authenticate the LDAP connection using the Active Directory
with the current user.
+@item areconly
+On Windows use only the A or AAAA record when resolving the LDAP
+server name.
@end table
Note that in an URL style specification the scheme @code{ldaps://}
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-20 11:12:33 +0000