20260408 Fixes search handling to allow clients that search without binding. (#140)

Author: Firstyear

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "ldap-proxy"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

Cargo.toml

@@ -1,15 +1,15 @@
 FROM opensuse/tumbleweed:latest AS ref_repo
 
-RUN sed -i -E 's/https?:\/\/download.opensuse.org/https:\/\/mirrorcache.firstyear.id.au/g' /etc/zypp/repos.d/*.repo && \
+RUN sed -i -E 's/https?:\/\/download.opensuse.org/http:\/\/suse-updates.int.firstyear.id.au\/opensuse/g' /etc/zypp/repos.d/*.repo && \
     zypper --gpg-auto-import-keys ref --force
 
 # // setup the builder pkgs
 FROM ref_repo AS build_base
-RUN zypper install -y cargo rust gcc libopenssl-3-devel sccache perl make gawk
+RUN zypper install -y cargo rust gcc sccache
 
 # // setup the runner pkgs
 FROM ref_repo AS run_base
-RUN zypper install -y sqlite3 openssl-3 timezone iputils iproute2 openldap2-client
+RUN zypper install -y timezone iputils iproute2 openldap2-client
 COPY SUSE_CA_Root.pem /etc/pki/trust/anchors/
 RUN /usr/sbin/update-ca-certificates
 

Dockerfile

@@ -215,7 +215,7 @@ async fn search<W: AsyncWrite + Unpin>(
     w: &mut FramedWrite<W, LdapCodec>,
     app_state: &AppState,
     search_request: SearchRequest<'_>,
-) -> Result<Option<ClientState>, LdapError> {
+) -> Result<(), LdapError> {
     let SearchRequest {
         sr,
         msgid,
@@ -265,7 +265,7 @@ async fn search<W: AsyncWrite + Unpin>(
                 LdapError::Transport
             })?;
 
-            return Ok(None);
+            return Ok(());
         }
     };
 
@@ -328,7 +328,7 @@ async fn search<W: AsyncWrite + Unpin>(
                     })?;
 
                     // Error sent, return with no state change.
-                    return Ok(None);
+                    return Ok(());
                 }
             }
         }
@@ -378,7 +378,7 @@ async fn search<W: AsyncWrite + Unpin>(
     app_state.cache.try_quiesce();
 
     // No state change
-    Ok(None)
+    Ok(())
 }
 
 #[instrument(level = "info", skip_all)]
@@ -471,6 +471,56 @@ pub async fn client_process<W: AsyncWrite + Unpin, R: AsyncRead + Unpin>(
                 break;
             }
 
+            // Unbound handler
+            (
+                ClientState::Unbound,
+                LdapMsg {
+                    msgid,
+                    op: LdapOp::SearchRequest(sr),
+                    ctrl,
+                },
+            ) => {
+                // We have to trigger a bind first in case we have a mapping.
+                let lbr = LdapBindRequest {
+                    dn: "".to_string(),
+                    cred: LdapBindCred::Simple("".to_string()),
+                };
+
+                let mut next_state = match bind(&mut w, &app_state, lbr, 0, Vec::default()).await {
+                    Ok(ns) => ns,
+                    Err(_) => break,
+                };
+
+                match &mut next_state {
+                    Some(ClientState::Unbound) | None => {
+                        error!("Invalid state, bind did not return an authenticated state!");
+                        break;
+                    }
+                    Some(ClientState::Authenticated {
+                        dn,
+                        display_dn,
+                        config,
+                        ref mut client,
+                    }) => {
+                        let search_req = SearchRequest {
+                            sr,
+                            msgid,
+                            ctrl,
+                            dn,
+                            display_dn,
+                            config,
+                            client,
+                        };
+                        match search(&mut w, &app_state, search_req).await {
+                            Ok(()) => {}
+                            Err(_) => break,
+                        }
+                    }
+                }
+
+                next_state
+            }
+
             // Authenticated message handler.
             //  - Search
             (
@@ -497,7 +547,7 @@ pub async fn client_process<W: AsyncWrite + Unpin, R: AsyncRead + Unpin>(
                 };
 
                 match search(&mut w, &app_state, search_req).await {
-                    Ok(ns) => ns,
+                    Ok(()) => None,
                     Err(_) => break,
                 }
             }
@@ -520,7 +570,7 @@ pub async fn client_process<W: AsyncWrite + Unpin, R: AsyncRead + Unpin>(
             },
             // Unknown message handler.
             (_, msg) => {
-                debug!(?msg);
+                debug!(?msg, "Invalid message state, triggering disconnection");
                 // Return a disconnect.
                 break;
             }