ldap/apr_ldap_url.c - apr-util - Git at Google

 /* Licensed to the Apache Software Foundation (ASF) under one or more
  * contributor license agreements.  See the NOTICE file distributed with
  * this work for additional information regarding copyright ownership.
  * The ASF licenses this file to You under the Apache License, Version 2.0
  * (the "License"); you may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 /* Portions Copyright 1998-2002 The OpenLDAP Foundation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted only as authorized by the OpenLDAP
  * Public License.  A copy of this license is available at
  * http://www.OpenLDAP.org/license.html or in file LICENSE in the
  * top-level directory of the distribution.
  *
  * OpenLDAP is a registered trademark of the OpenLDAP Foundation.
  *
  * Individual files and/or contributed packages may be copyright by
  * other parties and subject to additional restrictions.
  *
  * This work is derived from the University of Michigan LDAP v3.3
  * distribution.  Information concerning this software is available
  * at: http://www.umich.edu/~dirsvcs/ldap/
  *
  * This work also contains materials derived from public sources.
  *
  * Additional information about OpenLDAP can be obtained at:
  *     http://www.openldap.org/
  */

 /*
  * Portions Copyright (c) 1992-1996 Regents of the University of Michigan.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
  * provided that this notice is preserved and that due credit is given
  * to the University of Michigan at Ann Arbor. The name of the University
  * may not be used to endorse or promote products derived from this
  * software without specific prior written permission. This software
  * is provided ``as is'' without express or implied warranty.
  */

 /*  apr_ldap_url.c -- LDAP URL (RFC 2255) related routines
  *
  *  Win32 and perhaps other non-OpenLDAP based ldap libraries may be
  *  missing ldap_url_* APIs.  We focus here on the one significant
  *  aspect, which is parsing.  We have [for the time being] omitted
  *  the ldap_url_search APIs.
  *
  *  LDAP URLs look like this:
  *    ldap[is]://host:port[/[dn[?[attributes][?[scope][?[filter][?exts]]]]]]
  *
  *  where:
  *   attributes is a comma separated list
  *   scope is one of these three strings:  base one sub (default=base)
  *   filter is an string-represented filter as in RFC 2254
  *
  *  e.g.,  ldap://host:port/dc=com?o,cn?base?o=openldap?extension
  *
  *  Tolerates URLs that look like: <ldapurl> and <URL:ldapurl>
  */

 #include "apu.h"
 #include "apr_pools.h"
 #include "apr_general.h"
 #include "apr_strings.h"
 #include "apr_ldap.h"

 #if APR_HAS_LDAP

 #if APR_HAVE_STDLIB_H
 #include <stdlib.h>
 #endif

 #ifndef LDAPS_PORT
 #define LDAPS_PORT              636  /* ldaps:/// default LDAP over TLS port */
 #endif

 #define APR_LDAP_URL_PREFIX         "ldap://"
 #define APR_LDAP_URL_PREFIX_LEN     (sizeof(APR_LDAP_URL_PREFIX)-1)
 #define APR_LDAPS_URL_PREFIX        "ldaps://"
 #define APR_LDAPS_URL_PREFIX_LEN    (sizeof(APR_LDAPS_URL_PREFIX)-1)
 #define APR_LDAPI_URL_PREFIX        "ldapi://"
 #define APR_LDAPI_URL_PREFIX_LEN    (sizeof(APR_LDAPI_URL_PREFIX)-1)
 #define APR_LDAP_URL_URLCOLON       "URL:"
 #define APR_LDAP_URL_URLCOLON_LEN   (sizeof(APR_LDAP_URL_URLCOLON)-1)


 /* local functions */
 static const char* skip_url_prefix(const char *url,
                                    int *enclosedp,
                                    const char **scheme);

 static void apr_ldap_pvt_hex_unescape(char *s);

 static int apr_ldap_pvt_unhex(int c);

 static char **apr_ldap_str2charray(apr_pool_t *pool,
                                    const char *str,
                                    const char *brkstr);


 /**
  * Is this URL an ldap url?
  *
  */
 APU_DECLARE(int) apr_ldap_is_ldap_url(const char *url)
 {
     int enclosed;
     const char * scheme;

     if( url == NULL ) {
         return 0;
     }

     if( skip_url_prefix( url, &enclosed, &scheme ) == NULL ) {
         return 0;
     }

     return 1;
 }

 /**
  * Is this URL a secure ldap url?
  *
  */
 APU_DECLARE(int) apr_ldap_is_ldaps_url(const char *url)
 {
     int enclosed;
     const char * scheme;

     if( url == NULL ) {
         return 0;
     }

     if( skip_url_prefix( url, &enclosed, &scheme ) == NULL ) {
         return 0;
     }

     return strcmp(scheme, "ldaps") == 0;
 }

 /**
  * Is this URL an ldap socket url?
  *
  */
 APU_DECLARE(int) apr_ldap_is_ldapi_url(const char *url)
 {
     int enclosed;
     const char * scheme;

     if( url == NULL ) {
         return 0;
     }

     if( skip_url_prefix( url, &enclosed, &scheme ) == NULL ) {
         return 0;
     }

     return strcmp(scheme, "ldapi") == 0;
 }


 static const char *skip_url_prefix(const char *url, int *enclosedp,
                                    const char **scheme)
 {
     /*
      * return non-zero if this looks like a LDAP URL; zero if not
      * if non-zero returned, *urlp will be moved past "ldap://" part of URL
      */
     const char *p;

     if ( url == NULL ) {
         return( NULL );
     }

     p = url;

     /* skip leading '<' (if any) */
     if ( *p == '<' ) {
         *enclosedp = 1;
         ++p;
     } else {
         *enclosedp = 0;
     }

     /* skip leading "URL:" (if any) */
     if ( strncasecmp( p, APR_LDAP_URL_URLCOLON, APR_LDAP_URL_URLCOLON_LEN ) == 0 ) {
         p += APR_LDAP_URL_URLCOLON_LEN;
     }

     /* check for "ldap://" prefix */
     if ( strncasecmp( p, APR_LDAP_URL_PREFIX, APR_LDAP_URL_PREFIX_LEN ) == 0 ) {
         /* skip over "ldap://" prefix and return success */
         p += APR_LDAP_URL_PREFIX_LEN;
         *scheme = "ldap";
         return( p );
     }

     /* check for "ldaps://" prefix */
     if ( strncasecmp( p, APR_LDAPS_URL_PREFIX, APR_LDAPS_URL_PREFIX_LEN ) == 0 ) {
         /* skip over "ldaps://" prefix and return success */
         p += APR_LDAPS_URL_PREFIX_LEN;
         *scheme = "ldaps";
         return( p );
     }

     /* check for "ldapi://" prefix */
     if ( strncasecmp( p, APR_LDAPI_URL_PREFIX, APR_LDAPI_URL_PREFIX_LEN ) == 0 ) {
         /* skip over "ldapi://" prefix and return success */
         p += APR_LDAPI_URL_PREFIX_LEN;
         *scheme = "ldapi";
         return( p );
     }

     return( NULL );
 }


 static int str2scope(const char *p)
 {
     if ( strcasecmp( p, "one" ) == 0 ) {
         return LDAP_SCOPE_ONELEVEL;

     } else if ( strcasecmp( p, "onetree" ) == 0 ) {
         return LDAP_SCOPE_ONELEVEL;

     } else if ( strcasecmp( p, "base" ) == 0 ) {
         return LDAP_SCOPE_BASE;

     } else if ( strcasecmp( p, "sub" ) == 0 ) {
         return LDAP_SCOPE_SUBTREE;

     } else if ( strcasecmp( p, "subtree" ) == 0 ) {
         return LDAP_SCOPE_SUBTREE;
     }

     return( -1 );
 }


 /**
  * Parse the URL provided into an apr_ldap_url_desc_t object.
  *
  * APR_SUCCESS is returned on success, APR_EGENERAL on failure.
  * The LDAP result code and reason string is returned in the
  * apr_ldap_err_t structure.
  */
 APU_DECLARE(int) apr_ldap_url_parse_ext(apr_pool_t *pool,
                                         const char *url_in,
                                         apr_ldap_url_desc_t **ludpp,
                                         apr_ldap_err_t **result_err)
 {
     apr_ldap_url_desc_t *ludp;
     char        *p, *q, *r;
     int         i, enclosed;
     const char  *scheme = NULL;
     const char  *url_tmp;
     char        *url;

     apr_ldap_err_t *result = (apr_ldap_err_t *)apr_pcalloc(pool, sizeof(apr_ldap_err_t));
     *result_err = result;

     /* sanity check our parameters */
     if( url_in == NULL || ludpp == NULL ) {
         result->reason = "Either the LDAP URL, or the URL structure was NULL. Oops.";
         result->rc = APR_LDAP_URL_ERR_PARAM;
         return APR_EGENERAL;
     }

     *ludpp = NULL;  /* pessimistic */

     url_tmp = skip_url_prefix( url_in, &enclosed, &scheme );
     if ( url_tmp == NULL ) {
         result->reason = "The scheme was not recognised as a valid LDAP URL scheme.";
         result->rc = APR_LDAP_URL_ERR_BADSCHEME;
         return APR_EGENERAL;
     }

     /* make working copy of the remainder of the URL */
     url = (char *)apr_pstrdup(pool, url_tmp);
     if ( url == NULL ) {
         result->reason = "Out of memory parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_MEM;
         return APR_EGENERAL;
     }

     if ( enclosed ) {
         p = &url[strlen(url)-1];

         if( *p != '>' ) {
             result->reason = "Bad enclosure error while parsing LDAP URL.";
             result->rc = APR_LDAP_URL_ERR_BADENCLOSURE;
             return APR_EGENERAL;
         }

         *p = '\0';
     }

     /* allocate return struct */
     ludp = (apr_ldap_url_desc_t *)apr_pcalloc(pool, sizeof(apr_ldap_url_desc_t));
     if ( ludp == NULL ) {
         result->reason = "Out of memory parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_MEM;
         return APR_EGENERAL;
     }

     ludp->lud_next = NULL;
     ludp->lud_host = NULL;
     ludp->lud_port = LDAP_PORT;
     ludp->lud_dn = NULL;
     ludp->lud_attrs = NULL;
     ludp->lud_filter = NULL;
     ludp->lud_scope = -1;
     ludp->lud_filter = NULL;
     ludp->lud_exts = NULL;

     ludp->lud_scheme = (char *)apr_pstrdup(pool, scheme);
     if ( ludp->lud_scheme == NULL ) {
         result->reason = "Out of memory parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_MEM;
         return APR_EGENERAL;
     }

     if( strcasecmp( ludp->lud_scheme, "ldaps" ) == 0 ) {
         ludp->lud_port = LDAPS_PORT;
     }

     /* scan forward for '/' that marks end of hostport and begin. of dn */
     p = strchr( url, '/' );

     if( p != NULL ) {
         /* terminate hostport; point to start of dn */
         *p++ = '\0';
     }

     /* IPv6 syntax with [ip address]:port */
     if ( *url == '[' ) {
         r = strchr( url, ']' );
         if ( r == NULL ) {
             result->reason = "Bad LDAP URL while parsing IPV6 syntax.";
             result->rc = APR_LDAP_URL_ERR_BADURL;
             return APR_EGENERAL;
         }
         *r++ = '\0';
         q = strrchr( r, ':' );
     } else {
         q = strrchr( url, ':' );
     }

     if ( q != NULL ) {
         apr_ldap_pvt_hex_unescape( ++q );

         if( *q == '\0' ) {
             result->reason = "Bad LDAP URL while parsing.";
             result->rc = APR_LDAP_URL_ERR_BADURL;
             return APR_EGENERAL;
         }

         ludp->lud_port = atoi( q );
     }

     apr_ldap_pvt_hex_unescape( url );

     /* If [ip address]:port syntax, url is [ip and we skip the [ */
     ludp->lud_host = (char *)apr_pstrdup(pool, url + ( *url == '[' ));
     if( ludp->lud_host == NULL ) {
         result->reason = "Out of memory parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_MEM;
         return APR_EGENERAL;
     }

     /*
      * Kludge.  ldap://111.222.333.444:389??cn=abc,o=company
      *
      * On early Novell releases, search references/referrals were returned
      * in this format, i.e., the dn was kind of in the scope position,
      * but the required slash is missing. The whole thing is illegal syntax,
      * but we need to account for it. Fortunately it can't be confused with
      * anything real.
      */
     if( (p == NULL) && (q != NULL) && ((q = strchr( q, '?')) != NULL)) {
         q++;
         /* ? immediately followed by question */
         if( *q == '?') {
             q++;
             if( *q != '\0' ) {
                 /* parse dn part */
                 apr_ldap_pvt_hex_unescape( q );
                 ludp->lud_dn = (char *)apr_pstrdup(pool, q);
             } else {
                 ludp->lud_dn = (char *)apr_pstrdup(pool, "");
             }

             if( ludp->lud_dn == NULL ) {
                 result->reason = "Out of memory parsing LDAP URL.";
                 result->rc = APR_LDAP_URL_ERR_MEM;
                 return APR_EGENERAL;
             }
         }
     }

     if( p == NULL ) {
         *ludpp = ludp;
         return APR_SUCCESS;
     }

     /* scan forward for '?' that may marks end of dn */
     q = strchr( p, '?' );

     if( q != NULL ) {
         /* terminate dn part */
         *q++ = '\0';
     }

     if( *p != '\0' ) {
         /* parse dn part */
         apr_ldap_pvt_hex_unescape( p );
         ludp->lud_dn = (char *)apr_pstrdup(pool, p);
     } else {
         ludp->lud_dn = (char *)apr_pstrdup(pool, "");
     }

     if( ludp->lud_dn == NULL ) {
         result->reason = "Out of memory parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_MEM;
         return APR_EGENERAL;
     }

     if( q == NULL ) {
         /* no more */
         *ludpp = ludp;
         return APR_SUCCESS;
     }

     /* scan forward for '?' that may marks end of attributes */
     p = q;
     q = strchr( p, '?' );

     if( q != NULL ) {
         /* terminate attributes part */
         *q++ = '\0';
     }

     if( *p != '\0' ) {
         /* parse attributes */
         apr_ldap_pvt_hex_unescape( p );
         ludp->lud_attrs = apr_ldap_str2charray(pool, p, ",");

         if( ludp->lud_attrs == NULL ) {
             result->reason = "Bad attributes encountered while parsing LDAP URL.";
             result->rc = APR_LDAP_URL_ERR_BADATTRS;
             return APR_EGENERAL;
         }
     }

     if ( q == NULL ) {
         /* no more */
         *ludpp = ludp;
         return APR_SUCCESS;
     }

     /* scan forward for '?' that may marks end of scope */
     p = q;
     q = strchr( p, '?' );

     if( q != NULL ) {
         /* terminate the scope part */
         *q++ = '\0';
     }

     if( *p != '\0' ) {
         /* parse the scope */
         apr_ldap_pvt_hex_unescape( p );
         ludp->lud_scope = str2scope( p );

         if( ludp->lud_scope == -1 ) {
             result->reason = "Bad scope encountered while parsing LDAP URL.";
             result->rc = APR_LDAP_URL_ERR_BADSCOPE;
             return APR_EGENERAL;
         }
     }

     if ( q == NULL ) {
         /* no more */
         *ludpp = ludp;
         return APR_SUCCESS;
     }

     /* scan forward for '?' that may marks end of filter */
     p = q;
     q = strchr( p, '?' );

     if( q != NULL ) {
         /* terminate the filter part */
         *q++ = '\0';
     }

     if( *p != '\0' ) {
         /* parse the filter */
         apr_ldap_pvt_hex_unescape( p );

         if( ! *p ) {
             /* missing filter */
             result->reason = "Bad filter encountered while parsing LDAP URL.";
             result->rc = APR_LDAP_URL_ERR_BADFILTER;
             return APR_EGENERAL;
         }

         ludp->lud_filter = (char *)apr_pstrdup(pool, p);
         if( ludp->lud_filter == NULL ) {
             result->reason = "Out of memory parsing LDAP URL.";
             result->rc = APR_LDAP_URL_ERR_MEM;
             return APR_EGENERAL;
         }
     }

     if ( q == NULL ) {
         /* no more */
         *ludpp = ludp;
         return APR_SUCCESS;
     }

     /* scan forward for '?' that may marks end of extensions */
     p = q;
     q = strchr( p, '?' );

     if( q != NULL ) {
         /* extra '?' */
         result->reason = "Bad URL encountered while parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_BADURL;
         return APR_EGENERAL;
     }

     /* parse the extensions */
     ludp->lud_exts = apr_ldap_str2charray(pool, p, ",");
     if( ludp->lud_exts == NULL ) {
         result->reason = "Bad extensions encountered while parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_BADEXTS;
         return APR_EGENERAL;
     }

     for( i=0; ludp->lud_exts[i] != NULL; i++ ) {
         apr_ldap_pvt_hex_unescape( ludp->lud_exts[i] );

         if( *ludp->lud_exts[i] == '!' ) {
             /* count the number of critical extensions */
             ludp->lud_crit_exts++;
         }
     }

     if( i == 0 ) {
         /* must have 1 or more */
         result->reason = "Bad extensions encountered while parsing LDAP URL.";
         result->rc = APR_LDAP_URL_ERR_BADEXTS;
         return APR_EGENERAL;
     }

     /* no more */
     *ludpp = ludp;
     return APR_SUCCESS;
 }


 /**
  * Parse the URL provided into an apr_ldap_url_desc_t object.
  *
  * APR_SUCCESS is returned on success, APR_EGENERAL on failure.
  * The LDAP result code and reason string is returned in the
  * apr_ldap_err_t structure.
  */
 APU_DECLARE(int) apr_ldap_url_parse(apr_pool_t *pool,
                                     const char *url_in,
                                     apr_ldap_url_desc_t **ludpp,
                                     apr_ldap_err_t **result_err)
 {

     int rc = apr_ldap_url_parse_ext(pool, url_in, ludpp, result_err);
     if( rc != APR_SUCCESS ) {
         return rc;
     }

     if ((*ludpp)->lud_scope == -1) {
         (*ludpp)->lud_scope = LDAP_SCOPE_BASE;
     }

     if ((*ludpp)->lud_host != NULL && *(*ludpp)->lud_host == '\0') {
         (*ludpp)->lud_host = NULL;
     }

     return rc;

 }


 static void apr_ldap_pvt_hex_unescape(char *s)
 {
     /*
      * Remove URL hex escapes from s... done in place.  The basic concept for
      * this routine is borrowed from the WWW library HTUnEscape() routine.
      */
     char    *p;

     for ( p = s; *s != '\0'; ++s ) {
         if ( *s == '%' ) {
             if ( *++s == '\0' ) {
                 break;
             }
             *p = apr_ldap_pvt_unhex( *s ) << 4;
             if ( *++s == '\0' ) {
                 break;
             }
             *p++ += apr_ldap_pvt_unhex( *s );
         } else {
             *p++ = *s;
         }
     }

     *p = '\0';
 }


 static int apr_ldap_pvt_unhex(int c)
 {
     return( c >= '0' && c <= '9' ? c - '0'
         : c >= 'A' && c <= 'F' ? c - 'A' + 10
         : c - 'a' + 10 );
 }


 /**
  * Convert a string to a character array
  */
 static char **apr_ldap_str2charray(apr_pool_t *pool,
                                    const char *str_in,
                                    const char *brkstr)
 {
     char    **res;
     char    *str, *s;
     char    *lasts;
     int i;

     /* protect the input string from strtok */
     str = (char *)apr_pstrdup(pool, str_in);
     if( str == NULL ) {
         return NULL;
     }

     i = 1;
     for ( s = str; *s; s++ ) {
         /* Warning: this strchr was previously ldap_utf8_strchr(), check
          * whether this particular code has any charset issues.
          */
         if ( strchr( brkstr, *s ) != NULL ) {
             i++;
         }
     }

     res = (char **) apr_pcalloc(pool, (i + 1) * sizeof(char *));
     if( res == NULL ) {
         return NULL;
     }

     i = 0;

     for ( s = (char *)apr_strtok( str, brkstr, &lasts );
           s != NULL;
           s = (char *)apr_strtok( NULL, brkstr, &lasts ) ) {

         res[i] = (char *)apr_pstrdup(pool, s);
         if(res[i] == NULL) {
             return NULL;
         }

         i++;
     }

     res[i] = NULL;

     return( res );

 }

 #endif /* APR_HAS_LDAP */
	/* Licensed to the Apache Software Foundation (ASF) under one or more
	* contributor license agreements. See the NOTICE file distributed with
	* this work for additional information regarding copyright ownership.
	* The ASF licenses this file to You under the Apache License, Version 2.0
	* (the "License"); you may not use this file except in compliance with
	* the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	/* Portions Copyright 1998-2002 The OpenLDAP Foundation
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted only as authorized by the OpenLDAP
	* Public License. A copy of this license is available at
	* http://www.OpenLDAP.org/license.html or in file LICENSE in the
	* top-level directory of the distribution.
	*
	* OpenLDAP is a registered trademark of the OpenLDAP Foundation.
	*
	* Individual files and/or contributed packages may be copyright by
	* other parties and subject to additional restrictions.
	*
	* This work is derived from the University of Michigan LDAP v3.3
	* distribution. Information concerning this software is available
	* at: http://www.umich.edu/~dirsvcs/ldap/
	*
	* This work also contains materials derived from public sources.
	*
	* Additional information about OpenLDAP can be obtained at:
	* http://www.openldap.org/
	*/

	/*
	* Portions Copyright (c) 1992-1996 Regents of the University of Michigan.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms are permitted
	* provided that this notice is preserved and that due credit is given
	* to the University of Michigan at Ann Arbor. The name of the University
	* may not be used to endorse or promote products derived from this
	* software without specific prior written permission. This software
	* is provided ``as is'' without express or implied warranty.
	*/

	/* apr_ldap_url.c -- LDAP URL (RFC 2255) related routines
	*
	* Win32 and perhaps other non-OpenLDAP based ldap libraries may be
	* missing ldap_url_* APIs. We focus here on the one significant
	* aspect, which is parsing. We have [for the time being] omitted
	* the ldap_url_search APIs.
	*
	* LDAP URLs look like this:
	* ldap[is]://host:port[/[dn[?[attributes][?[scope][?[filter][?exts]]]]]]
	*
	* where:
	* attributes is a comma separated list
	* scope is one of these three strings: base one sub (default=base)
	* filter is an string-represented filter as in RFC 2254
	*
	* e.g., ldap://host:port/dc=com?o,cn?base?o=openldap?extension
	*
	* Tolerates URLs that look like: <ldapurl> and <URL:ldapurl>
	*/

	#include "apu.h"
	#include "apr_pools.h"
	#include "apr_general.h"
	#include "apr_strings.h"
	#include "apr_ldap.h"

	#if APR_HAS_LDAP

	#if APR_HAVE_STDLIB_H
	#include <stdlib.h>
	#endif

	#ifndef LDAPS_PORT
	#define LDAPS_PORT 636 /* ldaps:/// default LDAP over TLS port */
	#endif

	#define APR_LDAP_URL_PREFIX "ldap://"
	#define APR_LDAP_URL_PREFIX_LEN (sizeof(APR_LDAP_URL_PREFIX)-1)
	#define APR_LDAPS_URL_PREFIX "ldaps://"
	#define APR_LDAPS_URL_PREFIX_LEN (sizeof(APR_LDAPS_URL_PREFIX)-1)
	#define APR_LDAPI_URL_PREFIX "ldapi://"
	#define APR_LDAPI_URL_PREFIX_LEN (sizeof(APR_LDAPI_URL_PREFIX)-1)
	#define APR_LDAP_URL_URLCOLON "URL:"
	#define APR_LDAP_URL_URLCOLON_LEN (sizeof(APR_LDAP_URL_URLCOLON)-1)


	/* local functions */
	static const char* skip_url_prefix(const char *url,
	int *enclosedp,
	const char **scheme);

	static void apr_ldap_pvt_hex_unescape(char *s);

	static int apr_ldap_pvt_unhex(int c);

	static char *apr_ldap_str2charray(apr_pool_t pool,
	const char *str,
	const char *brkstr);


	/**
	* Is this URL an ldap url?
	*
	*/
	APU_DECLARE(int) apr_ldap_is_ldap_url(const char *url)
	{
	int enclosed;
	const char * scheme;

	if( url == NULL ) {
	return 0;
	}

	if( skip_url_prefix( url, &enclosed, &scheme ) == NULL ) {
	return 0;
	}

	return 1;
	}

	/**
	* Is this URL a secure ldap url?
	*
	*/
	APU_DECLARE(int) apr_ldap_is_ldaps_url(const char *url)
	{
	int enclosed;
	const char * scheme;

	if( url == NULL ) {
	return 0;
	}

	if( skip_url_prefix( url, &enclosed, &scheme ) == NULL ) {
	return 0;
	}

	return strcmp(scheme, "ldaps") == 0;
	}

	/**
	* Is this URL an ldap socket url?
	*
	*/
	APU_DECLARE(int) apr_ldap_is_ldapi_url(const char *url)
	{
	int enclosed;
	const char * scheme;

	if( url == NULL ) {
	return 0;
	}

	if( skip_url_prefix( url, &enclosed, &scheme ) == NULL ) {
	return 0;
	}

	return strcmp(scheme, "ldapi") == 0;
	}


	static const char skip_url_prefix(const char url, int *enclosedp,
	const char **scheme)
	{
	/*
	* return non-zero if this looks like a LDAP URL; zero if not
	* if non-zero returned, *urlp will be moved past "ldap://" part of URL
	*/
	const char *p;

	if ( url == NULL ) {
	return( NULL );
	}

	p = url;

	/* skip leading '<' (if any) */
	if ( *p == '<' ) {
	*enclosedp = 1;
	++p;
	} else {
	*enclosedp = 0;
	}

	/* skip leading "URL:" (if any) */
	if ( strncasecmp( p, APR_LDAP_URL_URLCOLON, APR_LDAP_URL_URLCOLON_LEN ) == 0 ) {
	p += APR_LDAP_URL_URLCOLON_LEN;
	}

	/* check for "ldap://" prefix */
	if ( strncasecmp( p, APR_LDAP_URL_PREFIX, APR_LDAP_URL_PREFIX_LEN ) == 0 ) {
	/* skip over "ldap://" prefix and return success */
	p += APR_LDAP_URL_PREFIX_LEN;
	*scheme = "ldap";
	return( p );
	}

	/* check for "ldaps://" prefix */
	if ( strncasecmp( p, APR_LDAPS_URL_PREFIX, APR_LDAPS_URL_PREFIX_LEN ) == 0 ) {
	/* skip over "ldaps://" prefix and return success */
	p += APR_LDAPS_URL_PREFIX_LEN;
	*scheme = "ldaps";
	return( p );
	}

	/* check for "ldapi://" prefix */
	if ( strncasecmp( p, APR_LDAPI_URL_PREFIX, APR_LDAPI_URL_PREFIX_LEN ) == 0 ) {
	/* skip over "ldapi://" prefix and return success */
	p += APR_LDAPI_URL_PREFIX_LEN;
	*scheme = "ldapi";
	return( p );
	}

	return( NULL );
	}


	static int str2scope(const char *p)
	{
	if ( strcasecmp( p, "one" ) == 0 ) {
	return LDAP_SCOPE_ONELEVEL;

	} else if ( strcasecmp( p, "onetree" ) == 0 ) {
	return LDAP_SCOPE_ONELEVEL;

	} else if ( strcasecmp( p, "base" ) == 0 ) {
	return LDAP_SCOPE_BASE;

	} else if ( strcasecmp( p, "sub" ) == 0 ) {
	return LDAP_SCOPE_SUBTREE;

	} else if ( strcasecmp( p, "subtree" ) == 0 ) {
	return LDAP_SCOPE_SUBTREE;
	}

	return( -1 );
	}


	/**
	* Parse the URL provided into an apr_ldap_url_desc_t object.
	*
	* APR_SUCCESS is returned on success, APR_EGENERAL on failure.
	* The LDAP result code and reason string is returned in the
	* apr_ldap_err_t structure.
	*/
	APU_DECLARE(int) apr_ldap_url_parse_ext(apr_pool_t *pool,
	const char *url_in,
	apr_ldap_url_desc_t **ludpp,
	apr_ldap_err_t **result_err)
	{
	apr_ldap_url_desc_t *ludp;
	char p, q, *r;
	int i, enclosed;
	const char *scheme = NULL;
	const char *url_tmp;
	char *url;

	apr_ldap_err_t result = (apr_ldap_err_t )apr_pcalloc(pool, sizeof(apr_ldap_err_t));
	*result_err = result;

	/* sanity check our parameters */
	if( url_in == NULL \|\| ludpp == NULL ) {
	result->reason = "Either the LDAP URL, or the URL structure was NULL. Oops.";
	result->rc = APR_LDAP_URL_ERR_PARAM;
	return APR_EGENERAL;
	}

	ludpp = NULL; / pessimistic */

	url_tmp = skip_url_prefix( url_in, &enclosed, &scheme );
	if ( url_tmp == NULL ) {
	result->reason = "The scheme was not recognised as a valid LDAP URL scheme.";
	result->rc = APR_LDAP_URL_ERR_BADSCHEME;
	return APR_EGENERAL;
	}

	/* make working copy of the remainder of the URL */
	url = (char *)apr_pstrdup(pool, url_tmp);
	if ( url == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}

	if ( enclosed ) {
	p = &url[strlen(url)-1];

	if( *p != '>' ) {
	result->reason = "Bad enclosure error while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADENCLOSURE;
	return APR_EGENERAL;
	}

	*p = '\0';
	}

	/* allocate return struct */
	ludp = (apr_ldap_url_desc_t *)apr_pcalloc(pool, sizeof(apr_ldap_url_desc_t));
	if ( ludp == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}

	ludp->lud_next = NULL;
	ludp->lud_host = NULL;
	ludp->lud_port = LDAP_PORT;
	ludp->lud_dn = NULL;
	ludp->lud_attrs = NULL;
	ludp->lud_filter = NULL;
	ludp->lud_scope = -1;
	ludp->lud_filter = NULL;
	ludp->lud_exts = NULL;

	ludp->lud_scheme = (char *)apr_pstrdup(pool, scheme);
	if ( ludp->lud_scheme == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}

	if( strcasecmp( ludp->lud_scheme, "ldaps" ) == 0 ) {
	ludp->lud_port = LDAPS_PORT;
	}

	/* scan forward for '/' that marks end of hostport and begin. of dn */
	p = strchr( url, '/' );

	if( p != NULL ) {
	/* terminate hostport; point to start of dn */
	*p++ = '\0';
	}

	/* IPv6 syntax with [ip address]:port */
	if ( *url == '[' ) {
	r = strchr( url, ']' );
	if ( r == NULL ) {
	result->reason = "Bad LDAP URL while parsing IPV6 syntax.";
	result->rc = APR_LDAP_URL_ERR_BADURL;
	return APR_EGENERAL;
	}
	*r++ = '\0';
	q = strrchr( r, ':' );
	} else {
	q = strrchr( url, ':' );
	}

	if ( q != NULL ) {
	apr_ldap_pvt_hex_unescape( ++q );

	if( *q == '\0' ) {
	result->reason = "Bad LDAP URL while parsing.";
	result->rc = APR_LDAP_URL_ERR_BADURL;
	return APR_EGENERAL;
	}

	ludp->lud_port = atoi( q );
	}

	apr_ldap_pvt_hex_unescape( url );

	/* If [ip address]:port syntax, url is [ip and we skip the [ */
	ludp->lud_host = (char )apr_pstrdup(pool, url + ( url == '[' ));
	if( ludp->lud_host == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}

	/*
	* Kludge. ldap://111.222.333.444:389??cn=abc,o=company
	*
	* On early Novell releases, search references/referrals were returned
	* in this format, i.e., the dn was kind of in the scope position,
	* but the required slash is missing. The whole thing is illegal syntax,
	* but we need to account for it. Fortunately it can't be confused with
	* anything real.
	*/
	if( (p == NULL) && (q != NULL) && ((q = strchr( q, '?')) != NULL)) {
	q++;
	/* ? immediately followed by question */
	if( *q == '?') {
	q++;
	if( *q != '\0' ) {
	/* parse dn part */
	apr_ldap_pvt_hex_unescape( q );
	ludp->lud_dn = (char *)apr_pstrdup(pool, q);
	} else {
	ludp->lud_dn = (char *)apr_pstrdup(pool, "");
	}

	if( ludp->lud_dn == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}
	}
	}

	if( p == NULL ) {
	*ludpp = ludp;
	return APR_SUCCESS;
	}

	/* scan forward for '?' that may marks end of dn */
	q = strchr( p, '?' );

	if( q != NULL ) {
	/* terminate dn part */
	*q++ = '\0';
	}

	if( *p != '\0' ) {
	/* parse dn part */
	apr_ldap_pvt_hex_unescape( p );
	ludp->lud_dn = (char *)apr_pstrdup(pool, p);
	} else {
	ludp->lud_dn = (char *)apr_pstrdup(pool, "");
	}

	if( ludp->lud_dn == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}

	if( q == NULL ) {
	/* no more */
	*ludpp = ludp;
	return APR_SUCCESS;
	}

	/* scan forward for '?' that may marks end of attributes */
	p = q;
	q = strchr( p, '?' );

	if( q != NULL ) {
	/* terminate attributes part */
	*q++ = '\0';
	}

	if( *p != '\0' ) {
	/* parse attributes */
	apr_ldap_pvt_hex_unescape( p );
	ludp->lud_attrs = apr_ldap_str2charray(pool, p, ",");

	if( ludp->lud_attrs == NULL ) {
	result->reason = "Bad attributes encountered while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADATTRS;
	return APR_EGENERAL;
	}
	}

	if ( q == NULL ) {
	/* no more */
	*ludpp = ludp;
	return APR_SUCCESS;
	}

	/* scan forward for '?' that may marks end of scope */
	p = q;
	q = strchr( p, '?' );

	if( q != NULL ) {
	/* terminate the scope part */
	*q++ = '\0';
	}

	if( *p != '\0' ) {
	/* parse the scope */
	apr_ldap_pvt_hex_unescape( p );
	ludp->lud_scope = str2scope( p );

	if( ludp->lud_scope == -1 ) {
	result->reason = "Bad scope encountered while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADSCOPE;
	return APR_EGENERAL;
	}
	}

	if ( q == NULL ) {
	/* no more */
	*ludpp = ludp;
	return APR_SUCCESS;
	}

	/* scan forward for '?' that may marks end of filter */
	p = q;
	q = strchr( p, '?' );

	if( q != NULL ) {
	/* terminate the filter part */
	*q++ = '\0';
	}

	if( *p != '\0' ) {
	/* parse the filter */
	apr_ldap_pvt_hex_unescape( p );

	if( ! *p ) {
	/* missing filter */
	result->reason = "Bad filter encountered while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADFILTER;
	return APR_EGENERAL;
	}

	ludp->lud_filter = (char *)apr_pstrdup(pool, p);
	if( ludp->lud_filter == NULL ) {
	result->reason = "Out of memory parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_MEM;
	return APR_EGENERAL;
	}
	}

	if ( q == NULL ) {
	/* no more */
	*ludpp = ludp;
	return APR_SUCCESS;
	}

	/* scan forward for '?' that may marks end of extensions */
	p = q;
	q = strchr( p, '?' );

	if( q != NULL ) {
	/* extra '?' */
	result->reason = "Bad URL encountered while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADURL;
	return APR_EGENERAL;
	}

	/* parse the extensions */
	ludp->lud_exts = apr_ldap_str2charray(pool, p, ",");
	if( ludp->lud_exts == NULL ) {
	result->reason = "Bad extensions encountered while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADEXTS;
	return APR_EGENERAL;
	}

	for( i=0; ludp->lud_exts[i] != NULL; i++ ) {
	apr_ldap_pvt_hex_unescape( ludp->lud_exts[i] );

	if( *ludp->lud_exts[i] == '!' ) {
	/* count the number of critical extensions */
	ludp->lud_crit_exts++;
	}
	}

	if( i == 0 ) {
	/* must have 1 or more */
	result->reason = "Bad extensions encountered while parsing LDAP URL.";
	result->rc = APR_LDAP_URL_ERR_BADEXTS;
	return APR_EGENERAL;
	}

	/* no more */
	*ludpp = ludp;
	return APR_SUCCESS;
	}


	/**
	* Parse the URL provided into an apr_ldap_url_desc_t object.
	*
	* APR_SUCCESS is returned on success, APR_EGENERAL on failure.
	* The LDAP result code and reason string is returned in the
	* apr_ldap_err_t structure.
	*/
	APU_DECLARE(int) apr_ldap_url_parse(apr_pool_t *pool,
	const char *url_in,
	apr_ldap_url_desc_t **ludpp,
	apr_ldap_err_t **result_err)
	{

	int rc = apr_ldap_url_parse_ext(pool, url_in, ludpp, result_err);
	if( rc != APR_SUCCESS ) {
	return rc;
	}

	if ((*ludpp)->lud_scope == -1) {
	(*ludpp)->lud_scope = LDAP_SCOPE_BASE;
	}

	if ((ludpp)->lud_host != NULL && (*ludpp)->lud_host == '\0') {
	(*ludpp)->lud_host = NULL;
	}

	return rc;

	}


	static void apr_ldap_pvt_hex_unescape(char *s)
	{
	/*
	* Remove URL hex escapes from s... done in place. The basic concept for
	* this routine is borrowed from the WWW library HTUnEscape() routine.
	*/
	char *p;

	for ( p = s; *s != '\0'; ++s ) {
	if ( *s == '%' ) {
	if ( *++s == '\0' ) {
	break;
	}
	p = apr_ldap_pvt_unhex( s ) << 4;
	if ( *++s == '\0' ) {
	break;
	}
	p++ += apr_ldap_pvt_unhex( s );
	} else {
	p++ = s;
	}
	}

	*p = '\0';
	}


	static int apr_ldap_pvt_unhex(int c)
	{
	return( c >= '0' && c <= '9' ? c - '0'
	: c >= 'A' && c <= 'F' ? c - 'A' + 10
	: c - 'a' + 10 );
	}


	/**
	* Convert a string to a character array
	*/
	static char *apr_ldap_str2charray(apr_pool_t pool,
	const char *str_in,
	const char *brkstr)
	{
	char **res;
	char str, s;
	char *lasts;
	int i;

	/* protect the input string from strtok */
	str = (char *)apr_pstrdup(pool, str_in);
	if( str == NULL ) {
	return NULL;
	}

	i = 1;
	for ( s = str; *s; s++ ) {
	/* Warning: this strchr was previously ldap_utf8_strchr(), check
	* whether this particular code has any charset issues.
	*/
	if ( strchr( brkstr, *s ) != NULL ) {
	i++;
	}
	}

	res = (char *) apr_pcalloc(pool, (i + 1) sizeof(char *));
	if( res == NULL ) {
	return NULL;
	}

	i = 0;

	for ( s = (char *)apr_strtok( str, brkstr, &lasts );
	s != NULL;
	s = (char *)apr_strtok( NULL, brkstr, &lasts ) ) {

	res[i] = (char *)apr_pstrdup(pool, s);
	if(res[i] == NULL) {
	return NULL;
	}

	i++;
	}

	res[i] = NULL;

	return( res );

	}

	#endif /* APR_HAS_LDAP */