Imported Upstream version 7.59.0
[platform/upstream/curl.git] / lib / openldap.c
index 7010da6..187c899 100644 (file)
@@ -6,10 +6,11 @@
  *                 \___|\___/|_| \_\_____|
  *
  * Copyright (C) 2010, Howard Chu, <hyc@openldap.org>
+ * Copyright (C) 2011 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at http://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.haxx.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -20,7 +21,7 @@
  *
  ***************************************************************************/
 
-#include "setup.h"
+#include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP)
 
 #include "urldata.h"
 #include <curl/curl.h>
 #include "sendf.h"
-#include "sslgen.h"
+#include "vtls/vtls.h"
 #include "transfer.h"
 #include "curl_ldap.h"
-#include "curl_memory.h"
 #include "curl_base64.h"
-
-#define _MPRINTF_REPLACE /* use our functions only */
-#include <curl/mprintf.h>
-
+#include "connect.h"
+/* The last 3 #include files should be in this order */
+#include "curl_printf.h"
+#include "curl_memory.h"
 #include "memdebug.h"
 
+/*
+ * Uncommenting this will enable the built-in debug logging of the openldap
+ * library. The debug log level can be set using the CURL_OPENLDAP_TRACE
+ * environment variable. The debug output is written to stderr.
+ *
+ * The library supports the following debug flags:
+ * LDAP_DEBUG_NONE         0x0000
+ * LDAP_DEBUG_TRACE        0x0001
+ * LDAP_DEBUG_CONSTRUCT    0x0002
+ * LDAP_DEBUG_DESTROY      0x0004
+ * LDAP_DEBUG_PARAMETER    0x0008
+ * LDAP_DEBUG_ANY          0xffff
+ *
+ * For example, use CURL_OPENLDAP_TRACE=0 for no debug,
+ * CURL_OPENLDAP_TRACE=2 for LDAP_DEBUG_CONSTRUCT messages only,
+ * CURL_OPENLDAP_TRACE=65535 for all debug message levels.
+ */
+/* #define CURL_OPENLDAP_DEBUG */
+
 #ifndef _LDAP_PVT_H
 extern int ldap_pvt_url_scheme2proto(const char *);
-extern int ldap_init_fd(ber_socket_t fd, int proto, const char *url, LDAP **ld);
+extern int ldap_init_fd(ber_socket_t fd, int proto, const char *url,
+                        LDAP **ld);
 #endif
 
-static CURLcode ldap_setup(struct connectdata *conn);
+static CURLcode ldap_setup_connection(struct connectdata *conn);
 static CURLcode ldap_do(struct connectdata *conn, bool *done);
 static CURLcode ldap_done(struct connectdata *conn, CURLcode, bool);
 static CURLcode ldap_connect(struct connectdata *conn, bool *done);
 static CURLcode ldap_connecting(struct connectdata *conn, bool *done);
-static CURLcode ldap_disconnect(struct connectdata *conn, bool dead_connection);
+static CURLcode ldap_disconnect(struct connectdata *conn, bool dead);
 
 static Curl_recv ldap_recv;
 
@@ -71,7 +91,7 @@ static Curl_recv ldap_recv;
 
 const struct Curl_handler Curl_handler_ldap = {
   "LDAP",                               /* scheme */
-  ldap_setup,                           /* setup_connection */
+  ldap_setup_connection,                /* setup_connection */
   ldap_do,                              /* do_it */
   ldap_done,                            /* done */
   ZERO_NULL,                            /* do_more */
@@ -80,10 +100,14 @@ const struct Curl_handler Curl_handler_ldap = {
   ZERO_NULL,                            /* doing */
   ZERO_NULL,                            /* proto_getsock */
   ZERO_NULL,                            /* doing_getsock */
+  ZERO_NULL,                            /* domore_getsock */
   ZERO_NULL,                            /* perform_getsock */
   ldap_disconnect,                      /* disconnect */
+  ZERO_NULL,                            /* readwrite */
+  ZERO_NULL,                            /* connection_check */
   PORT_LDAP,                            /* defport */
-  PROT_LDAP                             /* protocol */
+  CURLPROTO_LDAP,                       /* protocol */
+  PROTOPT_NONE                          /* flags */
 };
 
 #ifdef USE_SSL
@@ -93,7 +117,7 @@ const struct Curl_handler Curl_handler_ldap = {
 
 const struct Curl_handler Curl_handler_ldaps = {
   "LDAPS",                              /* scheme */
-  ldap_setup,                           /* setup_connection */
+  ldap_setup_connection,                /* setup_connection */
   ldap_do,                              /* do_it */
   ldap_done,                            /* done */
   ZERO_NULL,                            /* do_more */
@@ -102,10 +126,14 @@ const struct Curl_handler Curl_handler_ldaps = {
   ZERO_NULL,                            /* doing */
   ZERO_NULL,                            /* proto_getsock */
   ZERO_NULL,                            /* doing_getsock */
+  ZERO_NULL,                            /* domore_getsock */
   ZERO_NULL,                            /* perform_getsock */
   ldap_disconnect,                      /* disconnect */
+  ZERO_NULL,                            /* readwrite */
+  ZERO_NULL,                            /* connection_check */
   PORT_LDAPS,                           /* defport */
-  PROT_LDAP | PROT_SSL                  /* protocol */
+  CURLPROTO_LDAP,                       /* protocol */
+  PROTOPT_SSL                           /* flags */
 };
 #endif
 
@@ -139,20 +167,20 @@ typedef struct ldapreqinfo {
   int nument;
 } ldapreqinfo;
 
-static CURLcode ldap_setup(struct connectdata *conn)
+static CURLcode ldap_setup_connection(struct connectdata *conn)
 {
   ldapconninfo *li;
   LDAPURLDesc *lud;
-  struct SessionHandle *data=conn->data;
+  struct Curl_easy *data = conn->data;
   int rc, proto;
   CURLcode status;
 
   rc = ldap_url_parse(data->change.url, &lud);
-  if (rc != LDAP_URL_SUCCESS) {
+  if(rc != LDAP_URL_SUCCESS) {
     const char *msg = "url parsing problem";
     status = CURLE_URL_MALFORMAT;
-    if (rc > LDAP_URL_SUCCESS && rc <= LDAP_URL_ERR_BADEXTS) {
-      if (rc == LDAP_URL_ERR_MEM)
+    if(rc > LDAP_URL_SUCCESS && rc <= LDAP_URL_ERR_BADEXTS) {
+      if(rc == LDAP_URL_ERR_MEM)
         status = CURLE_OUT_OF_MEMORY;
       msg = url_errs[rc];
     }
@@ -163,9 +191,11 @@ static CURLcode ldap_setup(struct connectdata *conn)
   ldap_free_urldesc(lud);
 
   li = calloc(1, sizeof(ldapconninfo));
+  if(!li)
+    return CURLE_OUT_OF_MEMORY;
   li->proto = proto;
   conn->proto.generic = li;
-  conn->bits.close = FALSE;
+  connkeep(conn, "OpenLDAP default");
   /* TODO:
    * - provide option to choose SASL Binds instead of Simple
    */
@@ -179,19 +209,31 @@ static Sockbuf_IO ldapsb_tls;
 static CURLcode ldap_connect(struct connectdata *conn, bool *done)
 {
   ldapconninfo *li = conn->proto.generic;
-  struct SessionHandle *data=conn->data;
+  struct Curl_easy *data = conn->data;
   int rc, proto = LDAP_VERSION3;
-  char hosturl[1024], *ptr;
+  char hosturl[1024];
+  char *ptr;
+
+  (void)done;
 
   strcpy(hosturl, "ldap");
-  ptr = hosturl+4;
-  if (conn->protocol & PROT_SSL)
+  ptr = hosturl + 4;
+  if(conn->handler->flags & PROTOPT_SSL)
     *ptr++ = 's';
   snprintf(ptr, sizeof(hosturl)-(ptr-hosturl), "://%s:%d",
-    conn->host.name, conn->remote_port);
+           conn->host.name, conn->remote_port);
+
+#ifdef CURL_OPENLDAP_DEBUG
+  static int do_trace = 0;
+  const char *env = getenv("CURL_OPENLDAP_TRACE");
+  do_trace = (env && strtol(env, NULL, 10) > 0);
+  if(do_trace) {
+    ldap_set_option(li->ld, LDAP_OPT_DEBUG_LEVEL, &do_trace);
+  }
+#endif
 
   rc = ldap_init_fd(conn->sock[FIRSTSOCKET], li->proto, hosturl, &li->ld);
-  if (rc) {
+  if(rc) {
     failf(data, "LDAP local: Cannot connect to %s, %s",
           hosturl, ldap_err2string(rc));
     return CURLE_COULDNT_CONNECT;
@@ -199,76 +241,39 @@ static CURLcode ldap_connect(struct connectdata *conn, bool *done)
 
   ldap_set_option(li->ld, LDAP_OPT_PROTOCOL_VERSION, &proto);
 
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY)
-  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
-    /* for LDAP over HTTP proxy */
-    struct HTTP http_proxy;
-    ldapconninfo *li_save;
+#ifdef USE_SSL
+  if(conn->handler->flags & PROTOPT_SSL) {
     CURLcode result;
-
-    /* BLOCKING */
-    /* We want "seamless" LDAP operations through HTTP proxy tunnel */
-
-    /* Curl_proxyCONNECT is based on a pointer to a struct HTTP at the member
-     * conn->proto.http; we want LDAP through HTTP and we have to change the
-     * member temporarily for connecting to the HTTP proxy. After
-     * Curl_proxyCONNECT we have to set back the member to the original struct
-     * LDAP pointer
-     */
-    li_save = data->state.proto.generic;
-    memset(&http_proxy, 0, sizeof(http_proxy));
-    data->state.proto.http = &http_proxy;
-    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
-                               conn->host.name, conn->remote_port);
-
-    data->state.proto.generic = li_save;
-
-    if(CURLE_OK != result)
+    result = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &li->ssldone);
+    if(result)
       return result;
   }
-#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_PROXY */
-
-#ifdef USE_SSL
-  if (conn->protocol & PROT_SSL) {
-    CURLcode res;
-    if (data->state.used_interface == Curl_if_easy) {
-      res = Curl_ssl_connect(conn, FIRSTSOCKET);
-      if (res)
-        return res;
-      li->ssldone = TRUE;
-    } else {
-      res = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &li->ssldone);
-      if (res)
-        return res;
-    }
-  }
 #endif
 
-  if (data->state.used_interface == Curl_if_easy)
-    return ldap_connecting(conn, done);
-
   return CURLE_OK;
 }
 
 static CURLcode ldap_connecting(struct connectdata *conn, bool *done)
 {
   ldapconninfo *li = conn->proto.generic;
-  struct SessionHandle *data=conn->data;
-  LDAPMessage *result = NULL;
-  struct timeval tv = {0,1}, *tvp;
+  struct Curl_easy *data = conn->data;
+  LDAPMessage *msg = NULL;
+  struct timeval tv = {0, 1}, *tvp;
   int rc, err;
   char *info = NULL;
 
 #ifdef USE_SSL
-  if (conn->protocol & PROT_SSL) {
+  if(conn->handler->flags & PROTOPT_SSL) {
     /* Is the SSL handshake complete yet? */
-    if (!li->ssldone) {
-      CURLcode res = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET, &li->ssldone);
-      if (res || !li->ssldone)
-        return res;
+    if(!li->ssldone) {
+      CURLcode result = Curl_ssl_connect_nonblocking(conn, FIRSTSOCKET,
+                                                     &li->ssldone);
+      if(result || !li->ssldone)
+        return result;
     }
+
     /* Have we installed the libcurl SSL handlers into the sockbuf yet? */
-    if (!li->sslinst) {
+    if(!li->sslinst) {
       Sockbuf *sb;
       ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb);
       ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, conn);
@@ -279,54 +284,57 @@ static CURLcode ldap_connecting(struct connectdata *conn, bool *done)
   }
 #endif
 
-  if (data->state.used_interface == Curl_if_easy)
-    tvp = NULL;    /* let ldap_result block indefinitely */
-  else
-    tvp = &tv;
+  tvp = &tv;
 
-retry:
-  if (!li->didbind) {
+  retry:
+  if(!li->didbind) {
     char *binddn;
     struct berval passwd;
 
-    if (conn->bits.user_passwd) {
+    if(conn->bits.user_passwd) {
       binddn = conn->user;
       passwd.bv_val = conn->passwd;
       passwd.bv_len = strlen(passwd.bv_val);
-    } else {
+    }
+    else {
       binddn = NULL;
       passwd.bv_val = NULL;
       passwd.bv_len = 0;
     }
     rc = ldap_sasl_bind(li->ld, binddn, LDAP_SASL_SIMPLE, &passwd,
                         NULL, NULL, &li->msgid);
-    if (rc)
+    if(rc)
       return CURLE_LDAP_CANNOT_BIND;
     li->didbind = TRUE;
-    if (tvp)
+    if(tvp)
       return CURLE_OK;
   }
 
-  rc = ldap_result(li->ld, li->msgid, LDAP_MSG_ONE, tvp, &result);
-  if (rc < 0) {
+  rc = ldap_result(li->ld, li->msgid, LDAP_MSG_ONE, tvp, &msg);
+  if(rc < 0) {
     failf(data, "LDAP local: bind ldap_result %s", ldap_err2string(rc));
     return CURLE_LDAP_CANNOT_BIND;
   }
-  if (rc == 0) {
+  if(rc == 0) {
     /* timed out */
     return CURLE_OK;
   }
-  rc = ldap_parse_result(li->ld, result, &err, NULL, &info, NULL, NULL, 1);
-  if (rc) {
+
+  rc = ldap_parse_result(li->ld, msg, &err, NULL, &info, NULL, NULL, 1);
+  if(rc) {
     failf(data, "LDAP local: bind ldap_parse_result %s", ldap_err2string(rc));
     return CURLE_LDAP_CANNOT_BIND;
   }
+
   /* Try to fallback to LDAPv2? */
-  if (err == LDAP_PROTOCOL_ERROR) {
+  if(err == LDAP_PROTOCOL_ERROR) {
     int proto;
     ldap_get_option(li->ld, LDAP_OPT_PROTOCOL_VERSION, &proto);
-    if (proto == LDAP_VERSION3) {
-      ldap_memfree(info);
+    if(proto == LDAP_VERSION3) {
+      if(info) {
+        ldap_memfree(info);
+        info = NULL;
+      }
       proto = LDAP_VERSION2;
       ldap_set_option(li->ld, LDAP_OPT_PROTOCOL_VERSION, &proto);
       li->didbind = FALSE;
@@ -334,13 +342,19 @@ retry:
     }
   }
 
-  if (err) {
+  if(err) {
     failf(data, "LDAP remote: bind failed %s %s", ldap_err2string(rc),
           info ? info : "");
+    if(info)
+      ldap_memfree(info);
     return CURLE_LOGIN_DENIED;
   }
+
+  if(info)
+    ldap_memfree(info);
   conn->recv[FIRSTSOCKET] = ldap_recv;
   *done = TRUE;
+
   return CURLE_OK;
 }
 
@@ -349,8 +363,8 @@ static CURLcode ldap_disconnect(struct connectdata *conn, bool dead_connection)
   ldapconninfo *li = conn->proto.generic;
   (void) dead_connection;
 
-  if (li) {
-    if (li->ld) {
+  if(li) {
+    if(li->ld) {
       ldap_unbind_ext(li->ld, NULL, NULL);
       li->ld = NULL;
     }
@@ -368,18 +382,18 @@ static CURLcode ldap_do(struct connectdata *conn, bool *done)
   int rc = 0;
   LDAPURLDesc *ludp = NULL;
   int msgid;
-  struct SessionHandle *data=conn->data;
+  struct Curl_easy *data = conn->data;
 
-  conn->bits.close = FALSE;
+  connkeep(conn, "OpenLDAP do");
 
   infof(data, "LDAP local: %s\n", data->change.url);
 
   rc = ldap_url_parse(data->change.url, &ludp);
-  if (rc != LDAP_URL_SUCCESS) {
+  if(rc != LDAP_URL_SUCCESS) {
     const char *msg = "url parsing problem";
     status = CURLE_URL_MALFORMAT;
-    if (rc > LDAP_URL_SUCCESS && rc <= LDAP_URL_ERR_BADEXTS) {
-      if (rc == LDAP_URL_ERR_MEM)
+    if(rc > LDAP_URL_SUCCESS && rc <= LDAP_URL_ERR_BADEXTS) {
+      if(rc == LDAP_URL_ERR_MEM)
         status = CURLE_OUT_OF_MEMORY;
       msg = url_errs[rc];
     }
@@ -391,13 +405,15 @@ static CURLcode ldap_do(struct connectdata *conn, bool *done)
                        ludp->lud_filter, ludp->lud_attrs, 0,
                        NULL, NULL, NULL, 0, &msgid);
   ldap_free_urldesc(ludp);
-  if (rc != LDAP_SUCCESS) {
+  if(rc != LDAP_SUCCESS) {
     failf(data, "LDAP local: ldap_search_ext %s", ldap_err2string(rc));
     return CURLE_LDAP_SEARCH_FAILED;
   }
-  lr = calloc(1,sizeof(ldapreqinfo));
+  lr = calloc(1, sizeof(ldapreqinfo));
+  if(!lr)
+    return CURLE_OUT_OF_MEMORY;
   lr->msgid = msgid;
-  data->state.proto.generic = lr;
+  data->req.protop = lr;
   Curl_setup_transfer(conn, FIRSTSOCKET, -1, FALSE, NULL, -1, NULL);
   *done = TRUE;
   return CURLE_OK;
@@ -406,20 +422,22 @@ static CURLcode ldap_do(struct connectdata *conn, bool *done)
 static CURLcode ldap_done(struct connectdata *conn, CURLcode res,
                           bool premature)
 {
-  ldapreqinfo *lr = conn->data->state.proto.generic;
+  ldapreqinfo *lr = conn->data->req.protop;
+
   (void)res;
   (void)premature;
 
-  if (lr) {
+  if(lr) {
     /* if there was a search in progress, abandon it */
-    if (lr->msgid) {
+    if(lr->msgid) {
       ldapconninfo *li = conn->proto.generic;
       ldap_abandon_ext(li->ld, lr->msgid, NULL, NULL);
       lr->msgid = 0;
     }
-    conn->data->state.proto.generic = NULL;
+    conn->data->req.protop = NULL;
     free(lr);
   }
+
   return CURLE_OK;
 }
 
@@ -427,19 +445,20 @@ static ssize_t ldap_recv(struct connectdata *conn, int sockindex, char *buf,
                          size_t len, CURLcode *err)
 {
   ldapconninfo *li = conn->proto.generic;
-  struct SessionHandle *data=conn->data;
-  ldapreqinfo *lr = data->state.proto.generic;
+  struct Curl_easy *data = conn->data;
+  ldapreqinfo *lr = data->req.protop;
   int rc, ret;
-  LDAPMessage *result = NULL;
+  LDAPMessage *msg = NULL;
   LDAPMessage *ent;
   BerElement *ber = NULL;
-  struct timeval tv = {0,1};
+  struct timeval tv = {0, 1};
+
   (void)len;
   (void)buf;
   (void)sockindex;
 
-  rc = ldap_result(li->ld, lr->msgid, LDAP_MSG_RECEIVED, &tv, &result);
-  if (rc < 0) {
+  rc = ldap_result(li->ld, lr->msgid, LDAP_MSG_RECEIVED, &tv, &msg);
+  if(rc < 0) {
     failf(data, "LDAP local: search ldap_result %s", ldap_err2string(rc));
     *err = CURLE_RECV_ERROR;
     return -1;
@@ -449,29 +468,33 @@ static ssize_t ldap_recv(struct connectdata *conn, int sockindex, char *buf,
   ret = -1;
 
   /* timed out */
-  if (result == NULL)
+  if(!msg)
     return ret;
 
-  for (ent = ldap_first_message(li->ld, result); ent;
-    ent = ldap_next_message(li->ld, ent)) {
-    struct berval bv, *bvals, **bvp = &bvals;
+  for(ent = ldap_first_message(li->ld, msg); ent;
+      ent = ldap_next_message(li->ld, ent)) {
+    struct berval bv, *bvals;
     int binary = 0, msgtype;
+    CURLcode writeerr;
 
     msgtype = ldap_msgtype(ent);
-    if (msgtype == LDAP_RES_SEARCH_RESULT) {
+    if(msgtype == LDAP_RES_SEARCH_RESULT) {
       int code;
       char *info = NULL;
       rc = ldap_parse_result(li->ld, ent, &code, NULL, &info, NULL, NULL, 0);
-      if (rc) {
-        failf(data, "LDAP local: search ldap_parse_result %s", ldap_err2string(rc));
+      if(rc) {
+        failf(data, "LDAP local: search ldap_parse_result %s",
+              ldap_err2string(rc));
         *err = CURLE_LDAP_SEARCH_FAILED;
-      } else if (code && code != LDAP_SIZELIMIT_EXCEEDED) {
+      }
+      else if(code && code != LDAP_SIZELIMIT_EXCEEDED) {
         failf(data, "LDAP remote: search failed %s %s", ldap_err2string(rc),
-          info ? info : "");
+              info ? info : "");
         *err = CURLE_LDAP_SEARCH_FAILED;
-      } else {
+      }
+      else {
         /* successful */
-        if (code == LDAP_SIZELIMIT_EXCEEDED)
+        if(code == LDAP_SIZELIMIT_EXCEEDED)
           infof(data, "There are more than %d entries\n", lr->nument);
         data->req.size = data->req.bytecount;
         *err = CURLE_OK;
@@ -480,83 +503,164 @@ static ssize_t ldap_recv(struct connectdata *conn, int sockindex, char *buf,
       lr->msgid = 0;
       ldap_memfree(info);
       break;
-    } else if (msgtype != LDAP_RES_SEARCH_ENTRY) {
-      continue;
     }
+    else if(msgtype != LDAP_RES_SEARCH_ENTRY)
+      continue;
 
     lr->nument++;
     rc = ldap_get_dn_ber(li->ld, ent, &ber, &bv);
-    Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"DN: ", 4);
-    Curl_client_write(conn, CLIENTWRITE_BODY, (char *)bv.bv_val, bv.bv_len);
-    Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 1);
+    if(rc < 0) {
+      /* TODO: verify that this is really how this return code should be
+         handled */
+      *err = CURLE_RECV_ERROR;
+      return -1;
+    }
+    writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"DN: ", 4);
+    if(writeerr) {
+      *err = writeerr;
+      return -1;
+    }
+
+    writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)bv.bv_val,
+                                 bv.bv_len);
+    if(writeerr) {
+      *err = writeerr;
+      return -1;
+    }
+
+    writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 1);
+    if(writeerr) {
+      *err = writeerr;
+      return -1;
+    }
     data->req.bytecount += bv.bv_len + 5;
 
-    for (rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, bvp);
-      rc == LDAP_SUCCESS;
-      rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, bvp)) {
+    for(rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, &bvals);
+        (rc == LDAP_SUCCESS) && bvals;
+        rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, &bvals)) {
       int i;
 
-      if (bv.bv_val == NULL) break;
+      if(bv.bv_val == NULL)
+        break;
 
-      if (bv.bv_len > 7 && !strncmp(bv.bv_val + bv.bv_len - 7, ";binary", 7))
+      if(bv.bv_len > 7 && !strncmp(bv.bv_val + bv.bv_len - 7, ";binary", 7))
         binary = 1;
       else
         binary = 0;
 
-      for (i=0; bvals[i].bv_val != NULL; i++) {
+      for(i = 0; bvals[i].bv_val != NULL; i++) {
         int binval = 0;
-        Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\t", 1);
-        Curl_client_write(conn, CLIENTWRITE_BODY, (char *)bv.bv_val, bv.bv_len);
-        Curl_client_write(conn, CLIENTWRITE_BODY, (char *)":", 1);
+        writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\t", 1);
+        if(writeerr) {
+          *err = writeerr;
+          return -1;
+        }
+
+        writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)bv.bv_val,
+                                     bv.bv_len);
+        if(writeerr) {
+          *err = writeerr;
+          return -1;
+        }
+
+        writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)":", 1);
+        if(writeerr) {
+          *err = writeerr;
+          return -1;
+        }
         data->req.bytecount += bv.bv_len + 2;
 
-        if (!binary) {
+        if(!binary) {
           /* check for leading or trailing whitespace */
-          if (ISSPACE(bvals[i].bv_val[0]) ||
-              ISSPACE(bvals[i].bv_val[bvals[i].bv_len-1])) {
+          if(ISSPACE(bvals[i].bv_val[0]) ||
+             ISSPACE(bvals[i].bv_val[bvals[i].bv_len-1]))
             binval = 1;
-          else {
+          else {
             /* check for unprintable characters */
             unsigned int j;
-            for (j=0; j<bvals[i].bv_len; j++)
-              if (!ISPRINT(bvals[i].bv_val[j])) {
+            for(j = 0; j<bvals[i].bv_len; j++)
+              if(!ISPRINT(bvals[i].bv_val[j])) {
                 binval = 1;
                 break;
               }
           }
         }
-        if (binary || binval) {
-          char *val_b64;
+        if(binary || binval) {
+          char *val_b64 = NULL;
+          size_t val_b64_sz = 0;
           /* Binary value, encode to base64. */
-          size_t val_b64_sz = Curl_base64_encode(data,
-                                            bvals[i].bv_val,
-                                            bvals[i].bv_len,
-                                            &val_b64);
-          Curl_client_write(conn, CLIENTWRITE_BODY, (char *)": ", 2);
+          CURLcode error = Curl_base64_encode(data,
+                                              bvals[i].bv_val,
+                                              bvals[i].bv_len,
+                                              &val_b64,
+                                              &val_b64_sz);
+          if(error) {
+            ber_memfree(bvals);
+            ber_free(ber, 0);
+            ldap_msgfree(msg);
+            *err = error;
+            return -1;
+          }
+          writeerr = Curl_client_write(conn, CLIENTWRITE_BODY,
+                                       (char *)": ", 2);
+          if(writeerr) {
+            *err = writeerr;
+            return -1;
+          }
+
           data->req.bytecount += 2;
           if(val_b64_sz > 0) {
-            Curl_client_write(conn, CLIENTWRITE_BODY, val_b64, val_b64_sz);
+            writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, val_b64,
+                                         val_b64_sz);
+            if(writeerr) {
+              *err = writeerr;
+              return -1;
+            }
             free(val_b64);
             data->req.bytecount += val_b64_sz;
           }
-        } else {
-          Curl_client_write(conn, CLIENTWRITE_BODY, (char *)" ", 1);
-          Curl_client_write(conn, CLIENTWRITE_BODY, bvals[i].bv_val,
-                            bvals[i].bv_len);
+        }
+        else {
+          writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)" ", 1);
+          if(writeerr) {
+            *err = writeerr;
+            return -1;
+          }
+
+          writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, bvals[i].bv_val,
+                                       bvals[i].bv_len);
+          if(writeerr) {
+            *err = writeerr;
+            return -1;
+          }
+
           data->req.bytecount += bvals[i].bv_len + 1;
         }
-        Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
+        writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
+        if(writeerr) {
+          *err = writeerr;
+          return -1;
+        }
+
         data->req.bytecount++;
       }
       ber_memfree(bvals);
-      Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
+      writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
+      if(writeerr) {
+        *err = writeerr;
+        return -1;
+      }
       data->req.bytecount++;
     }
-    Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
+    writeerr = Curl_client_write(conn, CLIENTWRITE_BODY, (char *)"\n", 0);
+    if(writeerr) {
+      *err = writeerr;
+      return -1;
+    }
     data->req.bytecount++;
     ber_free(ber, 0);
   }
-  ldap_msgfree(result);
+  ldap_msgfree(msg);
   return ret;
 }
 
@@ -587,7 +691,7 @@ static int
 ldapsb_tls_ctrl(Sockbuf_IO_Desc *sbiod, int opt, void *arg)
 {
   (void)arg;
-  if (opt == LBER_SB_OPT_DATA_READY) {
+  if(opt == LBER_SB_OPT_DATA_READY) {
     struct connectdata *conn = sbiod->sbiod_pvt;
     return Curl_ssl_data_pending(conn, FIRSTSOCKET);
   }
@@ -602,8 +706,8 @@ ldapsb_tls_read(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
   ber_slen_t ret;
   CURLcode err = CURLE_RECV_ERROR;
 
-  ret = li->recv(conn, FIRSTSOCKET, buf, len, &err);
-  if (ret < 0 && err == CURLE_AGAIN) {
+  ret = (li->recv)(conn, FIRSTSOCKET, buf, len, &err);
+  if(ret < 0 && err == CURLE_AGAIN) {
     SET_SOCKERRNO(EWOULDBLOCK);
   }
   return ret;
@@ -617,8 +721,8 @@ ldapsb_tls_write(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
   ber_slen_t ret;
   CURLcode err = CURLE_SEND_ERROR;
 
-  ret = li->send(conn, FIRSTSOCKET, buf, len, &err);
-  if (ret < 0 && err == CURLE_AGAIN) {
+  ret = (li->send)(conn, FIRSTSOCKET, buf, len, &err);
+  if(ret < 0 && err == CURLE_AGAIN) {
     SET_SOCKERRNO(EWOULDBLOCK);
   }
   return ret;