/usr/src/libexec/login_ldap/util.c

Bug Summary

File:	src/libexec/login_ldap/util.c
Warning:	line 362, column 10 The left operand of '==' is a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name util.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/libexec/login_ldap/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/libexec/login_ldap -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/libexec/login_ldap/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/libexec/login_ldap/util.c

1/*
* $OpenBSD: util.c,v 1.3 2021/09/02 20:57:58 deraadt Exp $
* Copyright (c) 2002 Institute for Open Systems Technology Australia (IFOST)
* Copyright (c) 2007 Michael Erdely <merdely@openbsd.org>
* Copyright (c) 2019 Martijn van Duren <martijn@openbsd.org>
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
*    derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
* THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

32#include <sys/socket.h>
33#include <limits.h>
34#include <sys/time.h>
35#include <sys/types.h>
36#include <sys/stat.h>
37#include <sys/un.h>
38#include <netinet/in.h>

40#include <ctype.h>
41#include <grp.h>
42#include <unistd.h>
43#include <stdio.h>
44#include <stdarg.h>
45#include <stdlib.h>
46#include <string.h>
47#include <limits.h>
48#include <errno(*__errno()).h>
49#include <syslog.h>
50#include <tls.h>
51#include <netdb.h>
52#include <login_cap.h>

54#include "aldap.h"
55#include "login_ldap.h"

57int debug = 0;

59static int getscope(char *);

61void
62dlog(int d, char *fmt, ...)
63{
va_list ap;

/*
* if debugging is on, print everthing to stderr
* otherwise, syslog it if d = 0. messing with
* newlines means there wont be newlines in stuff
* that goes to syslog.
*/

va_start(ap, fmt)__builtin_va_start(ap, fmt);
if (debug) {
vfprintf(stderr(&__sF[2]), fmt, ap);
fputc('\n', stderr(&__sF[2]));
} else if (d == 0)
vsyslog(LOG_WARNING4, fmt, ap);

va_end(ap)__builtin_va_end(ap);
81}

83const char *
84ldap_resultcode(enum result_code code)
85{
86#define CODE(_X)case 0x40:return ("_X")	case _X0x40:return (#_X0x40)
switch (code) {
CODE(LDAP_SUCCESS)case LDAP_SUCCESS:return ("LDAP_SUCCESS");
CODE(LDAP_OPERATIONS_ERROR)case LDAP_OPERATIONS_ERROR:return ("LDAP_OPERATIONS_ERROR");
CODE(LDAP_PROTOCOL_ERROR)case LDAP_PROTOCOL_ERROR:return ("LDAP_PROTOCOL_ERROR");
CODE(LDAP_TIMELIMIT_EXCEEDED)case LDAP_TIMELIMIT_EXCEEDED:return ("LDAP_TIMELIMIT_EXCEEDED"
);
CODE(LDAP_SIZELIMIT_EXCEEDED)case LDAP_SIZELIMIT_EXCEEDED:return ("LDAP_SIZELIMIT_EXCEEDED"
);
CODE(LDAP_COMPARE_FALSE)case LDAP_COMPARE_FALSE:return ("LDAP_COMPARE_FALSE");
CODE(LDAP_COMPARE_TRUE)case LDAP_COMPARE_TRUE:return ("LDAP_COMPARE_TRUE");
CODE(LDAP_STRONG_AUTH_NOT_SUPPORTED)case LDAP_STRONG_AUTH_NOT_SUPPORTED:return ("LDAP_STRONG_AUTH_NOT_SUPPORTED"
);
CODE(LDAP_STRONG_AUTH_REQUIRED)case LDAP_STRONG_AUTH_REQUIRED:return ("LDAP_STRONG_AUTH_REQUIRED"
);
CODE(LDAP_REFERRAL)case LDAP_REFERRAL:return ("LDAP_REFERRAL");
CODE(LDAP_ADMINLIMIT_EXCEEDED)case LDAP_ADMINLIMIT_EXCEEDED:return ("LDAP_ADMINLIMIT_EXCEEDED"
);
CODE(LDAP_UNAVAILABLE_CRITICAL_EXTENSION)case LDAP_UNAVAILABLE_CRITICAL_EXTENSION:return ("LDAP_UNAVAILABLE_CRITICAL_EXTENSION"
);
CODE(LDAP_CONFIDENTIALITY_REQUIRED)case LDAP_CONFIDENTIALITY_REQUIRED:return ("LDAP_CONFIDENTIALITY_REQUIRED"
);
CODE(LDAP_SASL_BIND_IN_PROGRESS)case LDAP_SASL_BIND_IN_PROGRESS:return ("LDAP_SASL_BIND_IN_PROGRESS"
);
CODE(LDAP_NO_SUCH_ATTRIBUTE)case LDAP_NO_SUCH_ATTRIBUTE:return ("LDAP_NO_SUCH_ATTRIBUTE");
CODE(LDAP_UNDEFINED_TYPE)case LDAP_UNDEFINED_TYPE:return ("LDAP_UNDEFINED_TYPE");
CODE(LDAP_INAPPROPRIATE_MATCHING)case LDAP_INAPPROPRIATE_MATCHING:return ("LDAP_INAPPROPRIATE_MATCHING"
);
CODE(LDAP_CONSTRAINT_VIOLATION)case LDAP_CONSTRAINT_VIOLATION:return ("LDAP_CONSTRAINT_VIOLATION"
);
CODE(LDAP_TYPE_OR_VALUE_EXISTS)case LDAP_TYPE_OR_VALUE_EXISTS:return ("LDAP_TYPE_OR_VALUE_EXISTS"
);
CODE(LDAP_INVALID_SYNTAX)case LDAP_INVALID_SYNTAX:return ("LDAP_INVALID_SYNTAX");
CODE(LDAP_NO_SUCH_OBJECT)case LDAP_NO_SUCH_OBJECT:return ("LDAP_NO_SUCH_OBJECT");
CODE(LDAP_ALIAS_PROBLEM)case LDAP_ALIAS_PROBLEM:return ("LDAP_ALIAS_PROBLEM");
CODE(LDAP_INVALID_DN_SYNTAX)case LDAP_INVALID_DN_SYNTAX:return ("LDAP_INVALID_DN_SYNTAX");
CODE(LDAP_ALIAS_DEREF_PROBLEM)case LDAP_ALIAS_DEREF_PROBLEM:return ("LDAP_ALIAS_DEREF_PROBLEM"
);
CODE(LDAP_INAPPROPRIATE_AUTH)case LDAP_INAPPROPRIATE_AUTH:return ("LDAP_INAPPROPRIATE_AUTH"
);
CODE(LDAP_INVALID_CREDENTIALS)case LDAP_INVALID_CREDENTIALS:return ("LDAP_INVALID_CREDENTIALS"
);
CODE(LDAP_INSUFFICIENT_ACCESS)case LDAP_INSUFFICIENT_ACCESS:return ("LDAP_INSUFFICIENT_ACCESS"
);
CODE(LDAP_BUSY)case LDAP_BUSY:return ("LDAP_BUSY");
CODE(LDAP_UNAVAILABLE)case LDAP_UNAVAILABLE:return ("LDAP_UNAVAILABLE");
CODE(LDAP_UNWILLING_TO_PERFORM)case LDAP_UNWILLING_TO_PERFORM:return ("LDAP_UNWILLING_TO_PERFORM"
);
CODE(LDAP_LOOP_DETECT)case LDAP_LOOP_DETECT:return ("LDAP_LOOP_DETECT");
CODE(LDAP_NAMING_VIOLATION)case LDAP_NAMING_VIOLATION:return ("LDAP_NAMING_VIOLATION");
CODE(LDAP_OBJECT_CLASS_VIOLATION)case LDAP_OBJECT_CLASS_VIOLATION:return ("LDAP_OBJECT_CLASS_VIOLATION"
);
CODE(LDAP_NOT_ALLOWED_ON_NONLEAF)case LDAP_NOT_ALLOWED_ON_NONLEAF:return ("LDAP_NOT_ALLOWED_ON_NONLEAF"
);
CODE(LDAP_NOT_ALLOWED_ON_RDN)case LDAP_NOT_ALLOWED_ON_RDN:return ("LDAP_NOT_ALLOWED_ON_RDN"
);
CODE(LDAP_ALREADY_EXISTS)case LDAP_ALREADY_EXISTS:return ("LDAP_ALREADY_EXISTS");
CODE(LDAP_NO_OBJECT_CLASS_MODS)case LDAP_NO_OBJECT_CLASS_MODS:return ("LDAP_NO_OBJECT_CLASS_MODS"
);
CODE(LDAP_AFFECTS_MULTIPLE_DSAS)case LDAP_AFFECTS_MULTIPLE_DSAS:return ("LDAP_AFFECTS_MULTIPLE_DSAS"
);
CODE(LDAP_OTHER)case LDAP_OTHER:return ("LDAP_OTHER");
}

return ("UNKNOWN_ERROR");
130};


133static int
134parse_server_line(char *buf, struct aldap_url *s)
135{
/**
* host=[<protocol>://]<hostname>[:port]
*
* must have a hostname
* protocol can be "ldap", "ldaps", "ldap+tls" or "ldapi"
* for ldap and ldap+tls, port defaults to 389
* for ldaps, port defaults to 636
*/

if (buf == NULL((void*)0)) {
dlog(1, "%s got NULL buf!", __func__);
return 0;
}

dlog(1, "parse_server_line buf = %s", buf);

memset(s, 0, sizeof(*s));

if (aldap_parse_url(buf, s) == -1) {
dlog(0, "failed to parse host %s", buf);
return 0;
}

if (s->protocol == -1)
s->protocol = LDAP;
if (s->protocol != LDAPI && s->port == 0) {
if (s->protocol == LDAPS)
	s->port = 636;
else
	s->port = 389;
}

return 1;
169}

171int
172parse_conf(struct auth_ctx *ctx, const char *path)
173{
FILE *cf;
struct stat sb;
struct group *grp;
struct aldap_urlq *url;
char *buf = NULL((void*)0), *key, *value, *tail;
const char *errstr;
size_t buflen = 0;
ssize_t linelen;

dlog(1, "Parsing config file '%s'", path);

if ((cf = fopen(path, "r")) == NULL((void*)0)) {
dlog(0, "Can't open config file: %s", strerror(errno(*__errno())));
return 0;
}
if (fstat(fileno(cf)(!__isthreaded ? ((cf)->_file) : (fileno)(cf)), &sb) == -1) {
dlog(0, "Can't stat config file: %s", strerror(errno(*__errno())));
return 0;
}
if ((grp = getgrnam("auth")) == NULL((void*)0)) {
dlog(0, "Can't find group auth");
return 0;
}
if (sb.st_uid != 0 ||
   sb.st_gid != grp->gr_gid ||
   (sb.st_mode & S_IRWXU0000700) != (S_IRUSR0000400 | S_IWUSR0000200) ||
   (sb.st_mode & S_IRWXG0000070) != S_IRGRP0000040 ||
   (sb.st_mode & S_IRWXO0000007) != 0) {
dlog(0, "Wrong permissions for config file");
return 0;
}

/* We need a default scope */
ctx->gscope = ctx->scope = getscope(NULL((void*)0));

while ((linelen = getline(&buf, &buflen, cf)) != -1) {
if (buf[linelen - 1] == '\n')
	buf[linelen -1] = '\0';
/* Allow leading spaces */
for (key = buf; key[0] != '\0' && isspace(key[0]); key++)
	continue;
/* Comment or white lines */
if (key[0] == '#' || key[0] == '\0')
	continue;
if ((tail = value = strchr(key, '=')) == NULL((void*)0)) {
	dlog(0, "Missing value for option '%s'", key);
	return 0;
}
value++;
/* Don't fail over trailing key spaces */
for (tail--; isspace(tail[0]); tail--)
	continue;
tail[1] = '\0';
if (strcmp(key, "host") == 0) {
	if ((url = calloc(1, sizeof(*url))) == NULL((void*)0)) {
		dlog(0, "Failed to add %s: %s", value,
		    strerror(errno(*__errno())));
		continue;
	}
	if (parse_server_line(value, &(url->s)) == 0) {
		free(url);
		return 0;
	}
	TAILQ_INSERT_TAIL(&(ctx->s), url, entries)do { (url)->entries.tqe_next = ((void*)0); (url)->entries
.tqe_prev = (&(ctx->s))->tqh_last; *(&(ctx->
s))->tqh_last = (url); (&(ctx->s))->tqh_last = &
(url)->entries.tqe_next; } while (0);
} else if (strcmp(key, "basedn") == 0) {
	free(ctx->basedn);
	if ((ctx->basedn = strdup(value)) == NULL((void*)0)) {
		dlog(0, "%s", strerror(errno(*__errno())));
		return 0;
	}
} else if (strcmp(key, "binddn") == 0) {
	free(ctx->binddn);
	if ((ctx->binddn = parse_filter(ctx, value)) == NULL((void*)0))
		return 0;
} else if (strcmp(key, "bindpw") == 0) {
	free(ctx->bindpw);
	if ((ctx->bindpw = strdup(value)) == NULL((void*)0)) {
		dlog(0, "%s", strerror(errno(*__errno())));
		return 0;
	}
} else if (strcmp(key, "timeout") == 0) {
	ctx->timeout = strtonum(value, 0, INT_MAX2147483647, &errstr);
	if (ctx->timeout == 0 && errstr != NULL((void*)0)) {
		dlog(0, "timeout %s", errstr);
		return 0;
	}
} else if (strcmp(key, "filter") == 0) {
	free(ctx->filter);
	if ((ctx->filter = parse_filter(ctx, value)) == NULL((void*)0))
		return 0;
} else if (strcmp(key, "scope") == 0) {
	if ((ctx->scope = getscope(value)) == -1)
		return 0;
} else if (strcmp(key, "cacert") == 0) {
	free(ctx->cacert);
	if ((ctx->cacert = strdup(value)) == NULL((void*)0)) {
		dlog(0, "%s", strerror(errno(*__errno())));
		return 0;
	}
} else if (strcmp(key, "cacertdir") == 0) {
	free(ctx->cacertdir);
	if ((ctx->cacertdir = strdup(value)) == NULL((void*)0)) {
		dlog(0, "%s", strerror(errno(*__errno())));
		return 0;
	}
} else if (strcmp(key, "gbasedn") == 0) {
	free(ctx->gbasedn);
	if ((ctx->gbasedn = strdup(value)) == NULL((void*)0)) {
		dlog(0, "%s", strerror(errno(*__errno())));
		return 0;
	}
} else if (strcmp(key, "gfilter") == 0) {
	free(ctx->gfilter);
	if ((ctx->gfilter = strdup(value)) == NULL((void*)0)) {
		dlog(0, "%s", strerror(errno(*__errno())));
		return 0;
	}
} else if (strcmp(key, "gscope") == 0) {
	if ((ctx->scope = getscope(value)) == -1)
		return 0;
} else {
	dlog(0, "Unknown option '%s'", key);
	return 0;
}
}
if (ferror(cf)(!__isthreaded ? (((cf)->_flags & 0x0040) != 0) : (ferror
)(cf))) {
dlog(0, "Can't read config file: %s", strerror(errno(*__errno())));
return 0;
}
if (TAILQ_EMPTY(&(ctx->s))(((&(ctx->s))->tqh_first) == ((void*)0))) {
dlog(0, "Missing host");
return 0;
}
if (ctx->basedn == NULL((void*)0) && ctx->binddn == NULL((void*)0)) {
dlog(0, "Missing basedn or binddn");
return 0;
}
return 1;
312}

314int
315do_conn(struct auth_ctx *ctx, struct aldap_url *url)
316{
struct addrinfo		 ai, *res, *res0;
struct sockaddr_un	 un;
struct aldap_message	*m;
struct tls_config	*tls_config;
const char		*errstr;
char			 port[6];
int			 fd, code;
4
←
'fd' declared without an initial value→

dlog(1, "host %s, port %d", url->host, url->port);

if (url->protocol == LDAPI) {
5
←
Assuming field 'protocol' is not equal to LDAPI→
6
←
Taking false branch→
memset(&un, 0, sizeof(un));
un.sun_family = AF_UNIX1;
if (strlcpy(un.sun_path, url->host,
    sizeof(un.sun_path)) >= sizeof(un.sun_path)) {
	dlog(0, "socket '%s' too long", url->host);
	return 0;
}
if ((fd = socket(AF_UNIX1, SOCK_STREAM1, 0)) == -1 ||
    connect(fd, (struct sockaddr *)&un, sizeof(un)) == -1) {
	dlog(0, "can't create socket '%s'", url->host);
	return 0;
}
} else {
memset(&ai, 0, sizeof(ai));
ai.ai_family = AF_UNSPEC0;
ai.ai_socktype = SOCK_STREAM1;
ai.ai_protocol = IPPROTO_TCP6;
(void)snprintf(port, sizeof(port), "%u", url->port);
if ((code = getaddrinfo(url->host, port,
7
←
Assuming the condition is false→
8
←
Taking false branch→
    &ai, &res0)) != 0) {
	dlog(0, "%s", gai_strerror(code));
	return 0;
}
for (res = res0; res; res = res->ai_next, fd = -1) {
9
←
Loop condition is false. Execution continues on line 361→
	if ((fd = socket(res->ai_family, res->ai_socktype,
	    res->ai_protocol)) == -1)
		continue;

	if (connect(fd, res->ai_addr, res->ai_addrlen) >= 0)
		break;

	close(fd);
}
freeaddrinfo(res0);
if (fd == -1)
10
←
The left operand of '==' is a garbage value
	return 0;
}

ctx->ld = aldap_init(fd);
if (ctx->ld == NULL((void*)0)) {
dlog(0, "aldap_open(%s:%hd) failed", url->host, url->port);
return 0;
}

dlog(1, "connect success!");

if (url->protocol == LDAPTLS) {
dlog(1, "starttls!");
if (aldap_req_starttls(ctx->ld) == -1) {
	dlog(0, "failed to request STARTTLS");
	goto fail;
}

if ((m = aldap_parse(ctx->ld)) == NULL((void*)0)) {
	dlog(0, "failed to parse STARTTLS response");
	goto fail;
}

if (ctx->ld->msgid != m->msgid ||
    (code = aldap_get_resultcode(m)) != LDAP_SUCCESS) {
	dlog(0, "STARTTLS failed: %s(%d)",
	    ldap_resultcode(code), code);
	aldap_freemsg(m);
	goto fail;
}
aldap_freemsg(m);
}
if (url->protocol == LDAPTLS || url->protocol == LDAPS) {
dlog(1, "%s: starting TLS", __func__);

if ((tls_config = tls_config_new()) == NULL((void*)0)) {
	dlog(0, "TLS config failed");
	goto fail;
}

if (ctx->cacert != NULL((void*)0) &&
    tls_config_set_ca_file(tls_config, ctx->cacert) == -1) {
	dlog(0, "Failed to set ca file %s", ctx->cacert);
	goto fail;
}
if (ctx->cacertdir != NULL((void*)0) &&
    tls_config_set_ca_path(tls_config, ctx->cacertdir) == -1) {
	dlog(0, "Failed to set ca dir %s", ctx->cacertdir);
	goto fail;
}

if (aldap_tls(ctx->ld, tls_config, url->host) < 0) {
	aldap_get_errno(ctx->ld, &errstr);
	dlog(0, "TLS failed: %s", errstr);
	goto fail;
}
}
return 1;
421fail:
aldap_close(ctx->ld);
return 0;
424}

426int
427conn(struct auth_ctx *ctx)
428{
struct aldap_urlq *url;

TAILQ_FOREACH(url, &(ctx->s), entries)for((url) = ((&(ctx->s))->tqh_first); (url) != ((void
*)0); (url) = ((url)->entries.tqe_next)) {
1
Assuming 'url' is not equal to null→
2
←
Loop condition is true.  Entering loop body→
if (do_conn(ctx, &(url->s)))
3
←
Calling 'do_conn'→
	return 1;
}

/* all the urls have failed */
return 0;
438}

440static int
441getscope(char *scope)
442{
if (scope == NULL((void*)0) || scope[0] == '\0')
return LDAP_SCOPE_SUBTREE;

if (strcmp(scope, "base") == 0)
return LDAP_SCOPE_BASE;
else if (strcmp(scope, "one") == 0)
return LDAP_SCOPE_ONELEVEL;
else if (strcmp(scope, "sub") == 0)
return LDAP_SCOPE_SUBTREE;

dlog(0, "Invalid scope");
return -1;
455}

457/*
* Convert format specifiers from the filter in login.conf to their
* real values. return the new filter in the filter argument.
*/
461char *
462parse_filter(struct auth_ctx *ctx, const char *str)
463{
char tmp[PATH_MAX1024];
char hostname[HOST_NAME_MAX255+1];
const char *p;
char *q;

if (str == NULL((void*)0))
return NULL((void*)0);

/*
* copy over from str to q, if we hit a %, substitute the real value,
* if we hit a NULL, its the end of the filter string
*/
for (p = str, q = tmp; p[0] != '\0' &&
   ((size_t)(q - tmp) < sizeof(tmp)); p++) {
if (p[0] == '%') {
	p++;

	/* Make sure we can find the end of tmp for strlcat */
	q[0] = '\0';

	/*
	 * Don't need to check strcat for truncation, since we
	 * will bail on the next iteration
	 */
	switch (p[0]) {
	case 'u': /* username */
		q = tmp + strlcat(tmp, ctx->user, sizeof(tmp));
		break;
	case 'h': /* hostname */
		if (gethostname(hostname, sizeof(hostname)) ==
		    -1) {
			dlog(0, "couldn't get host name for "
			    "%%h %s", strerror(errno(*__errno())));
			return NULL((void*)0);
		}
		q = tmp + strlcat(tmp, hostname, sizeof(tmp));
		break;
	case 'd': /* user dn */
		if (ctx->userdn == NULL((void*)0)) {
			dlog(0, "no userdn has been recorded");
			return 0;
		}
		q = tmp + strlcat(tmp, ctx->userdn,
		    sizeof(tmp));
		break;
	case '%': /* literal % */
		q[0] = p[0];
		q++;
		break;
	default:
		dlog(0, "%s: invalid filter specifier",
		    __func__);
		return NULL((void*)0);
	}
} else {
	q[0] = p[0];
	q++;
}
}
if ((size_t) (q - tmp) >= sizeof(tmp)) {
dlog(0, "filter string too large, unable to process: %s", str);
return NULL((void*)0);
}

q[0] = '\0';
q = strdup(tmp);
if (q == NULL((void*)0)) {
dlog(0, "%s", strerror(errno(*__errno())));
return NULL((void*)0);
}

return q;
536}