Description of problem:

During certificate based client authentication, certmap may be configured to use the user cert's subjectDN to look for a match. The SubjectDN is however not protected and may be used to sabotage the search.

In certain circumstances, it may prevent certificate to properly authenticate (e.g.: if subjectDN contains a legitimate `*`, it might match several users, and not authenticate at all).

This is not considered a security flaw, since it still requires a trusted CA to have signed the certificate.

Version-Release number of selected component (if applicable): all

How reproducible: 100%

Steps to Reproduce:
1. enable cert based auth, and configure certmap so that it uses the subject to match.
e.g.:

```
default:CmapLdapAttr nsCertSubjectDN
```
2. Create a user with a `nsCertSubjectDN`
3. Create a certificate with a subject containing a `*`

Actual results:

The certificate will match against the user

Expected results:

No match, since the subject is actually different.

Additional info:

Lines 775 & 778

```c
748 static int
749 ldapu_cert_searchfn_default(void *cert, LDAP *ld, void *certmap_info_in, const char *basedn, const char *dn, const char *filter, const char **attrs, LDAP Message ***res)
750 {
751 int rv = LDAPU_FAILED;
752 const char *ldapdn;
753 LDAPUCertMapInfo_t *certmap_info = (LDAPUCertMapInfo_t *)certmap_info_in;
754 LDAPMessage *single_res = NULL;
755 LDAPMessage **multiple_res = NULL;
756
757
758 if (certmap_info && certmap_info->searchAttr) {
759 char *subjectDN = 0;
760 char *certFilter = 0;
761 int len;
762
763 rv = ldapu_get_cert_subject_dn(cert, &subjectDN);
764
765 if (rv != LDAPU_SUCCESS || !subjectDN)

768 len = strlen(certmap_info->searchAttr) + strlen(subjectDN) +
769 strlen("=") + 1;
770 certFilter = (char *)ldapu_malloc(len * sizeof(char));
771 if (!certFilter)

775 sprintf(certFilter, "%s=%s", certmap_info->searchAttr, subjectDN); // <= The Filter doesn't protect subjectDN
776 free(subjectDN);
777 if (ldapu_strcasecmp(basedn, "")) {
778 rv = ldapu_find(ld, basedn, LDAP_SCOPE_SUBTREE, certFilter, attrs, 0, &single_res);
779 ldapu_free((void *)certFilter);
780 if (rv == LDAPU_SUCCESS || rv == LDAPU_ERR_MULTIPLE_MATCHES) {
```