src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2020 Joel Sing <joel@sing.id.au>
   5  *   Copyright (C) 2019 linuxdaemon <linuxdaemon.irc@gmail.com>
   6  *   Copyright (C) 2016-2020 Sadie Powell <sadie@witchery.services>
   7  *   Copyright (C) 2014, 2016 Attila Molnar <attilamolnar@hush.com>
   8  *   Copyright (C) 2013-2016 Adam <Adam@anope.org>
   9  *
  10  * This file is part of InspIRCd.  InspIRCd is free software: you can
  11  * redistribute it and/or modify it under the terms of the GNU General Public
  12  * License as published by the Free Software Foundation, version 2.
  13  *
  14  * This program is distributed in the hope that it will be useful, but WITHOUT
  15  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  16  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  17  * details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 /// $LinkerFlags: -llber -lldap_r
  24
  25 /// $PackageInfo: require_system("arch") libldap
  26 /// $PackageInfo: require_system("centos") openldap-devel
  27 /// $PackageInfo: require_system("debian") libldap2-dev
  28 /// $PackageInfo: require_system("ubuntu") libldap2-dev
  29
  30 #include "inspircd.h"
  31 #include "modules/ldap.h"
  32
  33 // Ignore OpenLDAP deprecation warnings on OS X Yosemite and newer.
  34 #if defined __APPLE__
  35 # pragma GCC diagnostic push
  36 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  37 #endif
  38
  39 #include <ldap.h>
  40
  41 #ifdef __APPLE__
  42 # pragma GCC diagnostic pop
  43 #endif
  44
  45 #ifdef _WIN32
  46 # pragma comment(lib, "libldap_r.lib")
  47 # pragma comment(lib, "liblber.lib")
  48 #endif
  49
  50 class LDAPService;
  51
  52 class LDAPRequest
  53 {
  54  public:
  55         LDAPService* service;
  56         LDAPInterface* inter;
  57         LDAPMessage* message; /* message returned by ldap_ */
  58         LDAPResult* result; /* final result */
  59         struct timeval tv;
  60         QueryType type;
  61
  62         LDAPRequest(LDAPService* s, LDAPInterface* i)
  63                 : service(s)
  64                 , inter(i)
  65                 , message(NULL)
  66                 , result(NULL)
  67         {
  68                 type = QUERY_UNKNOWN;
  69                 tv.tv_sec = 0;
  70                 tv.tv_usec = 100000;
  71         }
  72
  73         virtual ~LDAPRequest()
  74         {
  75                 delete result;
  76                 if (message != NULL)
  77                         ldap_msgfree(message);
  78         }
  79
  80         virtual int run() = 0;
  81         virtual std::string info() = 0;
  82 };
  83
  84 class LDAPBind : public LDAPRequest
  85 {
  86         std::string who, pass;
  87
  88  public:
  89         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  90                 : LDAPRequest(s, i)
  91                 , who(w)
  92                 , pass(p)
  93         {
  94                 type = QUERY_BIND;
  95         }
  96
  97         int run() CXX11_OVERRIDE;
  98         std::string info() CXX11_OVERRIDE;
  99 };
 100
 101 class LDAPSearch : public LDAPRequest
 102 {
 103         std::string base;
 104         int searchscope;
 105         std::string filter;
 106
 107  public:
 108         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
 109                 : LDAPRequest(s, i)
 110                 , base(b)
 111                 , searchscope(se)
 112                 , filter(f)
 113         {
 114                 type = QUERY_SEARCH;
 115         }
 116
 117         int run() CXX11_OVERRIDE;
 118         std::string info() CXX11_OVERRIDE;
 119 };
 120
 121 class LDAPAdd : public LDAPRequest
 122 {
 123         std::string dn;
 124         LDAPMods attributes;
 125
 126  public:
 127         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 128                 : LDAPRequest(s, i)
 129                 , dn(d)
 130                 , attributes(attr)
 131         {
 132                 type = QUERY_ADD;
 133         }
 134
 135         int run() CXX11_OVERRIDE;
 136         std::string info() CXX11_OVERRIDE;
 137 };
 138
 139 class LDAPDel : public LDAPRequest
 140 {
 141         std::string dn;
 142
 143  public:
 144         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 145                 : LDAPRequest(s, i)
 146                 , dn(d)
 147         {
 148                 type = QUERY_DELETE;
 149         }
 150
 151         int run() CXX11_OVERRIDE;
 152         std::string info() CXX11_OVERRIDE;
 153 };
 154
 155 class LDAPModify : public LDAPRequest
 156 {
 157         std::string base;
 158         LDAPMods attributes;
 159
 160  public:
 161         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 162                 : LDAPRequest(s, i)
 163                 , base(b)
 164                 , attributes(attr)
 165         {
 166                 type = QUERY_MODIFY;
 167         }
 168
 169         int run() CXX11_OVERRIDE;
 170         std::string info() CXX11_OVERRIDE;
 171 };
 172
 173 class LDAPCompare : public LDAPRequest
 174 {
 175         std::string dn, attr, val;
 176
 177  public:
 178         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 179                 : LDAPRequest(s, i)
 180                 , dn(d)
 181                 , attr(a)
 182                 , val(v)
 183         {
 184                 type = QUERY_COMPARE;
 185         }
 186
 187         int run() CXX11_OVERRIDE;
 188         std::string info() CXX11_OVERRIDE;
 189 };
 190
 191 class LDAPService : public LDAPProvider, public SocketThread
 192 {
 193         LDAP* con;
 194         reference<ConfigTag> config;
 195         time_t last_connect;
 196         int searchscope;
 197         time_t timeout;
 198
 199  public:
 200         static LDAPMod** BuildMods(const LDAPMods& attributes)
 201         {
 202                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 203                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 204                 for (unsigned int x = 0; x < attributes.size(); ++x)
 205                 {
 206                         const LDAPModification& l = attributes[x];
 207                         LDAPMod* mod = new LDAPMod;
 208                         mods[x] = mod;
 209
 210                         if (l.op == LDAPModification::LDAP_ADD)
 211                                 mod->mod_op = LDAP_MOD_ADD;
 212                         else if (l.op == LDAPModification::LDAP_DEL)
 213                                 mod->mod_op = LDAP_MOD_DELETE;
 214                         else if (l.op == LDAPModification::LDAP_REPLACE)
 215                                 mod->mod_op = LDAP_MOD_REPLACE;
 216                         else if (l.op != 0)
 217                         {
 218                                 FreeMods(mods);
 219                                 throw LDAPException("Unknown LDAP operation");
 220                         }
 221                         mod->mod_type = strdup(l.name.c_str());
 222                         mod->mod_values = new char*[l.values.size() + 1];
 223                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 224                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 225                                 if (!l.values[j].empty())
 226                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 227                 }
 228                 return mods;
 229         }
 230
 231         static void FreeMods(LDAPMod** mods)
 232         {
 233                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 234                 {
 235                         LDAPMod* mod = mods[i];
 236                         if (mod->mod_type != NULL)
 237                                 free(mod->mod_type);
 238                         if (mod->mod_values != NULL)
 239                         {
 240                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 241                                         free(mod->mod_values[j]);
 242                                 delete[] mod->mod_values;
 243                         }
 244                 }
 245                 delete[] mods;
 246         }
 247
 248  private:
 249         void Reconnect()
 250         {
 251                 // Only try one connect a minute. It is an expensive blocking operation
 252                 if (last_connect > ServerInstance->Time() - 60)
 253                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 254                 last_connect = ServerInstance->Time();
 255
 256                 ldap_unbind_ext(this->con, NULL, NULL);
 257                 Connect();
 258         }
 259
 260         int SetOption(int option, const void* value)
 261         {
 262                 int ret = ldap_set_option(this->con, option, value);
 263                 if (ret != LDAP_OPT_SUCCESS)
 264                 {
 265                         ldap_unbind_ext(this->con, NULL, NULL);
 266                         this->con = NULL;
 267                 }
 268                 return ret;
 269         }
 270
 271         void QueueRequest(LDAPRequest* r)
 272         {
 273                 this->LockQueue();
 274                 this->queries.push_back(r);
 275                 this->UnlockQueueWakeup();
 276         }
 277
 278  public:
 279         typedef std::vector<LDAPRequest*> query_queue;
 280         query_queue queries, results;
 281         Mutex process_mutex; /* held when processing requests not in either queue */
 282
 283         LDAPService(Module* c, ConfigTag* tag)
 284                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 285                 , con(NULL), config(tag), last_connect(0)
 286         {
 287                 std::string scope = config->getString("searchscope");
 288                 if (stdalgo::string::equalsci(scope, "base"))
 289                         searchscope = LDAP_SCOPE_BASE;
 290                 else if (stdalgo::string::equalsci(scope, "onelevel"))
 291                         searchscope = LDAP_SCOPE_ONELEVEL;
 292                 else
 293                         searchscope = LDAP_SCOPE_SUBTREE;
 294                 timeout = config->getDuration("timeout", 5);
 295
 296                 Connect();
 297         }
 298
 299         ~LDAPService()
 300         {
 301                 this->LockQueue();
 302
 303                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 304                 {
 305                         LDAPRequest* req = this->queries[i];
 306
 307                         /* queries have no results yet */
 308                         req->result = new LDAPResult();
 309                         req->result->type = req->type;
 310                         req->result->error = "LDAP Interface is going away";
 311                         req->inter->OnError(*req->result);
 312
 313                         delete req;
 314                 }
 315                 this->queries.clear();
 316
 317                 for (unsigned int i = 0; i < this->results.size(); ++i)
 318                 {
 319                         LDAPRequest* req = this->results[i];
 320
 321                         /* even though this may have already finished successfully we return that it didn't */
 322                         req->result->error = "LDAP Interface is going away";
 323                         req->inter->OnError(*req->result);
 324
 325                         delete req;
 326                 }
 327                 this->results.clear();
 328
 329                 this->UnlockQueue();
 330
 331                 ldap_unbind_ext(this->con, NULL, NULL);
 332         }
 333
 334         void Connect()
 335         {
 336                 std::string server = config->getString("server");
 337                 int i = ldap_initialize(&this->con, server.c_str());
 338                 if (i != LDAP_SUCCESS)
 339                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 340
 341                 const int version = LDAP_VERSION3;
 342                 i = SetOption(LDAP_OPT_PROTOCOL_VERSION, &version);
 343                 if (i != LDAP_OPT_SUCCESS)
 344                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 345
 346                 const struct timeval tv = { 0, 0 };
 347                 i = SetOption(LDAP_OPT_NETWORK_TIMEOUT, &tv);
 348                 if (i != LDAP_OPT_SUCCESS)
 349                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 350         }
 351
 352         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 353         {
 354                 std::string binddn = config->getString("binddn");
 355                 std::string bindauth = config->getString("bindauth");
 356                 this->Bind(i, binddn, bindauth);
 357         }
 358
 359         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 360         {
 361                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 362                 QueueRequest(b);
 363         }
 364
 365         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 366         {
 367                 if (i == NULL)
 368                         throw LDAPException("No interface");
 369
 370                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 371                 QueueRequest(s);
 372         }
 373
 374         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 375         {
 376                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 377                 QueueRequest(add);
 378         }
 379
 380         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 381         {
 382                 LDAPDel* del = new LDAPDel(this, i, dn);
 383                 QueueRequest(del);
 384         }
 385
 386         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 387         {
 388                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 389                 QueueRequest(mod);
 390         }
 391
 392         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 393         {
 394                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 395                 QueueRequest(comp);
 396         }
 397
 398  private:
 399         void BuildReply(int res, LDAPRequest* req)
 400         {
 401                 LDAPResult* ldap_result = req->result = new LDAPResult();
 402                 req->result->type = req->type;
 403
 404                 if (res != LDAP_SUCCESS)
 405                 {
 406                         ldap_result->error = InspIRCd::Format("%s (%s)", ldap_err2string(res), req->info().c_str());
 407                         return;
 408                 }
 409
 410                 if (req->message == NULL)
 411                 {
 412                         return;
 413                 }
 414
 415                 /* a search result */
 416
 417                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 418                 {
 419                         LDAPAttributes attributes;
 420
 421                         char* dn = ldap_get_dn(this->con, cur);
 422                         if (dn != NULL)
 423                         {
 424                                 attributes["dn"].push_back(dn);
 425                                 ldap_memfree(dn);
 426                                 dn = NULL;
 427                         }
 428
 429                         BerElement* ber = NULL;
 430
 431                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 432                         {
 433                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 434                                 int count = ldap_count_values_len(vals);
 435
 436                                 std::vector<std::string> attrs;
 437                                 for (int j = 0; j < count; ++j)
 438                                         attrs.push_back(vals[j]->bv_val);
 439                                 attributes[attr] = attrs;
 440
 441                                 ldap_value_free_len(vals);
 442                                 ldap_memfree(attr);
 443                         }
 444                         if (ber != NULL)
 445                                 ber_free(ber, 0);
 446
 447                         ldap_result->messages.push_back(attributes);
 448                 }
 449         }
 450
 451         void SendRequests()
 452         {
 453                 process_mutex.Lock();
 454
 455                 query_queue q;
 456                 this->LockQueue();
 457                 queries.swap(q);
 458                 this->UnlockQueue();
 459
 460                 if (q.empty())
 461                 {
 462                         process_mutex.Unlock();
 463                         return;
 464                 }
 465
 466                 for (unsigned int i = 0; i < q.size(); ++i)
 467                 {
 468                         LDAPRequest* req = q[i];
 469                         int ret = req->run();
 470
 471                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 472                         {
 473                                 /* try again */
 474                                 try
 475                                 {
 476                                         Reconnect();
 477                                 }
 478                                 catch (const LDAPException &)
 479                                 {
 480                                 }
 481
 482                                 ret = req->run();
 483                         }
 484
 485                         BuildReply(ret, req);
 486
 487                         this->LockQueue();
 488                         this->results.push_back(req);
 489                         this->UnlockQueue();
 490                 }
 491
 492                 this->NotifyParent();
 493
 494                 process_mutex.Unlock();
 495         }
 496
 497  public:
 498         void Run() CXX11_OVERRIDE
 499         {
 500                 while (!this->GetExitFlag())
 501                 {
 502                         this->LockQueue();
 503                         if (this->queries.empty())
 504                                 this->WaitForQueue();
 505                         this->UnlockQueue();
 506
 507                         SendRequests();
 508                 }
 509         }
 510
 511         void OnNotify() CXX11_OVERRIDE
 512         {
 513                 query_queue r;
 514
 515                 this->LockQueue();
 516                 this->results.swap(r);
 517                 this->UnlockQueue();
 518
 519                 for (unsigned int i = 0; i < r.size(); ++i)
 520                 {
 521                         LDAPRequest* req = r[i];
 522                         LDAPInterface* li = req->inter;
 523                         LDAPResult* res = req->result;
 524
 525                         if (!res->error.empty())
 526                                 li->OnError(*res);
 527                         else
 528                                 li->OnResult(*res);
 529
 530                         delete req;
 531                 }
 532         }
 533
 534         LDAP* GetConnection()
 535         {
 536                 return con;
 537         }
 538 };
 539
 540 class ModuleLDAP : public Module
 541 {
 542         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 543         ServiceMap LDAPServices;
 544
 545  public:
 546         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 547         {
 548                 ServiceMap conns;
 549
 550                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 551                 for (ConfigIter i = tags.first; i != tags.second; i++)
 552                 {
 553                         const reference<ConfigTag>& tag = i->second;
 554
 555                         if (!stdalgo::string::equalsci(tag->getString("module"), "ldap"))
 556                                 continue;
 557
 558                         std::string id = tag->getString("id");
 559
 560                         ServiceMap::iterator curr = LDAPServices.find(id);
 561                         if (curr == LDAPServices.end())
 562                         {
 563                                 LDAPService* conn = new LDAPService(this, tag);
 564                                 conns[id] = conn;
 565
 566                                 ServerInstance->Modules->AddService(*conn);
 567                                 ServerInstance->Threads.Start(conn);
 568                         }
 569                         else
 570                         {
 571                                 conns.insert(*curr);
 572                                 LDAPServices.erase(curr);
 573                         }
 574                 }
 575
 576                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 577                 {
 578                         LDAPService* conn = i->second;
 579                         ServerInstance->Modules->DelService(*conn);
 580                         conn->join();
 581                         conn->OnNotify();
 582                         delete conn;
 583                 }
 584
 585                 LDAPServices.swap(conns);
 586         }
 587
 588         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 589         {
 590                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 591                 {
 592                         LDAPService* s = it->second;
 593
 594                         s->process_mutex.Lock();
 595                         s->LockQueue();
 596
 597                         for (unsigned int i = s->queries.size(); i > 0; --i)
 598                         {
 599                                 LDAPRequest* req = s->queries[i - 1];
 600                                 LDAPInterface* li = req->inter;
 601
 602                                 if (li->creator == m)
 603                                 {
 604                                         s->queries.erase(s->queries.begin() + i - 1);
 605                                         delete req;
 606                                 }
 607                         }
 608
 609                         for (unsigned int i = s->results.size(); i > 0; --i)
 610                         {
 611                                 LDAPRequest* req = s->results[i - 1];
 612                                 LDAPInterface* li = req->inter;
 613
 614                                 if (li->creator == m)
 615                                 {
 616                                         s->results.erase(s->results.begin() + i - 1);
 617                                         delete req;
 618                                 }
 619                         }
 620
 621                         s->UnlockQueue();
 622                         s->process_mutex.Unlock();
 623                 }
 624         }
 625
 626         ~ModuleLDAP()
 627         {
 628                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 629                 {
 630                         LDAPService* conn = i->second;
 631                         conn->join();
 632                         conn->OnNotify();
 633                         delete conn;
 634                 }
 635         }
 636
 637         Version GetVersion() CXX11_OVERRIDE
 638         {
 639                 return Version("Provides the ability for LDAP modules to query a LDAP directory.", VF_VENDOR);
 640         }
 641 };
 642
 643 int LDAPBind::run()
 644 {
 645         berval cred;
 646         cred.bv_val = strdup(pass.c_str());
 647         cred.bv_len = pass.length();
 648
 649         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 650
 651         free(cred.bv_val);
 652
 653         return i;
 654 }
 655
 656 std::string LDAPBind::info()
 657 {
 658         return "bind dn=" + who;
 659 }
 660
 661 int LDAPSearch::run()
 662 {
 663         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 664 }
 665
 666 std::string LDAPSearch::info()
 667 {
 668         return "search base=" + base + " filter=" + filter;
 669 }
 670
 671 int LDAPAdd::run()
 672 {
 673         LDAPMod** mods = LDAPService::BuildMods(attributes);
 674         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 675         LDAPService::FreeMods(mods);
 676         return i;
 677 }
 678
 679 std::string LDAPAdd::info()
 680 {
 681         return "add dn=" + dn;
 682 }
 683
 684 int LDAPDel::run()
 685 {
 686         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 687 }
 688
 689 std::string LDAPDel::info()
 690 {
 691         return "del dn=" + dn;
 692 }
 693
 694 int LDAPModify::run()
 695 {
 696         LDAPMod** mods = LDAPService::BuildMods(attributes);
 697         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 698         LDAPService::FreeMods(mods);
 699         return i;
 700 }
 701
 702 std::string LDAPModify::info()
 703 {
 704         return "modify base=" + base;
 705 }
 706
 707 int LDAPCompare::run()
 708 {
 709         berval cred;
 710         cred.bv_val = strdup(val.c_str());
 711         cred.bv_len = val.length();
 712
 713         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 714
 715         free(cred.bv_val);
 716
 717         return ret;
 718 }
 719
 720 std::string LDAPCompare::info()
 721 {
 722         return "compare dn=" + dn + " attr=" + attr;
 723 }
 724
 725 MODULE_INIT(ModuleLDAP)