src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2013-2015 Adam <Adam@anope.org>
   5  *   Copyright (C) 2003-2015 Anope Team <team@anope.org>
   6  *
   7  * This file is part of InspIRCd.  InspIRCd is free software: you can
   8  * redistribute it and/or modify it under the terms of the GNU General Public
   9  * License as published by the Free Software Foundation, version 2.
  10  *
  11  * This program is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  13  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  14  * details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /// $LinkerFlags: -llber -lldap_r
  21
  22 /// $PackageInfo: require_system("centos") openldap-devel
  23 /// $PackageInfo: require_system("debian") libldap2-dev
  24 /// $PackageInfo: require_system("ubuntu") libldap2-dev
  25
  26 #include "inspircd.h"
  27 #include "modules/ldap.h"
  28
  29 // Ignore OpenLDAP deprecation warnings on OS X Yosemite and newer.
  30 #if defined __APPLE__
  31 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  32 #endif
  33
  34 #include <ldap.h>
  35
  36 #ifdef _WIN32
  37 # pragma comment(lib, "libldap_r.lib")
  38 # pragma comment(lib, "liblber.lib")
  39 #endif
  40
  41 class LDAPService;
  42
  43 class LDAPRequest
  44 {
  45  public:
  46         LDAPService* service;
  47         LDAPInterface* inter;
  48         LDAPMessage* message; /* message returned by ldap_ */
  49         LDAPResult* result; /* final result */
  50         struct timeval tv;
  51         QueryType type;
  52
  53         LDAPRequest(LDAPService* s, LDAPInterface* i)
  54                 : service(s)
  55                 , inter(i)
  56                 , message(NULL)
  57                 , result(NULL)
  58         {
  59                 type = QUERY_UNKNOWN;
  60                 tv.tv_sec = 0;
  61                 tv.tv_usec = 100000;
  62         }
  63
  64         virtual ~LDAPRequest()
  65         {
  66                 delete result;
  67                 if (message != NULL)
  68                         ldap_msgfree(message);
  69         }
  70
  71         virtual int run() = 0;
  72 };
  73
  74 class LDAPBind : public LDAPRequest
  75 {
  76         std::string who, pass;
  77
  78  public:
  79         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  80                 : LDAPRequest(s, i)
  81                 , who(w)
  82                 , pass(p)
  83         {
  84                 type = QUERY_BIND;
  85         }
  86
  87         int run() CXX11_OVERRIDE;
  88 };
  89
  90 class LDAPSearch : public LDAPRequest
  91 {
  92         std::string base;
  93         int searchscope;
  94         std::string filter;
  95
  96  public:
  97         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
  98                 : LDAPRequest(s, i)
  99                 , base(b)
 100                 , searchscope(se)
 101                 , filter(f)
 102         {
 103                 type = QUERY_SEARCH;
 104         }
 105
 106         int run() CXX11_OVERRIDE;
 107 };
 108
 109 class LDAPAdd : public LDAPRequest
 110 {
 111         std::string dn;
 112         LDAPMods attributes;
 113
 114  public:
 115         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 116                 : LDAPRequest(s, i)
 117                 , dn(d)
 118                 , attributes(attr)
 119         {
 120                 type = QUERY_ADD;
 121         }
 122
 123         int run() CXX11_OVERRIDE;
 124 };
 125
 126 class LDAPDel : public LDAPRequest
 127 {
 128         std::string dn;
 129
 130  public:
 131         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 132                 : LDAPRequest(s, i)
 133                 , dn(d)
 134         {
 135                 type = QUERY_DELETE;
 136         }
 137
 138         int run() CXX11_OVERRIDE;
 139 };
 140
 141 class LDAPModify : public LDAPRequest
 142 {
 143         std::string base;
 144         LDAPMods attributes;
 145
 146  public:
 147         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 148                 : LDAPRequest(s, i)
 149                 , base(b)
 150                 , attributes(attr)
 151         {
 152                 type = QUERY_MODIFY;
 153         }
 154
 155         int run() CXX11_OVERRIDE;
 156 };
 157
 158 class LDAPCompare : public LDAPRequest
 159 {
 160         std::string dn, attr, val;
 161
 162  public:
 163         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 164                 : LDAPRequest(s, i)
 165                 , dn(d)
 166                 , attr(a)
 167                 , val(v)
 168         {
 169                 type = QUERY_COMPARE;
 170         }
 171
 172         int run() CXX11_OVERRIDE;
 173 };
 174
 175 class LDAPService : public LDAPProvider, public SocketThread
 176 {
 177         LDAP* con;
 178         reference<ConfigTag> config;
 179         time_t last_connect;
 180         int searchscope;
 181         time_t timeout;
 182
 183  public:
 184         static LDAPMod** BuildMods(const LDAPMods& attributes)
 185         {
 186                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 187                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 188                 for (unsigned int x = 0; x < attributes.size(); ++x)
 189                 {
 190                         const LDAPModification& l = attributes[x];
 191                         LDAPMod* mod = new LDAPMod;
 192                         mods[x] = mod;
 193
 194                         if (l.op == LDAPModification::LDAP_ADD)
 195                                 mod->mod_op = LDAP_MOD_ADD;
 196                         else if (l.op == LDAPModification::LDAP_DEL)
 197                                 mod->mod_op = LDAP_MOD_DELETE;
 198                         else if (l.op == LDAPModification::LDAP_REPLACE)
 199                                 mod->mod_op = LDAP_MOD_REPLACE;
 200                         else if (l.op != 0)
 201                         {
 202                                 FreeMods(mods);
 203                                 throw LDAPException("Unknown LDAP operation");
 204                         }
 205                         mod->mod_type = strdup(l.name.c_str());
 206                         mod->mod_values = new char*[l.values.size() + 1];
 207                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 208                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 209                                 if (!l.values[j].empty())
 210                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 211                 }
 212                 return mods;
 213         }
 214
 215         static void FreeMods(LDAPMod** mods)
 216         {
 217                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 218                 {
 219                         LDAPMod* mod = mods[i];
 220                         if (mod->mod_type != NULL)
 221                                 free(mod->mod_type);
 222                         if (mod->mod_values != NULL)
 223                         {
 224                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 225                                         free(mod->mod_values[j]);
 226                                 delete[] mod->mod_values;
 227                         }
 228                 }
 229                 delete[] mods;
 230         }
 231
 232  private:
 233         void Reconnect()
 234         {
 235                 // Only try one connect a minute. It is an expensive blocking operation
 236                 if (last_connect > ServerInstance->Time() - 60)
 237                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 238                 last_connect = ServerInstance->Time();
 239
 240                 ldap_unbind_ext(this->con, NULL, NULL);
 241                 Connect();
 242         }
 243
 244         void QueueRequest(LDAPRequest* r)
 245         {
 246                 this->LockQueue();
 247                 this->queries.push_back(r);
 248                 this->UnlockQueueWakeup();
 249         }
 250
 251  public:
 252         typedef std::vector<LDAPRequest*> query_queue;
 253         query_queue queries, results;
 254         Mutex process_mutex; /* held when processing requests not in either queue */
 255
 256         LDAPService(Module* c, ConfigTag* tag)
 257                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 258                 , con(NULL), config(tag), last_connect(0)
 259         {
 260                 std::string scope = config->getString("searchscope");
 261                 if (stdalgo::string::equalsci(scope, "base"))
 262                         searchscope = LDAP_SCOPE_BASE;
 263                 else if (stdalgo::string::equalsci(scope, "onelevel"))
 264                         searchscope = LDAP_SCOPE_ONELEVEL;
 265                 else
 266                         searchscope = LDAP_SCOPE_SUBTREE;
 267                 timeout = config->getDuration("timeout", 5);
 268
 269                 Connect();
 270         }
 271
 272         ~LDAPService()
 273         {
 274                 this->LockQueue();
 275
 276                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 277                 {
 278                         LDAPRequest* req = this->queries[i];
 279
 280                         /* queries have no results yet */
 281                         req->result = new LDAPResult();
 282                         req->result->type = req->type;
 283                         req->result->error = "LDAP Interface is going away";
 284                         req->inter->OnError(*req->result);
 285
 286                         delete req;
 287                 }
 288                 this->queries.clear();
 289
 290                 for (unsigned int i = 0; i < this->results.size(); ++i)
 291                 {
 292                         LDAPRequest* req = this->results[i];
 293
 294                         /* even though this may have already finished successfully we return that it didn't */
 295                         req->result->error = "LDAP Interface is going away";
 296                         req->inter->OnError(*req->result);
 297
 298                         delete req;
 299                 }
 300                 this->results.clear();
 301
 302                 this->UnlockQueue();
 303
 304                 ldap_unbind_ext(this->con, NULL, NULL);
 305         }
 306
 307         void Connect()
 308         {
 309                 std::string server = config->getString("server");
 310                 int i = ldap_initialize(&this->con, server.c_str());
 311                 if (i != LDAP_SUCCESS)
 312                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 313
 314                 const int version = LDAP_VERSION3;
 315                 i = ldap_set_option(this->con, LDAP_OPT_PROTOCOL_VERSION, &version);
 316                 if (i != LDAP_OPT_SUCCESS)
 317                 {
 318                         ldap_unbind_ext(this->con, NULL, NULL);
 319                         this->con = NULL;
 320                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 321                 }
 322
 323                 const struct timeval tv = { 0, 0 };
 324                 i = ldap_set_option(this->con, LDAP_OPT_NETWORK_TIMEOUT, &tv);
 325                 if (i != LDAP_OPT_SUCCESS)
 326                 {
 327                         ldap_unbind_ext(this->con, NULL, NULL);
 328                         this->con = NULL;
 329                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 330                 }
 331         }
 332
 333         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 334         {
 335                 std::string binddn = config->getString("binddn");
 336                 std::string bindauth = config->getString("bindauth");
 337                 this->Bind(i, binddn, bindauth);
 338         }
 339
 340         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 341         {
 342                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 343                 QueueRequest(b);
 344         }
 345
 346         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 347         {
 348                 if (i == NULL)
 349                         throw LDAPException("No interface");
 350
 351                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 352                 QueueRequest(s);
 353         }
 354
 355         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 356         {
 357                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 358                 QueueRequest(add);
 359         }
 360
 361         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 362         {
 363                 LDAPDel* del = new LDAPDel(this, i, dn);
 364                 QueueRequest(del);
 365         }
 366
 367         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 368         {
 369                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 370                 QueueRequest(mod);
 371         }
 372
 373         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 374         {
 375                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 376                 QueueRequest(comp);
 377         }
 378
 379  private:
 380         void BuildReply(int res, LDAPRequest* req)
 381         {
 382                 LDAPResult* ldap_result = req->result = new LDAPResult();
 383                 req->result->type = req->type;
 384
 385                 if (res != LDAP_SUCCESS)
 386                 {
 387                         ldap_result->error = ldap_err2string(res);
 388                         return;
 389                 }
 390
 391                 if (req->message == NULL)
 392                 {
 393                         return;
 394                 }
 395
 396                 /* a search result */
 397
 398                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 399                 {
 400                         LDAPAttributes attributes;
 401
 402                         char* dn = ldap_get_dn(this->con, cur);
 403                         if (dn != NULL)
 404                         {
 405                                 attributes["dn"].push_back(dn);
 406                                 ldap_memfree(dn);
 407                                 dn = NULL;
 408                         }
 409
 410                         BerElement* ber = NULL;
 411
 412                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 413                         {
 414                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 415                                 int count = ldap_count_values_len(vals);
 416
 417                                 std::vector<std::string> attrs;
 418                                 for (int j = 0; j < count; ++j)
 419                                         attrs.push_back(vals[j]->bv_val);
 420                                 attributes[attr] = attrs;
 421
 422                                 ldap_value_free_len(vals);
 423                                 ldap_memfree(attr);
 424                         }
 425                         if (ber != NULL)
 426                                 ber_free(ber, 0);
 427
 428                         ldap_result->messages.push_back(attributes);
 429                 }
 430         }
 431
 432         void SendRequests()
 433         {
 434                 process_mutex.Lock();
 435
 436                 query_queue q;
 437                 this->LockQueue();
 438                 queries.swap(q);
 439                 this->UnlockQueue();
 440
 441                 if (q.empty())
 442                 {
 443                         process_mutex.Unlock();
 444                         return;
 445                 }
 446
 447                 for (unsigned int i = 0; i < q.size(); ++i)
 448                 {
 449                         LDAPRequest* req = q[i];
 450                         int ret = req->run();
 451
 452                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 453                         {
 454                                 /* try again */
 455                                 try
 456                                 {
 457                                         Reconnect();
 458                                 }
 459                                 catch (const LDAPException &)
 460                                 {
 461                                 }
 462
 463                                 ret = req->run();
 464                         }
 465
 466                         BuildReply(ret, req);
 467
 468                         this->LockQueue();
 469                         this->results.push_back(req);
 470                         this->UnlockQueue();
 471                 }
 472
 473                 this->NotifyParent();
 474
 475                 process_mutex.Unlock();
 476         }
 477
 478  public:
 479         void Run() CXX11_OVERRIDE
 480         {
 481                 while (!this->GetExitFlag())
 482                 {
 483                         this->LockQueue();
 484                         if (this->queries.empty())
 485                                 this->WaitForQueue();
 486                         this->UnlockQueue();
 487
 488                         SendRequests();
 489                 }
 490         }
 491
 492         void OnNotify() CXX11_OVERRIDE
 493         {
 494                 query_queue r;
 495
 496                 this->LockQueue();
 497                 this->results.swap(r);
 498                 this->UnlockQueue();
 499
 500                 for (unsigned int i = 0; i < r.size(); ++i)
 501                 {
 502                         LDAPRequest* req = r[i];
 503                         LDAPInterface* li = req->inter;
 504                         LDAPResult* res = req->result;
 505
 506                         if (!res->error.empty())
 507                                 li->OnError(*res);
 508                         else
 509                                 li->OnResult(*res);
 510
 511                         delete req;
 512                 }
 513         }
 514
 515         LDAP* GetConnection()
 516         {
 517                 return con;
 518         }
 519 };
 520
 521 class ModuleLDAP : public Module
 522 {
 523         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 524         ServiceMap LDAPServices;
 525
 526  public:
 527         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 528         {
 529                 ServiceMap conns;
 530
 531                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 532                 for (ConfigIter i = tags.first; i != tags.second; i++)
 533                 {
 534                         const reference<ConfigTag>& tag = i->second;
 535
 536                         if (!stdalgo::string::equalsci(tag->getString("module"), "ldap"))
 537                                 continue;
 538
 539                         std::string id = tag->getString("id");
 540
 541                         ServiceMap::iterator curr = LDAPServices.find(id);
 542                         if (curr == LDAPServices.end())
 543                         {
 544                                 LDAPService* conn = new LDAPService(this, tag);
 545                                 conns[id] = conn;
 546
 547                                 ServerInstance->Modules->AddService(*conn);
 548                                 ServerInstance->Threads.Start(conn);
 549                         }
 550                         else
 551                         {
 552                                 conns.insert(*curr);
 553                                 LDAPServices.erase(curr);
 554                         }
 555                 }
 556
 557                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 558                 {
 559                         LDAPService* conn = i->second;
 560                         ServerInstance->Modules->DelService(*conn);
 561                         conn->join();
 562                         conn->OnNotify();
 563                         delete conn;
 564                 }
 565
 566                 LDAPServices.swap(conns);
 567         }
 568
 569         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 570         {
 571                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 572                 {
 573                         LDAPService* s = it->second;
 574
 575                         s->process_mutex.Lock();
 576                         s->LockQueue();
 577
 578                         for (unsigned int i = s->queries.size(); i > 0; --i)
 579                         {
 580                                 LDAPRequest* req = s->queries[i - 1];
 581                                 LDAPInterface* li = req->inter;
 582
 583                                 if (li->creator == m)
 584                                 {
 585                                         s->queries.erase(s->queries.begin() + i - 1);
 586                                         delete req;
 587                                 }
 588                         }
 589
 590                         for (unsigned int i = s->results.size(); i > 0; --i)
 591                         {
 592                                 LDAPRequest* req = s->results[i - 1];
 593                                 LDAPInterface* li = req->inter;
 594
 595                                 if (li->creator == m)
 596                                 {
 597                                         s->results.erase(s->results.begin() + i - 1);
 598                                         delete req;
 599                                 }
 600                         }
 601
 602                         s->UnlockQueue();
 603                         s->process_mutex.Unlock();
 604                 }
 605         }
 606
 607         ~ModuleLDAP()
 608         {
 609                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 610                 {
 611                         LDAPService* conn = i->second;
 612                         conn->join();
 613                         conn->OnNotify();
 614                         delete conn;
 615                 }
 616         }
 617
 618         Version GetVersion() CXX11_OVERRIDE
 619         {
 620                 return Version("LDAP support", VF_VENDOR);
 621         }
 622 };
 623
 624 int LDAPBind::run()
 625 {
 626         berval cred;
 627         cred.bv_val = strdup(pass.c_str());
 628         cred.bv_len = pass.length();
 629
 630         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 631
 632         free(cred.bv_val);
 633
 634         return i;
 635 }
 636
 637 int LDAPSearch::run()
 638 {
 639         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 640 }
 641
 642 int LDAPAdd::run()
 643 {
 644         LDAPMod** mods = LDAPService::BuildMods(attributes);
 645         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 646         LDAPService::FreeMods(mods);
 647         return i;
 648 }
 649
 650 int LDAPDel::run()
 651 {
 652         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 653 }
 654
 655 int LDAPModify::run()
 656 {
 657         LDAPMod** mods = LDAPService::BuildMods(attributes);
 658         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 659         LDAPService::FreeMods(mods);
 660         return i;
 661 }
 662
 663 int LDAPCompare::run()
 664 {
 665         berval cred;
 666         cred.bv_val = strdup(val.c_str());
 667         cred.bv_len = val.length();
 668
 669         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 670
 671         free(cred.bv_val);
 672
 673         return ret;
 674
 675 }
 676
 677 MODULE_INIT(ModuleLDAP)