src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2013-2015 Adam <Adam@anope.org>
   5  *   Copyright (C) 2003-2015 Anope Team <team@anope.org>
   6  *
   7  * This file is part of InspIRCd.  InspIRCd is free software: you can
   8  * redistribute it and/or modify it under the terms of the GNU General Public
   9  * License as published by the Free Software Foundation, version 2.
  10  *
  11  * This program is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  13  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  14  * details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "inspircd.h"
  21 #include "modules/ldap.h"
  22
  23 #include <ldap.h>
  24
  25 #ifdef _WIN32
  26 # pragma comment(lib, "libldap_r.lib")
  27 # pragma comment(lib, "liblber.lib")
  28 #endif
  29
  30 /* $LinkerFlags: -lldap_r */
  31
  32 class LDAPService;
  33
  34 class LDAPRequest
  35 {
  36  public:
  37         LDAPService* service;
  38         LDAPInterface* inter;
  39         LDAPMessage* message; /* message returned by ldap_ */
  40         LDAPResult* result; /* final result */
  41         struct timeval tv;
  42         QueryType type;
  43
  44         LDAPRequest(LDAPService* s, LDAPInterface* i)
  45                 : service(s)
  46                 , inter(i)
  47                 , message(NULL)
  48                 , result(NULL)
  49         {
  50                 type = QUERY_UNKNOWN;
  51                 tv.tv_sec = 0;
  52                 tv.tv_usec = 100000;
  53         }
  54
  55         virtual ~LDAPRequest()
  56         {
  57                 delete result;
  58                 if (message != NULL)
  59                         ldap_msgfree(message);
  60         }
  61
  62         virtual int run() = 0;
  63 };
  64
  65 class LDAPBind : public LDAPRequest
  66 {
  67         std::string who, pass;
  68
  69  public:
  70         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  71                 : LDAPRequest(s, i)
  72                 , who(w)
  73                 , pass(p)
  74         {
  75                 type = QUERY_BIND;
  76         }
  77
  78         int run() CXX11_OVERRIDE;
  79 };
  80
  81 class LDAPSearch : public LDAPRequest
  82 {
  83         std::string base;
  84         int searchscope;
  85         std::string filter;
  86
  87  public:
  88         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
  89                 : LDAPRequest(s, i)
  90                 , base(b)
  91                 , searchscope(se)
  92                 , filter(f)
  93         {
  94                 type = QUERY_SEARCH;
  95         }
  96
  97         int run() CXX11_OVERRIDE;
  98 };
  99
 100 class LDAPAdd : public LDAPRequest
 101 {
 102         std::string dn;
 103         LDAPMods attributes;
 104
 105  public:
 106         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 107                 : LDAPRequest(s, i)
 108                 , dn(d)
 109                 , attributes(attr)
 110         {
 111                 type = QUERY_ADD;
 112         }
 113
 114         int run() CXX11_OVERRIDE;
 115 };
 116
 117 class LDAPDel : public LDAPRequest
 118 {
 119         std::string dn;
 120
 121  public:
 122         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 123                 : LDAPRequest(s, i)
 124                 , dn(d)
 125         {
 126                 type = QUERY_DELETE;
 127         }
 128
 129         int run() CXX11_OVERRIDE;
 130 };
 131
 132 class LDAPModify : public LDAPRequest
 133 {
 134         std::string base;
 135         LDAPMods attributes;
 136
 137  public:
 138         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 139                 : LDAPRequest(s, i)
 140                 , base(b)
 141                 , attributes(attr)
 142         {
 143                 type = QUERY_MODIFY;
 144         }
 145
 146         int run() CXX11_OVERRIDE;
 147 };
 148
 149 class LDAPCompare : public LDAPRequest
 150 {
 151         std::string dn, attr, val;
 152
 153  public:
 154         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 155                 : LDAPRequest(s, i)
 156                 , dn(d)
 157                 , attr(a)
 158                 , val(v)
 159         {
 160                 type = QUERY_COMPARE;
 161         }
 162
 163         int run() CXX11_OVERRIDE;
 164 };
 165
 166 class LDAPService : public LDAPProvider, public SocketThread
 167 {
 168         LDAP* con;
 169         reference<ConfigTag> config;
 170         time_t last_connect;
 171         int searchscope;
 172         time_t timeout;
 173         time_t last_timeout_check;
 174
 175  public:
 176         static LDAPMod** BuildMods(const LDAPMods& attributes)
 177         {
 178                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 179                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 180                 for (unsigned int x = 0; x < attributes.size(); ++x)
 181                 {
 182                         const LDAPModification& l = attributes[x];
 183                         LDAPMod* mod = new LDAPMod;
 184                         mods[x] = mod;
 185
 186                         if (l.op == LDAPModification::LDAP_ADD)
 187                                 mod->mod_op = LDAP_MOD_ADD;
 188                         else if (l.op == LDAPModification::LDAP_DEL)
 189                                 mod->mod_op = LDAP_MOD_DELETE;
 190                         else if (l.op == LDAPModification::LDAP_REPLACE)
 191                                 mod->mod_op = LDAP_MOD_REPLACE;
 192                         else if (l.op != 0)
 193                         {
 194                                 FreeMods(mods);
 195                                 throw LDAPException("Unknown LDAP operation");
 196                         }
 197                         mod->mod_type = strdup(l.name.c_str());
 198                         mod->mod_values = new char*[l.values.size() + 1];
 199                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 200                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 201                                 if (!l.values[j].empty())
 202                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 203                 }
 204                 return mods;
 205         }
 206
 207         static void FreeMods(LDAPMod** mods)
 208         {
 209                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 210                 {
 211                         LDAPMod* mod = mods[i];
 212                         if (mod->mod_type != NULL)
 213                                 free(mod->mod_type);
 214                         if (mod->mod_values != NULL)
 215                         {
 216                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 217                                         free(mod->mod_values[j]);
 218                                 delete[] mod->mod_values;
 219                         }
 220                 }
 221                 delete[] mods;
 222         }
 223
 224  private:
 225         void Reconnect()
 226         {
 227                 // Only try one connect a minute. It is an expensive blocking operation
 228                 if (last_connect > ServerInstance->Time() - 60)
 229                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 230                 last_connect = ServerInstance->Time();
 231
 232                 ldap_unbind_ext(this->con, NULL, NULL);
 233                 Connect();
 234         }
 235
 236         void QueueRequest(LDAPRequest* r)
 237         {
 238                 this->LockQueue();
 239                 this->queries.push_back(r);
 240                 this->UnlockQueueWakeup();
 241         }
 242
 243  public:
 244         typedef std::vector<LDAPRequest*> query_queue;
 245         query_queue queries, results;
 246         Mutex process_mutex; /* held when processing requests not in either queue */
 247
 248         LDAPService(Module* c, ConfigTag* tag)
 249                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 250                 , con(NULL), config(tag), last_connect(0), last_timeout_check(0)
 251         {
 252                 std::string scope = config->getString("searchscope");
 253                 if (scope == "base")
 254                         searchscope = LDAP_SCOPE_BASE;
 255                 else if (scope == "onelevel")
 256                         searchscope = LDAP_SCOPE_ONELEVEL;
 257                 else
 258                         searchscope = LDAP_SCOPE_SUBTREE;
 259                 timeout = config->getInt("timeout", 5);
 260
 261                 Connect();
 262         }
 263
 264         ~LDAPService()
 265         {
 266                 this->LockQueue();
 267
 268                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 269                 {
 270                         LDAPRequest* req = this->queries[i];
 271
 272                         /* queries have no results yet */
 273                         req->result = new LDAPResult();
 274                         req->result->type = req->type;
 275                         req->result->error = "LDAP Interface is going away";
 276                         req->inter->OnError(*req->result);
 277
 278                         delete req;
 279                 }
 280                 this->queries.clear();
 281
 282                 for (unsigned int i = 0; i < this->results.size(); ++i)
 283                 {
 284                         LDAPRequest* req = this->results[i];
 285
 286                         /* even though this may have already finished successfully we return that it didn't */
 287                         req->result->error = "LDAP Interface is going away";
 288                         req->inter->OnError(*req->result);
 289
 290                         delete req;
 291                 }
 292                 this->results.clear();
 293
 294                 this->UnlockQueue();
 295
 296                 ldap_unbind_ext(this->con, NULL, NULL);
 297         }
 298
 299         void Connect()
 300         {
 301                 std::string server = config->getString("server");
 302                 int i = ldap_initialize(&this->con, server.c_str());
 303                 if (i != LDAP_SUCCESS)
 304                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 305
 306                 const int version = LDAP_VERSION3;
 307                 i = ldap_set_option(this->con, LDAP_OPT_PROTOCOL_VERSION, &version);
 308                 if (i != LDAP_OPT_SUCCESS)
 309                 {
 310                         ldap_unbind_ext(this->con, NULL, NULL);
 311                         this->con = NULL;
 312                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 313                 }
 314
 315                 const struct timeval tv = { 0, 0 };
 316                 i = ldap_set_option(this->con, LDAP_OPT_NETWORK_TIMEOUT, &tv);
 317                 if (i != LDAP_OPT_SUCCESS)
 318                 {
 319                         ldap_unbind_ext(this->con, NULL, NULL);
 320                         this->con = NULL;
 321                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 322                 }
 323         }
 324
 325         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 326         {
 327                 std::string binddn = config->getString("binddn");
 328                 std::string bindauth = config->getString("bindauth");
 329                 this->Bind(i, binddn, bindauth);
 330         }
 331
 332         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 333         {
 334                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 335                 QueueRequest(b);
 336         }
 337
 338         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 339         {
 340                 if (i == NULL)
 341                         throw LDAPException("No interface");
 342
 343                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 344                 QueueRequest(s);
 345         }
 346
 347         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 348         {
 349                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 350                 QueueRequest(add);
 351         }
 352
 353         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 354         {
 355                 LDAPDel* del = new LDAPDel(this, i, dn);
 356                 QueueRequest(del);
 357         }
 358
 359         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 360         {
 361                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 362                 QueueRequest(mod);
 363         }
 364
 365         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 366         {
 367                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 368                 QueueRequest(comp);
 369         }
 370
 371  private:
 372         void BuildReply(int res, LDAPRequest* req)
 373         {
 374                 LDAPResult* ldap_result = req->result = new LDAPResult();
 375                 req->result->type = req->type;
 376
 377                 if (res != LDAP_SUCCESS)
 378                 {
 379                         ldap_result->error = ldap_err2string(res);
 380                         return;
 381                 }
 382
 383                 if (req->message == NULL)
 384                 {
 385                         return;
 386                 }
 387
 388                 /* a search result */
 389
 390                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 391                 {
 392                         LDAPAttributes attributes;
 393
 394                         char* dn = ldap_get_dn(this->con, cur);
 395                         if (dn != NULL)
 396                         {
 397                                 attributes["dn"].push_back(dn);
 398                                 ldap_memfree(dn);
 399                                 dn = NULL;
 400                         }
 401
 402                         BerElement* ber = NULL;
 403
 404                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 405                         {
 406                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 407                                 int count = ldap_count_values_len(vals);
 408
 409                                 std::vector<std::string> attrs;
 410                                 for (int j = 0; j < count; ++j)
 411                                         attrs.push_back(vals[j]->bv_val);
 412                                 attributes[attr] = attrs;
 413
 414                                 ldap_value_free_len(vals);
 415                                 ldap_memfree(attr);
 416                         }
 417                         if (ber != NULL)
 418                                 ber_free(ber, 0);
 419
 420                         ldap_result->messages.push_back(attributes);
 421                 }
 422         }
 423
 424         void SendRequests()
 425         {
 426                 process_mutex.Lock();
 427
 428                 query_queue q;
 429                 this->LockQueue();
 430                 queries.swap(q);
 431                 this->UnlockQueue();
 432
 433                 if (q.empty())
 434                 {
 435                         process_mutex.Unlock();
 436                         return;
 437                 }
 438
 439                 for (unsigned int i = 0; i < q.size(); ++i)
 440                 {
 441                         LDAPRequest* req = q[i];
 442                         int ret = req->run();
 443
 444                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 445                         {
 446                                 /* try again */
 447                                 try
 448                                 {
 449                                         Reconnect();
 450                                 }
 451                                 catch (const LDAPException &)
 452                                 {
 453                                 }
 454
 455                                 ret = req->run();
 456                         }
 457
 458                         BuildReply(ret, req);
 459
 460                         this->LockQueue();
 461                         this->results.push_back(req);
 462                         this->UnlockQueue();
 463                 }
 464
 465                 this->NotifyParent();
 466
 467                 process_mutex.Unlock();
 468         }
 469
 470  public:
 471         void Run() CXX11_OVERRIDE
 472         {
 473                 while (!this->GetExitFlag())
 474                 {
 475                         this->LockQueue();
 476                         if (this->queries.empty())
 477                                 this->WaitForQueue();
 478                         this->UnlockQueue();
 479
 480                         SendRequests();
 481                 }
 482         }
 483
 484         void OnNotify() CXX11_OVERRIDE
 485         {
 486                 query_queue r;
 487
 488                 this->LockQueue();
 489                 this->results.swap(r);
 490                 this->UnlockQueue();
 491
 492                 for (unsigned int i = 0; i < r.size(); ++i)
 493                 {
 494                         LDAPRequest* req = r[i];
 495                         LDAPInterface* li = req->inter;
 496                         LDAPResult* res = req->result;
 497
 498                         if (!res->error.empty())
 499                                 li->OnError(*res);
 500                         else
 501                                 li->OnResult(*res);
 502
 503                         delete req;
 504                 }
 505         }
 506
 507         LDAP* GetConnection()
 508         {
 509                 return con;
 510         }
 511 };
 512
 513 class ModuleLDAP : public Module
 514 {
 515         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 516         ServiceMap LDAPServices;
 517
 518  public:
 519         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 520         {
 521                 ServiceMap conns;
 522
 523                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 524                 for (ConfigIter i = tags.first; i != tags.second; i++)
 525                 {
 526                         const reference<ConfigTag>& tag = i->second;
 527
 528                         if (tag->getString("module") != "ldap")
 529                                 continue;
 530
 531                         std::string id = tag->getString("id");
 532
 533                         ServiceMap::iterator curr = LDAPServices.find(id);
 534                         if (curr == LDAPServices.end())
 535                         {
 536                                 LDAPService* conn = new LDAPService(this, tag);
 537                                 conns[id] = conn;
 538
 539                                 ServerInstance->Modules->AddService(*conn);
 540                                 ServerInstance->Threads.Start(conn);
 541                         }
 542                         else
 543                         {
 544                                 conns.insert(*curr);
 545                                 LDAPServices.erase(curr);
 546                         }
 547                 }
 548
 549                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 550                 {
 551                         LDAPService* conn = i->second;
 552                         ServerInstance->Modules->DelService(*conn);
 553                         conn->join();
 554                         conn->OnNotify();
 555                         delete conn;
 556                 }
 557
 558                 LDAPServices.swap(conns);
 559         }
 560
 561         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 562         {
 563                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 564                 {
 565                         LDAPService* s = it->second;
 566
 567                         s->process_mutex.Lock();
 568                         s->LockQueue();
 569
 570                         for (unsigned int i = s->queries.size(); i > 0; --i)
 571                         {
 572                                 LDAPRequest* req = s->queries[i - 1];
 573                                 LDAPInterface* li = req->inter;
 574
 575                                 if (li->creator == m)
 576                                 {
 577                                         s->queries.erase(s->queries.begin() + i - 1);
 578                                         delete req;
 579                                 }
 580                         }
 581
 582                         for (unsigned int i = s->results.size(); i > 0; --i)
 583                         {
 584                                 LDAPRequest* req = s->results[i - 1];
 585                                 LDAPInterface* li = req->inter;
 586
 587                                 if (li->creator == m)
 588                                 {
 589                                         s->results.erase(s->results.begin() + i - 1);
 590                                         delete req;
 591                                 }
 592                         }
 593
 594                         s->UnlockQueue();
 595                         s->process_mutex.Unlock();
 596                 }
 597         }
 598
 599         ~ModuleLDAP()
 600         {
 601                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 602                 {
 603                         LDAPService* conn = i->second;
 604                         conn->join();
 605                         conn->OnNotify();
 606                         delete conn;
 607                 }
 608         }
 609
 610         Version GetVersion() CXX11_OVERRIDE
 611         {
 612                 return Version("LDAP support", VF_VENDOR);
 613         }
 614 };
 615
 616 int LDAPBind::run()
 617 {
 618         berval cred;
 619         cred.bv_val = strdup(pass.c_str());
 620         cred.bv_len = pass.length();
 621
 622         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 623
 624         free(cred.bv_val);
 625
 626         return i;
 627 }
 628
 629 int LDAPSearch::run()
 630 {
 631         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 632 }
 633
 634 int LDAPAdd::run()
 635 {
 636         LDAPMod** mods = LDAPService::BuildMods(attributes);
 637         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 638         LDAPService::FreeMods(mods);
 639         return i;
 640 }
 641
 642 int LDAPDel::run()
 643 {
 644         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 645 }
 646
 647 int LDAPModify::run()
 648 {
 649         LDAPMod** mods = LDAPService::BuildMods(attributes);
 650         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 651         LDAPService::FreeMods(mods);
 652         return i;
 653 }
 654
 655 int LDAPCompare::run()
 656 {
 657         berval cred;
 658         cred.bv_val = strdup(val.c_str());
 659         cred.bv_len = val.length();
 660
 661         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 662
 663         free(cred.bv_val);
 664
 665         return ret;
 666
 667 }
 668
 669 MODULE_INIT(ModuleLDAP)