src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2013-2015 Adam <Adam@anope.org>
   5  *   Copyright (C) 2003-2015 Anope Team <team@anope.org>
   6  *
   7  * This file is part of InspIRCd.  InspIRCd is free software: you can
   8  * redistribute it and/or modify it under the terms of the GNU General Public
   9  * License as published by the Free Software Foundation, version 2.
  10  *
  11  * This program is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  13  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  14  * details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /// $LinkerFlags: -llber -lldap_r
  21
  22 /// $PackageInfo: require_system("centos") openldap-devel
  23 /// $PackageInfo: require_system("ubuntu") libldap2-dev
  24
  25 #include "inspircd.h"
  26 #include "modules/ldap.h"
  27
  28 // Ignore OpenLDAP deprecation warnings on OS X Yosemite and newer.
  29 #if defined __APPLE__
  30 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  31 #endif
  32
  33 #include <ldap.h>
  34
  35 #ifdef _WIN32
  36 # pragma comment(lib, "libldap_r.lib")
  37 # pragma comment(lib, "liblber.lib")
  38 #endif
  39
  40 class LDAPService;
  41
  42 class LDAPRequest
  43 {
  44  public:
  45         LDAPService* service;
  46         LDAPInterface* inter;
  47         LDAPMessage* message; /* message returned by ldap_ */
  48         LDAPResult* result; /* final result */
  49         struct timeval tv;
  50         QueryType type;
  51
  52         LDAPRequest(LDAPService* s, LDAPInterface* i)
  53                 : service(s)
  54                 , inter(i)
  55                 , message(NULL)
  56                 , result(NULL)
  57         {
  58                 type = QUERY_UNKNOWN;
  59                 tv.tv_sec = 0;
  60                 tv.tv_usec = 100000;
  61         }
  62
  63         virtual ~LDAPRequest()
  64         {
  65                 delete result;
  66                 if (message != NULL)
  67                         ldap_msgfree(message);
  68         }
  69
  70         virtual int run() = 0;
  71 };
  72
  73 class LDAPBind : public LDAPRequest
  74 {
  75         std::string who, pass;
  76
  77  public:
  78         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  79                 : LDAPRequest(s, i)
  80                 , who(w)
  81                 , pass(p)
  82         {
  83                 type = QUERY_BIND;
  84         }
  85
  86         int run() CXX11_OVERRIDE;
  87 };
  88
  89 class LDAPSearch : public LDAPRequest
  90 {
  91         std::string base;
  92         int searchscope;
  93         std::string filter;
  94
  95  public:
  96         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
  97                 : LDAPRequest(s, i)
  98                 , base(b)
  99                 , searchscope(se)
 100                 , filter(f)
 101         {
 102                 type = QUERY_SEARCH;
 103         }
 104
 105         int run() CXX11_OVERRIDE;
 106 };
 107
 108 class LDAPAdd : public LDAPRequest
 109 {
 110         std::string dn;
 111         LDAPMods attributes;
 112
 113  public:
 114         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 115                 : LDAPRequest(s, i)
 116                 , dn(d)
 117                 , attributes(attr)
 118         {
 119                 type = QUERY_ADD;
 120         }
 121
 122         int run() CXX11_OVERRIDE;
 123 };
 124
 125 class LDAPDel : public LDAPRequest
 126 {
 127         std::string dn;
 128
 129  public:
 130         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 131                 : LDAPRequest(s, i)
 132                 , dn(d)
 133         {
 134                 type = QUERY_DELETE;
 135         }
 136
 137         int run() CXX11_OVERRIDE;
 138 };
 139
 140 class LDAPModify : public LDAPRequest
 141 {
 142         std::string base;
 143         LDAPMods attributes;
 144
 145  public:
 146         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 147                 : LDAPRequest(s, i)
 148                 , base(b)
 149                 , attributes(attr)
 150         {
 151                 type = QUERY_MODIFY;
 152         }
 153
 154         int run() CXX11_OVERRIDE;
 155 };
 156
 157 class LDAPCompare : public LDAPRequest
 158 {
 159         std::string dn, attr, val;
 160
 161  public:
 162         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 163                 : LDAPRequest(s, i)
 164                 , dn(d)
 165                 , attr(a)
 166                 , val(v)
 167         {
 168                 type = QUERY_COMPARE;
 169         }
 170
 171         int run() CXX11_OVERRIDE;
 172 };
 173
 174 class LDAPService : public LDAPProvider, public SocketThread
 175 {
 176         LDAP* con;
 177         reference<ConfigTag> config;
 178         time_t last_connect;
 179         int searchscope;
 180         time_t timeout;
 181
 182  public:
 183         static LDAPMod** BuildMods(const LDAPMods& attributes)
 184         {
 185                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 186                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 187                 for (unsigned int x = 0; x < attributes.size(); ++x)
 188                 {
 189                         const LDAPModification& l = attributes[x];
 190                         LDAPMod* mod = new LDAPMod;
 191                         mods[x] = mod;
 192
 193                         if (l.op == LDAPModification::LDAP_ADD)
 194                                 mod->mod_op = LDAP_MOD_ADD;
 195                         else if (l.op == LDAPModification::LDAP_DEL)
 196                                 mod->mod_op = LDAP_MOD_DELETE;
 197                         else if (l.op == LDAPModification::LDAP_REPLACE)
 198                                 mod->mod_op = LDAP_MOD_REPLACE;
 199                         else if (l.op != 0)
 200                         {
 201                                 FreeMods(mods);
 202                                 throw LDAPException("Unknown LDAP operation");
 203                         }
 204                         mod->mod_type = strdup(l.name.c_str());
 205                         mod->mod_values = new char*[l.values.size() + 1];
 206                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 207                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 208                                 if (!l.values[j].empty())
 209                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 210                 }
 211                 return mods;
 212         }
 213
 214         static void FreeMods(LDAPMod** mods)
 215         {
 216                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 217                 {
 218                         LDAPMod* mod = mods[i];
 219                         if (mod->mod_type != NULL)
 220                                 free(mod->mod_type);
 221                         if (mod->mod_values != NULL)
 222                         {
 223                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 224                                         free(mod->mod_values[j]);
 225                                 delete[] mod->mod_values;
 226                         }
 227                 }
 228                 delete[] mods;
 229         }
 230
 231  private:
 232         void Reconnect()
 233         {
 234                 // Only try one connect a minute. It is an expensive blocking operation
 235                 if (last_connect > ServerInstance->Time() - 60)
 236                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 237                 last_connect = ServerInstance->Time();
 238
 239                 ldap_unbind_ext(this->con, NULL, NULL);
 240                 Connect();
 241         }
 242
 243         void QueueRequest(LDAPRequest* r)
 244         {
 245                 this->LockQueue();
 246                 this->queries.push_back(r);
 247                 this->UnlockQueueWakeup();
 248         }
 249
 250  public:
 251         typedef std::vector<LDAPRequest*> query_queue;
 252         query_queue queries, results;
 253         Mutex process_mutex; /* held when processing requests not in either queue */
 254
 255         LDAPService(Module* c, ConfigTag* tag)
 256                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 257                 , con(NULL), config(tag), last_connect(0)
 258         {
 259                 std::string scope = config->getString("searchscope");
 260                 if (scope == "base")
 261                         searchscope = LDAP_SCOPE_BASE;
 262                 else if (scope == "onelevel")
 263                         searchscope = LDAP_SCOPE_ONELEVEL;
 264                 else
 265                         searchscope = LDAP_SCOPE_SUBTREE;
 266                 timeout = config->getInt("timeout", 5);
 267
 268                 Connect();
 269         }
 270
 271         ~LDAPService()
 272         {
 273                 this->LockQueue();
 274
 275                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 276                 {
 277                         LDAPRequest* req = this->queries[i];
 278
 279                         /* queries have no results yet */
 280                         req->result = new LDAPResult();
 281                         req->result->type = req->type;
 282                         req->result->error = "LDAP Interface is going away";
 283                         req->inter->OnError(*req->result);
 284
 285                         delete req;
 286                 }
 287                 this->queries.clear();
 288
 289                 for (unsigned int i = 0; i < this->results.size(); ++i)
 290                 {
 291                         LDAPRequest* req = this->results[i];
 292
 293                         /* even though this may have already finished successfully we return that it didn't */
 294                         req->result->error = "LDAP Interface is going away";
 295                         req->inter->OnError(*req->result);
 296
 297                         delete req;
 298                 }
 299                 this->results.clear();
 300
 301                 this->UnlockQueue();
 302
 303                 ldap_unbind_ext(this->con, NULL, NULL);
 304         }
 305
 306         void Connect()
 307         {
 308                 std::string server = config->getString("server");
 309                 int i = ldap_initialize(&this->con, server.c_str());
 310                 if (i != LDAP_SUCCESS)
 311                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 312
 313                 const int version = LDAP_VERSION3;
 314                 i = ldap_set_option(this->con, LDAP_OPT_PROTOCOL_VERSION, &version);
 315                 if (i != LDAP_OPT_SUCCESS)
 316                 {
 317                         ldap_unbind_ext(this->con, NULL, NULL);
 318                         this->con = NULL;
 319                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 320                 }
 321
 322                 const struct timeval tv = { 0, 0 };
 323                 i = ldap_set_option(this->con, LDAP_OPT_NETWORK_TIMEOUT, &tv);
 324                 if (i != LDAP_OPT_SUCCESS)
 325                 {
 326                         ldap_unbind_ext(this->con, NULL, NULL);
 327                         this->con = NULL;
 328                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 329                 }
 330         }
 331
 332         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 333         {
 334                 std::string binddn = config->getString("binddn");
 335                 std::string bindauth = config->getString("bindauth");
 336                 this->Bind(i, binddn, bindauth);
 337         }
 338
 339         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 340         {
 341                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 342                 QueueRequest(b);
 343         }
 344
 345         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 346         {
 347                 if (i == NULL)
 348                         throw LDAPException("No interface");
 349
 350                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 351                 QueueRequest(s);
 352         }
 353
 354         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 355         {
 356                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 357                 QueueRequest(add);
 358         }
 359
 360         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 361         {
 362                 LDAPDel* del = new LDAPDel(this, i, dn);
 363                 QueueRequest(del);
 364         }
 365
 366         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 367         {
 368                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 369                 QueueRequest(mod);
 370         }
 371
 372         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 373         {
 374                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 375                 QueueRequest(comp);
 376         }
 377
 378  private:
 379         void BuildReply(int res, LDAPRequest* req)
 380         {
 381                 LDAPResult* ldap_result = req->result = new LDAPResult();
 382                 req->result->type = req->type;
 383
 384                 if (res != LDAP_SUCCESS)
 385                 {
 386                         ldap_result->error = ldap_err2string(res);
 387                         return;
 388                 }
 389
 390                 if (req->message == NULL)
 391                 {
 392                         return;
 393                 }
 394
 395                 /* a search result */
 396
 397                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 398                 {
 399                         LDAPAttributes attributes;
 400
 401                         char* dn = ldap_get_dn(this->con, cur);
 402                         if (dn != NULL)
 403                         {
 404                                 attributes["dn"].push_back(dn);
 405                                 ldap_memfree(dn);
 406                                 dn = NULL;
 407                         }
 408
 409                         BerElement* ber = NULL;
 410
 411                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 412                         {
 413                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 414                                 int count = ldap_count_values_len(vals);
 415
 416                                 std::vector<std::string> attrs;
 417                                 for (int j = 0; j < count; ++j)
 418                                         attrs.push_back(vals[j]->bv_val);
 419                                 attributes[attr] = attrs;
 420
 421                                 ldap_value_free_len(vals);
 422                                 ldap_memfree(attr);
 423                         }
 424                         if (ber != NULL)
 425                                 ber_free(ber, 0);
 426
 427                         ldap_result->messages.push_back(attributes);
 428                 }
 429         }
 430
 431         void SendRequests()
 432         {
 433                 process_mutex.Lock();
 434
 435                 query_queue q;
 436                 this->LockQueue();
 437                 queries.swap(q);
 438                 this->UnlockQueue();
 439
 440                 if (q.empty())
 441                 {
 442                         process_mutex.Unlock();
 443                         return;
 444                 }
 445
 446                 for (unsigned int i = 0; i < q.size(); ++i)
 447                 {
 448                         LDAPRequest* req = q[i];
 449                         int ret = req->run();
 450
 451                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 452                         {
 453                                 /* try again */
 454                                 try
 455                                 {
 456                                         Reconnect();
 457                                 }
 458                                 catch (const LDAPException &)
 459                                 {
 460                                 }
 461
 462                                 ret = req->run();
 463                         }
 464
 465                         BuildReply(ret, req);
 466
 467                         this->LockQueue();
 468                         this->results.push_back(req);
 469                         this->UnlockQueue();
 470                 }
 471
 472                 this->NotifyParent();
 473
 474                 process_mutex.Unlock();
 475         }
 476
 477  public:
 478         void Run() CXX11_OVERRIDE
 479         {
 480                 while (!this->GetExitFlag())
 481                 {
 482                         this->LockQueue();
 483                         if (this->queries.empty())
 484                                 this->WaitForQueue();
 485                         this->UnlockQueue();
 486
 487                         SendRequests();
 488                 }
 489         }
 490
 491         void OnNotify() CXX11_OVERRIDE
 492         {
 493                 query_queue r;
 494
 495                 this->LockQueue();
 496                 this->results.swap(r);
 497                 this->UnlockQueue();
 498
 499                 for (unsigned int i = 0; i < r.size(); ++i)
 500                 {
 501                         LDAPRequest* req = r[i];
 502                         LDAPInterface* li = req->inter;
 503                         LDAPResult* res = req->result;
 504
 505                         if (!res->error.empty())
 506                                 li->OnError(*res);
 507                         else
 508                                 li->OnResult(*res);
 509
 510                         delete req;
 511                 }
 512         }
 513
 514         LDAP* GetConnection()
 515         {
 516                 return con;
 517         }
 518 };
 519
 520 class ModuleLDAP : public Module
 521 {
 522         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 523         ServiceMap LDAPServices;
 524
 525  public:
 526         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 527         {
 528                 ServiceMap conns;
 529
 530                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 531                 for (ConfigIter i = tags.first; i != tags.second; i++)
 532                 {
 533                         const reference<ConfigTag>& tag = i->second;
 534
 535                         if (tag->getString("module") != "ldap")
 536                                 continue;
 537
 538                         std::string id = tag->getString("id");
 539
 540                         ServiceMap::iterator curr = LDAPServices.find(id);
 541                         if (curr == LDAPServices.end())
 542                         {
 543                                 LDAPService* conn = new LDAPService(this, tag);
 544                                 conns[id] = conn;
 545
 546                                 ServerInstance->Modules->AddService(*conn);
 547                                 ServerInstance->Threads.Start(conn);
 548                         }
 549                         else
 550                         {
 551                                 conns.insert(*curr);
 552                                 LDAPServices.erase(curr);
 553                         }
 554                 }
 555
 556                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 557                 {
 558                         LDAPService* conn = i->second;
 559                         ServerInstance->Modules->DelService(*conn);
 560                         conn->join();
 561                         conn->OnNotify();
 562                         delete conn;
 563                 }
 564
 565                 LDAPServices.swap(conns);
 566         }
 567
 568         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 569         {
 570                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 571                 {
 572                         LDAPService* s = it->second;
 573
 574                         s->process_mutex.Lock();
 575                         s->LockQueue();
 576
 577                         for (unsigned int i = s->queries.size(); i > 0; --i)
 578                         {
 579                                 LDAPRequest* req = s->queries[i - 1];
 580                                 LDAPInterface* li = req->inter;
 581
 582                                 if (li->creator == m)
 583                                 {
 584                                         s->queries.erase(s->queries.begin() + i - 1);
 585                                         delete req;
 586                                 }
 587                         }
 588
 589                         for (unsigned int i = s->results.size(); i > 0; --i)
 590                         {
 591                                 LDAPRequest* req = s->results[i - 1];
 592                                 LDAPInterface* li = req->inter;
 593
 594                                 if (li->creator == m)
 595                                 {
 596                                         s->results.erase(s->results.begin() + i - 1);
 597                                         delete req;
 598                                 }
 599                         }
 600
 601                         s->UnlockQueue();
 602                         s->process_mutex.Unlock();
 603                 }
 604         }
 605
 606         ~ModuleLDAP()
 607         {
 608                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 609                 {
 610                         LDAPService* conn = i->second;
 611                         conn->join();
 612                         conn->OnNotify();
 613                         delete conn;
 614                 }
 615         }
 616
 617         Version GetVersion() CXX11_OVERRIDE
 618         {
 619                 return Version("LDAP support", VF_VENDOR);
 620         }
 621 };
 622
 623 int LDAPBind::run()
 624 {
 625         berval cred;
 626         cred.bv_val = strdup(pass.c_str());
 627         cred.bv_len = pass.length();
 628
 629         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 630
 631         free(cred.bv_val);
 632
 633         return i;
 634 }
 635
 636 int LDAPSearch::run()
 637 {
 638         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 639 }
 640
 641 int LDAPAdd::run()
 642 {
 643         LDAPMod** mods = LDAPService::BuildMods(attributes);
 644         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 645         LDAPService::FreeMods(mods);
 646         return i;
 647 }
 648
 649 int LDAPDel::run()
 650 {
 651         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 652 }
 653
 654 int LDAPModify::run()
 655 {
 656         LDAPMod** mods = LDAPService::BuildMods(attributes);
 657         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 658         LDAPService::FreeMods(mods);
 659         return i;
 660 }
 661
 662 int LDAPCompare::run()
 663 {
 664         berval cred;
 665         cred.bv_val = strdup(val.c_str());
 666         cred.bv_len = val.length();
 667
 668         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 669
 670         free(cred.bv_val);
 671
 672         return ret;
 673
 674 }
 675
 676 MODULE_INIT(ModuleLDAP)