src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2013-2015 Adam <Adam@anope.org>
   5  *   Copyright (C) 2003-2015 Anope Team <team@anope.org>
   6  *
   7  * This file is part of InspIRCd.  InspIRCd is free software: you can
   8  * redistribute it and/or modify it under the terms of the GNU General Public
   9  * License as published by the Free Software Foundation, version 2.
  10  *
  11  * This program is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  13  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  14  * details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /// $LinkerFlags: -llber -lldap_r
  21
  22 /// $PackageInfo: require_system("centos") openldap-devel
  23 /// $PackageInfo: require_system("debian") libldap2-dev
  24 /// $PackageInfo: require_system("ubuntu") libldap2-dev
  25
  26 #include "inspircd.h"
  27 #include "modules/ldap.h"
  28
  29 // Ignore OpenLDAP deprecation warnings on OS X Yosemite and newer.
  30 #if defined __APPLE__
  31 # pragma GCC diagnostic push
  32 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  33 #endif
  34
  35 #include <ldap.h>
  36
  37 #ifdef __APPLE__
  38 # pragma GCC diagnostic pop
  39 #endif
  40
  41 #ifdef _WIN32
  42 # pragma comment(lib, "libldap_r.lib")
  43 # pragma comment(lib, "liblber.lib")
  44 #endif
  45
  46 class LDAPService;
  47
  48 class LDAPRequest
  49 {
  50  public:
  51         LDAPService* service;
  52         LDAPInterface* inter;
  53         LDAPMessage* message; /* message returned by ldap_ */
  54         LDAPResult* result; /* final result */
  55         struct timeval tv;
  56         QueryType type;
  57
  58         LDAPRequest(LDAPService* s, LDAPInterface* i)
  59                 : service(s)
  60                 , inter(i)
  61                 , message(NULL)
  62                 , result(NULL)
  63         {
  64                 type = QUERY_UNKNOWN;
  65                 tv.tv_sec = 0;
  66                 tv.tv_usec = 100000;
  67         }
  68
  69         virtual ~LDAPRequest()
  70         {
  71                 delete result;
  72                 if (message != NULL)
  73                         ldap_msgfree(message);
  74         }
  75
  76         virtual int run() = 0;
  77 };
  78
  79 class LDAPBind : public LDAPRequest
  80 {
  81         std::string who, pass;
  82
  83  public:
  84         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  85                 : LDAPRequest(s, i)
  86                 , who(w)
  87                 , pass(p)
  88         {
  89                 type = QUERY_BIND;
  90         }
  91
  92         int run() CXX11_OVERRIDE;
  93 };
  94
  95 class LDAPSearch : public LDAPRequest
  96 {
  97         std::string base;
  98         int searchscope;
  99         std::string filter;
 100
 101  public:
 102         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
 103                 : LDAPRequest(s, i)
 104                 , base(b)
 105                 , searchscope(se)
 106                 , filter(f)
 107         {
 108                 type = QUERY_SEARCH;
 109         }
 110
 111         int run() CXX11_OVERRIDE;
 112 };
 113
 114 class LDAPAdd : public LDAPRequest
 115 {
 116         std::string dn;
 117         LDAPMods attributes;
 118
 119  public:
 120         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 121                 : LDAPRequest(s, i)
 122                 , dn(d)
 123                 , attributes(attr)
 124         {
 125                 type = QUERY_ADD;
 126         }
 127
 128         int run() CXX11_OVERRIDE;
 129 };
 130
 131 class LDAPDel : public LDAPRequest
 132 {
 133         std::string dn;
 134
 135  public:
 136         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 137                 : LDAPRequest(s, i)
 138                 , dn(d)
 139         {
 140                 type = QUERY_DELETE;
 141         }
 142
 143         int run() CXX11_OVERRIDE;
 144 };
 145
 146 class LDAPModify : public LDAPRequest
 147 {
 148         std::string base;
 149         LDAPMods attributes;
 150
 151  public:
 152         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 153                 : LDAPRequest(s, i)
 154                 , base(b)
 155                 , attributes(attr)
 156         {
 157                 type = QUERY_MODIFY;
 158         }
 159
 160         int run() CXX11_OVERRIDE;
 161 };
 162
 163 class LDAPCompare : public LDAPRequest
 164 {
 165         std::string dn, attr, val;
 166
 167  public:
 168         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 169                 : LDAPRequest(s, i)
 170                 , dn(d)
 171                 , attr(a)
 172                 , val(v)
 173         {
 174                 type = QUERY_COMPARE;
 175         }
 176
 177         int run() CXX11_OVERRIDE;
 178 };
 179
 180 class LDAPService : public LDAPProvider, public SocketThread
 181 {
 182         LDAP* con;
 183         reference<ConfigTag> config;
 184         time_t last_connect;
 185         int searchscope;
 186         time_t timeout;
 187
 188  public:
 189         static LDAPMod** BuildMods(const LDAPMods& attributes)
 190         {
 191                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 192                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 193                 for (unsigned int x = 0; x < attributes.size(); ++x)
 194                 {
 195                         const LDAPModification& l = attributes[x];
 196                         LDAPMod* mod = new LDAPMod;
 197                         mods[x] = mod;
 198
 199                         if (l.op == LDAPModification::LDAP_ADD)
 200                                 mod->mod_op = LDAP_MOD_ADD;
 201                         else if (l.op == LDAPModification::LDAP_DEL)
 202                                 mod->mod_op = LDAP_MOD_DELETE;
 203                         else if (l.op == LDAPModification::LDAP_REPLACE)
 204                                 mod->mod_op = LDAP_MOD_REPLACE;
 205                         else if (l.op != 0)
 206                         {
 207                                 FreeMods(mods);
 208                                 throw LDAPException("Unknown LDAP operation");
 209                         }
 210                         mod->mod_type = strdup(l.name.c_str());
 211                         mod->mod_values = new char*[l.values.size() + 1];
 212                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 213                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 214                                 if (!l.values[j].empty())
 215                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 216                 }
 217                 return mods;
 218         }
 219
 220         static void FreeMods(LDAPMod** mods)
 221         {
 222                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 223                 {
 224                         LDAPMod* mod = mods[i];
 225                         if (mod->mod_type != NULL)
 226                                 free(mod->mod_type);
 227                         if (mod->mod_values != NULL)
 228                         {
 229                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 230                                         free(mod->mod_values[j]);
 231                                 delete[] mod->mod_values;
 232                         }
 233                 }
 234                 delete[] mods;
 235         }
 236
 237  private:
 238         void Reconnect()
 239         {
 240                 // Only try one connect a minute. It is an expensive blocking operation
 241                 if (last_connect > ServerInstance->Time() - 60)
 242                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 243                 last_connect = ServerInstance->Time();
 244
 245                 ldap_unbind_ext(this->con, NULL, NULL);
 246                 Connect();
 247         }
 248
 249         void QueueRequest(LDAPRequest* r)
 250         {
 251                 this->LockQueue();
 252                 this->queries.push_back(r);
 253                 this->UnlockQueueWakeup();
 254         }
 255
 256  public:
 257         typedef std::vector<LDAPRequest*> query_queue;
 258         query_queue queries, results;
 259         Mutex process_mutex; /* held when processing requests not in either queue */
 260
 261         LDAPService(Module* c, ConfigTag* tag)
 262                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 263                 , con(NULL), config(tag), last_connect(0)
 264         {
 265                 std::string scope = config->getString("searchscope");
 266                 if (stdalgo::string::equalsci(scope, "base"))
 267                         searchscope = LDAP_SCOPE_BASE;
 268                 else if (stdalgo::string::equalsci(scope, "onelevel"))
 269                         searchscope = LDAP_SCOPE_ONELEVEL;
 270                 else
 271                         searchscope = LDAP_SCOPE_SUBTREE;
 272                 timeout = config->getDuration("timeout", 5);
 273
 274                 Connect();
 275         }
 276
 277         ~LDAPService()
 278         {
 279                 this->LockQueue();
 280
 281                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 282                 {
 283                         LDAPRequest* req = this->queries[i];
 284
 285                         /* queries have no results yet */
 286                         req->result = new LDAPResult();
 287                         req->result->type = req->type;
 288                         req->result->error = "LDAP Interface is going away";
 289                         req->inter->OnError(*req->result);
 290
 291                         delete req;
 292                 }
 293                 this->queries.clear();
 294
 295                 for (unsigned int i = 0; i < this->results.size(); ++i)
 296                 {
 297                         LDAPRequest* req = this->results[i];
 298
 299                         /* even though this may have already finished successfully we return that it didn't */
 300                         req->result->error = "LDAP Interface is going away";
 301                         req->inter->OnError(*req->result);
 302
 303                         delete req;
 304                 }
 305                 this->results.clear();
 306
 307                 this->UnlockQueue();
 308
 309                 ldap_unbind_ext(this->con, NULL, NULL);
 310         }
 311
 312         void Connect()
 313         {
 314                 std::string server = config->getString("server");
 315                 int i = ldap_initialize(&this->con, server.c_str());
 316                 if (i != LDAP_SUCCESS)
 317                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 318
 319                 const int version = LDAP_VERSION3;
 320                 i = ldap_set_option(this->con, LDAP_OPT_PROTOCOL_VERSION, &version);
 321                 if (i != LDAP_OPT_SUCCESS)
 322                 {
 323                         ldap_unbind_ext(this->con, NULL, NULL);
 324                         this->con = NULL;
 325                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 326                 }
 327
 328                 const struct timeval tv = { 0, 0 };
 329                 i = ldap_set_option(this->con, LDAP_OPT_NETWORK_TIMEOUT, &tv);
 330                 if (i != LDAP_OPT_SUCCESS)
 331                 {
 332                         ldap_unbind_ext(this->con, NULL, NULL);
 333                         this->con = NULL;
 334                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 335                 }
 336         }
 337
 338         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 339         {
 340                 std::string binddn = config->getString("binddn");
 341                 std::string bindauth = config->getString("bindauth");
 342                 this->Bind(i, binddn, bindauth);
 343         }
 344
 345         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 346         {
 347                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 348                 QueueRequest(b);
 349         }
 350
 351         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 352         {
 353                 if (i == NULL)
 354                         throw LDAPException("No interface");
 355
 356                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 357                 QueueRequest(s);
 358         }
 359
 360         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 361         {
 362                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 363                 QueueRequest(add);
 364         }
 365
 366         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 367         {
 368                 LDAPDel* del = new LDAPDel(this, i, dn);
 369                 QueueRequest(del);
 370         }
 371
 372         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 373         {
 374                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 375                 QueueRequest(mod);
 376         }
 377
 378         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 379         {
 380                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 381                 QueueRequest(comp);
 382         }
 383
 384  private:
 385         void BuildReply(int res, LDAPRequest* req)
 386         {
 387                 LDAPResult* ldap_result = req->result = new LDAPResult();
 388                 req->result->type = req->type;
 389
 390                 if (res != LDAP_SUCCESS)
 391                 {
 392                         ldap_result->error = ldap_err2string(res);
 393                         return;
 394                 }
 395
 396                 if (req->message == NULL)
 397                 {
 398                         return;
 399                 }
 400
 401                 /* a search result */
 402
 403                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 404                 {
 405                         LDAPAttributes attributes;
 406
 407                         char* dn = ldap_get_dn(this->con, cur);
 408                         if (dn != NULL)
 409                         {
 410                                 attributes["dn"].push_back(dn);
 411                                 ldap_memfree(dn);
 412                                 dn = NULL;
 413                         }
 414
 415                         BerElement* ber = NULL;
 416
 417                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 418                         {
 419                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 420                                 int count = ldap_count_values_len(vals);
 421
 422                                 std::vector<std::string> attrs;
 423                                 for (int j = 0; j < count; ++j)
 424                                         attrs.push_back(vals[j]->bv_val);
 425                                 attributes[attr] = attrs;
 426
 427                                 ldap_value_free_len(vals);
 428                                 ldap_memfree(attr);
 429                         }
 430                         if (ber != NULL)
 431                                 ber_free(ber, 0);
 432
 433                         ldap_result->messages.push_back(attributes);
 434                 }
 435         }
 436
 437         void SendRequests()
 438         {
 439                 process_mutex.Lock();
 440
 441                 query_queue q;
 442                 this->LockQueue();
 443                 queries.swap(q);
 444                 this->UnlockQueue();
 445
 446                 if (q.empty())
 447                 {
 448                         process_mutex.Unlock();
 449                         return;
 450                 }
 451
 452                 for (unsigned int i = 0; i < q.size(); ++i)
 453                 {
 454                         LDAPRequest* req = q[i];
 455                         int ret = req->run();
 456
 457                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 458                         {
 459                                 /* try again */
 460                                 try
 461                                 {
 462                                         Reconnect();
 463                                 }
 464                                 catch (const LDAPException &)
 465                                 {
 466                                 }
 467
 468                                 ret = req->run();
 469                         }
 470
 471                         BuildReply(ret, req);
 472
 473                         this->LockQueue();
 474                         this->results.push_back(req);
 475                         this->UnlockQueue();
 476                 }
 477
 478                 this->NotifyParent();
 479
 480                 process_mutex.Unlock();
 481         }
 482
 483  public:
 484         void Run() CXX11_OVERRIDE
 485         {
 486                 while (!this->GetExitFlag())
 487                 {
 488                         this->LockQueue();
 489                         if (this->queries.empty())
 490                                 this->WaitForQueue();
 491                         this->UnlockQueue();
 492
 493                         SendRequests();
 494                 }
 495         }
 496
 497         void OnNotify() CXX11_OVERRIDE
 498         {
 499                 query_queue r;
 500
 501                 this->LockQueue();
 502                 this->results.swap(r);
 503                 this->UnlockQueue();
 504
 505                 for (unsigned int i = 0; i < r.size(); ++i)
 506                 {
 507                         LDAPRequest* req = r[i];
 508                         LDAPInterface* li = req->inter;
 509                         LDAPResult* res = req->result;
 510
 511                         if (!res->error.empty())
 512                                 li->OnError(*res);
 513                         else
 514                                 li->OnResult(*res);
 515
 516                         delete req;
 517                 }
 518         }
 519
 520         LDAP* GetConnection()
 521         {
 522                 return con;
 523         }
 524 };
 525
 526 class ModuleLDAP : public Module
 527 {
 528         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 529         ServiceMap LDAPServices;
 530
 531  public:
 532         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 533         {
 534                 ServiceMap conns;
 535
 536                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 537                 for (ConfigIter i = tags.first; i != tags.second; i++)
 538                 {
 539                         const reference<ConfigTag>& tag = i->second;
 540
 541                         if (!stdalgo::string::equalsci(tag->getString("module"), "ldap"))
 542                                 continue;
 543
 544                         std::string id = tag->getString("id");
 545
 546                         ServiceMap::iterator curr = LDAPServices.find(id);
 547                         if (curr == LDAPServices.end())
 548                         {
 549                                 LDAPService* conn = new LDAPService(this, tag);
 550                                 conns[id] = conn;
 551
 552                                 ServerInstance->Modules->AddService(*conn);
 553                                 ServerInstance->Threads.Start(conn);
 554                         }
 555                         else
 556                         {
 557                                 conns.insert(*curr);
 558                                 LDAPServices.erase(curr);
 559                         }
 560                 }
 561
 562                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 563                 {
 564                         LDAPService* conn = i->second;
 565                         ServerInstance->Modules->DelService(*conn);
 566                         conn->join();
 567                         conn->OnNotify();
 568                         delete conn;
 569                 }
 570
 571                 LDAPServices.swap(conns);
 572         }
 573
 574         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 575         {
 576                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 577                 {
 578                         LDAPService* s = it->second;
 579
 580                         s->process_mutex.Lock();
 581                         s->LockQueue();
 582
 583                         for (unsigned int i = s->queries.size(); i > 0; --i)
 584                         {
 585                                 LDAPRequest* req = s->queries[i - 1];
 586                                 LDAPInterface* li = req->inter;
 587
 588                                 if (li->creator == m)
 589                                 {
 590                                         s->queries.erase(s->queries.begin() + i - 1);
 591                                         delete req;
 592                                 }
 593                         }
 594
 595                         for (unsigned int i = s->results.size(); i > 0; --i)
 596                         {
 597                                 LDAPRequest* req = s->results[i - 1];
 598                                 LDAPInterface* li = req->inter;
 599
 600                                 if (li->creator == m)
 601                                 {
 602                                         s->results.erase(s->results.begin() + i - 1);
 603                                         delete req;
 604                                 }
 605                         }
 606
 607                         s->UnlockQueue();
 608                         s->process_mutex.Unlock();
 609                 }
 610         }
 611
 612         ~ModuleLDAP()
 613         {
 614                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 615                 {
 616                         LDAPService* conn = i->second;
 617                         conn->join();
 618                         conn->OnNotify();
 619                         delete conn;
 620                 }
 621         }
 622
 623         Version GetVersion() CXX11_OVERRIDE
 624         {
 625                 return Version("Provides LDAP support", VF_VENDOR);
 626         }
 627 };
 628
 629 int LDAPBind::run()
 630 {
 631         berval cred;
 632         cred.bv_val = strdup(pass.c_str());
 633         cred.bv_len = pass.length();
 634
 635         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 636
 637         free(cred.bv_val);
 638
 639         return i;
 640 }
 641
 642 int LDAPSearch::run()
 643 {
 644         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 645 }
 646
 647 int LDAPAdd::run()
 648 {
 649         LDAPMod** mods = LDAPService::BuildMods(attributes);
 650         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 651         LDAPService::FreeMods(mods);
 652         return i;
 653 }
 654
 655 int LDAPDel::run()
 656 {
 657         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 658 }
 659
 660 int LDAPModify::run()
 661 {
 662         LDAPMod** mods = LDAPService::BuildMods(attributes);
 663         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 664         LDAPService::FreeMods(mods);
 665         return i;
 666 }
 667
 668 int LDAPCompare::run()
 669 {
 670         berval cred;
 671         cred.bv_val = strdup(val.c_str());
 672         cred.bv_len = val.length();
 673
 674         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 675
 676         free(cred.bv_val);
 677
 678         return ret;
 679
 680 }
 681
 682 MODULE_INIT(ModuleLDAP)