src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2013-2015 Adam <Adam@anope.org>
   5  *   Copyright (C) 2003-2015 Anope Team <team@anope.org>
   6  *
   7  * This file is part of InspIRCd.  InspIRCd is free software: you can
   8  * redistribute it and/or modify it under the terms of the GNU General Public
   9  * License as published by the Free Software Foundation, version 2.
  10  *
  11  * This program is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  13  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  14  * details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /// $LinkerFlags: -llber -lldap_r
  21
  22 /// $PackageInfo: require_system("arch") libldap
  23 /// $PackageInfo: require_system("centos") openldap-devel
  24 /// $PackageInfo: require_system("debian") libldap2-dev
  25 /// $PackageInfo: require_system("ubuntu") libldap2-dev
  26
  27 #include "inspircd.h"
  28 #include "modules/ldap.h"
  29
  30 // Ignore OpenLDAP deprecation warnings on OS X Yosemite and newer.
  31 #if defined __APPLE__
  32 # pragma GCC diagnostic push
  33 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  34 #endif
  35
  36 #include <ldap.h>
  37
  38 #ifdef __APPLE__
  39 # pragma GCC diagnostic pop
  40 #endif
  41
  42 #ifdef _WIN32
  43 # pragma comment(lib, "libldap_r.lib")
  44 # pragma comment(lib, "liblber.lib")
  45 #endif
  46
  47 class LDAPService;
  48
  49 class LDAPRequest
  50 {
  51  public:
  52         LDAPService* service;
  53         LDAPInterface* inter;
  54         LDAPMessage* message; /* message returned by ldap_ */
  55         LDAPResult* result; /* final result */
  56         struct timeval tv;
  57         QueryType type;
  58
  59         LDAPRequest(LDAPService* s, LDAPInterface* i)
  60                 : service(s)
  61                 , inter(i)
  62                 , message(NULL)
  63                 , result(NULL)
  64         {
  65                 type = QUERY_UNKNOWN;
  66                 tv.tv_sec = 0;
  67                 tv.tv_usec = 100000;
  68         }
  69
  70         virtual ~LDAPRequest()
  71         {
  72                 delete result;
  73                 if (message != NULL)
  74                         ldap_msgfree(message);
  75         }
  76
  77         virtual int run() = 0;
  78 };
  79
  80 class LDAPBind : public LDAPRequest
  81 {
  82         std::string who, pass;
  83
  84  public:
  85         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  86                 : LDAPRequest(s, i)
  87                 , who(w)
  88                 , pass(p)
  89         {
  90                 type = QUERY_BIND;
  91         }
  92
  93         int run() CXX11_OVERRIDE;
  94 };
  95
  96 class LDAPSearch : public LDAPRequest
  97 {
  98         std::string base;
  99         int searchscope;
 100         std::string filter;
 101
 102  public:
 103         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
 104                 : LDAPRequest(s, i)
 105                 , base(b)
 106                 , searchscope(se)
 107                 , filter(f)
 108         {
 109                 type = QUERY_SEARCH;
 110         }
 111
 112         int run() CXX11_OVERRIDE;
 113 };
 114
 115 class LDAPAdd : public LDAPRequest
 116 {
 117         std::string dn;
 118         LDAPMods attributes;
 119
 120  public:
 121         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 122                 : LDAPRequest(s, i)
 123                 , dn(d)
 124                 , attributes(attr)
 125         {
 126                 type = QUERY_ADD;
 127         }
 128
 129         int run() CXX11_OVERRIDE;
 130 };
 131
 132 class LDAPDel : public LDAPRequest
 133 {
 134         std::string dn;
 135
 136  public:
 137         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 138                 : LDAPRequest(s, i)
 139                 , dn(d)
 140         {
 141                 type = QUERY_DELETE;
 142         }
 143
 144         int run() CXX11_OVERRIDE;
 145 };
 146
 147 class LDAPModify : public LDAPRequest
 148 {
 149         std::string base;
 150         LDAPMods attributes;
 151
 152  public:
 153         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 154                 : LDAPRequest(s, i)
 155                 , base(b)
 156                 , attributes(attr)
 157         {
 158                 type = QUERY_MODIFY;
 159         }
 160
 161         int run() CXX11_OVERRIDE;
 162 };
 163
 164 class LDAPCompare : public LDAPRequest
 165 {
 166         std::string dn, attr, val;
 167
 168  public:
 169         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 170                 : LDAPRequest(s, i)
 171                 , dn(d)
 172                 , attr(a)
 173                 , val(v)
 174         {
 175                 type = QUERY_COMPARE;
 176         }
 177
 178         int run() CXX11_OVERRIDE;
 179 };
 180
 181 class LDAPService : public LDAPProvider, public SocketThread
 182 {
 183         LDAP* con;
 184         reference<ConfigTag> config;
 185         time_t last_connect;
 186         int searchscope;
 187         time_t timeout;
 188
 189  public:
 190         static LDAPMod** BuildMods(const LDAPMods& attributes)
 191         {
 192                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 193                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 194                 for (unsigned int x = 0; x < attributes.size(); ++x)
 195                 {
 196                         const LDAPModification& l = attributes[x];
 197                         LDAPMod* mod = new LDAPMod;
 198                         mods[x] = mod;
 199
 200                         if (l.op == LDAPModification::LDAP_ADD)
 201                                 mod->mod_op = LDAP_MOD_ADD;
 202                         else if (l.op == LDAPModification::LDAP_DEL)
 203                                 mod->mod_op = LDAP_MOD_DELETE;
 204                         else if (l.op == LDAPModification::LDAP_REPLACE)
 205                                 mod->mod_op = LDAP_MOD_REPLACE;
 206                         else if (l.op != 0)
 207                         {
 208                                 FreeMods(mods);
 209                                 throw LDAPException("Unknown LDAP operation");
 210                         }
 211                         mod->mod_type = strdup(l.name.c_str());
 212                         mod->mod_values = new char*[l.values.size() + 1];
 213                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 214                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 215                                 if (!l.values[j].empty())
 216                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 217                 }
 218                 return mods;
 219         }
 220
 221         static void FreeMods(LDAPMod** mods)
 222         {
 223                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 224                 {
 225                         LDAPMod* mod = mods[i];
 226                         if (mod->mod_type != NULL)
 227                                 free(mod->mod_type);
 228                         if (mod->mod_values != NULL)
 229                         {
 230                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 231                                         free(mod->mod_values[j]);
 232                                 delete[] mod->mod_values;
 233                         }
 234                 }
 235                 delete[] mods;
 236         }
 237
 238  private:
 239         void Reconnect()
 240         {
 241                 // Only try one connect a minute. It is an expensive blocking operation
 242                 if (last_connect > ServerInstance->Time() - 60)
 243                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 244                 last_connect = ServerInstance->Time();
 245
 246                 ldap_unbind_ext(this->con, NULL, NULL);
 247                 Connect();
 248         }
 249
 250         int SetOption(int option, const void* value)
 251         {
 252                 int ret = ldap_set_option(this->con, option, value);
 253                 if (ret != LDAP_OPT_SUCCESS)
 254                 {
 255                         ldap_unbind_ext(this->con, NULL, NULL);
 256                         this->con = NULL;
 257                 }
 258                 return ret;
 259         }
 260
 261         void QueueRequest(LDAPRequest* r)
 262         {
 263                 this->LockQueue();
 264                 this->queries.push_back(r);
 265                 this->UnlockQueueWakeup();
 266         }
 267
 268  public:
 269         typedef std::vector<LDAPRequest*> query_queue;
 270         query_queue queries, results;
 271         Mutex process_mutex; /* held when processing requests not in either queue */
 272
 273         LDAPService(Module* c, ConfigTag* tag)
 274                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 275                 , con(NULL), config(tag), last_connect(0)
 276         {
 277                 std::string scope = config->getString("searchscope");
 278                 if (stdalgo::string::equalsci(scope, "base"))
 279                         searchscope = LDAP_SCOPE_BASE;
 280                 else if (stdalgo::string::equalsci(scope, "onelevel"))
 281                         searchscope = LDAP_SCOPE_ONELEVEL;
 282                 else
 283                         searchscope = LDAP_SCOPE_SUBTREE;
 284                 timeout = config->getDuration("timeout", 5);
 285
 286                 Connect();
 287         }
 288
 289         ~LDAPService()
 290         {
 291                 this->LockQueue();
 292
 293                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 294                 {
 295                         LDAPRequest* req = this->queries[i];
 296
 297                         /* queries have no results yet */
 298                         req->result = new LDAPResult();
 299                         req->result->type = req->type;
 300                         req->result->error = "LDAP Interface is going away";
 301                         req->inter->OnError(*req->result);
 302
 303                         delete req;
 304                 }
 305                 this->queries.clear();
 306
 307                 for (unsigned int i = 0; i < this->results.size(); ++i)
 308                 {
 309                         LDAPRequest* req = this->results[i];
 310
 311                         /* even though this may have already finished successfully we return that it didn't */
 312                         req->result->error = "LDAP Interface is going away";
 313                         req->inter->OnError(*req->result);
 314
 315                         delete req;
 316                 }
 317                 this->results.clear();
 318
 319                 this->UnlockQueue();
 320
 321                 ldap_unbind_ext(this->con, NULL, NULL);
 322         }
 323
 324         void Connect()
 325         {
 326                 std::string server = config->getString("server");
 327                 int i = ldap_initialize(&this->con, server.c_str());
 328                 if (i != LDAP_SUCCESS)
 329                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 330
 331                 const int version = LDAP_VERSION3;
 332                 i = SetOption(LDAP_OPT_PROTOCOL_VERSION, &version);
 333                 if (i != LDAP_OPT_SUCCESS)
 334                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 335
 336                 const struct timeval tv = { 0, 0 };
 337                 i = SetOption(LDAP_OPT_NETWORK_TIMEOUT, &tv);
 338                 if (i != LDAP_OPT_SUCCESS)
 339                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 340         }
 341
 342         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 343         {
 344                 std::string binddn = config->getString("binddn");
 345                 std::string bindauth = config->getString("bindauth");
 346                 this->Bind(i, binddn, bindauth);
 347         }
 348
 349         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 350         {
 351                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 352                 QueueRequest(b);
 353         }
 354
 355         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 356         {
 357                 if (i == NULL)
 358                         throw LDAPException("No interface");
 359
 360                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 361                 QueueRequest(s);
 362         }
 363
 364         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 365         {
 366                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 367                 QueueRequest(add);
 368         }
 369
 370         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 371         {
 372                 LDAPDel* del = new LDAPDel(this, i, dn);
 373                 QueueRequest(del);
 374         }
 375
 376         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 377         {
 378                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 379                 QueueRequest(mod);
 380         }
 381
 382         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 383         {
 384                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 385                 QueueRequest(comp);
 386         }
 387
 388  private:
 389         void BuildReply(int res, LDAPRequest* req)
 390         {
 391                 LDAPResult* ldap_result = req->result = new LDAPResult();
 392                 req->result->type = req->type;
 393
 394                 if (res != LDAP_SUCCESS)
 395                 {
 396                         ldap_result->error = ldap_err2string(res);
 397                         return;
 398                 }
 399
 400                 if (req->message == NULL)
 401                 {
 402                         return;
 403                 }
 404
 405                 /* a search result */
 406
 407                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 408                 {
 409                         LDAPAttributes attributes;
 410
 411                         char* dn = ldap_get_dn(this->con, cur);
 412                         if (dn != NULL)
 413                         {
 414                                 attributes["dn"].push_back(dn);
 415                                 ldap_memfree(dn);
 416                                 dn = NULL;
 417                         }
 418
 419                         BerElement* ber = NULL;
 420
 421                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 422                         {
 423                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 424                                 int count = ldap_count_values_len(vals);
 425
 426                                 std::vector<std::string> attrs;
 427                                 for (int j = 0; j < count; ++j)
 428                                         attrs.push_back(vals[j]->bv_val);
 429                                 attributes[attr] = attrs;
 430
 431                                 ldap_value_free_len(vals);
 432                                 ldap_memfree(attr);
 433                         }
 434                         if (ber != NULL)
 435                                 ber_free(ber, 0);
 436
 437                         ldap_result->messages.push_back(attributes);
 438                 }
 439         }
 440
 441         void SendRequests()
 442         {
 443                 process_mutex.Lock();
 444
 445                 query_queue q;
 446                 this->LockQueue();
 447                 queries.swap(q);
 448                 this->UnlockQueue();
 449
 450                 if (q.empty())
 451                 {
 452                         process_mutex.Unlock();
 453                         return;
 454                 }
 455
 456                 for (unsigned int i = 0; i < q.size(); ++i)
 457                 {
 458                         LDAPRequest* req = q[i];
 459                         int ret = req->run();
 460
 461                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 462                         {
 463                                 /* try again */
 464                                 try
 465                                 {
 466                                         Reconnect();
 467                                 }
 468                                 catch (const LDAPException &)
 469                                 {
 470                                 }
 471
 472                                 ret = req->run();
 473                         }
 474
 475                         BuildReply(ret, req);
 476
 477                         this->LockQueue();
 478                         this->results.push_back(req);
 479                         this->UnlockQueue();
 480                 }
 481
 482                 this->NotifyParent();
 483
 484                 process_mutex.Unlock();
 485         }
 486
 487  public:
 488         void Run() CXX11_OVERRIDE
 489         {
 490                 while (!this->GetExitFlag())
 491                 {
 492                         this->LockQueue();
 493                         if (this->queries.empty())
 494                                 this->WaitForQueue();
 495                         this->UnlockQueue();
 496
 497                         SendRequests();
 498                 }
 499         }
 500
 501         void OnNotify() CXX11_OVERRIDE
 502         {
 503                 query_queue r;
 504
 505                 this->LockQueue();
 506                 this->results.swap(r);
 507                 this->UnlockQueue();
 508
 509                 for (unsigned int i = 0; i < r.size(); ++i)
 510                 {
 511                         LDAPRequest* req = r[i];
 512                         LDAPInterface* li = req->inter;
 513                         LDAPResult* res = req->result;
 514
 515                         if (!res->error.empty())
 516                                 li->OnError(*res);
 517                         else
 518                                 li->OnResult(*res);
 519
 520                         delete req;
 521                 }
 522         }
 523
 524         LDAP* GetConnection()
 525         {
 526                 return con;
 527         }
 528 };
 529
 530 class ModuleLDAP : public Module
 531 {
 532         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 533         ServiceMap LDAPServices;
 534
 535  public:
 536         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 537         {
 538                 ServiceMap conns;
 539
 540                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 541                 for (ConfigIter i = tags.first; i != tags.second; i++)
 542                 {
 543                         const reference<ConfigTag>& tag = i->second;
 544
 545                         if (!stdalgo::string::equalsci(tag->getString("module"), "ldap"))
 546                                 continue;
 547
 548                         std::string id = tag->getString("id");
 549
 550                         ServiceMap::iterator curr = LDAPServices.find(id);
 551                         if (curr == LDAPServices.end())
 552                         {
 553                                 LDAPService* conn = new LDAPService(this, tag);
 554                                 conns[id] = conn;
 555
 556                                 ServerInstance->Modules->AddService(*conn);
 557                                 ServerInstance->Threads.Start(conn);
 558                         }
 559                         else
 560                         {
 561                                 conns.insert(*curr);
 562                                 LDAPServices.erase(curr);
 563                         }
 564                 }
 565
 566                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 567                 {
 568                         LDAPService* conn = i->second;
 569                         ServerInstance->Modules->DelService(*conn);
 570                         conn->join();
 571                         conn->OnNotify();
 572                         delete conn;
 573                 }
 574
 575                 LDAPServices.swap(conns);
 576         }
 577
 578         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 579         {
 580                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 581                 {
 582                         LDAPService* s = it->second;
 583
 584                         s->process_mutex.Lock();
 585                         s->LockQueue();
 586
 587                         for (unsigned int i = s->queries.size(); i > 0; --i)
 588                         {
 589                                 LDAPRequest* req = s->queries[i - 1];
 590                                 LDAPInterface* li = req->inter;
 591
 592                                 if (li->creator == m)
 593                                 {
 594                                         s->queries.erase(s->queries.begin() + i - 1);
 595                                         delete req;
 596                                 }
 597                         }
 598
 599                         for (unsigned int i = s->results.size(); i > 0; --i)
 600                         {
 601                                 LDAPRequest* req = s->results[i - 1];
 602                                 LDAPInterface* li = req->inter;
 603
 604                                 if (li->creator == m)
 605                                 {
 606                                         s->results.erase(s->results.begin() + i - 1);
 607                                         delete req;
 608                                 }
 609                         }
 610
 611                         s->UnlockQueue();
 612                         s->process_mutex.Unlock();
 613                 }
 614         }
 615
 616         ~ModuleLDAP()
 617         {
 618                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 619                 {
 620                         LDAPService* conn = i->second;
 621                         conn->join();
 622                         conn->OnNotify();
 623                         delete conn;
 624                 }
 625         }
 626
 627         Version GetVersion() CXX11_OVERRIDE
 628         {
 629                 return Version("Provides LDAP support", VF_VENDOR);
 630         }
 631 };
 632
 633 int LDAPBind::run()
 634 {
 635         berval cred;
 636         cred.bv_val = strdup(pass.c_str());
 637         cred.bv_len = pass.length();
 638
 639         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 640
 641         free(cred.bv_val);
 642
 643         return i;
 644 }
 645
 646 int LDAPSearch::run()
 647 {
 648         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 649 }
 650
 651 int LDAPAdd::run()
 652 {
 653         LDAPMod** mods = LDAPService::BuildMods(attributes);
 654         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 655         LDAPService::FreeMods(mods);
 656         return i;
 657 }
 658
 659 int LDAPDel::run()
 660 {
 661         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 662 }
 663
 664 int LDAPModify::run()
 665 {
 666         LDAPMod** mods = LDAPService::BuildMods(attributes);
 667         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 668         LDAPService::FreeMods(mods);
 669         return i;
 670 }
 671
 672 int LDAPCompare::run()
 673 {
 674         berval cred;
 675         cred.bv_val = strdup(val.c_str());
 676         cred.bv_len = val.length();
 677
 678         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 679
 680         free(cred.bv_val);
 681
 682         return ret;
 683
 684 }
 685
 686 MODULE_INIT(ModuleLDAP)