src/modules/extra/m_ldap.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2019 linuxdaemon <linuxdaemon.irc@gmail.com>
   5  *   Copyright (C) 2019 Robby <robby@chatbelgie.be>
   6  *   Copyright (C) 2016-2019 Sadie Powell <sadie@witchery.services>
   7  *   Copyright (C) 2014, 2016 Attila Molnar <attilamolnar@hush.com>
   8  *   Copyright (C) 2013-2016 Adam <Adam@anope.org>
   9  *
  10  * This file is part of InspIRCd.  InspIRCd is free software: you can
  11  * redistribute it and/or modify it under the terms of the GNU General Public
  12  * License as published by the Free Software Foundation, version 2.
  13  *
  14  * This program is distributed in the hope that it will be useful, but WITHOUT
  15  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  16  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  17  * details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 /// $LinkerFlags: -llber -lldap_r
  24
  25 /// $PackageInfo: require_system("arch") libldap
  26 /// $PackageInfo: require_system("centos") openldap-devel
  27 /// $PackageInfo: require_system("debian") libldap2-dev
  28 /// $PackageInfo: require_system("ubuntu") libldap2-dev
  29
  30 #include "inspircd.h"
  31 #include "modules/ldap.h"
  32
  33 // Ignore OpenLDAP deprecation warnings on OS X Yosemite and newer.
  34 #if defined __APPLE__
  35 # pragma GCC diagnostic push
  36 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  37 #endif
  38
  39 #include <ldap.h>
  40
  41 #ifdef __APPLE__
  42 # pragma GCC diagnostic pop
  43 #endif
  44
  45 #ifdef _WIN32
  46 # pragma comment(lib, "libldap_r.lib")
  47 # pragma comment(lib, "liblber.lib")
  48 #endif
  49
  50 class LDAPService;
  51
  52 class LDAPRequest
  53 {
  54  public:
  55         LDAPService* service;
  56         LDAPInterface* inter;
  57         LDAPMessage* message; /* message returned by ldap_ */
  58         LDAPResult* result; /* final result */
  59         struct timeval tv;
  60         QueryType type;
  61
  62         LDAPRequest(LDAPService* s, LDAPInterface* i)
  63                 : service(s)
  64                 , inter(i)
  65                 , message(NULL)
  66                 , result(NULL)
  67         {
  68                 type = QUERY_UNKNOWN;
  69                 tv.tv_sec = 0;
  70                 tv.tv_usec = 100000;
  71         }
  72
  73         virtual ~LDAPRequest()
  74         {
  75                 delete result;
  76                 if (message != NULL)
  77                         ldap_msgfree(message);
  78         }
  79
  80         virtual int run() = 0;
  81 };
  82
  83 class LDAPBind : public LDAPRequest
  84 {
  85         std::string who, pass;
  86
  87  public:
  88         LDAPBind(LDAPService* s, LDAPInterface* i, const std::string& w, const std::string& p)
  89                 : LDAPRequest(s, i)
  90                 , who(w)
  91                 , pass(p)
  92         {
  93                 type = QUERY_BIND;
  94         }
  95
  96         int run() CXX11_OVERRIDE;
  97 };
  98
  99 class LDAPSearch : public LDAPRequest
 100 {
 101         std::string base;
 102         int searchscope;
 103         std::string filter;
 104
 105  public:
 106         LDAPSearch(LDAPService* s, LDAPInterface* i, const std::string& b, int se, const std::string& f)
 107                 : LDAPRequest(s, i)
 108                 , base(b)
 109                 , searchscope(se)
 110                 , filter(f)
 111         {
 112                 type = QUERY_SEARCH;
 113         }
 114
 115         int run() CXX11_OVERRIDE;
 116 };
 117
 118 class LDAPAdd : public LDAPRequest
 119 {
 120         std::string dn;
 121         LDAPMods attributes;
 122
 123  public:
 124         LDAPAdd(LDAPService* s, LDAPInterface* i, const std::string& d, const LDAPMods& attr)
 125                 : LDAPRequest(s, i)
 126                 , dn(d)
 127                 , attributes(attr)
 128         {
 129                 type = QUERY_ADD;
 130         }
 131
 132         int run() CXX11_OVERRIDE;
 133 };
 134
 135 class LDAPDel : public LDAPRequest
 136 {
 137         std::string dn;
 138
 139  public:
 140         LDAPDel(LDAPService* s, LDAPInterface* i, const std::string& d)
 141                 : LDAPRequest(s, i)
 142                 , dn(d)
 143         {
 144                 type = QUERY_DELETE;
 145         }
 146
 147         int run() CXX11_OVERRIDE;
 148 };
 149
 150 class LDAPModify : public LDAPRequest
 151 {
 152         std::string base;
 153         LDAPMods attributes;
 154
 155  public:
 156         LDAPModify(LDAPService* s, LDAPInterface* i, const std::string& b, const LDAPMods& attr)
 157                 : LDAPRequest(s, i)
 158                 , base(b)
 159                 , attributes(attr)
 160         {
 161                 type = QUERY_MODIFY;
 162         }
 163
 164         int run() CXX11_OVERRIDE;
 165 };
 166
 167 class LDAPCompare : public LDAPRequest
 168 {
 169         std::string dn, attr, val;
 170
 171  public:
 172         LDAPCompare(LDAPService* s, LDAPInterface* i, const std::string& d, const std::string& a, const std::string& v)
 173                 : LDAPRequest(s, i)
 174                 , dn(d)
 175                 , attr(a)
 176                 , val(v)
 177         {
 178                 type = QUERY_COMPARE;
 179         }
 180
 181         int run() CXX11_OVERRIDE;
 182 };
 183
 184 class LDAPService : public LDAPProvider, public SocketThread
 185 {
 186         LDAP* con;
 187         reference<ConfigTag> config;
 188         time_t last_connect;
 189         int searchscope;
 190         time_t timeout;
 191
 192  public:
 193         static LDAPMod** BuildMods(const LDAPMods& attributes)
 194         {
 195                 LDAPMod** mods = new LDAPMod*[attributes.size() + 1];
 196                 memset(mods, 0, sizeof(LDAPMod*) * (attributes.size() + 1));
 197                 for (unsigned int x = 0; x < attributes.size(); ++x)
 198                 {
 199                         const LDAPModification& l = attributes[x];
 200                         LDAPMod* mod = new LDAPMod;
 201                         mods[x] = mod;
 202
 203                         if (l.op == LDAPModification::LDAP_ADD)
 204                                 mod->mod_op = LDAP_MOD_ADD;
 205                         else if (l.op == LDAPModification::LDAP_DEL)
 206                                 mod->mod_op = LDAP_MOD_DELETE;
 207                         else if (l.op == LDAPModification::LDAP_REPLACE)
 208                                 mod->mod_op = LDAP_MOD_REPLACE;
 209                         else if (l.op != 0)
 210                         {
 211                                 FreeMods(mods);
 212                                 throw LDAPException("Unknown LDAP operation");
 213                         }
 214                         mod->mod_type = strdup(l.name.c_str());
 215                         mod->mod_values = new char*[l.values.size() + 1];
 216                         memset(mod->mod_values, 0, sizeof(char*) * (l.values.size() + 1));
 217                         for (unsigned int j = 0, c = 0; j < l.values.size(); ++j)
 218                                 if (!l.values[j].empty())
 219                                         mod->mod_values[c++] = strdup(l.values[j].c_str());
 220                 }
 221                 return mods;
 222         }
 223
 224         static void FreeMods(LDAPMod** mods)
 225         {
 226                 for (unsigned int i = 0; mods[i] != NULL; ++i)
 227                 {
 228                         LDAPMod* mod = mods[i];
 229                         if (mod->mod_type != NULL)
 230                                 free(mod->mod_type);
 231                         if (mod->mod_values != NULL)
 232                         {
 233                                 for (unsigned int j = 0; mod->mod_values[j] != NULL; ++j)
 234                                         free(mod->mod_values[j]);
 235                                 delete[] mod->mod_values;
 236                         }
 237                 }
 238                 delete[] mods;
 239         }
 240
 241  private:
 242         void Reconnect()
 243         {
 244                 // Only try one connect a minute. It is an expensive blocking operation
 245                 if (last_connect > ServerInstance->Time() - 60)
 246                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": reconnecting too fast");
 247                 last_connect = ServerInstance->Time();
 248
 249                 ldap_unbind_ext(this->con, NULL, NULL);
 250                 Connect();
 251         }
 252
 253         int SetOption(int option, const void* value)
 254         {
 255                 int ret = ldap_set_option(this->con, option, value);
 256                 if (ret != LDAP_OPT_SUCCESS)
 257                 {
 258                         ldap_unbind_ext(this->con, NULL, NULL);
 259                         this->con = NULL;
 260                 }
 261                 return ret;
 262         }
 263
 264         void QueueRequest(LDAPRequest* r)
 265         {
 266                 this->LockQueue();
 267                 this->queries.push_back(r);
 268                 this->UnlockQueueWakeup();
 269         }
 270
 271  public:
 272         typedef std::vector<LDAPRequest*> query_queue;
 273         query_queue queries, results;
 274         Mutex process_mutex; /* held when processing requests not in either queue */
 275
 276         LDAPService(Module* c, ConfigTag* tag)
 277                 : LDAPProvider(c, "LDAP/" + tag->getString("id"))
 278                 , con(NULL), config(tag), last_connect(0)
 279         {
 280                 std::string scope = config->getString("searchscope");
 281                 if (stdalgo::string::equalsci(scope, "base"))
 282                         searchscope = LDAP_SCOPE_BASE;
 283                 else if (stdalgo::string::equalsci(scope, "onelevel"))
 284                         searchscope = LDAP_SCOPE_ONELEVEL;
 285                 else
 286                         searchscope = LDAP_SCOPE_SUBTREE;
 287                 timeout = config->getDuration("timeout", 5);
 288
 289                 Connect();
 290         }
 291
 292         ~LDAPService()
 293         {
 294                 this->LockQueue();
 295
 296                 for (unsigned int i = 0; i < this->queries.size(); ++i)
 297                 {
 298                         LDAPRequest* req = this->queries[i];
 299
 300                         /* queries have no results yet */
 301                         req->result = new LDAPResult();
 302                         req->result->type = req->type;
 303                         req->result->error = "LDAP Interface is going away";
 304                         req->inter->OnError(*req->result);
 305
 306                         delete req;
 307                 }
 308                 this->queries.clear();
 309
 310                 for (unsigned int i = 0; i < this->results.size(); ++i)
 311                 {
 312                         LDAPRequest* req = this->results[i];
 313
 314                         /* even though this may have already finished successfully we return that it didn't */
 315                         req->result->error = "LDAP Interface is going away";
 316                         req->inter->OnError(*req->result);
 317
 318                         delete req;
 319                 }
 320                 this->results.clear();
 321
 322                 this->UnlockQueue();
 323
 324                 ldap_unbind_ext(this->con, NULL, NULL);
 325         }
 326
 327         void Connect()
 328         {
 329                 std::string server = config->getString("server");
 330                 int i = ldap_initialize(&this->con, server.c_str());
 331                 if (i != LDAP_SUCCESS)
 332                         throw LDAPException("Unable to connect to LDAP service " + this->name + ": " + ldap_err2string(i));
 333
 334                 const int version = LDAP_VERSION3;
 335                 i = SetOption(LDAP_OPT_PROTOCOL_VERSION, &version);
 336                 if (i != LDAP_OPT_SUCCESS)
 337                         throw LDAPException("Unable to set protocol version for " + this->name + ": " + ldap_err2string(i));
 338
 339                 const struct timeval tv = { 0, 0 };
 340                 i = SetOption(LDAP_OPT_NETWORK_TIMEOUT, &tv);
 341                 if (i != LDAP_OPT_SUCCESS)
 342                         throw LDAPException("Unable to set timeout for " + this->name + ": " + ldap_err2string(i));
 343         }
 344
 345         void BindAsManager(LDAPInterface* i) CXX11_OVERRIDE
 346         {
 347                 std::string binddn = config->getString("binddn");
 348                 std::string bindauth = config->getString("bindauth");
 349                 this->Bind(i, binddn, bindauth);
 350         }
 351
 352         void Bind(LDAPInterface* i, const std::string& who, const std::string& pass) CXX11_OVERRIDE
 353         {
 354                 LDAPBind* b = new LDAPBind(this, i, who, pass);
 355                 QueueRequest(b);
 356         }
 357
 358         void Search(LDAPInterface* i, const std::string& base, const std::string& filter) CXX11_OVERRIDE
 359         {
 360                 if (i == NULL)
 361                         throw LDAPException("No interface");
 362
 363                 LDAPSearch* s = new LDAPSearch(this, i, base, searchscope, filter);
 364                 QueueRequest(s);
 365         }
 366
 367         void Add(LDAPInterface* i, const std::string& dn, LDAPMods& attributes) CXX11_OVERRIDE
 368         {
 369                 LDAPAdd* add = new LDAPAdd(this, i, dn, attributes);
 370                 QueueRequest(add);
 371         }
 372
 373         void Del(LDAPInterface* i, const std::string& dn) CXX11_OVERRIDE
 374         {
 375                 LDAPDel* del = new LDAPDel(this, i, dn);
 376                 QueueRequest(del);
 377         }
 378
 379         void Modify(LDAPInterface* i, const std::string& base, LDAPMods& attributes) CXX11_OVERRIDE
 380         {
 381                 LDAPModify* mod = new LDAPModify(this, i, base, attributes);
 382                 QueueRequest(mod);
 383         }
 384
 385         void Compare(LDAPInterface* i, const std::string& dn, const std::string& attr, const std::string& val) CXX11_OVERRIDE
 386         {
 387                 LDAPCompare* comp = new LDAPCompare(this, i, dn, attr, val);
 388                 QueueRequest(comp);
 389         }
 390
 391  private:
 392         void BuildReply(int res, LDAPRequest* req)
 393         {
 394                 LDAPResult* ldap_result = req->result = new LDAPResult();
 395                 req->result->type = req->type;
 396
 397                 if (res != LDAP_SUCCESS)
 398                 {
 399                         ldap_result->error = ldap_err2string(res);
 400                         return;
 401                 }
 402
 403                 if (req->message == NULL)
 404                 {
 405                         return;
 406                 }
 407
 408                 /* a search result */
 409
 410                 for (LDAPMessage* cur = ldap_first_message(this->con, req->message); cur; cur = ldap_next_message(this->con, cur))
 411                 {
 412                         LDAPAttributes attributes;
 413
 414                         char* dn = ldap_get_dn(this->con, cur);
 415                         if (dn != NULL)
 416                         {
 417                                 attributes["dn"].push_back(dn);
 418                                 ldap_memfree(dn);
 419                                 dn = NULL;
 420                         }
 421
 422                         BerElement* ber = NULL;
 423
 424                         for (char* attr = ldap_first_attribute(this->con, cur, &ber); attr; attr = ldap_next_attribute(this->con, cur, ber))
 425                         {
 426                                 berval** vals = ldap_get_values_len(this->con, cur, attr);
 427                                 int count = ldap_count_values_len(vals);
 428
 429                                 std::vector<std::string> attrs;
 430                                 for (int j = 0; j < count; ++j)
 431                                         attrs.push_back(vals[j]->bv_val);
 432                                 attributes[attr] = attrs;
 433
 434                                 ldap_value_free_len(vals);
 435                                 ldap_memfree(attr);
 436                         }
 437                         if (ber != NULL)
 438                                 ber_free(ber, 0);
 439
 440                         ldap_result->messages.push_back(attributes);
 441                 }
 442         }
 443
 444         void SendRequests()
 445         {
 446                 process_mutex.Lock();
 447
 448                 query_queue q;
 449                 this->LockQueue();
 450                 queries.swap(q);
 451                 this->UnlockQueue();
 452
 453                 if (q.empty())
 454                 {
 455                         process_mutex.Unlock();
 456                         return;
 457                 }
 458
 459                 for (unsigned int i = 0; i < q.size(); ++i)
 460                 {
 461                         LDAPRequest* req = q[i];
 462                         int ret = req->run();
 463
 464                         if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT)
 465                         {
 466                                 /* try again */
 467                                 try
 468                                 {
 469                                         Reconnect();
 470                                 }
 471                                 catch (const LDAPException &)
 472                                 {
 473                                 }
 474
 475                                 ret = req->run();
 476                         }
 477
 478                         BuildReply(ret, req);
 479
 480                         this->LockQueue();
 481                         this->results.push_back(req);
 482                         this->UnlockQueue();
 483                 }
 484
 485                 this->NotifyParent();
 486
 487                 process_mutex.Unlock();
 488         }
 489
 490  public:
 491         void Run() CXX11_OVERRIDE
 492         {
 493                 while (!this->GetExitFlag())
 494                 {
 495                         this->LockQueue();
 496                         if (this->queries.empty())
 497                                 this->WaitForQueue();
 498                         this->UnlockQueue();
 499
 500                         SendRequests();
 501                 }
 502         }
 503
 504         void OnNotify() CXX11_OVERRIDE
 505         {
 506                 query_queue r;
 507
 508                 this->LockQueue();
 509                 this->results.swap(r);
 510                 this->UnlockQueue();
 511
 512                 for (unsigned int i = 0; i < r.size(); ++i)
 513                 {
 514                         LDAPRequest* req = r[i];
 515                         LDAPInterface* li = req->inter;
 516                         LDAPResult* res = req->result;
 517
 518                         if (!res->error.empty())
 519                                 li->OnError(*res);
 520                         else
 521                                 li->OnResult(*res);
 522
 523                         delete req;
 524                 }
 525         }
 526
 527         LDAP* GetConnection()
 528         {
 529                 return con;
 530         }
 531 };
 532
 533 class ModuleLDAP : public Module
 534 {
 535         typedef insp::flat_map<std::string, LDAPService*> ServiceMap;
 536         ServiceMap LDAPServices;
 537
 538  public:
 539         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 540         {
 541                 ServiceMap conns;
 542
 543                 ConfigTagList tags = ServerInstance->Config->ConfTags("database");
 544                 for (ConfigIter i = tags.first; i != tags.second; i++)
 545                 {
 546                         const reference<ConfigTag>& tag = i->second;
 547
 548                         if (!stdalgo::string::equalsci(tag->getString("module"), "ldap"))
 549                                 continue;
 550
 551                         std::string id = tag->getString("id");
 552
 553                         ServiceMap::iterator curr = LDAPServices.find(id);
 554                         if (curr == LDAPServices.end())
 555                         {
 556                                 LDAPService* conn = new LDAPService(this, tag);
 557                                 conns[id] = conn;
 558
 559                                 ServerInstance->Modules->AddService(*conn);
 560                                 ServerInstance->Threads.Start(conn);
 561                         }
 562                         else
 563                         {
 564                                 conns.insert(*curr);
 565                                 LDAPServices.erase(curr);
 566                         }
 567                 }
 568
 569                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 570                 {
 571                         LDAPService* conn = i->second;
 572                         ServerInstance->Modules->DelService(*conn);
 573                         conn->join();
 574                         conn->OnNotify();
 575                         delete conn;
 576                 }
 577
 578                 LDAPServices.swap(conns);
 579         }
 580
 581         void OnUnloadModule(Module* m) CXX11_OVERRIDE
 582         {
 583                 for (ServiceMap::iterator it = this->LDAPServices.begin(); it != this->LDAPServices.end(); ++it)
 584                 {
 585                         LDAPService* s = it->second;
 586
 587                         s->process_mutex.Lock();
 588                         s->LockQueue();
 589
 590                         for (unsigned int i = s->queries.size(); i > 0; --i)
 591                         {
 592                                 LDAPRequest* req = s->queries[i - 1];
 593                                 LDAPInterface* li = req->inter;
 594
 595                                 if (li->creator == m)
 596                                 {
 597                                         s->queries.erase(s->queries.begin() + i - 1);
 598                                         delete req;
 599                                 }
 600                         }
 601
 602                         for (unsigned int i = s->results.size(); i > 0; --i)
 603                         {
 604                                 LDAPRequest* req = s->results[i - 1];
 605                                 LDAPInterface* li = req->inter;
 606
 607                                 if (li->creator == m)
 608                                 {
 609                                         s->results.erase(s->results.begin() + i - 1);
 610                                         delete req;
 611                                 }
 612                         }
 613
 614                         s->UnlockQueue();
 615                         s->process_mutex.Unlock();
 616                 }
 617         }
 618
 619         ~ModuleLDAP()
 620         {
 621                 for (ServiceMap::iterator i = LDAPServices.begin(); i != LDAPServices.end(); ++i)
 622                 {
 623                         LDAPService* conn = i->second;
 624                         conn->join();
 625                         conn->OnNotify();
 626                         delete conn;
 627                 }
 628         }
 629
 630         Version GetVersion() CXX11_OVERRIDE
 631         {
 632                 return Version("Provides LDAP support", VF_VENDOR);
 633         }
 634 };
 635
 636 int LDAPBind::run()
 637 {
 638         berval cred;
 639         cred.bv_val = strdup(pass.c_str());
 640         cred.bv_len = pass.length();
 641
 642         int i = ldap_sasl_bind_s(service->GetConnection(), who.c_str(), LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL);
 643
 644         free(cred.bv_val);
 645
 646         return i;
 647 }
 648
 649 int LDAPSearch::run()
 650 {
 651         return ldap_search_ext_s(service->GetConnection(), base.c_str(), searchscope, filter.c_str(), NULL, 0, NULL, NULL, &tv, 0, &message);
 652 }
 653
 654 int LDAPAdd::run()
 655 {
 656         LDAPMod** mods = LDAPService::BuildMods(attributes);
 657         int i = ldap_add_ext_s(service->GetConnection(), dn.c_str(), mods, NULL, NULL);
 658         LDAPService::FreeMods(mods);
 659         return i;
 660 }
 661
 662 int LDAPDel::run()
 663 {
 664         return ldap_delete_ext_s(service->GetConnection(), dn.c_str(), NULL, NULL);
 665 }
 666
 667 int LDAPModify::run()
 668 {
 669         LDAPMod** mods = LDAPService::BuildMods(attributes);
 670         int i = ldap_modify_ext_s(service->GetConnection(), base.c_str(), mods, NULL, NULL);
 671         LDAPService::FreeMods(mods);
 672         return i;
 673 }
 674
 675 int LDAPCompare::run()
 676 {
 677         berval cred;
 678         cred.bv_val = strdup(val.c_str());
 679         cred.bv_len = val.length();
 680
 681         int ret = ldap_compare_ext_s(service->GetConnection(), dn.c_str(), attr.c_str(), &cred, NULL, NULL);
 682
 683         free(cred.bv_val);
 684
 685         return ret;
 686
 687 }
 688
 689 MODULE_INIT(ModuleLDAP)