src/modules/m_ldapoper.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2013 Adam <Adam@anope.org>
   5  *   Copyright (C) 2009 Robin Burchell <robin+git@viroteck.net>
   6  *   Copyright (C) 2008 Pippijn van Steenhoven <pip88nl@gmail.com>
   7  *   Copyright (C) 2008 Craig Edwards <craigedwards@brainbox.cc>
   8  *   Copyright (C) 2007 Carsten Valdemar Munk <carsten.munk+inspircd@gmail.com>
   9  *
  10  * This file is part of InspIRCd.  InspIRCd is free software: you can
  11  * redistribute it and/or modify it under the terms of the GNU General Public
  12  * License as published by the Free Software Foundation, version 2.
  13  *
  14  * This program is distributed in the hope that it will be useful, but WITHOUT
  15  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  16  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  17  * details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23
  24 #include "inspircd.h"
  25 #include "modules/ldap.h"
  26
  27 namespace
  28 {
  29         Module* me;
  30 }
  31
  32 class LDAPOperBase : public LDAPInterface
  33 {
  34  protected:
  35         const std::string uid;
  36         const std::string opername;
  37         const std::string password;
  38
  39         void Fallback(User* user)
  40         {
  41                 if (!user)
  42                         return;
  43
  44                 Command* oper_command = ServerInstance->Parser->GetHandler("OPER");
  45                 if (!oper_command)
  46                         return;
  47
  48                 std::vector<std::string> params;
  49                 params.push_back(opername);
  50                 params.push_back(password);
  51                 oper_command->Handle(params, user);
  52         }
  53
  54         void Fallback()
  55         {
  56                 User* user = ServerInstance->FindUUID(uid);
  57                 Fallback(user);
  58         }
  59
  60  public:
  61         LDAPOperBase(Module* mod, const std::string& uuid, const std::string& oper, const std::string& pass)
  62                 : LDAPInterface(mod)
  63                 , uid(uuid), opername(oper), password(pass)
  64         {
  65         }
  66
  67         void OnError(const LDAPResult& err) CXX11_OVERRIDE
  68         {
  69                 ServerInstance->SNO->WriteToSnoMask('a', "Error searching LDAP server: %s", err.getError().c_str());
  70                 Fallback();
  71                 delete this;
  72         }
  73 };
  74
  75 class BindInterface : public LDAPOperBase
  76 {
  77  public:
  78         BindInterface(Module* mod, const std::string& uuid, const std::string& oper, const std::string& pass)
  79                 : LDAPOperBase(mod, uuid, oper, pass)
  80         {
  81         }
  82
  83         void OnResult(const LDAPResult& r) CXX11_OVERRIDE
  84         {
  85                 User* user = ServerInstance->FindUUID(uid);
  86                 OperIndex::iterator iter = ServerInstance->Config->oper_blocks.find(opername);
  87
  88                 if (!user || iter == ServerInstance->Config->oper_blocks.end())
  89                 {
  90                         Fallback();
  91                         delete this;
  92                         return;
  93                 }
  94
  95                 OperInfo* ifo = iter->second;
  96                 user->Oper(ifo);
  97                 delete this;
  98         }
  99 };
 100
 101 class SearchInterface : public LDAPOperBase
 102 {
 103         const std::string provider;
 104
 105         bool HandleResult(const LDAPResult& result)
 106         {
 107                 dynamic_reference<LDAPProvider> LDAP(me, provider);
 108                 if (!LDAP || result.empty())
 109                         return false;
 110
 111                 try
 112                 {
 113                         const LDAPAttributes& attr = result.get(0);
 114                         std::string bindDn = attr.get("dn");
 115                         if (bindDn.empty())
 116                                 return false;
 117
 118                         LDAP->Bind(new BindInterface(this->creator, uid, opername, password), bindDn, password);
 119                 }
 120                 catch (LDAPException& ex)
 121                 {
 122                         ServerInstance->SNO->WriteToSnoMask('a', "Error searching LDAP server: " + ex.GetReason());
 123                 }
 124
 125                 return true;
 126         }
 127
 128  public:
 129         SearchInterface(Module* mod, const std::string& prov, User* user, const std::string& oper, const std::string& pass)
 130                 : LDAPOperBase(mod, user->uuid, oper, pass)
 131                 , provider(prov)
 132         {
 133         }
 134
 135         void OnResult(const LDAPResult& result) CXX11_OVERRIDE
 136         {
 137                 if (!HandleResult(result))
 138                         Fallback();
 139                 delete this;
 140         }
 141 };
 142
 143 class ModuleLDAPAuth : public Module
 144 {
 145         dynamic_reference<LDAPProvider> LDAP;
 146         std::string base;
 147         std::string attribute;
 148
 149  public:
 150         ModuleLDAPAuth()
 151                 : LDAP(this, "LDAP")
 152         {
 153                 me = this;
 154         }
 155
 156         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 157         {
 158                 ConfigTag* tag = ServerInstance->Config->ConfValue("ldapoper");
 159
 160                 LDAP.SetProvider("LDAP/" + tag->getString("dbid"));
 161                 base = tag->getString("baserdn");
 162                 attribute = tag->getString("attribute");
 163         }
 164
 165         ModResult OnPreCommand(std::string& command, std::vector<std::string>& parameters, LocalUser* user, bool validated, const std::string& original_line) CXX11_OVERRIDE
 166         {
 167                 if (validated && command == "OPER" && parameters.size() >= 2)
 168                 {
 169                         const std::string& opername = parameters[0];
 170                         const std::string& password = parameters[1];
 171
 172                         OperIndex::iterator it = ServerInstance->Config->oper_blocks.find(opername);
 173                         if (it == ServerInstance->Config->oper_blocks.end())
 174                                 return MOD_RES_PASSTHRU;
 175
 176                         ConfigTag* tag = it->second->oper_block;
 177                         if (!tag)
 178                                 return MOD_RES_PASSTHRU;
 179
 180                         std::string acceptedhosts = tag->getString("host");
 181                         std::string hostname = user->ident + "@" + user->host;
 182                         if (!InspIRCd::MatchMask(acceptedhosts, hostname, user->GetIPString()))
 183                                 return MOD_RES_PASSTHRU;
 184
 185                         if (!LDAP)
 186                                 return MOD_RES_PASSTHRU;
 187
 188                         try
 189                         {
 190                                 // First, bind as the manager so the following search will go through
 191                                 LDAP->BindAsManager(NULL);
 192
 193                                 // Fire off the search
 194                                 std::string what = attribute + "=" + opername;
 195                                 LDAP->Search(new SearchInterface(this, LDAP.GetProvider(), user, opername, password), base, what);
 196                                 return MOD_RES_DENY;
 197                         }
 198                         catch (LDAPException& ex)
 199                         {
 200                                 ServerInstance->SNO->WriteToSnoMask('a', "LDAP exception: " + ex.GetReason());
 201                         }
 202                 }
 203
 204                 return MOD_RES_PASSTHRU;
 205         }
 206
 207         Version GetVersion() CXX11_OVERRIDE
 208         {
 209                 return Version("Adds the ability to authenticate opers via LDAP", VF_VENDOR);
 210         }
 211 };
 212
 213 MODULE_INIT(ModuleLDAPAuth)