lighttpd
/
lighttpd1.4
2
0
Fork 0
Code Issues Releases Wiki Activity
Browse Source

[mod_auth*] use config_plugin_values_init()

personal/stbuehler/ci-build
Glenn Strauss 3 years ago
parent
12b11f3042
commit
8e713130b3
7 changed files with 994 additions and 931 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 266
      src/mod_auth.c
  2. 163
      src/mod_authn_file.c
  3. 152
      src/mod_authn_gssapi.c
  4. 515
      src/mod_authn_ldap.c
  5. 465
      src/mod_authn_mysql.c
  6. 125
      src/mod_authn_pam.c
  7. 239
      src/mod_authn_sasl.c

266
src/mod_auth.c
Unescape View File

@ -19,21 +19,15 @@
*/
typedef struct {
/* auth */
array *auth_require;
buffer *auth_backend_conf;
unsigned short auth_extern_authn;
/* generated */
const http_auth_backend_t *auth_backend;
const http_auth_backend_t *auth_backend;
const array *auth_require;
unsigned int auth_extern_authn;
} plugin_config;
typedef struct {
PLUGIN_DATA;
plugin_config **config_storage;
plugin_config conf;
PLUGIN_DATA;
plugin_config defaults;
plugin_config conf;
} plugin_data;
static handler_t mod_auth_check_basic(server *srv, connection *con, void *p_d, const struct http_auth_require_t *require, const struct http_auth_backend_t *backend);
@ -56,31 +50,34 @@ INIT_FUNC(mod_auth_init) {
return p;
}
FREE_FUNC(mod_auth_free) {
plugin_data *p = p_d;
UNUSED(srv);
if (!p) return HANDLER_GO_ON;
if (p->config_storage) {
size_t i;
for (i = 0; i < srv->config_context->used; i++) {
plugin_config *s = p->config_storage[i];
if (NULL == s) continue;
array_free(s->auth_require);
buffer_free(s->auth_backend_conf);
static void mod_auth_free_config(plugin_data * const p) {
if (NULL == p->cvlist) return;
/* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1], used = p->nconfig; i < used; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
for (; -1 != cpv->k_id; ++cpv) {
if (cpv->vtype != T_CONFIG_LOCAL || NULL == cpv->v.v) continue;
switch (cpv->k_id) {
case 1: /* auth.require */
array_free(cpv->v.v);
break;
default:
break;
}
}
}
}
free(s);
}
free(p->config_storage);
}
FREE_FUNC(mod_auth_free) {
plugin_data *p = p_d;
if (!p) return HANDLER_GO_ON;
free(p);
mod_auth_free_config(p);
return HANDLER_GO_ON;
free(p->cvlist);
free(p);
UNUSED(srv);
return HANDLER_GO_ON;
}
/* data type for mod_auth structured data
@ -268,63 +265,11 @@ static int mod_auth_require_parse (server *srv, http_auth_require_t * const requ
return 1; /* success */
}
SETDEFAULTS_FUNC(mod_auth_set_defaults) {
plugin_data *p = p_d;
size_t i;
config_values_t cv[] = {
{ "auth.backend", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
{ "auth.require", NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
{ "auth.extern-authn", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },/* 2 */
{ NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
};
p->config_storage = calloc(srv->config_context->used, sizeof(plugin_config *));
for (i = 0; i < srv->config_context->used; i++) {
data_config const* config = (data_config const*)srv->config_context->data[i];
plugin_config *s;
size_t n;
const data_array *da;
s = calloc(1, sizeof(plugin_config));
s->auth_backend_conf = buffer_init();
s->auth_require = array_init();
cv[0].destination = s->auth_backend_conf;
cv[1].destination = s->auth_require; /* T_CONFIG_LOCAL; not modified by config_insert_values_global() */
cv[2].destination = &s->auth_extern_authn;
p->config_storage[i] = s;
if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
return HANDLER_ERROR;
}
if (!buffer_string_is_empty(s->auth_backend_conf)) {
s->auth_backend = http_auth_backend_get(s->auth_backend_conf);
if (NULL == s->auth_backend) {
log_error_write(srv, __FILE__, __LINE__, "sb", "auth.backend not supported:", s->auth_backend_conf);
return HANDLER_ERROR;
}
}
/* no auth.require for this section */
if (NULL == (da = (const data_array *)array_get_element_klen(config->value, CONST_STR_LEN("auth.require")))) continue;
if (da->type != TYPE_ARRAY || !array_is_kvarray(&da->value)) {
log_error_write(srv, __FILE__, __LINE__, "ss",
"unexpected value for auth.require; expected ",
"auth.require = ( \"urlpath\" => ( \"option\" => \"value\" ) )");
return HANDLER_ERROR;
}
for (n = 0; n < da->value.used; n++) {
static handler_t mod_auth_require_parse_array(server *srv, const array *value, array * const auth_require)
{
for (uint32_t n = 0; n < value->used; ++n) {
size_t m;
data_array *da_file = (data_array *)da->value.data[n];
data_array *da_file = (data_array *)value->data[n];
const buffer *method = NULL, *realm = NULL, *require = NULL;
const http_auth_scheme_t *auth_scheme;
buffer *algos = NULL;
@ -417,54 +362,125 @@ SETDEFAULTS_FUNC(mod_auth_set_defaults) {
dauth->fn->free((data_unset *)dauth);
return HANDLER_ERROR;
}
array_insert_unique(s->auth_require, (data_unset *)dauth);
array_insert_unique(auth_require, (data_unset *)dauth);
}
}
}
return HANDLER_GO_ON;
}
#define PATCH(x) \
p->conf.x = s->x;
static int mod_auth_patch_connection(server *srv, connection *con, plugin_data *p) {
size_t i, j;
plugin_config *s = p->config_storage[0];
PATCH(auth_backend);
PATCH(auth_require);
PATCH(auth_extern_authn);
/* skip the first, the global context */
for (i = 1; i < srv->config_context->used; i++) {
if (!config_check_cond(con, i)) continue; /* condition not matched */
data_config *dc = (data_config *)srv->config_context->data[i];
s = p->config_storage[i];
/* merge config */
for (j = 0; j < dc->value->used; j++) {
data_unset *du = dc->value->data[j];
if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend"))) {
PATCH(auth_backend);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.require"))) {
PATCH(auth_require);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.extern-authn"))) {
PATCH(auth_extern_authn);
}
}
}
static void mod_auth_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* auth.backend */
if (cpv->vtype == T_CONFIG_LOCAL)
pconf->auth_backend = cpv->v.v;
break;
case 1: /* auth.require */
if (cpv->vtype == T_CONFIG_LOCAL)
pconf->auth_require = cpv->v.v;
break;
case 2: /* auth.extern-authn */
pconf->auth_extern_authn = cpv->v.u;
default:/* should not happen */
return;
}
}
return 0;
static void mod_auth_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_auth_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
static void mod_auth_patch_config(connection * const con, plugin_data * const p) {
memcpy(&p->conf, &p->defaults, sizeof(plugin_config));
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(con, (uint32_t)p->cvlist[i].k_id))
mod_auth_merge_config(&p->conf, p->cvlist + p->cvlist[i].v.u2[0]);
}
}
SETDEFAULTS_FUNC(mod_auth_set_defaults) {
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("auth.backend"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.require"),
T_CONFIG_ARRAY,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.extern-authn"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_auth"))
return HANDLER_ERROR;
/* process and validate config directives
* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
for (; -1 != cpv->k_id; ++cpv) {
switch (cpv->k_id) {
case 0: /* auth.backend */
if (!buffer_string_is_empty(cpv->v.b)) {
const http_auth_backend_t * const auth_backend =
http_auth_backend_get(cpv->v.b);
if (NULL == auth_backend) {
log_error(srv->errh, __FILE__, __LINE__,
"auth.backend not supported: %s", cpv->v.b->ptr);
return HANDLER_ERROR;
}
*(const http_auth_backend_t **)&cpv->v.v = auth_backend;
cpv->vtype = T_CONFIG_LOCAL;
}
break;
case 1: /* auth.require */
if (array_is_kvarray(cpv->v.a)) {
array * const a = array_init();
if (HANDLER_GO_ON !=
mod_auth_require_parse_array(srv, cpv->v.a, a)) {
array_free(a);
return HANDLER_ERROR;
}
cpv->v.a = a;
cpv->vtype = T_CONFIG_LOCAL;
}
else {
log_error(srv->errh, __FILE__, __LINE__,
"unexpected value for %s; expected "
"%s = ( \"urlpath\" => ( \"option\" => \"value\" ) )",
cpk[cpv->k_id].k, cpk[cpv->k_id].k);
return HANDLER_ERROR;
}
break;
case 2: /* auth.extern-authn */
break;
default:/* should not happen */
break;
}
}
}
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_auth_merge_config(&p->defaults, cpv);
}
return HANDLER_GO_ON;
}
#undef PATCH
static handler_t mod_auth_uri_handler(server *srv, connection *con, void *p_d) {
plugin_data *p = p_d;
data_auth *dauth;
mod_auth_patch_connection(srv, con, p);
mod_auth_patch_config(con, p);
if (p->conf.auth_require == NULL) return HANDLER_GO_ON;

163
src/mod_authn_file.c
Unescape View File

@ -47,15 +47,15 @@
*/
typedef struct {
buffer *auth_plain_groupfile;
buffer *auth_plain_userfile;
buffer *auth_htdigest_userfile;
buffer *auth_htpasswd_userfile;
const buffer *auth_plain_groupfile;
const buffer *auth_plain_userfile;
const buffer *auth_htdigest_userfile;
const buffer *auth_htpasswd_userfile;
} plugin_config;
typedef struct {
PLUGIN_DATA;
plugin_config **config_storage;
plugin_config defaults;
plugin_config conf;
} plugin_data;
@ -91,110 +91,81 @@ INIT_FUNC(mod_authn_file_init) {
FREE_FUNC(mod_authn_file_free) {
plugin_data *p = p_d;
UNUSED(srv);
if (!p) return HANDLER_GO_ON;
if (p->config_storage) {
size_t i;
for (i = 0; i < srv->config_context->used; i++) {
plugin_config *s = p->config_storage[i];
if (NULL == s) continue;
buffer_free(s->auth_plain_groupfile);
buffer_free(s->auth_plain_userfile);
buffer_free(s->auth_htdigest_userfile);
buffer_free(s->auth_htpasswd_userfile);
free(p->cvlist);
free(p);
UNUSED(srv);
return HANDLER_GO_ON;
}
free(s);
}
free(p->config_storage);
static void mod_authn_file_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* auth.backend.plain.groupfile */
pconf->auth_plain_groupfile = cpv->v.b;
break;
case 1: /* auth.backend.plain.userfile */
pconf->auth_plain_userfile = cpv->v.b;
break;
case 2: /* auth.backend.htdigest.userfile */
pconf->auth_htdigest_userfile = cpv->v.b;
break;
case 3: /* auth.backend.htpasswd.userfile */
pconf->auth_htpasswd_userfile = cpv->v.b;
break;
default:/* should not happen */
return;
}
}
free(p);
static void mod_authn_file_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_authn_file_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
return HANDLER_GO_ON;
static void mod_authn_file_patch_config(connection * const con, plugin_data * const p) {
memcpy(&p->conf, &p->defaults, sizeof(plugin_config));
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(con, (uint32_t)p->cvlist[i].k_id))
mod_authn_file_merge_config(&p->conf,
p->cvlist + p->cvlist[i].v.u2[0]);
}
}
SETDEFAULTS_FUNC(mod_authn_file_set_defaults) {
plugin_data *p = p_d;
size_t i;
config_values_t cv[] = {
{ "auth.backend.plain.groupfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
{ "auth.backend.plain.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
{ "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
{ "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 3 */
{ NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("auth.backend.plain.groupfile"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.plain.userfile"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.htdigest.userfile"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.htpasswd.userfile"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
p->config_storage = calloc(srv->config_context->used, sizeof(plugin_config *));
for (i = 0; i < srv->config_context->used; i++) {
data_config const* config = (data_config const*)srv->config_context->data[i];
plugin_config *s;
s = calloc(1, sizeof(plugin_config));
s->auth_plain_groupfile = buffer_init();
s->auth_plain_userfile = buffer_init();
s->auth_htdigest_userfile = buffer_init();
s->auth_htpasswd_userfile = buffer_init();
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_authn_file"))
return HANDLER_ERROR;
cv[0].destination = s->auth_plain_groupfile;
cv[1].destination = s->auth_plain_userfile;
cv[2].destination = s->auth_htdigest_userfile;
cv[3].destination = s->auth_htpasswd_userfile;
p->config_storage[i] = s;
if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
return HANDLER_ERROR;
}
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_authn_file_merge_config(&p->defaults, cpv);
}
return HANDLER_GO_ON;
}
#define PATCH(x) \
p->conf.x = s->x;
static int mod_authn_file_patch_connection(server *srv, connection *con, plugin_data *p) {
size_t i, j;
plugin_config *s = p->config_storage[0];
PATCH(auth_plain_groupfile);
PATCH(auth_plain_userfile);
PATCH(auth_htdigest_userfile);
PATCH(auth_htpasswd_userfile);
/* skip the first, the global context */
for (i = 1; i < srv->config_context->used; i++) {
if (!config_check_cond(con, i)) continue; /* condition not matched */
data_config *dc = (data_config *)srv->config_context->data[i];
s = p->config_storage[i];
/* merge config */
for (j = 0; j < dc->value->used; j++) {
data_unset *du = dc->value->data[j];
if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.plain.groupfile"))) {
PATCH(auth_plain_groupfile);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.plain.userfile"))) {
PATCH(auth_plain_userfile);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.htdigest.userfile"))) {
PATCH(auth_htdigest_userfile);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.htpasswd.userfile"))) {
PATCH(auth_htpasswd_userfile);
}
}
}
return 0;
}
#undef PATCH
@ -314,7 +285,7 @@ static int mod_authn_file_htdigest_get(server *srv, connection *con, void *p_d,
const buffer *auth_fn;
FILE *fp;
mod_authn_file_patch_connection(srv, con, p);
mod_authn_file_patch_config(con, p);
auth_fn = p->conf.auth_htdigest_userfile;
if (buffer_string_is_empty(auth_fn)) return -1;
@ -425,7 +396,7 @@ static handler_t mod_authn_file_plain_digest(server *srv, connection *con, void
plugin_data *p = (plugin_data *)p_d;
buffer *password_buf = buffer_init();/* password-string from auth-backend */
int rc;
mod_authn_file_patch_connection(srv, con, p);
mod_authn_file_patch_config(con, p);
rc = mod_authn_file_htpasswd_get(srv, p->conf.auth_plain_userfile, ai->username, ai->ulen, password_buf);
if (0 == rc) {
/* generate password from plain-text */
@ -439,7 +410,7 @@ static handler_t mod_authn_file_plain_basic(server *srv, connection *con, void *
plugin_data *p = (plugin_data *)p_d;
buffer *password_buf = buffer_init();/* password-string from auth-backend */
int rc;
mod_authn_file_patch_connection(srv, con, p);
mod_authn_file_patch_config(con, p);
rc = mod_authn_file_htpasswd_get(srv, p->conf.auth_plain_userfile, CONST_BUF_LEN(username), password_buf);
if (0 == rc) {
rc = http_auth_const_time_memeq_pad(CONST_BUF_LEN(password_buf), pw, strlen(pw)) ? 0 : -1;
@ -663,7 +634,7 @@ static handler_t mod_authn_file_htpasswd_basic(server *srv, connection *con, voi
plugin_data *p = (plugin_data *)p_d;
buffer *password = buffer_init();/* password-string from auth-backend */
int rc;
mod_authn_file_patch_connection(srv, con, p);
mod_authn_file_patch_config(con, p);
rc = mod_authn_file_htpasswd_get(srv, p->conf.auth_htpasswd_userfile, CONST_BUF_LEN(username), password);
if (0 == rc) {
char sample[256];

152
src/mod_authn_gssapi.c
Unescape View File

@ -30,7 +30,6 @@
#include "http_header.h"
#include "base.h"
#include "log.h"
#include "md5.h"
#include "base64.h"
#include <errno.h>
@ -39,14 +38,14 @@
#include <unistd.h>
typedef struct {
buffer *auth_gssapi_keytab;
buffer *auth_gssapi_principal;
unsigned short int auth_gssapi_store_creds;
const buffer *auth_gssapi_keytab;
const buffer *auth_gssapi_principal;
unsigned int auth_gssapi_store_creds;
} plugin_config;
typedef struct {
PLUGIN_DATA;
plugin_config **config_storage;
plugin_config defaults;
plugin_config conf;
} plugin_data;
@ -71,104 +70,78 @@ INIT_FUNC(mod_authn_gssapi_init) {
FREE_FUNC(mod_authn_gssapi_free) {
plugin_data *p = p_d;
UNUSED(srv);
if (!p) return HANDLER_GO_ON;
if (p->config_storage) {
size_t i;
for (i = 0; i < srv->config_context->used; i++) {
plugin_config *s = p->config_storage[i];
if (NULL == s) continue;
buffer_free(s->auth_gssapi_keytab);
buffer_free(s->auth_gssapi_principal);
free(p->cvlist);
free(p);
UNUSED(srv);
return HANDLER_GO_ON;
}
free(s);
}
free(p->config_storage);
static void mod_authn_gssapi_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* auth.backend.gssapi.keytab */
pconf->auth_gssapi_keytab = cpv->v.b;
break;
case 1: /* auth.backend.gssapi.principal */
pconf->auth_gssapi_principal = cpv->v.b;
break;
case 2: /* auth.backend.gssapi.store-creds */
pconf->auth_gssapi_store_creds = cpv->v.u;
break;
default:/* should not happen */
return;
}
}
free(p);
static void mod_authn_gssapi_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_authn_gssapi_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
return HANDLER_GO_ON;
static void mod_authn_gssapi_patch_config(connection * const con, plugin_data * const p) {
memcpy(&p->conf, &p->defaults, sizeof(plugin_config));
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(con, (uint32_t)p->cvlist[i].k_id))
mod_authn_gssapi_merge_config(&p->conf,
p->cvlist + p->cvlist[i].v.u2[0]);
}
}
SETDEFAULTS_FUNC(mod_authn_gssapi_set_defaults) {
plugin_data *p = p_d;
size_t i;
config_values_t cv[] = {
{ "auth.backend.gssapi.keytab", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
{ "auth.backend.gssapi.principal", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
{ "auth.backend.gssapi.store-creds",NULL, T_CONFIG_BOOLEAN,T_CONFIG_SCOPE_CONNECTION },
{ NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("auth.backend.gssapi.keytab"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.gssapi.principal"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.gssapi.store-creds"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
p->config_storage = calloc(srv->config_context->used, sizeof(plugin_config *));
for (i = 0; i < srv->config_context->used; i++) {
data_config const* config = (data_config const*)srv->config_context->data[i];
plugin_config *s;
s = calloc(1, sizeof(plugin_config));
s->auth_gssapi_keytab = buffer_init();
s->auth_gssapi_principal = buffer_init();
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_authn_gssapi"))
return HANDLER_ERROR;
cv[0].destination = s->auth_gssapi_keytab;
cv[1].destination = s->auth_gssapi_principal;
cv[2].destination = &s->auth_gssapi_store_creds;
/* default enabled for backwards compatibility; disable in future */
s->auth_gssapi_store_creds = 1;
/* default enabled for backwards compatibility; disable in future */
p->defaults.auth_gssapi_store_creds = 1;
p->config_storage[i] = s;
if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
return HANDLER_ERROR;
}
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_authn_gssapi_merge_config(&p->defaults, cpv);
}
return HANDLER_GO_ON;
}
#define PATCH(x) \
p->conf.x = s->x;
static int mod_authn_gssapi_patch_connection(server *srv, connection *con, plugin_data *p)
{
size_t i, j;
plugin_config *s = p->config_storage[0];
PATCH(auth_gssapi_keytab);
PATCH(auth_gssapi_principal);
PATCH(auth_gssapi_store_creds);
/* skip the first, the global context */
for (i = 1; i < srv->config_context->used; i++) {
if (!config_check_cond(con, i)) continue; /* condition not matched */
data_config *dc = (data_config *)srv->config_context->data[i];
s = p->config_storage[i];
/* merge config */
for (j = 0; j < dc->value->used; j++) {
data_unset *du = dc->value->data[j];
if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.gssapi.keytab"))) {
PATCH(auth_gssapi_keytab);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.gssapi.principal"))) {
PATCH(auth_gssapi_principal);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.gssapi.store-creds"))) {
PATCH(auth_gssapi_store_creds);
}
}
}
return 0;
}
#undef PATCH
static handler_t mod_authn_gssapi_send_400_bad_request (server *srv, connection *con)
{
UNUSED(srv);
@ -357,7 +330,7 @@ static handler_t mod_authn_gssapi_check_spnego(server *srv, connection *con, plu
return mod_authn_gssapi_send_400_bad_request(srv, con);
}
mod_authn_gssapi_patch_connection(srv, con, p);
mod_authn_gssapi_patch_config(con, p);
{
/* ??? Should code = krb5_kt_resolve(kcontext, p->conf.auth_gssapi_keytab->ptr, &keytab);
@ -661,7 +634,7 @@ static handler_t mod_authn_gssapi_basic(server *srv, connection *con, void *p_d,
return mod_authn_gssapi_send_401_unauthorized_basic(con);
}
mod_authn_gssapi_patch_connection(srv, con, p);
mod_authn_gssapi_patch_config(con, p);
code = krb5_init_context(&kcontext);
if (code) {
@ -669,6 +642,11 @@ static handler_t mod_authn_gssapi_basic(server *srv, connection *con, void *p_d,
return mod_authn_gssapi_send_401_unauthorized_basic(con); /*(well, should be 500)*/
}
if (buffer_string_is_empty(p->conf.auth_gssapi_keytab)) {
log_error_write(srv, __FILE__, __LINE__, "s", "auth.backend.gssapi.keytab not configured");
return mod_authn_gssapi_send_401_unauthorized_basic(con); /*(well, should be 500)*/
}
code = krb5_kt_resolve(kcontext, p->conf.auth_gssapi_keytab->ptr, &keytab);
if (code) {
log_error_write(srv, __FILE__, __LINE__, "sdb", "krb5_kt_resolve():", code, p->conf.auth_gssapi_keytab);

515
src/mod_authn_ldap.c
Unescape View File

@ -14,24 +14,32 @@
typedef struct {
LDAP *ldap;
server *srv;
const char *auth_ldap_hostname;
const char *auth_ldap_binddn;
const char *auth_ldap_bindpw;
const char *auth_ldap_cafile;
int auth_ldap_starttls;
} plugin_config_ldap;
buffer *auth_ldap_hostname;
buffer *auth_ldap_basedn;
buffer *auth_ldap_binddn;
buffer *auth_ldap_bindpw;
buffer *auth_ldap_filter;
buffer *auth_ldap_cafile;
buffer *auth_ldap_groupmember;
unsigned short auth_ldap_starttls;
unsigned short auth_ldap_allow_empty_pw;
typedef struct {
plugin_config_ldap *ldc;
const char *auth_ldap_basedn;
const buffer *auth_ldap_filter;
const buffer *auth_ldap_groupmember;
int auth_ldap_allow_empty_pw;
int auth_ldap_starttls;
const char *auth_ldap_binddn;
const char *auth_ldap_bindpw;
const char *auth_ldap_cafile;
} plugin_config;
typedef struct {
PLUGIN_DATA;
plugin_config **config_storage;
plugin_config conf, *anon_conf; /* this is only used as long as no handler_ctx is setup */
plugin_config defaults;
plugin_config conf;
buffer *ldap_filter;
buffer ldap_filter;
} plugin_data;
static handler_t mod_authn_ldap_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw);
@ -40,7 +48,6 @@ INIT_FUNC(mod_authn_ldap_init) {
static http_auth_backend_t http_auth_backend_ldap =
{ "ldap", mod_authn_ldap_basic, NULL, NULL };
plugin_data *p = calloc(1, sizeof(*p));
p->ldap_filter = buffer_init();
/* register http_auth_backend_ldap */
http_auth_backend_ldap.p_d = p;
@ -49,39 +56,89 @@ INIT_FUNC(mod_authn_ldap_init) {
return p;
}
static void mod_authn_ldap_free_config(plugin_data *p) {
if (NULL == p->cvlist) return;
/* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1], used = p->nconfig; i < used; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
for (; -1 != cpv->k_id; ++cpv) {
switch (cpv->k_id) {
case 0: /* auth.backend.ldap.hostname */
if (cpv->vtype == T_CONFIG_LOCAL) {
plugin_config_ldap *s = cpv->v.v;
if (NULL != s->ldap) ldap_unbind_ext_s(s->ldap, NULL, NULL);
free(s);
}
break;
default:
break;
}
}
}
}
FREE_FUNC(mod_authn_ldap_free) {
plugin_data *p = p_d;
UNUSED(srv);
if (!p) return HANDLER_GO_ON;
buffer_free(p->ldap_filter);
if (p->config_storage) {
size_t i;
for (i = 0; i < srv->config_context->used; i++) {
plugin_config *s = p->config_storage[i];
if (NULL == s) continue;
mod_authn_ldap_free_config(p);
free(p->ldap_filter.ptr);
buffer_free(s->auth_ldap_hostname);
buffer_free(s->auth_ldap_basedn);
buffer_free(s->auth_ldap_binddn);
buffer_free(s->auth_ldap_bindpw);
buffer_free(s->auth_ldap_filter);
buffer_free(s->auth_ldap_cafile);
buffer_free(s->auth_ldap_groupmember);
free(p->cvlist);
free(p);
UNUSED(srv);
return HANDLER_GO_ON;
}
if (NULL != s->ldap) ldap_unbind_ext_s(s->ldap, NULL, NULL);
free(s);
}
free(p->config_storage);
static void mod_authn_ldap_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* auth.backend.ldap.hostname */
if (cpv->vtype == T_CONFIG_LOCAL)
pconf->ldc = cpv->v.v;
break;
case 1: /* auth.backend.ldap.base-dn */
if (cpv->vtype == T_CONFIG_LOCAL)
pconf->auth_ldap_basedn = cpv->v.v;
break;
case 2: /* auth.backend.ldap.filter */
pconf->auth_ldap_filter = cpv->v.v;
break;
case 3: /* auth.backend.ldap.ca-file */
pconf->auth_ldap_cafile = cpv->v.v;
break;
case 4: /* auth.backend.ldap.starttls */
pconf->auth_ldap_starttls = (int)cpv->v.u;
break;
case 5: /* auth.backend.ldap.bind-dn */
pconf->auth_ldap_binddn = cpv->v.v;
break;
case 6: /* auth.backend.ldap.bind-pw */
pconf->auth_ldap_bindpw = cpv->v.v;
break;
case 7: /* auth.backend.ldap.allow-empty-pw */
pconf->auth_ldap_allow_empty_pw = (int)cpv->v.u;
break;
case 8: /* auth.backend.ldap.groupmember */
pconf->auth_ldap_groupmember = cpv->v.b;
break;
default:/* should not happen */
return;
}
}
free(p);
static void mod_authn_ldap_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_authn_ldap_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
return HANDLER_GO_ON;
static void mod_authn_ldap_patch_config(connection * const con, plugin_data * const p) {
memcpy(&p->conf, &p->defaults, sizeof(plugin_config));
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(con, (uint32_t)p->cvlist[i].k_id))
mod_authn_ldap_merge_config(&p->conf,
p->cvlist + p->cvlist[i].v.u2[0]);
}
}
/*(copied from mod_vhostdb_ldap.c)*/
@ -118,133 +175,155 @@ static void mod_authn_add_scheme (server *srv, buffer *host)
}
SETDEFAULTS_FUNC(mod_authn_ldap_set_defaults) {
plugin_data *p = p_d;
size_t i;
config_values_t cv[] = {
{ "auth.backend.ldap.hostname", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
{ "auth.backend.ldap.base-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
{ "auth.backend.ldap.filter", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
{ "auth.backend.ldap.ca-file", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 3 */
{ "auth.backend.ldap.starttls", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 4 */
{ "auth.backend.ldap.bind-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 5 */
{ "auth.backend.ldap.bind-pw", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 6 */
{ "auth.backend.ldap.allow-empty-pw", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 7 */
{ "auth.backend.ldap.groupmember", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 8 */
{ NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("auth.backend.ldap.hostname"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.base-dn"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.filter"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.ca-file"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.starttls"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.bind-dn"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.bind-pw"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.allow-empty-pw"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.backend.ldap.groupmember"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
p->config_storage = calloc(srv->config_context->used, sizeof(plugin_config *));
for (i = 0; i < srv->config_context->used; i++) {
data_config const* config = (data_config const*)srv->config_context->data[i];
plugin_config *s;
s = calloc(1, sizeof(plugin_config));
s->auth_ldap_hostname = buffer_init();
s->auth_ldap_basedn = buffer_init();
s->auth_ldap_binddn = buffer_init();
s->auth_ldap_bindpw = buffer_init();
s->auth_ldap_filter = buffer_init();
s->auth_ldap_cafile = buffer_init();
s->auth_ldap_groupmember = buffer_init_string("memberUid");
s->auth_ldap_starttls = 0;
s->ldap = NULL;
cv[0].destination = s->auth_ldap_hostname;
cv[1].destination = s->auth_ldap_basedn;
cv[2].destination = s->auth_ldap_filter;
cv[3].destination = s->auth_ldap_cafile;
cv[4].destination = &(s->auth_ldap_starttls);
cv[5].destination = s->auth_ldap_binddn;
cv[6].destination = s->auth_ldap_bindpw;
cv[7].destination = &(s->auth_ldap_allow_empty_pw);
cv[8].destination = s->auth_ldap_groupmember;
p->config_storage[i] = s;
if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
return HANDLER_ERROR;
}
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_authn_ldap"))
return HANDLER_ERROR;
if (!buffer_string_is_empty(s->auth_ldap_filter)) {
if (*s->auth_ldap_filter->ptr != ',') {
/*(translate '$' to '?' for consistency with other modules)*/
char *d = s->auth_ldap_filter->ptr;
for (; NULL != (d = strchr(d, '$')); ++d) *d = '?';
if (NULL == strchr(s->auth_ldap_filter->ptr, '?')) {
log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.filter is missing a replace-operator '?'");
return HANDLER_ERROR;
/* process and validate config directives
* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
plugin_config_ldap *ldc = NULL;
char *binddn = NULL, *bindpw = NULL, *cafile = NULL;
int starttls = 0;
for (; -1 != cpv->k_id; ++cpv) {
switch (cpv->k_id) {
case 0: /* auth.backend.ldap.hostname */
if (!buffer_string_is_empty(cpv->v.b)) {
buffer *b;
*(const buffer **)&b = cpv->v.b;
mod_authn_add_scheme(srv, b);
ldc = malloc(sizeof(plugin_config_ldap));
force_assert(ldc);
ldc->srv = srv;
ldc->auth_ldap_hostname = b->ptr;
cpv->v.v = ldc;
}
else {
cpv->v.v = NULL;
}
cpv->vtype = T_CONFIG_LOCAL;
break;
case 1: /* auth.backend.ldap.base-dn */
cpv->vtype = T_CONFIG_LOCAL;
cpv->v.v = !buffer_string_is_empty(cpv->v.b)
? cpv->v.b->ptr
: NULL;
break;
case 2: /* auth.backend.ldap.filter */
if (!buffer_string_is_empty(cpv->v.b)) {
buffer *b;
*(const buffer **)&b = cpv->v.b;
if (*b->ptr != ',') {
/*(translate $ to ? for consistency w/ other modules)*/
char *d = b->ptr;
for (; NULL != (d = strchr(d, '$')); ++d) *d = '?';
if (NULL == strchr(b->ptr, '?')) {
log_error(srv->errh, __FILE__, __LINE__,
"ldap: %s is missing a replace-operator '?'",
cpk[cpv->k_id].k);
return HANDLER_ERROR;
}
}
cpv->v.v = b;
}
else {
cpv->v.v = NULL;
}
cpv->vtype = T_CONFIG_LOCAL;
break;
case 3: /* auth.backend.ldap.ca-file */
cafile = !buffer_string_is_empty(cpv->v.b)
? cpv->v.b->ptr
: NULL;
cpv->vtype = T_CONFIG_LOCAL;
cpv->v.v = cafile;
break;
case 4: /* auth.backend.ldap.starttls */
starttls = (int)cpv->v.u;
break;
case 5: /* auth.backend.ldap.bind-dn */
binddn = !buffer_string_is_empty(cpv->v.b)
? cpv->v.b->ptr
: NULL;
cpv->vtype = T_CONFIG_LOCAL;
cpv->v.v = binddn;
break;
case 6: /* auth.backend.ldap.bind-pw */
cpv->vtype = T_CONFIG_LOCAL;
cpv->v.v = bindpw = cpv->v.b->ptr;
break;
case 7: /* auth.backend.ldap.allow-empty-pw */
case 8: /* auth.backend.ldap.groupmember */
break;
default:/* should not happen */
break;
}
}
mod_authn_add_scheme(srv, s->auth_ldap_hostname);
if (ldc) {
ldc->auth_ldap_binddn = binddn;
ldc->auth_ldap_bindpw = bindpw;
ldc->auth_ldap_cafile = cafile;
ldc->auth_ldap_starttls = starttls;
}
}
return HANDLER_GO_ON;
}
static const struct { const char *ptr; uint32_t used; uint32_t size; }
memberUid = { "memberUid", sizeof("memberUid"), 0 };
*(const buffer **)&p->defaults.auth_ldap_groupmember =
(const buffer *)&memberUid;
#define PATCH(x) \
p->conf.x = s->x;
static int mod_authn_ldap_patch_connection(server *srv, connection *con, plugin_data *p) {
size_t i, j;
plugin_config *s = p->config_storage[0];
PATCH(auth_ldap_hostname);
PATCH(auth_ldap_basedn);
PATCH(auth_ldap_binddn);
PATCH(auth_ldap_bindpw);
PATCH(auth_ldap_filter);
PATCH(auth_ldap_cafile);
PATCH(auth_ldap_starttls);
PATCH(auth_ldap_allow_empty_pw);
PATCH(auth_ldap_groupmember);
p->anon_conf = s;
/* skip the first, the global context */
for (i = 1; i < srv->config_context->used; i++) {
if (!config_check_cond(con, i)) continue; /* condition not matched */
data_config *dc = (data_config *)srv->config_context->data[i];
s = p->config_storage[i];
/* merge config */
for (j = 0; j < dc->value->used; j++) {
data_unset *du = dc->value->data[j];
if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.hostname"))) {
PATCH(auth_ldap_hostname);
p->anon_conf = s;
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.base-dn"))) {
PATCH(auth_ldap_basedn);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.filter"))) {
PATCH(auth_ldap_filter);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.ca-file"))) {
PATCH(auth_ldap_cafile);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.starttls"))) {
PATCH(auth_ldap_starttls);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.bind-dn"))) {
PATCH(auth_ldap_binddn);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.bind-pw"))) {
PATCH(auth_ldap_bindpw);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.allow-empty-pw"))) {
PATCH(auth_ldap_allow_empty_pw);
} else if (buffer_is_equal_string(&du->key, CONST_STR_LEN("auth.backend.ldap.groupmember"))) {
PATCH(auth_ldap_groupmember);
}
}
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_authn_ldap_merge_config(&p->defaults, cpv);
}
return 0;
return HANDLER_GO_ON;
}
#undef PATCH
__attribute_cold__
static void mod_authn_ldap_err(server *srv, const char *file, unsigned long line, const char *fn, int err)
{
log_error_write(srv,file,line,"sSss","ldap:",fn,":",ldap_err2string(err));
}
__attribute_cold__
static void mod_authn_ldap_opt_err(server *srv, const char *file, unsigned long line, const char *fn, LDAP *ld)
{
int err;
@ -383,13 +462,13 @@ static void mod_authn_append_ldap_filter_escape(buffer * const filter, const buf
}
}
static LDAP * mod_authn_ldap_host_init(server *srv, plugin_config *s) {
static LDAP * mod_authn_ldap_host_init(server *srv, plugin_config_ldap *s) {
LDAP *ld;
int ret;
if (buffer_string_is_empty(s->auth_ldap_hostname)) return NULL;
if (NULL == s->auth_ldap_hostname) return NULL;
if (LDAP_SUCCESS != ldap_initialize(&ld, s->auth_ldap_hostname->ptr)) {
if (LDAP_SUCCESS != ldap_initialize(&ld, s->auth_ldap_hostname)) {
log_error_write(srv, __FILE__, __LINE__, "sss", "ldap:",
"ldap_initialize():", strerror(errno));
return NULL;
@ -409,9 +488,9 @@ static LDAP * mod_authn_ldap_host_init(server *srv, plugin_config *s) {
if (s->auth_ldap_starttls) {
/* if no CA file is given, it is ok, as we will use encryption
* if the server requires a CAfile it will tell us */
if (!buffer_string_is_empty(s->auth_ldap_cafile)) {
if (s->auth_ldap_cafile) {
ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,
s->auth_ldap_cafile->ptr);
s->auth_ldap_cafile);
if (LDAP_OPT_SUCCESS != ret) {
mod_authn_ldap_err(srv, __FILE__, __LINE__,
"ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE)",
@ -455,18 +534,18 @@ static int mod_authn_ldap_bind(server *srv, LDAP *ld, const char *dn, const char
}
static int mod_authn_ldap_rebind_proc (LDAP *ld, LDAP_CONST char *url, ber_tag_t ldap_request, ber_int_t msgid, void *params) {
plugin_config *s = (plugin_config *)params;
const plugin_config_ldap *s = (const plugin_config_ldap *)params;
UNUSED(url);
UNUSED(ldap_request);
UNUSED(msgid);
return !buffer_string_is_empty(s->auth_ldap_binddn)
return s->auth_ldap_binddn
? mod_authn_ldap_bind(s->srv, ld,
s->auth_ldap_binddn->ptr,
s->auth_ldap_bindpw->ptr)
s->auth_ldap_binddn,
s->auth_ldap_bindpw)
: mod_authn_ldap_bind(s->srv, ld, NULL, NULL);
}
static LDAPMessage * mod_authn_ldap_search(server *srv, plugin_config *s, char *base, char *filter) {
static LDAPMessage * mod_authn_ldap_search(server *srv, plugin_config_ldap *s, const char *base, const char *filter) {
LDAPMessage *lm = NULL;
char *attrs[] = { LDAP_NO_ATTRS, NULL };
int ret;
@ -521,7 +600,7 @@ static LDAPMessage * mod_authn_ldap_search(server *srv, plugin_config *s, char *
return lm;
}
static char * mod_authn_ldap_get_dn(server *srv, plugin_config *s, char *base, char *filter) {
static char * mod_authn_ldap_get_dn(server *srv, plugin_config_ldap *s, const char *base, const char *filter) {
LDAP *ld;
LDAPMessage *lm, *first;
char *dn;
@ -576,11 +655,12 @@ static handler_t mod_authn_ldap_memberOf(server *srv, plugin_config *s, const ht
}
buffer_append_string_len(filter, CONST_STR_LEN(")"));
plugin_config_ldap * const ldc = s->ldc;
for (size_t i = 0; i < groups->used; ++i) {
char *base = groups->data[i]->key.ptr;
LDAPMessage *lm = mod_authn_ldap_search(srv, s, base, filter->ptr);
const char *base = groups->data[i]->key.ptr;
LDAPMessage *lm = mod_authn_ldap_search(srv, ldc, base, filter->ptr);
if (NULL != lm) {
int count = ldap_count_entries(s->ldap, lm);
int count = ldap_count_entries(ldc->ldap, lm);
ldap_msgfree(lm);
if (count > 0) {
rc = HANDLER_GO_ON;
@ -597,88 +677,101 @@ static handler_t mod_authn_ldap_basic(server *srv, connection *con, void *p_d, c
plugin_data *p = (plugin_data *)p_d;
LDAP *ld;
char *dn;