/* * HttpAuth * * Copyright (C) 2004 Stefan Walter * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with this program; if not, write to the * Free Software Foundation, Inc., * 59 Temple Place, Suite 330, * Boston, MA 02111-1307, USA. */ #include "usuals.h" #include "httpauthd.h" #include "md5.h" #include "sha1.h" #include "bd.h" #include /* LDAP library */ #include /* ------------------------------------------------------------------------------- * Defaults and Constants */ /* TODO: We need to support more password types */ #define LDAP_PW_CLEAR 0 #define LDAP_PW_CRYPT 1 #define LDAP_PW_MD5 2 #define LDAP_PW_SHA 3 #define LDAP_PW_UNKNOWN -1 typedef struct ldap_pw_type { const char* name; int type; } ldap_pw_type_t; static const ldap_pw_type_t kLDAPPWTypes[] = { { "cleartext", LDAP_PW_CLEAR }, { "crypt", LDAP_PW_CRYPT }, { "md5", LDAP_PW_MD5 }, { "sha", LDAP_PW_SHA } }; /* ------------------------------------------------------------------------------- * Structures */ /* Our hanler context */ typedef struct ldap_context { /* Base Handler ------------------------------------------------------ */ bd_context_t bd; /* Read Only --------------------------------------------------------- */ const char* servers; /* Servers to authenticate against (required) */ const char* filter; /* Filter (either this or dnmap must be set) */ const char* base; /* Base for the filter */ const char* pw_attr; /* The clear password attribute */ const char* ha1_attr; /* Password for an encrypted Digest H(A1) */ const char* user; /* User to bind as */ const char* password; /* Password to bind with */ const char* dnmap; /* For mapping users to dns */ int port; /* Port to connect to LDAP server on */ int scope; /* Scope for filter */ int dobind; /* Bind to do simple authentication */ int ldap_max; /* Number of open connections allowed */ int ldap_timeout; /* Maximum amount of time to dedicate to an ldap query */ /* Require Locking --------------------------------------------------- */ LDAP** pool; /* Pool of available connections */ int pool_mark; /* Amount of connections allocated */ } ldap_context_t; /* Forward declarations for callbacks */ static int validate_digest(ha_request_t* rq, const char* user, digest_context_t* dg); static int validate_basic(ha_request_t* rq, const char* user, const char* password); static void escape_ldap(const ha_request_t* rq, ha_buffer_t* buf, const char* value); /* The defaults for the context */ static const ldap_context_t ldap_defaults = { BD_CALLBACKS(validate_digest, validate_basic, escape_ldap), NULL, /* servers */ NULL, /* filter */ NULL, /* base */ "userPassword", /* pw_attr */ NULL, /* ha1_attr */ NULL, /* user */ NULL, /* password */ NULL, /* dnmap */ 389, /* port */ LDAP_SCOPE_SUBTREE, /* scope */ 1, /* dobind */ 10, /* ldap_max */ 30, /* ldap_timeout */ NULL, /* pool */ 0 /* pool_mark */ }; /* ------------------------------------------------------------------------------- * Internal Functions */ static int report_ldap(const ha_request_t* rq, const char* msg, int code) { ASSERT(code != LDAP_SUCCESS); switch(code) { case LDAP_NO_MEMORY: ha_memerr(NULL); return HA_CRITERROR; default: if(!msg) msg = "error"; ha_messagex(rq, LOG_ERR, "%s: %s", msg, ldap_err2string(code)); return HA_FAILED; }; } #define LDAP_NO_ESCAPE "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-_0123456789" #define LDAP_HEX "0123456789abcdef" static void escape_ldap(const ha_request_t* rq, ha_buffer_t* buf, const char* str) { const char* t = str; size_t pos; ha_bufcpy(buf, ""); while(*t) { pos = strspn(t, LDAP_NO_ESCAPE); if(pos > 0) { ha_bufjoin(buf); ha_bufncpy(buf, t, pos); t += pos; } while(*t && !strchr(LDAP_NO_ESCAPE, *t)) { char hex[4]; hex[0] = '\\'; hex[1] = LDAP_HEX[*t >> 4 & 0xf]; hex[2] = LDAP_HEX[*t & 0xf]; hex[3] = '\0'; ha_bufjoin(buf); ha_bufcpy(buf, hex); t++; } } } static const char* make_password_md5(ha_buffer_t* buf, const char* clearpw) { md5_ctx_t md5; unsigned char digest[MD5_LEN]; ASSERT(buf && clearpw); md5_init(&md5); md5_update(&md5, clearpw, strlen(clearpw)); md5_final(digest, &md5); return ha_bufenc64(buf, digest, MD5_LEN); } static const char* make_password_sha(ha_buffer_t* buf, const char* clearpw) { sha1_ctx_t sha; unsigned char digest[SHA1_LEN]; ASSERT(buf && clearpw); sha1_init(&sha); sha1_update(&sha, clearpw, strlen(clearpw)); sha1_final(digest, &sha); return ha_bufenc64(buf, digest, SHA1_LEN); } static int parse_ldap_password(const char** password) { const char* pw; const char* scheme; int i; ASSERT(password && *password); pw = *password; /* zero length passwords are clear */ if(strlen(pw) == 0) return LDAP_PW_CLEAR; /* passwords without a scheme are clear */ if(pw[0] != '{') return LDAP_PW_CLEAR; pw++; scheme = pw; while(*pw && (isalpha(*pw) || isdigit(*pw) || *pw == '-')) pw++; /* scheme should end in a brace */ if(*pw != '}') return LDAP_PW_CLEAR; *password = pw + 1; /* find a scheme in our map */ for(i = 0; i < countof(kLDAPPWTypes); i++) { if(strncasecmp(kLDAPPWTypes[i].name, scheme, pw - scheme) == 0) return kLDAPPWTypes[i].type; } return LDAP_PW_UNKNOWN; } static const char** find_cleartext_password(ha_buffer_t* buf, const char** pws) { ASSERT(buf); for(; pws && *pws; pws++) { if(parse_ldap_password(pws) == LDAP_PW_CLEAR) return pws; } return NULL; } static int parse_ldap_ha1(const ha_request_t* rq, struct berval* bv, unsigned char* ha1) { size_t len; void* d; ASSERT(rq && bv && ha1); /* Raw binary */ if(bv->bv_len == MD5_LEN) { ha_messagex(rq, LOG_DEBUG, "found ha1 in raw binary format"); memcpy(ha1, bv->bv_val, MD5_LEN); return HA_OK; } /* Hex encoded */ else if(bv->bv_len == (MD5_LEN * 2)) { len = MD5_LEN; d = ha_bufdechex(rq->buf, bv->bv_val, &len); if(d && len == MD5_LEN) { ha_messagex(rq, LOG_DEBUG, "found ha1 in hex encoded format"); memcpy(ha1, d, MD5_LEN); return HA_OK; } } /* B64 Encoded */ else { len = MD5_LEN; d = ha_bufdec64(rq->buf, bv->bv_val, &len); if(d && len == MD5_LEN) { ha_messagex(rq, LOG_DEBUG, "found ha1 in b64 encoded format"); memcpy(ha1, ha_bufdata(rq->buf), MD5_LEN); return HA_OK; } } return CHECK_RBUF(rq) ? HA_CRITERROR : HA_FALSE; } static int validate_ldap_password(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld, LDAPMessage* entry, const char* user, const char* clearpw) { char** pws; char** t; const char* pw; const char* p; int type; int res = HA_FALSE; int foundany = 0; ASSERT(entry && ld && ctx && clearpw && rq); ASSERT(ctx->pw_attr); pws = ldap_get_values(ld, entry, ctx->pw_attr); if(pws) { for(t = pws ; *t; t++) { pw = *t; type = parse_ldap_password(&pw); if(type != LDAP_PW_UNKNOWN) foundany = 1; else continue; switch(type) { case LDAP_PW_CLEAR: p = clearpw; break; case LDAP_PW_MD5: p = make_password_md5(rq->buf, clearpw); break; case LDAP_PW_CRYPT: /* Not sure if crypt is thread safe */ ha_lock(NULL); p = (const char*)crypt(clearpw, pw); ha_unlock(NULL); break; case LDAP_PW_SHA: p = make_password_sha(rq->buf, clearpw); break; default: /* Not reached */ ASSERT(0); }; if(!p) { res = HA_CRITERROR; break; } if(strcmp(pw, p) == 0) { ha_messagex(rq, LOG_DEBUG, "successful validate against password"); res = HA_OK; break; } } ldap_value_free(pws); } if(res == HA_FALSE && !foundany) ha_messagex(rq, LOG_ERR, "server does not contain any compatible passwords for user: %s", user); return res; } static int validate_ldap_ha1(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld, LDAPMessage* entry, const char* user, const char* realm, const char* clearpw) { struct berval** ha1s; struct berval** b; unsigned char key[MD5_LEN]; unsigned char k[MD5_LEN]; int r, first = 1; int res = HA_FALSE; ASSERT(ctx && ld && entry && rq && user && clearpw); if(!ctx->ha1_attr) return HA_FALSE; ha1s = ldap_get_values_len(ld, entry, ctx->ha1_attr); if(ha1s) { digest_makeha1(key, user, realm, clearpw); for(b = ha1s ; *b; b++) { r = parse_ldap_ha1(rq, *b, k); if(r < 0) { res = r; break; } if(r == HA_FALSE) { if(first) ha_messagex(rq, LOG_ERR, "server contains invalid HA1 digest hash for user: %s", user); first = 0; continue; } if(memcmp(key, k, MD5_LEN) == 0) { ha_messagex(rq, LOG_DEBUG, "successful validate against ha1"); res = HA_OK; break; } } ldap_value_free_len(ha1s); } return res; } static LDAP* get_ldap_connection(const ha_request_t* rq, ldap_context_t* ctx) { LDAP* ld = NULL; int i, r, create = 1; ASSERT(ctx); /* * Note that below there maybe a race condition between the two locks * but this will only allow a few extra connections to open at best * and as such really isn't a big issue. */ ha_lock(NULL); for(i = 0; i < ctx->ldap_max; i++) { /* An open connection in the pool */ if(ctx->pool[i]) { ha_messagex(rq, LOG_DEBUG, "using cached LDAP connection"); ld = ctx->pool[i]; ctx->pool[i] = NULL; break; } } if(ld == NULL && ctx->pool_mark >= ctx->ldap_max) { ha_messagex(rq, LOG_ERR, "too many open LDAP connections"); create = 0; } ha_unlock(NULL); if(ld != NULL || create == 0) return ld; ld = ldap_init(ctx->servers, ctx->port); if(!ld) { ha_message(rq, LOG_ERR, "couldn't initialize LDAP connection"); return NULL; } if(ctx->user || ctx->password) { r = ldap_simple_bind_s(ld, ctx->user ? ctx->user : "", ctx->password ? ctx->password : ""); if(r != LDAP_SUCCESS) { report_ldap(rq, "couldn't bind to LDAP server", r); ldap_unbind_s(ld); return NULL; } } ha_lock(NULL); ctx->pool_mark++; ha_messagex(rq, LOG_DEBUG, "opened new connection (total %d)", ctx->pool_mark); ha_unlock(NULL); return ld; } static void discard_ldap_connection(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld) { ldap_unbind_s(ld); ha_lock(NULL); ctx->pool_mark--; ha_messagex(rq, LOG_DEBUG, "discarding connection (total %d)", ctx->pool_mark); ha_unlock(NULL); } static void save_ldap_connection(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld) { int i, e; ASSERT(ctx); if(!ld) return; ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &e); /* Make sure it's worth saving */ switch(e) { case LDAP_SERVER_DOWN: case LDAP_LOCAL_ERROR: case LDAP_NO_MEMORY: break; default: ha_lock(NULL); for(i = 0; i < ctx->ldap_max; i++) { /* An open connection in the pool */ if(!ctx->pool[i]) { ha_messagex(rq, LOG_DEBUG, "caching ldap connection for later use"); ctx->pool[i] = ld; ld = NULL; break; } } ha_unlock(NULL); break; }; if(ld != NULL) discard_ldap_connection(rq, ctx, ld); } static int retrieve_user_entry(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld, const char* user, const char** dn, LDAPMessage** entry, LDAPMessage** result) { struct timeval tv; const char* filter; const char* attrs[3]; const char* base; int scope; int r; ASSERT(ctx && rq && ld && user && dn && entry && result); if(ctx->filter) { /* Filters can also have %u and %r */ filter = bd_substitute(rq, user, ctx->filter); if(!filter) return HA_CRITERROR; } else { filter = "(objectClass=*)"; } attrs[0] = ctx->dobind ? NULL : ctx->pw_attr; attrs[1] = ctx->dobind ? NULL : ctx->ha1_attr; attrs[2] = NULL; tv.tv_sec = ctx->ldap_timeout; tv.tv_usec = 0; base = *dn ? *dn : ctx->base; scope = *dn ? LDAP_SCOPE_BASE : ctx->scope; ha_messagex(rq, LOG_DEBUG, "performing search: [ base: %s / scope: %d / filter: %s ]", base, scope, filter); r = ldap_search_st(ld, base, scope, filter, (char**)attrs, 0, &tv, result); if(r != LDAP_SUCCESS) { if(r == LDAP_NO_SUCH_OBJECT) { ha_messagex(rq, LOG_WARNING, "user not found in %s", user); return HA_FALSE; } return report_ldap(rq, "couldn't search LDAP server", r); } /* Only one result should exist */ switch(r = ldap_count_entries(ld, *result)) { case 1: *entry = ldap_first_entry(ld, *result); if(!(*dn)) { *dn = ldap_get_dn(ld, *entry); ha_messagex(rq, LOG_DEBUG, "found entry for user: %s", *dn); } return HA_OK; case 0: ha_messagex(rq, LOG_WARNING, "user not found in %s", user); break; default: ha_messagex(rq, LOG_WARNING, "more than one user found for filter: %s", filter); break; }; return HA_FALSE; } static int validate_digest(ha_request_t* rq, const char* user, digest_context_t* dg) { ldap_context_t* ctx = (ldap_context_t*)rq->context->ctx_data; LDAP* ld = NULL; /* freed in finally */ LDAPMessage* results = NULL; /* freed in finally */ LDAPMessage* entry = NULL; /* no need to free */ struct berval** ha1s = NULL; /* freed in finally */ const char** pws = NULL; /* freed in finally */ int ret = HA_FALSE; const char* dn = NULL; int r; int foundany = 0; ASSERT(rq && dg && user); ld = get_ldap_connection(rq, ctx); if(!ld) RETURN(HA_FAILED); /* * Discover the DN of the user. If there's a DN map string * then we can do this really quickly here without querying * the LDAP tree */ if(ctx->dnmap) { /* The map can have %u and %r to denote user and realm */ dn = bd_substitute(rq, user, ctx->dnmap); if(!dn) RETURN(HA_CRITERROR); ha_messagex(rq, LOG_INFO, "mapped %s to %s", user, dn); } /* Okay now we contact the LDAP server. */ r = retrieve_user_entry(rq, ctx, ld, user, &dn, &entry, &results); if(r != HA_OK) RETURN(r); /* Figure out the users ha1 */ if(ctx->ha1_attr) ha1s = ldap_get_values_len(ld, entry, ctx->ha1_attr); if(ha1s && *ha1s) { int foundinvalid = 0; struct berval** h = NULL; for(h = ha1s; *h; ++h) { r = parse_ldap_ha1(rq, *h, dg->ha1); if(r == HA_FALSE) { foundinvalid = 1; } else if(r == HA_OK) { foundany = 1; /* Run the actual check */ ret = digest_complete_check(dg, rq->context, rq->buf); if(ret != HA_FALSE) RETURN(ret); } else if(r < 0) RETURN(r); } if(foundinvalid) ha_messagex(rq, LOG_ERR, "server contains invalid HA1 for user: %s", user); } /* If no ha1 set or none found, use password and make a HA1 */ pws = (const char**)ldap_get_values(ld, entry, ctx->pw_attr); if(pws && *pws) { const char** p = pws; /* Find a cleartext password */ while((p = find_cleartext_password(rq->buf, p))) { foundany = 1; digest_makeha1(dg->ha1, user, rq->context->realm, *p); /* Run the actual check */ ret = digest_complete_check(dg, rq->context, rq->buf); if(ret != HA_FALSE) RETURN(ret); p++; } } if(!foundany) ha_messagex(rq, LOG_WARNING, "server contains no clear password or HA1 for user: %s", user); finally: if(ha1s) ldap_value_free_len(ha1s); if(pws) ldap_value_free((char**)pws); if(results) ldap_msgfree(results); if(ld) save_ldap_connection(rq, ctx, ld); return ret; } static int validate_basic(ha_request_t* rq, const char* user, const char* password) { ldap_context_t* ctx = (ldap_context_t*)rq->context->ctx_data; LDAP* ld = NULL; LDAPMessage* entry = NULL; LDAPMessage* results = NULL; const char* dn = NULL; int ret = HA_FALSE; int found = 0; int r; ASSERT(rq && user && password); ld = get_ldap_connection(rq, ctx); if(!ld) RETURN(HA_FAILED); /* * Discover the DN of the user. If there's a DN map string * then we can do this really quickly here without querying * the LDAP tree */ if(ctx->dnmap) { /* The map can have %u and %r to denote user and realm */ dn = bd_substitute(rq, user, ctx->dnmap); if(!dn) RETURN(HA_CRITERROR); ha_messagex(rq, LOG_INFO, "mapped %s to %s", user, dn); } /** * Okay now we contact the LDAP server. There are many ways * this is used for different authentication modes: * * - If a dn has been mapped above, this can apply a * configured filter to narrow things down. * - If no dn has been mapped, then this maps out a dn * by using the single object the filter returns. * - If not in 'dobind' mode we also retrieve the password * here. * * All this results in only one query to the LDAP server, * except for the case of dobind without a dnmap. */ if(!ctx->dobind || !dn || ctx->filter) { r = retrieve_user_entry(rq, ctx, ld, user, &dn, &entry, &results); if(r != HA_OK) RETURN(r); } /* Now if in bind mode we try to bind as that user */ if(ctx->dobind) { ASSERT(dn); r = ldap_simple_bind_s(ld, dn, password); if(r != LDAP_SUCCESS) { if(r == LDAP_INVALID_CREDENTIALS) { ha_messagex(rq, LOG_WARNING, "basic authentication (via bind) failed for user: %s", user); RETURN(HA_FALSE); } else { report_ldap(rq, "couldn't bind to LDAP server", r); RETURN(HA_FAILED); } } /* It worked! */ ha_messagex(rq, LOG_NOTICE, "validated basic user using bind: %s", user); found = 1; /* Now we have to rebind the connection back to the main user */ r = ldap_simple_bind_s(ld, ctx->user ? ctx->user : "", ctx->password ? ctx->password : ""); if(r != LDAP_SUCCESS) { report_ldap(rq, "couldn't rebind LDAP connection back to auth credentials", r); /* Discard the connection since it's useless to us */ discard_ldap_connection(rq, ctx, ld); ld = NULL; } } /* Otherwise we compare the password attribute */ else { ret = validate_ldap_password(rq, ctx, ld, entry, user, password); if(ret == HA_FALSE) ret = validate_ldap_ha1(rq, ctx, ld, entry, user, rq->context->realm, password); if(ret == HA_OK) { ha_messagex(rq, LOG_NOTICE, "validated basic user password/ha1: %s", user); found = 1; } else { ha_messagex(rq, LOG_WARNING, "invalid, unreadable or unrecognized password for user: %s", user); } } finally: if(results) ldap_msgfree(results); if(ld) save_ldap_connection(rq, ctx, ld); return ret; } /* ------------------------------------------------------------------------------- * Handler Functions */ int ldap_config(ha_context_t* context, const char* name, const char* value) { ldap_context_t* ctx = (ldap_context_t*)(context->ctx_data); ASSERT(name && value && value[0]); if(strcmp(name, "ldapservers") == 0) { ctx->servers = value; return HA_OK; } else if(strcmp(name, "ldapfilter") == 0) { ctx->filter = value; return HA_OK; } else if(strcmp(name, "ldapbase") == 0) { ctx->base = value; return HA_OK; } else if(strcmp(name, "ldappwattr") == 0) { ctx->pw_attr = value; return HA_OK; } else if(strcmp(name, "ldapha1attr") == 0) { ctx->ha1_attr = value; return HA_OK; } else if(strcmp(name, "ldapuser") == 0) { ctx->user = value; return HA_OK; } else if(strcmp(name, "ldappassword") == 0) { ctx->password = value; return HA_OK; } else if(strcmp(name, "ldapdnmap") == 0) { ctx->dnmap = value; return HA_OK; } else if(strcmp(name, "ldapscope") == 0) { if(strcmp(value, "sub") == 0 || strcmp(value, "subtree") == 0) ctx->scope = LDAP_SCOPE_SUBTREE; else if(strcmp(value, "base") == 0) ctx->scope = LDAP_SCOPE_BASE; else if(strcmp(value, "one") == 0 || strcmp(value, "onelevel") == 0) ctx->scope = LDAP_SCOPE_ONELEVEL; else { ha_messagex(NULL, LOG_ERR, "invalid value for '%s' (must be 'sub', 'base' or 'one')", name); return HA_FAILED; } return HA_OK; } else if(strcmp(name, "ldapdobind") == 0) { return ha_confbool(name, value, &(ctx->dobind)); } else if(strcmp(name, "ldapmax") == 0) { return ha_confint(name, value, 1, 256, &(ctx->ldap_max)); } else if(strcmp(name, "ldaptimeout") == 0) { return ha_confint(name, value, 0, 86400, &(ctx->ldap_timeout)); } return HA_FALSE; } int ldap_inithand(ha_context_t* context) { int r; if((r = bd_init(context)) != HA_OK) return r; /* Context specific initialization */ if(context) { ldap_context_t* ctx = (ldap_context_t*)(context->ctx_data); ASSERT(ctx); /* Check for mandatory configuration */ if(!ctx->servers) { ha_messagex(NULL, LOG_ERR, "configuration incomplete. " "Must have LDAPServers."); return HA_FAILED; } if(!ctx->dnmap && (!ctx->filter || !ctx->base)) { ha_messagex(NULL, LOG_ERR, "configuration incomplete. " "When not using LDAPDNMap must specify LDAPBase and LDAPFilter."); return HA_FAILED; } ASSERT(!ctx->pool); ASSERT(ctx->ldap_max > 0); /* * Our connection pool. It's the size of our maximum * amount of pending connections as that's the max * we'd be able to use at a time anyway. */ ctx->pool = (LDAP**)malloc(sizeof(LDAP*) * ctx->ldap_max); if(!ctx->pool) { ha_memerr(NULL); return HA_CRITERROR; } memset(ctx->pool, 0, sizeof(LDAP*) * ctx->ldap_max); ha_messagex(NULL, LOG_INFO, "initialized ldap handler"); } return HA_OK; } void ldap_destroy(ha_context_t* context) { if(context) { /* Note: We don't need to be thread safe here anymore */ ldap_context_t* ctx = (ldap_context_t*)(context->ctx_data); int i; ASSERT(ctx); if(ctx->pool) { /* Close any connections we have open */ for(i = 0; i < ctx->ldap_max; i++) { if(ctx->pool[i]) ldap_unbind_s(ctx->pool[i]); } /* And free the connection pool */ free(ctx->pool); } } bd_destroy(context); ha_messagex(NULL, LOG_INFO, "uninitialized ldap handler"); } /* ------------------------------------------------------------------------------- * Handler Definition */ ha_handler_t ldap_handler = { "LDAP", /* The type */ ldap_inithand, /* Initialization function */ ldap_destroy, /* Uninitialization routine */ ldap_config, /* Config routine */ bd_process, /* Processing routine */ &ldap_defaults, /* The context defaults */ sizeof(ldap_context_t) };