support_ldap.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/*
10 * -----------------------------------------------------------------------------
11 *
12 * Author: Markus Moeller (markus_moeller at compuserve.com)
13 *
14 * Copyright (C) 2007 Markus Moeller. All rights reserved.
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, write to the Free Software
28 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
29 *
30 * -----------------------------------------------------------------------------
31 */
32
33/* get_attributes is partly from OpenLDAP Software <http://www.openldap.org/>.
34 *
35 * Copyright 1998-2009 The OpenLDAP Foundation.
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted only as authorized by the OpenLDAP
40 * Public License.
41 *
42 * A copy of this license is available in the file LICENSE in the
43 * top-level directory of the distribution or, alternatively, at
44 * <http://www.OpenLDAP.org/license.html>.
45 */
46
47#include "squid.h"
48#include "util.h"
49
50#if HAVE_LDAP
51
52#include "support.h"
53#include <cerrno>
54
55char *convert_domain_to_bind_path(char *domain);
56char *escape_filter(char *filter);
57int check_AD(struct main_args *margs, LDAP * ld);
58int ldap_set_defaults(LDAP * ld);
59int ldap_set_ssl_defaults(struct main_args *margs);
60LDAP *tool_ldap_open(struct main_args *margs, char *host, int port, char *ssl);
61
62#define CONNECT_TIMEOUT 2
63#define SEARCH_TIMEOUT 30
64
65#define FILTER "(memberuid=%s)"
66#define ATTRIBUTE "cn"
67#define ATTRIBUTE_DN "distinguishedName"
68#define FILTER_UID "(uid=%s)"
69#define FILTER_GID "(&(gidNumber=%s)(objectclass=posixgroup))"
70#define ATTRIBUTE_GID "gidNumber"
71#define ATTRIBUTE_GID_AD "primaryGroupID"
72#define ATTRIBUTE_SID "objectSID"
73
74#define FILTER_AD "(samaccountname=%s)"
75#define ATTRIBUTE_AD "memberof"
76
77size_t get_attributes(LDAP * ld, LDAPMessage * res,
78 const char *attribute /* IN */, char ***out_val /* OUT (caller frees) */ );
79size_t get_bin_attributes(LDAP * ld, LDAPMessage * res,
80 const char *attribute /* IN */, char ***out_val,
81 int **out_len /* OUT (caller frees) */ );
82int search_group_tree(struct main_args *margs, LDAP * ld, char *bindp,
83 char *ldap_group, char *group, int depth);
84
85#if HAVE_SUN_LDAP_SDK || HAVE_MOZILLA_LDAP_SDK
86#if HAVE_LDAP_REBINDPROC_CALLBACK
87
88#if HAVE_SASL_H || HAVE_SASL_SASL_H || HAVE_SASL_DARWIN
89static LDAP_REBINDPROC_CALLBACK ldap_sasl_rebind;
90
91static int LDAP_CALL LDAP_CALLBACK
92ldap_sasl_rebind(LDAP * ld,
93 char **whop, char **credp, int *methodp, int freeit, void *params)
94{
95 struct ldap_creds *cp = (struct ldap_creds *) params;
96 whop = whop;
97 credp = credp;
98 methodp = methodp;
99 freeit = freeit;
100 return tool_sasl_bind(ld, cp->dn, cp->pw);
101}
102#endif
103
104static LDAP_REBINDPROC_CALLBACK ldap_simple_rebind;
105
106static int LDAP_CALL LDAP_CALLBACK
107ldap_simple_rebind(LDAP * ld,
108 char **whop, char **credp, int *methodp, int freeit, void *params)
109{
110 struct ldap_creds *cp = (struct ldap_creds *) params;
111 struct berval cred;
112 if (cp->pw) {
113 cred.bv_val = cp->pw;
114 cred.bv_len = strlen(cp->pw);
115 }
116 whop = whop;
117 credp = credp;
118 methodp = methodp;
119 freeit = freeit;
120 return ldap_sasl_bind_s(ld, cp->dn, LDAP_SASL_SIMPLE, &cred, nullptr, nullptr,
121 nullptr);
122}
123#elif HAVE_LDAP_REBIND_PROC
124#if HAVE_SASL_H || HAVE_SASL_SASL_H || HAVE_SASL_DARWIN
125static LDAP_REBIND_PROC ldap_sasl_rebind;
126
127static int
128ldap_sasl_rebind(LDAP * ld,
129 LDAP_CONST char *url, ber_tag_t request, ber_int_t msgid, void *params)
130{
131 struct ldap_creds *cp = (struct ldap_creds *) params;
132 return tool_sasl_bind(ld, cp->dn, cp->pw);
133}
134#endif /* HAVE_SASL_H || HAVE_SASL_SASL_H || HAVE_SASL_DARWIN */
135
136static LDAP_REBIND_PROC ldap_simple_rebind;
137
138static int
139ldap_simple_rebind(LDAP * ld,
140 LDAP_CONST char *url, ber_tag_t request, ber_int_t msgid, void *params)
141{
142 struct ldap_creds *cp = (struct ldap_creds *) params;
143 struct berval cred;
144 if (cp->pw) {
145 cred.bv_val = cp->pw;
146 cred.bv_len = strlen(cp->pw);
147 }
148 return ldap_sasl_bind_s(ld, cp->dn, LDAP_SASL_SIMPLE, &cred, nullptr, nullptr,
149 nullptr);
150}
151
152#elif HAVE_LDAP_REBIND_FUNCTION
153#ifndef LDAP_REFERRALS
154#define LDAP_REFERRALS
155#endif /* LDAP_REFERRALS */
156#if HAVE_SASL_H || HAVE_SASL_SASL_H || HAVE_SASL_DARWIN
157static LDAP_REBIND_FUNCTION ldap_sasl_rebind;
158
159static int
160ldap_sasl_rebind(LDAP * ld,
161 char **whop, char **credp, int *methodp, int freeit, void *params)
162{
163 struct ldap_creds *cp = (struct ldap_creds *) params;
164 whop = whop;
165 credp = credp;
166 methodp = methodp;
167 freeit = freeit;
168 return tool_sasl_bind(ld, cp->dn, cp->pw);
169}
170#endif
171
172static LDAP_REBIND_FUNCTION ldap_simple_rebind;
173
174static int
175ldap_simple_rebind(LDAP * ld,
176 char **whop, char **credp, int *methodp, int freeit, void *params)
177{
178 struct ldap_creds *cp = (struct ldap_creds *) params;
179 struct berval cred;
180 if (cp->pw) {
181 cred.bv_val = cp->pw;
182 cred.bv_len = strlen(cp->pw);
183 }
184 whop = whop;
185 credp = credp;
186 methodp = methodp;
187 freeit = freeit;
188 return ldap_sasl_bind_s(ld, cp->dn, LDAP_SASL_SIMPLE, &cred, nullptr, nullptr,
189 nullptr);
190}
191#else
192#error "No rebind functione defined"
193#endif
194#else /* HAVE_SUN_LDAP_SDK */
195#if HAVE_SASL_H || HAVE_SASL_SASL_H || HAVE_SASL_DARWIN
196static LDAP_REBIND_PROC ldap_sasl_rebind;
197
198static int
199ldap_sasl_rebind(LDAP * ld, LDAP_CONST char *, ber_tag_t,
200 ber_int_t, void *params)
201{
202 struct ldap_creds *cp = (struct ldap_creds *) params;
203 return tool_sasl_bind(ld, cp->dn, cp->pw);
204}
205#endif
206
207static LDAP_REBIND_PROC ldap_simple_rebind;
208
209static int
210ldap_simple_rebind(LDAP * ld, LDAP_CONST char *, ber_tag_t,
211 ber_int_t, void *params)
212{
213
214 struct ldap_creds *cp = (struct ldap_creds *) params;
215 struct berval cred;
216 if (cp->pw) {
217 cred.bv_val = cp->pw;
218 cred.bv_len = strlen(cp->pw);
219 }
220 return ldap_sasl_bind_s(ld, cp->dn, LDAP_SASL_SIMPLE, &cred, nullptr, nullptr,
221 nullptr);
222}
223
224#endif
225char *
226convert_domain_to_bind_path(char *domain)
227{
228 char *dp, *bindp = nullptr, *bp = nullptr;
229 size_t i = 0;
230
231 if (!domain)
232 return nullptr;
233
234 for (dp = domain; *dp; ++dp) {
235 if (*dp == '.')
236 ++i;
237 }
238 /*
239 * add dc= and
240 * replace . with ,dc= => new length = old length + #dots * 3 + 3
241 */
242 bindp = (char *) xmalloc(strlen(domain) + 3 + i * 3 + 1);
243 bp = bindp;
244 strcpy(bp, "dc=");
245 bp += 3;
246 for (dp = domain; *dp; ++dp) {
247 if (*dp == '.') {
248 strcpy(bp, ",dc=");
249 bp += 4;
250 } else {
251 *bp = *dp;
252 ++bp;
253 }
254 }
255 *bp = '\0';
256 return bindp;
257}
258
259char *
260escape_filter(char *filter)
261{
262 char *ldap_filter_esc, *ldf;
263 size_t i;
264
265 i = 0;
266 for (ldap_filter_esc = filter; *ldap_filter_esc; ++ldap_filter_esc) {
267 if ((*ldap_filter_esc == '*') ||
268 (*ldap_filter_esc == '(') ||
269 (*ldap_filter_esc == ')') || (*ldap_filter_esc == '\\'))
270 i = i + 3;
271 }
272
273 ldap_filter_esc = (char *) xcalloc(strlen(filter) + i + 1, sizeof(char));
274 ldf = ldap_filter_esc;
275 for (; *filter; ++filter) {
276 if (*filter == '*') {
277 strcpy(ldf, "\\2a");
278 ldf = ldf + 3;
279 } else if (*filter == '(') {
280 strcpy(ldf, "\\28");
281 ldf = ldf + 3;
282 } else if (*filter == ')') {
283 strcpy(ldf, "\\29");
284 ldf = ldf + 3;
285 } else if (*filter == '\\') {
286 strcpy(ldf, "\\5c");
287 ldf = ldf + 3;
288 } else {
289 *ldf = *filter;
290 ++ldf;
291 }
292 }
293 *ldf = '\0';
294
295 return ldap_filter_esc;
296}
297
298int
299check_AD(struct main_args *margs, LDAP * ld)
300{
301 LDAPMessage *res;
302 char **attr_value = nullptr;
303 struct timeval searchtime;
304 size_t max_attr = 0;
305 int rc = 0;
306
307#define FILTER_SCHEMA "(objectclass=*)"
308#define ATTRIBUTE_SCHEMA "schemaNamingContext"
309#define FILTER_SAM "(ldapdisplayname=samaccountname)"
310
311 searchtime.tv_sec = SEARCH_TIMEOUT;
312 searchtime.tv_usec = 0;
313
314 debug((char *)
315 "%s| %s: DEBUG: Search ldap server with bind path \"\" and filter: %s\n",
316 LogTime(), PROGRAM, FILTER_SCHEMA);
317 rc = ldap_search_ext_s(ld, (char *) "", LDAP_SCOPE_BASE,
318 (char *) FILTER_SCHEMA, nullptr, 0, nullptr, nullptr, &searchtime, 0, &res);
319
320 if (rc == LDAP_SUCCESS)
321 max_attr = get_attributes(ld, res, ATTRIBUTE_SCHEMA, &attr_value);
322
323 if (max_attr == 1) {
324 ldap_msgfree(res);
325 debug((char *)
326 "%s| %s: DEBUG: Search ldap server with bind path %s and filter: %s\n",
327 LogTime(), PROGRAM, attr_value[0], FILTER_SAM);
328 rc = ldap_search_ext_s(ld, attr_value[0], LDAP_SCOPE_SUBTREE,
329 (char *) FILTER_SAM, nullptr, 0, nullptr, nullptr, &searchtime, 0, &res);
330 debug((char *) "%s| %s: DEBUG: Found %d ldap entr%s\n", LogTime(),
331 PROGRAM, ldap_count_entries(ld, res), ldap_count_entries(ld,
332 res) > 1 || ldap_count_entries(ld, res) == 0 ? "ies" : "y");
333 if (ldap_count_entries(ld, res) > 0)
334 margs->AD = 1;
335 } else
336 debug((char *)
337 "%s| %s: DEBUG: Did not find ldap entry for subschemasubentry\n",
338 LogTime(), PROGRAM);
339 debug((char *)
340 "%s| %s: DEBUG: Determined ldap server %sas an Active Directory server\n",
341 LogTime(), PROGRAM, margs->AD ? "" : "not ");
342 /*
343 * Cleanup
344 */
345 if (attr_value) {
346 size_t j;
347 for (j = 0; j < max_attr; ++j) {
348 xfree(attr_value[j]);
349 }
350 safe_free(attr_value);
351 }
352 ldap_msgfree(res);
353 return rc;
354}
355
356int
357search_group_tree(struct main_args *margs, LDAP * ld, char *bindp,
358 char *ldap_group, char *group, int depth)
359{
360 LDAPMessage *res = nullptr;
361 char **attr_value = nullptr;
362 size_t max_attr = 0;
363 char *filter = nullptr;
364 char *search_exp = nullptr;
365 size_t se_len = 0;
366 int rc = 0, retval = 0;
367 int ldepth;
368 char *ldap_filter_esc = nullptr;
369 struct timeval searchtime;
370
371#define FILTER_GROUP_AD "(&(%s)(objectclass=group))"
372#define FILTER_GROUP "(&(memberuid=%s)(objectclass=posixgroup))"
373
374 searchtime.tv_sec = SEARCH_TIMEOUT;
375 searchtime.tv_usec = 0;
376
377 if (margs->AD)
378 filter = (char *) FILTER_GROUP_AD;
379 else
380 filter = (char *) FILTER_GROUP;
381
382 ldap_filter_esc = escape_filter(ldap_group);
383
384 se_len = strlen(filter) + strlen(ldap_filter_esc) + 1;
385 search_exp = (char *) xmalloc(se_len);
386 snprintf(search_exp, se_len, filter, ldap_filter_esc);
387
388 xfree(ldap_filter_esc);
389
390 if (depth > margs->mdepth) {
391 debug((char *) "%s| %s: DEBUG: Max search depth reached %d>%d\n",
392 LogTime(), PROGRAM, depth, margs->mdepth);
393 xfree(search_exp);
394 return 0;
395 }
396 debug((char *)
397 "%s| %s: DEBUG: Search ldap server with bind path %s and filter : %s\n",
398 LogTime(), PROGRAM, bindp, search_exp);
399 rc = ldap_search_ext_s(ld, bindp, LDAP_SCOPE_SUBTREE, search_exp, nullptr, 0,
400 nullptr, nullptr, &searchtime, 0, &res);
401 xfree(search_exp);
402
403 if (rc != LDAP_SUCCESS) {
404 error((char *) "%s| %s: ERROR: Error searching ldap server: %s\n",
405 LogTime(), PROGRAM, ldap_err2string(rc));
406 return 0;
407 }
408 debug((char *) "%s| %s: DEBUG: Found %d ldap entr%s\n", LogTime(), PROGRAM,
409 ldap_count_entries(ld, res), ldap_count_entries(ld, res) > 1
410 || ldap_count_entries(ld, res) == 0 ? "ies" : "y");
411
412 if (margs->AD)
413 max_attr = get_attributes(ld, res, ATTRIBUTE_AD, &attr_value);
414 else
415 max_attr = get_attributes(ld, res, ATTRIBUTE, &attr_value);
416
417 /*
418 * Compare group names
419 */
420 retval = 0;
421 ldepth = depth + 1;
422 for (size_t j = 0; j < max_attr; ++j) {
423 char *av = nullptr;
424
425 /* Compare first CN= value assuming it is the same as the group name itself */
426 av = attr_value[j];
427 if (!strncasecmp("CN=", av, 3)) {
428 char *avp = nullptr;
429 av += 3;
430 if ((avp = strchr(av, ','))) {
431 *avp = '\0';
432 }
433 }
434 if (debug_enabled) {
435 int n;
436 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" in hex UTF-8 is ", LogTime(), PROGRAM, j + 1, av);
437 for (n = 0; av[n] != '\0'; ++n)
438 fprintf(stderr, "%02x", (unsigned char) av[n]);
439 fprintf(stderr, "\n");
440 }
441 if (!strcasecmp(group, av)) {
442 retval = 1;
443 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" matches group name \"%s\"\n", LogTime(), PROGRAM,
444 j + 1, av, group);
445 break;
446 } else
447 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" does not match group name \"%s\"\n", LogTime(),
448 PROGRAM, j + 1, av, group);
449 /*
450 * Do recursive group search
451 */
452 debug((char *)
453 "%s| %s: DEBUG: Perform recursive group search for group \"%s\"\n",
454 LogTime(), PROGRAM, av);
455 av = attr_value[j];
456 if (search_group_tree(margs, ld, bindp, av, group, ldepth)) {
457 retval = 1;
458 if (!strncasecmp("CN=", av, 3)) {
459 char *avp = nullptr;
460 av += 3;
461 if ((avp = strchr(av, ','))) {
462 *avp = '\0';
463 }
464 }
465 if (debug_enabled)
466 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" is member of group named \"%s\"\n", LogTime(),
467 PROGRAM, j + 1, av, group);
468 else
469 break;
470
471 }
472 }
473
474 /*
475 * Cleanup
476 */
477 if (attr_value) {
478 for (size_t j = 0; j < max_attr; ++j) {
479 xfree(attr_value[j]);
480 }
481 safe_free(attr_value);
482 }
483 ldap_msgfree(res);
484
485 return retval;
486}
487
488int
489ldap_set_defaults(LDAP * ld)
490{
491 int val, rc = 0;
492#if LDAP_OPT_NETWORK_TIMEOUT
493 struct timeval tv;
494#endif
495 val = LDAP_VERSION3;
496 rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val);
497 if (rc != LDAP_SUCCESS) {
498 debug((char *)
499 "%s| %s: DEBUG: Error while setting protocol version: %s\n",
500 LogTime(), PROGRAM, ldap_err2string(rc));
501 return rc;
502 }
503 rc = ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
504 if (rc != LDAP_SUCCESS) {
505 debug((char *) "%s| %s: DEBUG: Error while setting referrals off: %s\n",
506 LogTime(), PROGRAM, ldap_err2string(rc));
507 return rc;
508 }
509#if LDAP_OPT_NETWORK_TIMEOUT
510 tv.tv_sec = CONNECT_TIMEOUT;
511 tv.tv_usec = 0;
512 rc = ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
513 if (rc != LDAP_SUCCESS) {
514 debug((char *)
515 "%s| %s: DEBUG: Error while setting network timeout: %s\n",
516 LogTime(), PROGRAM, ldap_err2string(rc));
517 return rc;
518 }
519#endif /* LDAP_OPT_NETWORK_TIMEOUT */
520 return LDAP_SUCCESS;
521}
522
523int
524ldap_set_ssl_defaults(struct main_args *margs)
525{
526#if HAVE_OPENLDAP || HAVE_LDAPSSL_CLIENT_INIT
527 int rc = 0;
528#endif
529#if HAVE_OPENLDAP
530 int val;
531#elif HAVE_LDAPSSL_CLIENT_INIT
532 char *ssl_certdbpath = nullptr;
533#endif
534
535#if HAVE_OPENLDAP
536 if (!margs->rc_allow) {
537 char *ssl_cacertfile = nullptr;
538 char *ssl_cacertdir = nullptr;
539 debug((char *)
540 "%s| %s: DEBUG: Enable server certificate check for ldap server.\n",
541 LogTime(), PROGRAM);
542 val = LDAP_OPT_X_TLS_DEMAND;
543 rc = ldap_set_option(nullptr, LDAP_OPT_X_TLS_REQUIRE_CERT, &val);
544 if (rc != LDAP_SUCCESS) {
545 error((char *)
546 "%s| %s: ERROR: Error while setting LDAP_OPT_X_TLS_REQUIRE_CERT DEMAND for ldap server: %s\n",
547 LogTime(), PROGRAM, ldap_err2string(rc));
548 return rc;
549 }
550 ssl_cacertfile = xstrdup(getenv("TLS_CACERTFILE"));
551 if (!ssl_cacertfile) {
552 ssl_cacertfile = xstrdup("/etc/ssl/certs/cert.pem");
553 }
554 if (access(ssl_cacertfile, R_OK) == 0) {
555 debug((char *)
556 "%s| %s: DEBUG: Set certificate file for ldap server to %s. (Changeable through setting environment variable TLS_CACERTFILE)\n",
557 LogTime(), PROGRAM, ssl_cacertfile);
558 rc = ldap_set_option(nullptr, LDAP_OPT_X_TLS_CACERTFILE,
559 ssl_cacertfile);
560 xfree(ssl_cacertfile);
561 if (rc != LDAP_OPT_SUCCESS) {
562 error((char *)
563 "%s| %s: ERROR: Error while setting LDAP_OPT_X_TLS_CACERTFILE for ldap server: %s\n",
564 LogTime(), PROGRAM, ldap_err2string(rc));
565 return rc;
566 }
567 } else {
568 debug((char *)
569 "%s| %s: DEBUG: Set certificate file for ldap server to %s failed (%s). (Changeable through setting environment variable TLS_CACERTFILE) Trying db certificate directory\n",
570 LogTime(), PROGRAM, ssl_cacertfile, strerror(errno));
571 xfree(ssl_cacertfile);
572 ssl_cacertdir = xstrdup(getenv("TLS_CACERTDIR"));
573 if (!ssl_cacertdir) {
574 ssl_cacertdir = xstrdup("/etc/ssl/certs");
575 }
576 if (access(ssl_cacertdir, R_OK) == 0) {
577 debug((char *)
578 "%s| %s: DEBUG: Set certificate database path for ldap server to %s. (Changeable through setting environment variable TLS_CACERTDIR)\n",
579 LogTime(), PROGRAM, ssl_cacertdir);
580 rc = ldap_set_option(nullptr, LDAP_OPT_X_TLS_CACERTDIR,
581 ssl_cacertdir);
582 xfree(ssl_cacertdir);
583 if (rc != LDAP_OPT_SUCCESS) {
584 error((char *)
585 "%s| %s: ERROR: Error while setting LDAP_OPT_X_TLS_CACERTDIR for ldap server: %s\n",
586 LogTime(), PROGRAM, ldap_err2string(rc));
587 return rc;
588 }
589 } else {
590 debug((char *)
591 "%s| %s: DEBUG: Set certificate database path for ldap server to %s failed (%s). (Changeable through setting environment variable TLS_CACERTDIR)\n",
592 LogTime(), PROGRAM, ssl_cacertdir, strerror(errno));
593 xfree(ssl_cacertdir);
594 return errno;
595 }
596 }
597 } else {
598 debug((char *)
599 "%s| %s: DEBUG: Disable server certificate check for ldap server.\n",
600 LogTime(), PROGRAM);
601 val = LDAP_OPT_X_TLS_ALLOW;
602 rc = ldap_set_option(nullptr, LDAP_OPT_X_TLS_REQUIRE_CERT, &val);
603 if (rc != LDAP_SUCCESS) {
604 error((char *)
605 "%s| %s: ERROR: Error while setting LDAP_OPT_X_TLS_REQUIRE_CERT ALLOW for ldap server: %s\n",
606 LogTime(), PROGRAM, ldap_err2string(rc));
607 return rc;
608 }
609 }
610#elif HAVE_LDAPSSL_CLIENT_INIT
611 /*
612 * Solaris SSL ldap calls require path to certificate database
613 */
614 /*
615 * rc = ldapssl_client_init( ssl_certdbpath, nullptr);
616 * rc = ldapssl_advclientauth_init( ssl_certdbpath, nullptr, 0 , nullptr, nullptr, 0, nullptr, 2);
617 */
618 ssl_certdbpath = getenv("SSL_CERTDBPATH");
619 if (!ssl_certdbpath) {
620 ssl_certdbpath = xstrdup("/etc/certs");
621 }
622 debug((char *)
623 "%s| %s: DEBUG: Set certificate database path for ldap server to %s. (Changeable through setting environment variable SSL_CERTDBPATH)\n",
624 LogTime(), PROGRAM, ssl_certdbpath);
625 if (!margs->rc_allow) {
626 rc = ldapssl_advclientauth_init(ssl_certdbpath, nullptr, 0, nullptr, nullptr, 0,
627 nullptr, 2);
628 } else {
629 rc = ldapssl_advclientauth_init(ssl_certdbpath, nullptr, 0, nullptr, nullptr, 0,
630 nullptr, 0);
631 debug((char *)
632 "%s| %s: DEBUG: Disable server certificate check for ldap server.\n",
633 LogTime(), PROGRAM);
634 }
635 xfree(ssl_certdbpath);
636 if (rc != LDAP_SUCCESS) {
637 error((char *)
638 "%s| %s: ERROR: Error while setting SSL for ldap server: %s\n",
639 LogTime(), PROGRAM, ldapssl_err2string(rc));
640 return rc;
641 }
642#else
643 (void)margs;
644 error((char *) "%s| %s: ERROR: SSL not supported by ldap library\n",
645 LogTime(), PROGRAM);
646#endif
647 return LDAP_SUCCESS;
648}
649
650size_t
651get_attributes(LDAP * ld, LDAPMessage * res, const char *attribute,
652 char ***ret_value)
653{
654
655 char **attr_value = *ret_value;
656 size_t max_attr = 0;
657
658 /*
659 * loop over attributes
660 */
661 debug((char *) "%s| %s: DEBUG: Search ldap entries for attribute : %s\n",
662 LogTime(), PROGRAM, attribute);
663 for (LDAPMessage * msg = ldap_first_entry(ld, res); msg;
664 msg = ldap_next_entry(ld, msg)) {
665
666 switch (ldap_msgtype(msg)) {
667
668 case LDAP_RES_SEARCH_ENTRY: {
669 BerElement *b = nullptr;
670 for (char *attr = ldap_first_attribute(ld, msg, &b); attr;
671 attr = ldap_next_attribute(ld, msg, b)) {
672 if (strcasecmp(attr, attribute) == 0) {
673 struct berval **values;
674
675 if ((values =
676 ldap_get_values_len(ld, msg, attr)) != nullptr) {
677 for (int il = 0; values[il] != nullptr; ++il) {
678
679 attr_value =
680 (char **) xrealloc(attr_value,
681 (max_attr + 1) * sizeof(char *));
682 if (!attr_value)
683 break;
684
685 attr_value[max_attr] =
686 (char *) xmalloc(values[il]->bv_len + 1);
687 memcpy(attr_value[max_attr], values[il]->bv_val,
688 values[il]->bv_len);
689 attr_value[max_attr][values[il]->bv_len] = 0;
690 max_attr++;
691 }
692 }
693 ber_bvecfree(values);
694 }
695 ldap_memfree(attr);
696 }
697 ber_free(b, 0);
698 }
699 break;
700 case LDAP_RES_SEARCH_REFERENCE:
701 debug((char *)
702 "%s| %s: DEBUG: Received a search reference message\n",
703 LogTime(), PROGRAM);
704 break;
705 case LDAP_RES_SEARCH_RESULT:
706 debug((char *) "%s| %s: DEBUG: Received a search result message\n",
707 LogTime(), PROGRAM);
708 break;
709 default:
710 break;
711 }
712 }
713
714 debug((char *) "%s| %s: DEBUG: %zu ldap entr%s found with attribute : %s\n", LogTime(), PROGRAM,
715 max_attr, max_attr > 1 || max_attr == 0 ? "ies" : "y", attribute);
716
717 *ret_value = attr_value;
718 return max_attr;
719}
720
721size_t
722get_bin_attributes(LDAP * ld, LDAPMessage * res, const char *attribute,
723 char ***ret_value, int **ret_len)
724{
725
726 char **attr_value = *ret_value;
727 int *attr_len = *ret_len;
728 size_t max_attr = 0;
729
730 /*
731 * loop over attributes
732 */
733 debug((char *) "%s| %s: DEBUG: Search ldap entries for attribute : %s\n",
734 LogTime(), PROGRAM, attribute);
735 for (LDAPMessage * msg = ldap_first_entry(ld, res); msg;
736 msg = ldap_next_entry(ld, msg)) {
737
738 switch (ldap_msgtype(msg)) {
739
740 case LDAP_RES_SEARCH_ENTRY: {
741 BerElement *b = nullptr;
742 for (char *attr = ldap_first_attribute(ld, msg, &b); attr;
743 attr = ldap_next_attribute(ld, msg, b)) {
744 if (strcasecmp(attr, attribute) == 0) {
745 struct berval **values;
746
747 if ((values =
748 ldap_get_values_len(ld, msg, attr)) != nullptr) {
749 for (int il = 0; values[il] != nullptr; ++il) {
750
751 attr_value =
752 (char **) xrealloc(attr_value,
753 (max_attr + 1) * sizeof(char *));
754 if (!attr_value)
755 break;
756
757 attr_len =
758 (int *) xrealloc(attr_len,
759 (max_attr + 1) * sizeof(int));
760 if (!attr_len)
761 break;
762
763 attr_value[max_attr] =
764 (char *) xmalloc(values[il]->bv_len + 1);
765 memcpy(attr_value[max_attr], values[il]->bv_val,
766 values[il]->bv_len);
767 attr_value[max_attr][values[il]->bv_len] = 0;
768 attr_len[max_attr] = values[il]->bv_len;
769 max_attr++;
770 }
771 }
772 ber_bvecfree(values);
773 }
774 ldap_memfree(attr);
775 }
776 ber_free(b, 0);
777 }
778 break;
779 case LDAP_RES_SEARCH_REFERENCE:
780 debug((char *)
781 "%s| %s: DEBUG: Received a search reference message\n",
782 LogTime(), PROGRAM);
783 break;
784 case LDAP_RES_SEARCH_RESULT:
785 debug((char *) "%s| %s: DEBUG: Received a search result message\n",
786 LogTime(), PROGRAM);
787 break;
788 default:
789 break;
790 }
791 }
792
793 debug((char *) "%s| %s: DEBUG: %zu ldap entr%s found with attribute : %s\n", LogTime(), PROGRAM,
794 max_attr, max_attr > 1 || max_attr == 0 ? "ies" : "y", attribute);
795
796 *ret_value = attr_value;
797 *ret_len = attr_len;
798 return max_attr;
799}
800
801/*
802 * call to open ldap server with or without SSL
803 */
804LDAP *
805tool_ldap_open(struct main_args * margs, char *host, int port, char *ssl)
806{
807 LDAP *ld;
808#if HAVE_OPENLDAP
809 LDAPURLDesc *url = nullptr;
810 char *ldapuri = nullptr;
811#endif
812 int rc = 0;
813
814 /*
815 * Use ldap open here to check if TCP connection is possible. If possible use it.
816 * (Not sure if this is the best way)
817 */
818#if HAVE_OPENLDAP
819 url = (LDAPURLDesc *) xmalloc(sizeof(*url));
820 memset(url, 0, sizeof(*url));
821#if HAVE_LDAP_URL_LUD_SCHEME
822 if (ssl)
823 url->lud_scheme = xstrdup("ldaps");
824 else
825 url->lud_scheme = xstrdup("ldap");
826#endif
827 url->lud_host = xstrdup(host);
828 url->lud_port = port;
829#if HAVE_LDAP_SCOPE_DEFAULT
830 url->lud_scope = LDAP_SCOPE_DEFAULT;
831#else
832 url->lud_scope = LDAP_SCOPE_SUBTREE;
833#endif
834#if HAVE_LDAP_URL_DESC2STR
835 ldapuri = ldap_url_desc2str(url);
836#elif HAVE_LDAP_URL_PARSE
837 rc = ldap_url_parse(ldapuri, &url);
838 if (rc != LDAP_SUCCESS) {
839 error((char *) "%s| %s: ERROR: Error while parsing url: %s\n",
840 LogTime(), PROGRAM, ldap_err2string(rc));
841 xfree(ldapuri);
842 ldap_free_urldesc(url);
843 return nullptr;
844 }
845#else
846#error "No URL parsing function"
847#endif
848 ldap_free_urldesc(url);
849 rc = ldap_initialize(&ld, ldapuri);
850 xfree(ldapuri);
851 if (rc != LDAP_SUCCESS) {
852 error((char *)
853 "%s| %s: ERROR: Error while initialising connection to ldap server: %s\n",
854 LogTime(), PROGRAM, ldap_err2string(rc));
855 ldap_unbind_ext(ld, nullptr, nullptr);
856 ld = nullptr;
857 return nullptr;
858 }
859#else
860 ld = ldap_init(host, port);
861#endif
862 rc = ldap_set_defaults(ld);
863 if (rc != LDAP_SUCCESS) {
864 error((char *)
865 "%s| %s: ERROR: Error while setting default options for ldap server: %s\n",
866 LogTime(), PROGRAM, ldap_err2string(rc));
867 ldap_unbind_ext(ld, nullptr, nullptr);
868 ld = nullptr;
869 return nullptr;
870 }
871 if (ssl) {
872 /*
873 * Try Start TLS first
874 */
875 debug((char *) "%s| %s: DEBUG: Set SSL defaults\n", LogTime(), PROGRAM);
876 rc = ldap_set_ssl_defaults(margs);
877 if (rc != LDAP_SUCCESS) {
878 error((char *)
879 "%s| %s: ERROR: Error while setting SSL default options for ldap server: %s\n",
880 LogTime(), PROGRAM, ldap_err2string(rc));
881 ldap_unbind_ext(ld, nullptr, nullptr);
882 ld = nullptr;
883 return nullptr;
884 }
885#if HAVE_OPENLDAP
886 /*
887 * Use tls if possible
888 */
889 rc = ldap_start_tls_s(ld, nullptr, nullptr);
890 if (rc != LDAP_SUCCESS) {
891 debug((char *)
892 "%s| %s: WARNING: Error while setting start_tls for ldap server: %s\n",
893 LogTime(), PROGRAM, ldap_err2string(rc));
894 ldap_unbind_ext(ld, nullptr, nullptr);
895 ld = nullptr;
896 url = (LDAPURLDesc *) xmalloc(sizeof(*url));
897 memset(url, 0, sizeof(*url));
898#if HAVE_LDAP_URL_LUD_SCHEME
899 url->lud_scheme = xstrdup("ldaps");
900#endif
901 url->lud_host = xstrdup(host);
902 url->lud_port = port;
903#if HAVE_LDAP_SCOPE_DEFAULT
904 url->lud_scope = LDAP_SCOPE_DEFAULT;
905#else
906 url->lud_scope = LDAP_SCOPE_SUBTREE;
907#endif
908#if HAVE_LDAP_URL_DESC2STR
909 ldapuri = ldap_url_desc2str(url);
910#elif HAVE_LDAP_URL_PARSE
911 rc = ldap_url_parse(ldapuri, &url);
912 if (rc != LDAP_SUCCESS) {
913 error((char *) "%s| %s: ERROR: Error while parsing url: %s\n",
914 LogTime(), PROGRAM, ldap_err2string(rc));
915 xfree(ldapuri);
916 ldap_free_urldesc(url);
917 return nullptr;
918 }
919#else
920#error "No URL parsing function"
921#endif
922 ldap_free_urldesc(url);
923 rc = ldap_initialize(&ld, ldapuri);
924 xfree(ldapuri);
925 if (rc != LDAP_SUCCESS) {
926 error((char *)
927 "%s| %s: ERROR: Error while initialising connection to ldap server: %s\n",
928 LogTime(), PROGRAM, ldap_err2string(rc));
929 ldap_unbind_ext(ld, nullptr, nullptr);
930 ld = nullptr;
931 return nullptr;
932 }
933 rc = ldap_set_defaults(ld);
934 if (rc != LDAP_SUCCESS) {
935 error((char *)
936 "%s| %s: ERROR: Error while setting default options for ldap server: %s\n",
937 LogTime(), PROGRAM, ldap_err2string(rc));
938 ldap_unbind_ext(ld, nullptr, nullptr);
939 ld = nullptr;
940 return nullptr;
941 }
942 }
943#elif HAVE_LDAPSSL_CLIENT_INIT
944 ld = ldapssl_init(host, port, 1);
945 if (!ld) {
946 error((char *)
947 "%s| %s: ERROR: Error while setting SSL for ldap server: %s\n",
948 LogTime(), PROGRAM, ldapssl_err2string(rc));
949 ldap_unbind_ext(ld, nullptr, nullptr);
950 ld = nullptr;
951 return nullptr;
952 }
953 rc = ldap_set_defaults(ld);
954 if (rc != LDAP_SUCCESS) {
955 error((char *)
956 "%s| %s: ERROR: Error while setting default options for ldap server: %s\n",
957 LogTime(), PROGRAM, ldap_err2string(rc));
958 ldap_unbind_ext(ld, nullptr, nullptr);
959 ld = nullptr;
960 return nullptr;
961 }
962#else
963 error((char *) "%s| %s: ERROR: SSL not supported by ldap library\n",
964 LogTime(), PROGRAM);
965#endif
966 }
967 return ld;
968}
969
970/*
971 * ldap calls to get attribute from Ldap Directory Server
972 */
973int
974get_memberof(struct main_args *margs, char *user, char *domain, char *group)
975{
976 LDAP *ld = nullptr;
977 LDAPMessage *res;
978#if !HAVE_SUN_LDAP_SDK
979 int ldap_debug = 0;
980#endif
981 struct ldap_creds *lcreds = nullptr;
982 char *bindp = nullptr;
983 char *filter = nullptr;
984 char *search_exp;
985 size_t se_len = 0;
986 struct timeval searchtime;
987 int rc = 0, kc = 1;
988 int retval;
989 char **attr_value = nullptr;
990 size_t max_attr = 0;
991 struct hstruct *hlist = nullptr;
992 size_t nhosts = 0;
993 char *ldap_filter_esc = nullptr;
994
995 searchtime.tv_sec = SEARCH_TIMEOUT;
996 searchtime.tv_usec = 0;
997 /*
998 * Fill Kerberos memory cache with credential from keytab for SASL/GSSAPI
999 */
1000 if (domain) {
1001 debug((char *) "%s| %s: DEBUG: Setup Kerberos credential cache\n",
1002 LogTime(), PROGRAM);
1003
1004#if HAVE_KRB5
1005 if (margs->nokerberos) {
1006 kc = 1;
1007 debug((char *)
1008 "%s| %s: DEBUG: Kerberos is disabled. Use username/password with ldap url instead\n",
1009 LogTime(), PROGRAM);
1010 } else {
1011 kc = krb5_create_cache(domain, margs->principal);
1012 if (kc) {
1013 error((char *)
1014 "%s| %s: ERROR: Error during setup of Kerberos credential cache\n",
1015 LogTime(), PROGRAM);
1016 }
1017 }
1018#else
1019 kc = 1;
1020 debug((char *)
1021 "%s| %s: DEBUG: Kerberos is not supported. Use username/password with ldap url instead\n",
1022 LogTime(), PROGRAM);
1023#endif
1024 }
1025
1026 if (kc && (!margs->lurl || !margs->luser || !margs->lpass)) {
1027 /*
1028 * If Kerberos fails and no url given exit here
1029 */
1030 retval = 0;
1031 goto cleanup;
1032 }
1033#if !HAVE_SUN_LDAP_SDK
1034 /*
1035 * Initialise ldap
1036 */
1037// ldap_debug = 127 /* LDAP_DEBUG_TRACE */ ;
1038// ldap_debug = -1 /* LDAP_DEBUG_ANY */ ;
1039 ldap_debug = 0;
1040 (void) ldap_set_option(nullptr, LDAP_OPT_DEBUG_LEVEL, &ldap_debug);
1041#endif
1042 debug((char *) "%s| %s: DEBUG: Initialise ldap connection\n", LogTime(),
1043 PROGRAM);
1044
1045 if (domain && !kc) {
1046 if (margs->ssl) {
1047 debug((char *) "%s| %s: DEBUG: Enable SSL to ldap servers\n",
1048 LogTime(), PROGRAM);
1049 }
1050 debug((char *)
1051 "%s| %s: DEBUG: Canonicalise ldap server name for domain %s\n",
1052 LogTime(), PROGRAM, domain);
1053 /*
1054 * Loop over list of ldap servers of users domain
1055 */
1056 nhosts = get_ldap_hostname_list(margs, &hlist, 0, domain);
1057 for (size_t i = 0; i < nhosts; ++i) {
1058 int port = 389;
1059 if (hlist[i].port != -1)
1060 port = hlist[i].port;
1061 debug((char *)
1062 "%s| %s: DEBUG: Setting up connection to ldap server %s:%d\n",
1063 LogTime(), PROGRAM, hlist[i].host, port);
1064
1065 ld = tool_ldap_open(margs, hlist[i].host, port, margs->ssl);
1066 if (!ld)
1067 continue;
1068
1069 /*
1070 * ldap bind with SASL/GSSAPI authentication (only possible if a domain was part of the username)
1071 */
1072
1073#if HAVE_SASL_H || HAVE_SASL_SASL_H || HAVE_SASL_DARWIN
1074 debug((char *)
1075 "%s| %s: DEBUG: Bind to ldap server with SASL/GSSAPI\n",
1076 LogTime(), PROGRAM);
1077
1078 rc = tool_sasl_bind(ld, bindp, margs->ssl);
1079 if (rc != LDAP_SUCCESS) {
1080 error((char *)
1081 "%s| %s: ERROR: Error while binding to ldap server with SASL/GSSAPI: %s\n",
1082 LogTime(), PROGRAM, ldap_err2string(rc));
1083 ldap_unbind_ext(ld, nullptr, nullptr);
1084 ld = nullptr;
1085 continue;
1086 }
1087 lcreds = (struct ldap_creds *) xmalloc(sizeof(struct ldap_creds));
1088 lcreds->dn = nullptr;
1089 lcreds->pw = margs->ssl ? xstrdup(margs->ssl) : nullptr;
1090 ldap_set_rebind_proc(ld, ldap_sasl_rebind, (char *) lcreds);
1091 if (ld != nullptr) {
1092 debug((char *)
1093 "%s| %s: DEBUG: %s initialised %sconnection to ldap server %s:%d\n",
1094 LogTime(), PROGRAM, ld ? "Successfully" : "Failed to",
1095 margs->ssl ? "SSL protected " : "", hlist[i].host, port);
1096 break;
1097 }
1098#else
1099 ldap_unbind_ext(ld, nullptr, nullptr);
1100 ld = nullptr;
1101 error((char *) "%s| %s: ERROR: SASL not supported on system\n",
1102 LogTime(), PROGRAM);
1103 continue;
1104#endif
1105 }
1106 nhosts = free_hostname_list(&hlist, nhosts);
1107 if (ld == nullptr) {
1108 debug((char *)
1109 "%s| %s: DEBUG: Error during initialisation of ldap connection: %s\n",
1110 LogTime(), PROGRAM, strerror(errno));
1111 }
1112 if (margs->lbind) {
1113 bindp = xstrdup(margs->lbind);
1114 } else {
1115 bindp = convert_domain_to_bind_path(domain);
1116 }
1117 }
1118 if ((!domain || !ld) && margs->lurl && strstr(margs->lurl, "://")) {
1119 char *hostname;
1120 char *host;
1121 int port;
1122 char *ssl = nullptr;
1123 char *p;
1124 /*
1125 * If username does not contain a domain and a url was given then try it
1126 */
1127 hostname = strstr(margs->lurl, "://") + 3;
1128 ssl = strstr(margs->lurl, "ldaps://");
1129 if (ssl) {
1130 debug((char *) "%s| %s: DEBUG: Enable SSL to ldap servers\n",
1131 LogTime(), PROGRAM);
1132 }
1133 debug((char *) "%s| %s: DEBUG: Canonicalise ldap server name %s\n",
1134 LogTime(), PROGRAM, hostname);
1135 /*
1136 * Loop over list of ldap servers
1137 */
1138 host = xstrdup(hostname);
1139 port = 389;
1140 if ((p = strchr(host, ':'))) {
1141 *p = '\0';
1142 ++p;
1143 port = atoi(p);
1144 }
1145 nhosts = get_hostname_list(&hlist, 0, host);
1146 xfree(host);
1147 for (size_t i = 0; i < nhosts; ++i) {
1148 struct berval cred;
1149 if (margs->lpass) {
1150 cred.bv_val = margs->lpass;
1151 cred.bv_len = strlen(margs->lpass);
1152 }
1153 ld = tool_ldap_open(margs, hlist[i].host, port, ssl);
1154 if (!ld)
1155 continue;
1156 /*
1157 * ldap bind with username/password authentication
1158 */
1159
1160 debug((char *)
1161 "%s| %s: DEBUG: Bind to ldap server with Username/Password\n",
1162 LogTime(), PROGRAM);
1163 rc = ldap_sasl_bind_s(ld, margs->luser, LDAP_SASL_SIMPLE, &cred,
1164 nullptr, nullptr, nullptr);
1165 if (rc != LDAP_SUCCESS) {
1166 error((char *)
1167 "%s| %s: ERROR: Error while binding to ldap server with Username/Password: %s\n",
1168 LogTime(), PROGRAM, ldap_err2string(rc));
1169 ldap_unbind_ext(ld, nullptr, nullptr);
1170 ld = nullptr;
1171 continue;
1172 }
1173 lcreds = (struct ldap_creds *) xmalloc(sizeof(struct ldap_creds));
1174 lcreds->dn = xstrdup(margs->luser);
1175 lcreds->pw = xstrdup(margs->lpass);
1176 ldap_set_rebind_proc(ld, ldap_simple_rebind, (char *) lcreds);
1177 debug((char *)
1178 "%s| %s: DEBUG: %s set up %sconnection to ldap server %s:%d\n",
1179 LogTime(), PROGRAM, ld ? "Successfully" : "Failed to",
1180 ssl ? "SSL protected " : "", hlist[i].host, port);
1181 break;
1182
1183 }
1184 nhosts = free_hostname_list(&hlist, nhosts);
1185 xfree(bindp);
1186 if (margs->lbind) {
1187 bindp = xstrdup(margs->lbind);
1188 } else {
1189 bindp = convert_domain_to_bind_path(domain);
1190 }
1191 }
1192 if (ld == nullptr) {
1193 debug((char *)
1194 "%s| %s: DEBUG: Error during initialisation of ldap connection: %s\n",
1195 LogTime(), PROGRAM, strerror(errno));
1196 retval = 0;
1197 goto cleanup;
1198 }
1199 /*
1200 * ldap search for user
1201 */
1202 /*
1203 * Check if server is AD by querying for attribute samaccountname
1204 */
1205 margs->AD = 0;
1206 rc = check_AD(margs, ld);
1207 if (rc != LDAP_SUCCESS) {
1208 error((char *)
1209 "%s| %s: ERROR: Error determining ldap server type: %s\n",
1210 LogTime(), PROGRAM, ldap_err2string(rc));
1211 ldap_unbind_ext(ld, nullptr, nullptr);
1212 ld = nullptr;
1213 retval = 0;
1214 goto cleanup;
1215 }
1216 if (margs->AD)
1217 filter = (char *) FILTER_AD;
1218 else
1219 filter = (char *) FILTER;
1220
1221 ldap_filter_esc = escape_filter(user);
1222
1223 se_len = strlen(filter) + strlen(ldap_filter_esc) + 1;
1224 search_exp = (char *) xmalloc(se_len);
1225 snprintf(search_exp, se_len, filter, ldap_filter_esc);
1226
1227 xfree(ldap_filter_esc);
1228
1229 debug((char *)
1230 "%s| %s: DEBUG: Search ldap server with bind path %s and filter : %s\n",
1231 LogTime(), PROGRAM, bindp, search_exp);
1232 rc = ldap_search_ext_s(ld, bindp, LDAP_SCOPE_SUBTREE, search_exp, nullptr, 0,
1233 nullptr, nullptr, &searchtime, 0, &res);
1234 xfree(search_exp);
1235
1236 if (rc != LDAP_SUCCESS) {
1237 error((char *) "%s| %s: ERROR: Error searching ldap server: %s\n",
1238 LogTime(), PROGRAM, ldap_err2string(rc));
1239 ldap_unbind_ext(ld, nullptr, nullptr);
1240 ld = nullptr;
1241 retval = 0;
1242 goto cleanup;
1243 }
1244 debug((char *) "%s| %s: DEBUG: Found %d ldap entr%s\n", LogTime(), PROGRAM,
1245 ldap_count_entries(ld, res), ldap_count_entries(ld, res) > 1
1246 || ldap_count_entries(ld, res) == 0 ? "ies" : "y");
1247
1248 if (ldap_count_entries(ld, res) != 0) {
1249
1250 if (margs->AD)
1251 max_attr = get_attributes(ld, res, ATTRIBUTE_AD, &attr_value);
1252 else {
1253 max_attr = get_attributes(ld, res, ATTRIBUTE, &attr_value);
1254 }
1255
1256 /*
1257 * Compare group names
1258 */
1259 retval = 0;
1260 for (size_t k = 0; k < max_attr; ++k) {
1261 char *av = nullptr;
1262
1263 /* Compare first CN= value assuming it is the same as the group name itself */
1264 av = attr_value[k];
1265 if (!strncasecmp("CN=", av, 3)) {
1266 char *avp = nullptr;
1267 av += 3;
1268 if ((avp = strchr(av, ','))) {
1269 *avp = '\0';
1270 }
1271 }
1272 if (debug_enabled) {
1273 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" in hex UTF-8 is ", LogTime(), PROGRAM, k + 1, av);
1274 for (unsigned int n = 0; av[n] != '\0'; ++n)
1275 fprintf(stderr, "%02x", (unsigned char) av[n]);
1276 fprintf(stderr, "\n");
1277 }
1278 if (!strcasecmp(group, av)) {
1279 retval = 1;
1280 if (debug_enabled)
1281 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" matches group name \"%s\"\n", LogTime(),
1282 PROGRAM, k + 1, av, group);
1283 else
1284 break;
1285 } else
1286 debug((char *) "%s| %s: DEBUG: Entry %zu \"%s\" does not match group name \"%s\"\n", LogTime(),
1287 PROGRAM, k + 1, av, group);
1288 }
1289 /*
1290 * Do recursive group search for AD only since posixgroups can not contain other groups
1291 */
1292 if (!retval && margs->AD) {
1293 if (debug_enabled && max_attr > 0) {
1294 debug((char *)
1295 "%s| %s: DEBUG: Perform recursive group search\n",
1296 LogTime(), PROGRAM);
1297 }
1298 for (size_t j = 0; j < max_attr; ++j) {
1299 char *av = nullptr;
1300
1301 av = attr_value[j];
1302 if (search_group_tree(margs, ld, bindp, av, group, 1)) {
1303 retval = 1;
1304 if (!strncasecmp("CN=", av, 3)) {
1305 char *avp = nullptr;
1306 av += 3;
1307 if ((avp = strchr(av, ','))) {
1308 *avp = '\0';
1309 }
1310 }
1311 if (debug_enabled)
1312 debug((char *) "%s| %s: DEBUG: Entry %zu group \"%s\" is (in)direct member of group \"%s\"\n",
1313 LogTime(), PROGRAM, j + 1, av, group);
1314 else
1315 break;
1316 }
1317 }
1318 }
1319 /*
1320 * Cleanup
1321 */
1322 if (attr_value) {
1323 for (size_t j = 0; j < max_attr; ++j) {
1324 xfree(attr_value[j]);
1325 }
1326 safe_free(attr_value);
1327 }
1328 ldap_msgfree(res);
1329 } else if (ldap_count_entries(ld, res) == 0 && margs->AD) {
1330 ldap_msgfree(res);
1331 ldap_unbind_ext(ld, nullptr, nullptr);
1332 ld = nullptr;
1333 retval = 0;
1334 goto cleanup;
1335 } else {
1336 ldap_msgfree(res);
1337 retval = 0;
1338 }
1339
1340 if (retval == 0) {
1341 /*
1342 * Check for primary Group membership
1343 */
1344 debug((char *)
1345 "%s| %s: DEBUG: Search for primary group membership: \"%s\"\n",
1346 LogTime(), PROGRAM, group);
1347 if (margs->AD)
1348 filter = (char *) FILTER_AD;
1349 else
1350 filter = (char *) FILTER_UID;
1351
1352 ldap_filter_esc = escape_filter(user);
1353
1354 se_len = strlen(filter) + strlen(ldap_filter_esc) + 1;
1355 search_exp = (char *) xmalloc(se_len);
1356 snprintf(search_exp, se_len, filter, ldap_filter_esc);
1357
1358 xfree(ldap_filter_esc);
1359
1360 debug((char *)
1361 "%s| %s: DEBUG: Search ldap server with bind path %s and filter: %s\n",
1362 LogTime(), PROGRAM, bindp, search_exp);
1363 rc = ldap_search_ext_s(ld, bindp, LDAP_SCOPE_SUBTREE, search_exp, nullptr,
1364 0, nullptr, nullptr, &searchtime, 0, &res);
1365 xfree(search_exp);
1366
1367 debug((char *) "%s| %s: DEBUG: Found %d ldap entr%s\n", LogTime(),
1368 PROGRAM, ldap_count_entries(ld, res), ldap_count_entries(ld,
1369 res) > 1 || ldap_count_entries(ld, res) == 0 ? "ies" : "y");
1370
1371 max_attr = 0;
1372 if (!rc) {
1373 if (margs->AD)
1374 max_attr =
1375 get_attributes(ld, res, ATTRIBUTE_GID_AD, &attr_value);
1376 else
1377 max_attr = get_attributes(ld, res, ATTRIBUTE_GID, &attr_value);
1378 }
1379
1380 if (max_attr == 1) {
1381 char **attr_value_2 = nullptr;
1382 size_t max_attr_2 = 0;
1383
1384 if (margs->AD) {
1385 char **attr_value_3 = nullptr;
1386 int *attr_len_3 = nullptr;
1387 size_t max_attr_3 = 0;
1388 uint32_t gid = atoi(attr_value[0]);
1389
1390 /* Get objectsid and search for group
1391 * with objectsid = domain(objectsid) + primarygroupid */
1392 debug((char *) "%s| %s: DEBUG: Got primaryGroupID %u\n",
1393 LogTime(), PROGRAM, gid);
1394 max_attr_3 =
1395 get_bin_attributes(ld, res, ATTRIBUTE_SID, &attr_value_3,
1396 &attr_len_3);
1397 ldap_msgfree(res);
1398 if (max_attr_3 == 1) {
1399 int len = attr_len_3[0];
1400 if (len < 4) {
1401 debug((char *)
1402 "%s| %s: ERROR: Length %d is too short for objectSID\n",
1403 LogTime(), PROGRAM, len);
1404 rc = 1;
1405 } else {
1406 char *se = nullptr;
1407 attr_value_3[0][len - 1] = ((gid >> 24) & 0xff);
1408 attr_value_3[0][len - 2] = ((gid >> 16) & 0xff);
1409 attr_value_3[0][len - 3] = ((gid >> 8) & 0xff);
1410 attr_value_3[0][len - 4] = ((gid >> 0) & 0xff);
1411
1412#define FILTER_SID_1 "(objectSID="
1413#define FILTER_SID_2 ")"
1414
1415 se_len =
1416 strlen(FILTER_SID_1) + len * 3 +
1417 strlen(FILTER_SID_2) + 1;
1418 search_exp = (char *) xmalloc(se_len);
1419 snprintf(search_exp, se_len, "%s", FILTER_SID_1);
1420
1421 for (int j = 0; j < len; j++) {
1422 se = xstrdup(search_exp);
1423 snprintf(search_exp, se_len, "%s\\%02x", se,
1424 attr_value_3[0][j] & 0xFF);
1425 xfree(se);
1426 }
1427 se = xstrdup(search_exp);
1428 snprintf(search_exp, se_len, "%s%s", se, FILTER_SID_2);
1429 xfree(se);
1430
1431 debug((char *)
1432 "%s| %s: DEBUG: Search ldap server with bind path %s and filter: %s\n",
1433 LogTime(), PROGRAM, bindp, search_exp);
1434 rc = ldap_search_ext_s(ld, bindp, LDAP_SCOPE_SUBTREE,
1435 search_exp, nullptr, 0, nullptr, nullptr, &searchtime, 0,
1436 &res);
1437 xfree(search_exp);
1438
1439 debug((char *) "%s| %s: DEBUG: Found %d ldap entr%s\n",
1440 LogTime(), PROGRAM, ldap_count_entries(ld, res),
1441 ldap_count_entries(ld, res) > 1
1442 || ldap_count_entries(ld, res) == 0 ? "ies" : "y");
1443
1444 }
1445 } else {
1446 rc = 1;
1447 }
1448 if (attr_value_3) {
1449 size_t j;
1450 for (j = 0; j < max_attr_3; ++j) {
1451 xfree(attr_value_3[j]);
1452 }
1453 safe_free(attr_value_3);
1454 }
1455 if (attr_len_3) {
1456 xfree(attr_len_3);
1457 }
1458 } else {
1459 ldap_msgfree(res);
1460 filter = (char *) FILTER_GID;
1461
1462 ldap_filter_esc = escape_filter(attr_value[0]);
1463
1464 se_len = strlen(filter) + strlen(ldap_filter_esc) + 1;
1465 search_exp = (char *) xmalloc(se_len);
1466 snprintf(search_exp, se_len, filter, ldap_filter_esc);
1467
1468 xfree(ldap_filter_esc);
1469
1470 debug((char *)
1471 "%s| %s: DEBUG: Search ldap server with bind path %s and filter: %s\n",
1472 LogTime(), PROGRAM, bindp, search_exp);
1473 rc = ldap_search_ext_s(ld, bindp, LDAP_SCOPE_SUBTREE,
1474 search_exp, nullptr, 0, nullptr, nullptr, &searchtime, 0, &res);
1475 xfree(search_exp);
1476 }
1477
1478 if (!rc) {
1479 if (margs->AD)
1480 max_attr_2 =
1481 get_attributes(ld, res, ATTRIBUTE_DN, &attr_value_2);
1482 else
1483 max_attr_2 =
1484 get_attributes(ld, res, ATTRIBUTE, &attr_value_2);
1485 ldap_msgfree(res);
1486 } else {
1487 ldap_msgfree(res);
1488 }
1489 /*
1490 * Compare group names
1491 */
1492 retval = 0;
1493 if (max_attr_2 == 1) {
1494 /* Compare first CN= value assuming it is the same as the group name itself */
1495 char *av = attr_value_2[0];
1496 if (!strncasecmp("CN=", av, 3)) {
1497 char *avp = nullptr;
1498 av += 3;
1499 if ((avp = strchr(av, ','))) {
1500 *avp = '\0';
1501 }
1502 }
1503 if (!strcasecmp(group, av)) {
1504 retval = 1;
1505 debug((char *)
1506 "%s| %s: DEBUG: \"%s\" matches group name \"%s\"\n",
1507 LogTime(), PROGRAM, av, group);
1508 } else
1509 debug((char *)
1510 "%s| %s: DEBUG: \"%s\" does not match group name \"%s\"\n",
1511 LogTime(), PROGRAM, av, group);
1512
1513 }
1514 /*
1515 * Do recursive group search for AD only since posixgroups can not contain other groups
1516 */
1517 if (!retval && margs->AD) {
1518 if (debug_enabled && max_attr_2 > 0) {
1519 debug((char *)
1520 "%s| %s: DEBUG: Perform recursive group search\n",
1521 LogTime(), PROGRAM);
1522 }
1523 for (size_t j = 0; j < max_attr_2; ++j) {
1524 char *av = nullptr;
1525
1526 av = attr_value_2[j];
1527 if (search_group_tree(margs, ld, bindp, av, group, 1)) {
1528 retval = 1;
1529 if (!strncasecmp("CN=", av, 3)) {
1530 char *avp = nullptr;
1531 av += 3;
1532 if ((avp = strchr(av, ','))) {
1533 *avp = '\0';
1534 }
1535 }
1536 if (debug_enabled) {
1537 debug((char *) "%s| %s: DEBUG: Entry %zu group \"%s\" is (in)direct member of group \"%s\"\n",
1538 LogTime(), PROGRAM, j + 1, av, group);
1539 } else {
1540 break;
1541 }
1542 }
1543 }
1544 }
1545 /*
1546 * Cleanup
1547 */
1548 if (attr_value_2) {
1549 size_t j;
1550 for (j = 0; j < max_attr_2; ++j) {
1551 xfree(attr_value_2[j]);
1552 }
1553 safe_free(attr_value_2);
1554 }
1555
1556 debug((char *) "%s| %s: DEBUG: Users primary group %s %s\n",
1557 LogTime(), PROGRAM, retval ? "matches" : "does not match",
1558 group);
1559
1560 } else {
1561 ldap_msgfree(res);
1562 debug((char *)
1563 "%s| %s: DEBUG: Did not find ldap entry for group %s\n",
1564 LogTime(), PROGRAM, group);
1565 }
1566 /*
1567 * Cleanup
1568 */
1569 if (attr_value) {
1570 for (size_t j = 0; j < max_attr; ++j) {
1571 xfree(attr_value[j]);
1572 }
1573 safe_free(attr_value);
1574 }
1575 }
1576 rc = ldap_unbind_ext(ld, nullptr, nullptr);
1577 ld = nullptr;
1578 if (rc != LDAP_SUCCESS) {
1579 error((char *) "%s| %s: ERROR: Error unbind ldap server: %s\n",
1580 LogTime(), PROGRAM, ldap_err2string(rc));
1581 }
1582 debug((char *) "%s| %s: DEBUG: Unbind ldap server\n", LogTime(), PROGRAM);
1583cleanup:
1584 if (lcreds) {
1585 xfree(lcreds->dn);
1586 xfree(lcreds->pw);
1587 xfree(lcreds);
1588 }
1589 xfree(bindp);
1590 return (retval);
1591}
1592#endif
1593
error
void error(char *format,...)
get_hostname_list
size_t get_hostname_list(struct hstruct **hlist, size_t nhosts, char *name)
PROGRAM
#define PROGRAM
Definition: support.h:166
get_memberof
int get_memberof(struct main_args *margs, char *user, char *domain, char *group)
LogTime
const char * LogTime(void)
Definition: negotiate_kerberos.h:103
free_hostname_list
size_t free_hostname_list(struct hstruct **hlist, size_t nhosts)
get_ldap_hostname_list
size_t get_ldap_hostname_list(struct main_args *margs, struct hstruct **hlist, size_t nhosts, char *domain)
debug_enabled
int debug_enabled
Definition: debug.cc:13
debug
void debug(const char *format,...)
Definition: debug.cc:19
port
static int port
Definition: ldap_backend.cc:70
ld
static LDAP * ld
Definition: ldap_backend.cc:57
xfree
#define xfree
Definition: negotiate_wrapper.cc:54
xstrdup
#define xstrdup
Definition: negotiate_wrapper.cc:51
xmalloc
#define xmalloc
Definition: negotiate_wrapper.cc:48
strerror
char * strerror(int ern)
Definition: strerror.c:22
hstruct::port
int port
Definition: support.h:122
hstruct::host
char * host
Definition: support.h:121
ldap_creds
Definition: support.h:127
ldap_creds::dn
char * dn
Definition: support.h:128
ldap_creds::pw
char * pw
Definition: support.h:129
main_args
Definition: support.h:71
main_args::ssl
char * ssl
Definition: support.h:81
main_args::AD
int AD
Definition: support.h:83
main_args::mdepth
int mdepth
Definition: support.h:84
main_args::rc_allow
int rc_allow
Definition: support.h:82
main_args::luser
char * luser
Definition: support.h:77
main_args::lpass
char * lpass
Definition: support.h:78
main_args::principal
char * principal
Definition: support.h:90
main_args::lurl
char * lurl
Definition: support.h:80
main_args::lbind
char * lbind
Definition: support.h:79
main_args::nokerberos
int nokerberos
Definition: support.h:85
int
int unsigned int
Definition: stub_fd.cc:19
xrealloc
void * xrealloc(void *s, size_t sz)
Definition: xalloc.cc:126
xcalloc
void * xcalloc(size_t n, size_t sz)
Definition: xalloc.cc:71
safe_free
#define safe_free(x)
Definition: xalloc.h:73

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors