1 #include "plugin.h"
2 #include "http_auth.h"
3 #include "log.h"
4 #include "response.h"
5
6 #include <sys/types.h>
7 #include <sys/stat.h>
8
9 #include <stdlib.h>
10 #include <string.h>
11 #include <errno.h>
12 #include <fcntl.h>
13 #include <unistd.h>
14
15 handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
16
17
18 /**
19 * the basic and digest auth framework
20 *
21 * - config handling
22 * - protocol handling
23 *
24 * http_auth.c
25 * http_auth_digest.c
26 *
27 * do the real work
28 */
29
INIT_FUNC(mod_auth_init)30 INIT_FUNC(mod_auth_init) {
31 mod_auth_plugin_data *p;
32
33 p = calloc(1, sizeof(*p));
34
35 p->tmp_buf = buffer_init();
36
37 p->auth_user = buffer_init();
38 #ifdef USE_LDAP
39 p->ldap_filter = buffer_init();
40 #endif
41
42 return p;
43 }
44
FREE_FUNC(mod_auth_free)45 FREE_FUNC(mod_auth_free) {
46 mod_auth_plugin_data *p = p_d;
47
48 UNUSED(srv);
49
50 if (!p) return HANDLER_GO_ON;
51
52 buffer_free(p->tmp_buf);
53 buffer_free(p->auth_user);
54 #ifdef USE_LDAP
55 buffer_free(p->ldap_filter);
56 #endif
57
58 if (p->config_storage) {
59 size_t i;
60 for (i = 0; i < srv->config_context->used; i++) {
61 mod_auth_plugin_config *s = p->config_storage[i];
62
63 if (!s) continue;
64
65 array_free(s->auth_require);
66 buffer_free(s->auth_plain_groupfile);
67 buffer_free(s->auth_plain_userfile);
68 buffer_free(s->auth_htdigest_userfile);
69 buffer_free(s->auth_htpasswd_userfile);
70 buffer_free(s->auth_backend_conf);
71
72 buffer_free(s->auth_ldap_hostname);
73 buffer_free(s->auth_ldap_basedn);
74 buffer_free(s->auth_ldap_binddn);
75 buffer_free(s->auth_ldap_bindpw);
76 buffer_free(s->auth_ldap_filter);
77 buffer_free(s->auth_ldap_cafile);
78
79 #ifdef USE_LDAP
80 buffer_free(s->ldap_filter_pre);
81 buffer_free(s->ldap_filter_post);
82
83 if (s->ldap) ldap_unbind_s(s->ldap);
84 #endif
85
86 free(s);
87 }
88 free(p->config_storage);
89 }
90
91 free(p);
92
93 return HANDLER_GO_ON;
94 }
95
96 #define PATCH(x) \
97 p->conf.x = s->x;
mod_auth_patch_connection(server * srv,connection * con,mod_auth_plugin_data * p)98 static int mod_auth_patch_connection(server *srv, connection *con, mod_auth_plugin_data *p) {
99 size_t i, j;
100 mod_auth_plugin_config *s = p->config_storage[0];
101
102 PATCH(auth_backend);
103 PATCH(auth_plain_groupfile);
104 PATCH(auth_plain_userfile);
105 PATCH(auth_htdigest_userfile);
106 PATCH(auth_htpasswd_userfile);
107 PATCH(auth_require);
108 PATCH(auth_debug);
109 PATCH(auth_ldap_hostname);
110 PATCH(auth_ldap_basedn);
111 PATCH(auth_ldap_binddn);
112 PATCH(auth_ldap_bindpw);
113 PATCH(auth_ldap_filter);
114 PATCH(auth_ldap_cafile);
115 PATCH(auth_ldap_starttls);
116 PATCH(auth_ldap_allow_empty_pw);
117 #ifdef USE_LDAP
118 p->anon_conf = s;
119 PATCH(ldap_filter_pre);
120 PATCH(ldap_filter_post);
121 #endif
122
123 /* skip the first, the global context */
124 for (i = 1; i < srv->config_context->used; i++) {
125 data_config *dc = (data_config *)srv->config_context->data[i];
126 s = p->config_storage[i];
127
128 /* condition didn't match */
129 if (!config_check_cond(srv, con, dc)) continue;
130
131 /* merge config */
132 for (j = 0; j < dc->value->used; j++) {
133 data_unset *du = dc->value->data[j];
134
135 if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend"))) {
136 PATCH(auth_backend);
137 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.groupfile"))) {
138 PATCH(auth_plain_groupfile);
139 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.userfile"))) {
140 PATCH(auth_plain_userfile);
141 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htdigest.userfile"))) {
142 PATCH(auth_htdigest_userfile);
143 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htpasswd.userfile"))) {
144 PATCH(auth_htpasswd_userfile);
145 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.require"))) {
146 PATCH(auth_require);
147 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.debug"))) {
148 PATCH(auth_debug);
149 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.hostname"))) {
150 PATCH(auth_ldap_hostname);
151 #ifdef USE_LDAP
152 p->anon_conf = s;
153 #endif
154 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.base-dn"))) {
155 PATCH(auth_ldap_basedn);
156 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.filter"))) {
157 PATCH(auth_ldap_filter);
158 #ifdef USE_LDAP
159 PATCH(ldap_filter_pre);
160 PATCH(ldap_filter_post);
161 #endif
162 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.ca-file"))) {
163 PATCH(auth_ldap_cafile);
164 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.starttls"))) {
165 PATCH(auth_ldap_starttls);
166 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-dn"))) {
167 PATCH(auth_ldap_binddn);
168 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-pw"))) {
169 PATCH(auth_ldap_bindpw);
170 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.allow-empty-pw"))) {
171 PATCH(auth_ldap_allow_empty_pw);
172 }
173 }
174 }
175
176 return 0;
177 }
178 #undef PATCH
179
mod_auth_uri_handler(server * srv,connection * con,void * p_d)180 static handler_t mod_auth_uri_handler(server *srv, connection *con, void *p_d) {
181 size_t k;
182 int auth_required = 0, auth_satisfied = 0;
183 char *http_authorization = NULL;
184 const char *auth_type = NULL;
185 data_string *ds;
186 mod_auth_plugin_data *p = p_d;
187 array *req;
188
189 /* select the right config */
190 mod_auth_patch_connection(srv, con, p);
191
192 if (p->conf.auth_require == NULL) return HANDLER_GO_ON;
193
194 /*
195 * AUTH
196 *
197 */
198
199 /* do we have to ask for auth ? */
200
201 auth_required = 0;
202 auth_satisfied = 0;
203
204 /* search auth-directives for path */
205 for (k = 0; k < p->conf.auth_require->used; k++) {
206 buffer *require = p->conf.auth_require->data[k]->key;
207
208 if (require->used == 0) continue;
209 if (con->uri.path->used < require->used) continue;
210
211 /* if we have a case-insensitive FS we have to lower-case the URI here too */
212
213 if (con->conf.force_lowercase_filenames) {
214 if (0 == strncasecmp(con->uri.path->ptr, require->ptr, require->used - 1)) {
215 auth_required = 1;
216 break;
217 }
218 } else {
219 if (0 == strncmp(con->uri.path->ptr, require->ptr, require->used - 1)) {
220 auth_required = 1;
221 break;
222 }
223 }
224 }
225
226 /* nothing to do for us */
227 if (auth_required == 0) return HANDLER_GO_ON;
228
229 req = ((data_array *)(p->conf.auth_require->data[k]))->value;
230
231 /* try to get Authorization-header */
232
233 if (NULL != (ds = (data_string *)array_get_element(con->request.headers, "Authorization"))) {
234 http_authorization = ds->value->ptr;
235 }
236
237 if (ds && ds->value && ds->value->used) {
238 char *auth_realm;
239 data_string *method;
240
241 method = (data_string *)array_get_element(req, "method");
242
243 /* parse auth-header */
244 if (NULL != (auth_realm = strchr(http_authorization, ' '))) {
245 int auth_type_len = auth_realm - http_authorization;
246
247 if ((auth_type_len == 5) &&
248 (0 == strncasecmp(http_authorization, "Basic", auth_type_len))) {
249 auth_type = "Basic";
250
251 if (0 == strcmp(method->value->ptr, "basic")) {
252 auth_satisfied = http_auth_basic_check(srv, con, p, req, con->uri.path, auth_realm+1);
253 }
254 } else if ((auth_type_len == 6) &&
255 (0 == strncasecmp(http_authorization, "Digest", auth_type_len))) {
256 auth_type = "Digest";
257 if (0 == strcmp(method->value->ptr, "digest")) {
258 if (-1 == (auth_satisfied = http_auth_digest_check(srv, con, p, req, con->uri.path, auth_realm+1))) {
259 con->http_status = 400;
260 con->mode = DIRECT;
261
262 /* a field was missing */
263
264 return HANDLER_FINISHED;
265 }
266 }
267 } else {
268 log_error_write(srv, __FILE__, __LINE__, "ss",
269 "unknown authentification type:",
270 http_authorization);
271 }
272 }
273 }
274
275 if (!auth_satisfied) {
276 data_string *method, *realm;
277 method = (data_string *)array_get_element(req, "method");
278 realm = (data_string *)array_get_element(req, "realm");
279
280 con->http_status = 401;
281 con->mode = DIRECT;
282
283 if (0 == strcmp(method->value->ptr, "basic")) {
284 buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Basic realm=\""));
285 buffer_append_string_buffer(p->tmp_buf, realm->value);
286 buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\""));
287
288 response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
289 } else if (0 == strcmp(method->value->ptr, "digest")) {
290 char hh[33];
291 http_auth_digest_generate_nonce(srv, p, srv->tmp_buf, hh);
292
293 buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Digest realm=\""));
294 buffer_append_string_buffer(p->tmp_buf, realm->value);
295 buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", nonce=\""));
296 buffer_append_string(p->tmp_buf, hh);
297 buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", qop=\"auth\""));
298
299 response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
300 } else {
301 /* evil */
302 }
303 return HANDLER_FINISHED;
304 } else {
305 /* the REMOTE_USER header */
306
307 buffer_copy_string_buffer(con->authed_user, p->auth_user);
308
309 /* AUTH_TYPE environment */
310
311 if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
312 ds = data_string_init();
313 }
314
315 buffer_copy_string(ds->key, "AUTH_TYPE");
316 buffer_copy_string(ds->value, auth_type);
317
318 array_insert_unique(con->environment, (data_unset *)ds);
319 }
320
321 return HANDLER_GO_ON;
322 }
323
SETDEFAULTS_FUNC(mod_auth_set_defaults)324 SETDEFAULTS_FUNC(mod_auth_set_defaults) {
325 mod_auth_plugin_data *p = p_d;
326 size_t i;
327
328 config_values_t cv[] = {
329 { "auth.backend", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
330 { "auth.backend.plain.groupfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
331 { "auth.backend.plain.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
332 { "auth.require", NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 3 */
333 { "auth.backend.ldap.hostname", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 4 */
334 { "auth.backend.ldap.base-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 5 */
335 { "auth.backend.ldap.filter", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 6 */
336 { "auth.backend.ldap.ca-file", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 7 */
337 { "auth.backend.ldap.starttls", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 8 */
338 { "auth.backend.ldap.bind-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 9 */
339 { "auth.backend.ldap.bind-pw", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 10 */
340 { "auth.backend.ldap.allow-empty-pw", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 11 */
341 { "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 12 */
342 { "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 13 */
343 { "auth.debug", NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION }, /* 14 */
344 { NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
345 };
346
347 p->config_storage = calloc(1, srv->config_context->used * sizeof(specific_config *));
348
349 for (i = 0; i < srv->config_context->used; i++) {
350 mod_auth_plugin_config *s;
351 size_t n;
352 data_array *da;
353 array *ca;
354
355 s = calloc(1, sizeof(mod_auth_plugin_config));
356 s->auth_plain_groupfile = buffer_init();
357 s->auth_plain_userfile = buffer_init();
358 s->auth_htdigest_userfile = buffer_init();
359 s->auth_htpasswd_userfile = buffer_init();
360 s->auth_backend_conf = buffer_init();
361
362 s->auth_ldap_hostname = buffer_init();
363 s->auth_ldap_basedn = buffer_init();
364 s->auth_ldap_binddn = buffer_init();
365 s->auth_ldap_bindpw = buffer_init();
366 s->auth_ldap_filter = buffer_init();
367 s->auth_ldap_cafile = buffer_init();
368 s->auth_ldap_starttls = 0;
369 s->auth_debug = 0;
370
371 s->auth_require = array_init();
372
373 #ifdef USE_LDAP
374 s->ldap_filter_pre = buffer_init();
375 s->ldap_filter_post = buffer_init();
376 s->ldap = NULL;
377 #endif
378
379 cv[0].destination = s->auth_backend_conf;
380 cv[1].destination = s->auth_plain_groupfile;
381 cv[2].destination = s->auth_plain_userfile;
382 cv[3].destination = s->auth_require;
383 cv[4].destination = s->auth_ldap_hostname;
384 cv[5].destination = s->auth_ldap_basedn;
385 cv[6].destination = s->auth_ldap_filter;
386 cv[7].destination = s->auth_ldap_cafile;
387 cv[8].destination = &(s->auth_ldap_starttls);
388 cv[9].destination = s->auth_ldap_binddn;
389 cv[10].destination = s->auth_ldap_bindpw;
390 cv[11].destination = &(s->auth_ldap_allow_empty_pw);
391 cv[12].destination = s->auth_htdigest_userfile;
392 cv[13].destination = s->auth_htpasswd_userfile;
393 cv[14].destination = &(s->auth_debug);
394
395 p->config_storage[i] = s;
396 ca = ((data_config *)srv->config_context->data[i])->value;
397
398 if (0 != config_insert_values_global(srv, ca, cv)) {
399 return HANDLER_ERROR;
400 }
401
402 if (s->auth_backend_conf->used) {
403 if (0 == strcmp(s->auth_backend_conf->ptr, "htpasswd")) {
404 s->auth_backend = AUTH_BACKEND_HTPASSWD;
405 } else if (0 == strcmp(s->auth_backend_conf->ptr, "htdigest")) {
406 s->auth_backend = AUTH_BACKEND_HTDIGEST;
407 } else if (0 == strcmp(s->auth_backend_conf->ptr, "plain")) {
408 s->auth_backend = AUTH_BACKEND_PLAIN;
409 } else if (0 == strcmp(s->auth_backend_conf->ptr, "ldap")) {
410 s->auth_backend = AUTH_BACKEND_LDAP;
411 } else {
412 log_error_write(srv, __FILE__, __LINE__, "sb", "auth.backend not supported:", s->auth_backend_conf);
413
414 return HANDLER_ERROR;
415 }
416 }
417
418 #ifdef USE_LDAP
419 if (s->auth_ldap_filter->used) {
420 char *dollar;
421
422 /* parse filter */
423
424 if (NULL == (dollar = strchr(s->auth_ldap_filter->ptr, '$'))) {
425 log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.filter is missing a replace-operator '$'");
426
427 return HANDLER_ERROR;
428 }
429
430 buffer_copy_string_len(s->ldap_filter_pre, s->auth_ldap_filter->ptr, dollar - s->auth_ldap_filter->ptr);
431 buffer_copy_string(s->ldap_filter_post, dollar+1);
432 }
433 #endif
434
435 /* no auth.require for this section */
436 if (NULL == (da = (data_array *)array_get_element(ca, "auth.require"))) continue;
437
438 if (da->type != TYPE_ARRAY) continue;
439
440 for (n = 0; n < da->value->used; n++) {
441 size_t m;
442 data_array *da_file = (data_array *)da->value->data[n];
443 const char *method, *realm, *require;
444
445 if (da->value->data[n]->type != TYPE_ARRAY) {
446 log_error_write(srv, __FILE__, __LINE__, "ss",
447 "auth.require should contain an array as in:",
448 "auth.require = ( \"...\" => ( ..., ...) )");
449
450 return HANDLER_ERROR;
451 }
452
453 method = realm = require = NULL;
454
455 for (m = 0; m < da_file->value->used; m++) {
456 if (da_file->value->data[m]->type == TYPE_STRING) {
457 if (0 == strcmp(da_file->value->data[m]->key->ptr, "method")) {
458 method = ((data_string *)(da_file->value->data[m]))->value->ptr;
459 } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "realm")) {
460 realm = ((data_string *)(da_file->value->data[m]))->value->ptr;
461 } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "require")) {
462 require = ((data_string *)(da_file->value->data[m]))->value->ptr;
463 } else {
464 log_error_write(srv, __FILE__, __LINE__, "ssbs",
465 "the field is unknown in:",
466 "auth.require = ( \"...\" => ( ..., -> \"",
467 da_file->value->data[m]->key,
468 "\" <- => \"...\" ) )");
469
470 return HANDLER_ERROR;
471 }
472 } else {
473 log_error_write(srv, __FILE__, __LINE__, "ssbs",
474 "a string was expected for:",
475 "auth.require = ( \"...\" => ( ..., -> \"",
476 da_file->value->data[m]->key,
477 "\" <- => \"...\" ) )");
478
479 return HANDLER_ERROR;
480 }
481 }
482
483 if (method == NULL) {
484 log_error_write(srv, __FILE__, __LINE__, "ss",
485 "the method field is missing in:",
486 "auth.require = ( \"...\" => ( ..., \"method\" => \"...\" ) )");
487 return HANDLER_ERROR;
488 } else {
489 if (0 != strcmp(method, "basic") &&
490 0 != strcmp(method, "digest")) {
491 log_error_write(srv, __FILE__, __LINE__, "ss",
492 "method has to be either \"basic\" or \"digest\" in",
493 "auth.require = ( \"...\" => ( ..., \"method\" => \"...\") )");
494 return HANDLER_ERROR;
495 }
496 }
497
498 if (realm == NULL) {
499 log_error_write(srv, __FILE__, __LINE__, "ss",
500 "the realm field is missing in:",
501 "auth.require = ( \"...\" => ( ..., \"realm\" => \"...\" ) )");
502 return HANDLER_ERROR;
503 }
504
505 if (require == NULL) {
506 log_error_write(srv, __FILE__, __LINE__, "ss",
507 "the require field is missing in:",
508 "auth.require = ( \"...\" => ( ..., \"require\" => \"...\" ) )");
509 return HANDLER_ERROR;
510 }
511
512 if (method && realm && require) {
513 data_string *ds;
514 data_array *a;
515
516 a = data_array_init();
517 buffer_copy_string_buffer(a->key, da_file->key);
518
519 ds = data_string_init();
520
521 buffer_copy_string_len(ds->key, CONST_STR_LEN("method"));
522 buffer_copy_string(ds->value, method);
523
524 array_insert_unique(a->value, (data_unset *)ds);
525
526 ds = data_string_init();
527
528 buffer_copy_string_len(ds->key, CONST_STR_LEN("realm"));
529 buffer_copy_string(ds->value, realm);
530
531 array_insert_unique(a->value, (data_unset *)ds);
532
533 ds = data_string_init();
534
535 buffer_copy_string_len(ds->key, CONST_STR_LEN("require"));
536 buffer_copy_string(ds->value, require);
537
538 array_insert_unique(a->value, (data_unset *)ds);
539
540 array_insert_unique(s->auth_require, (data_unset *)a);
541 }
542 }
543
544 switch(s->auth_ldap_hostname->used) {
545 case AUTH_BACKEND_LDAP: {
546 handler_t ret = auth_ldap_init(srv, s);
547 if (ret == HANDLER_ERROR)
548 return (ret);
549 break;
550 }
551 default:
552 break;
553 }
554 }
555
556 return HANDLER_GO_ON;
557 }
558
auth_ldap_init(server * srv,mod_auth_plugin_config * s)559 handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s) {
560 #ifdef USE_LDAP
561 int ret;
562 #if 0
563 if (s->auth_ldap_basedn->used == 0) {
564 log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.base-dn has to be set");
565
566 return HANDLER_ERROR;
567 }
568 #endif
569
570 if (s->auth_ldap_hostname->used) {
571 /* free old context */
572 if (NULL != s->ldap) ldap_unbind_s(s->ldap);
573
574 if (NULL == (s->ldap = ldap_init(s->auth_ldap_hostname->ptr, LDAP_PORT))) {
575 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
576
577 return HANDLER_ERROR;
578 }
579
580 ret = LDAP_VERSION3;
581 if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(s->ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
582 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
583
584 return HANDLER_ERROR;
585 }
586
587 if (s->auth_ldap_starttls) {
588 /* if no CA file is given, it is ok, as we will use encryption
589 * if the server requires a CAfile it will tell us */
590 if (!buffer_is_empty(s->auth_ldap_cafile)) {
591 if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,
592 s->auth_ldap_cafile->ptr))) {
593 log_error_write(srv, __FILE__, __LINE__, "ss",
594 "Loading CA certificate failed:", ldap_err2string(ret));
595
596 return HANDLER_ERROR;
597 }
598 }
599
600 if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(s->ldap, NULL, NULL))) {
601 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
602
603 return HANDLER_ERROR;
604 }
605 }
606
607
608 /* 1. */
609 if (s->auth_ldap_binddn->used) {
610 if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, s->auth_ldap_binddn->ptr, s->auth_ldap_bindpw->ptr))) {
611 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
612
613 return HANDLER_ERROR;
614 }
615 } else {
616 if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, NULL, NULL))) {
617 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
618
619 return HANDLER_ERROR;
620 }
621 }
622 }
623 return HANDLER_GO_ON;
624 #else
625 UNUSED(s);
626 log_error_write(srv, __FILE__, __LINE__, "s", "no ldap support available");
627 return HANDLER_ERROR;
628 #endif
629 }
630
631 int mod_auth_plugin_init(plugin *p);
mod_auth_plugin_init(plugin * p)632 int mod_auth_plugin_init(plugin *p) {
633 p->version = LIGHTTPD_VERSION_ID;
634 p->name = buffer_init_string("auth");
635 p->init = mod_auth_init;
636 p->set_defaults = mod_auth_set_defaults;
637 p->handle_uri_clean = mod_auth_uri_handler;
638 p->cleanup = mod_auth_free;
639
640 p->data = NULL;
641
642 return 0;
643 }
644