1 | /* ============================================================ |
---|
2 | * Copyright (c) 2003-2004, Ondrej Sury |
---|
3 | * All rights reserved. |
---|
4 | * |
---|
5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
---|
6 | * you may not use this file except in compliance with the License. |
---|
7 | * You may obtain a copy of the License at |
---|
8 | * |
---|
9 | * http://www.apache.org/licenses/LICENSE-2.0 |
---|
10 | * |
---|
11 | * Unless required by applicable law or agreed to in writing, software |
---|
12 | * distributed under the License is distributed on an "AS IS" BASIS, |
---|
13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
---|
14 | * See the License for the specific language governing permissions and |
---|
15 | * limitations under the License. |
---|
16 | * |
---|
17 | */ |
---|
18 | |
---|
19 | /* |
---|
20 | * mod_vhost_ldap.c --- read virtual host config from LDAP directory |
---|
21 | */ |
---|
22 | |
---|
23 | #define CORE_PRIVATE |
---|
24 | |
---|
25 | #include <unistd.h> |
---|
26 | |
---|
27 | #include "httpd.h" |
---|
28 | #include "http_config.h" |
---|
29 | #include "http_core.h" |
---|
30 | #include "http_log.h" |
---|
31 | #include "http_request.h" |
---|
32 | #include "apr_version.h" |
---|
33 | #include "apr_ldap.h" |
---|
34 | #include "apr_strings.h" |
---|
35 | #include "apr_reslist.h" |
---|
36 | #include "util_ldap.h" |
---|
37 | |
---|
38 | #if !defined(APU_HAS_LDAP) && !defined(APR_HAS_LDAP) |
---|
39 | #error mod_vhost_ldap requires APR-util to have LDAP support built in |
---|
40 | #endif |
---|
41 | |
---|
42 | #if !defined(WIN32) && !defined(OS2) && !defined(BEOS) && !defined(NETWARE) |
---|
43 | #define HAVE_UNIX_SUEXEC |
---|
44 | #endif |
---|
45 | |
---|
46 | #ifdef HAVE_UNIX_SUEXEC |
---|
47 | #include "unixd.h" /* Contains the suexec_identity hook used on Unix */ |
---|
48 | #endif |
---|
49 | |
---|
50 | #define MIN_UID 100 |
---|
51 | #define MIN_GID 100 |
---|
52 | const char USERDIR[] = "web_scripts"; |
---|
53 | |
---|
54 | module AP_MODULE_DECLARE_DATA vhost_ldap_module; |
---|
55 | |
---|
56 | typedef enum { |
---|
57 | MVL_UNSET, MVL_DISABLED, MVL_ENABLED |
---|
58 | } mod_vhost_ldap_status_e; |
---|
59 | |
---|
60 | typedef struct mod_vhost_ldap_config_t { |
---|
61 | mod_vhost_ldap_status_e enabled; /* Is vhost_ldap enabled? */ |
---|
62 | |
---|
63 | /* These parameters are all derived from the VhostLDAPURL directive */ |
---|
64 | char *url; /* String representation of LDAP URL */ |
---|
65 | |
---|
66 | char *host; /* Name of the LDAP server (or space separated list) */ |
---|
67 | int port; /* Port of the LDAP server */ |
---|
68 | char *basedn; /* Base DN to do all searches from */ |
---|
69 | int scope; /* Scope of the search */ |
---|
70 | char *filter; /* Filter to further limit the search */ |
---|
71 | deref_options deref; /* how to handle alias dereferening */ |
---|
72 | |
---|
73 | char *binddn; /* DN to bind to server (can be NULL) */ |
---|
74 | char *bindpw; /* Password to bind to server (can be NULL) */ |
---|
75 | |
---|
76 | int have_deref; /* Set if we have found an Deref option */ |
---|
77 | int have_ldap_url; /* Set if we have found an LDAP url */ |
---|
78 | |
---|
79 | int secure; /* True if SSL connections are requested */ |
---|
80 | |
---|
81 | char *fallback; /* Fallback virtual host */ |
---|
82 | |
---|
83 | } mod_vhost_ldap_config_t; |
---|
84 | |
---|
85 | typedef struct mod_vhost_ldap_request_t { |
---|
86 | char *dn; /* The saved dn from a successful search */ |
---|
87 | char *name; /* ServerName */ |
---|
88 | char *admin; /* ServerAdmin */ |
---|
89 | char *docroot; /* DocumentRoot */ |
---|
90 | char *cgiroot; /* ScriptAlias */ |
---|
91 | char *uid; /* Suexec Uid */ |
---|
92 | char *gid; /* Suexec Gid */ |
---|
93 | } mod_vhost_ldap_request_t; |
---|
94 | |
---|
95 | char *attributes[] = |
---|
96 | { "apacheServerName", "apacheDocumentRoot", "apacheScriptAlias", "apacheSuexecUid", "apacheSuexecGid", "apacheServerAdmin", 0 }; |
---|
97 | |
---|
98 | #if (APR_MAJOR_VERSION >= 1) |
---|
99 | static APR_OPTIONAL_FN_TYPE(uldap_connection_close) *util_ldap_connection_close; |
---|
100 | static APR_OPTIONAL_FN_TYPE(uldap_connection_find) *util_ldap_connection_find; |
---|
101 | static APR_OPTIONAL_FN_TYPE(uldap_cache_comparedn) *util_ldap_cache_comparedn; |
---|
102 | static APR_OPTIONAL_FN_TYPE(uldap_cache_compare) *util_ldap_cache_compare; |
---|
103 | static APR_OPTIONAL_FN_TYPE(uldap_cache_checkuserid) *util_ldap_cache_checkuserid; |
---|
104 | static APR_OPTIONAL_FN_TYPE(uldap_cache_getuserdn) *util_ldap_cache_getuserdn; |
---|
105 | static APR_OPTIONAL_FN_TYPE(uldap_ssl_supported) *util_ldap_ssl_supported; |
---|
106 | |
---|
107 | static void ImportULDAPOptFn(void) |
---|
108 | { |
---|
109 | util_ldap_connection_close = APR_RETRIEVE_OPTIONAL_FN(uldap_connection_close); |
---|
110 | util_ldap_connection_find = APR_RETRIEVE_OPTIONAL_FN(uldap_connection_find); |
---|
111 | util_ldap_cache_comparedn = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_comparedn); |
---|
112 | util_ldap_cache_compare = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_compare); |
---|
113 | util_ldap_cache_checkuserid = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_checkuserid); |
---|
114 | util_ldap_cache_getuserdn = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_getuserdn); |
---|
115 | util_ldap_ssl_supported = APR_RETRIEVE_OPTIONAL_FN(uldap_ssl_supported); |
---|
116 | } |
---|
117 | #endif |
---|
118 | |
---|
119 | static int mod_vhost_ldap_post_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s) |
---|
120 | { |
---|
121 | /* make sure that mod_ldap (util_ldap) is loaded */ |
---|
122 | if (ap_find_linked_module("util_ldap.c") == NULL) { |
---|
123 | ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, s, |
---|
124 | "Module mod_ldap missing. Mod_ldap (aka. util_ldap) " |
---|
125 | "must be loaded in order for mod_vhost_ldap to function properly"); |
---|
126 | return HTTP_INTERNAL_SERVER_ERROR; |
---|
127 | |
---|
128 | } |
---|
129 | |
---|
130 | ap_add_version_component(p, MOD_VHOST_LDAP_VERSION); |
---|
131 | |
---|
132 | return OK; |
---|
133 | } |
---|
134 | |
---|
135 | static void * |
---|
136 | mod_vhost_ldap_create_server_config (apr_pool_t *p, server_rec *s) |
---|
137 | { |
---|
138 | mod_vhost_ldap_config_t *conf = |
---|
139 | (mod_vhost_ldap_config_t *)apr_pcalloc(p, sizeof (mod_vhost_ldap_config_t)); |
---|
140 | |
---|
141 | conf->enabled = MVL_UNSET; |
---|
142 | conf->have_ldap_url = 0; |
---|
143 | conf->have_deref = 0; |
---|
144 | conf->binddn = NULL; |
---|
145 | conf->bindpw = NULL; |
---|
146 | conf->deref = always; |
---|
147 | conf->fallback = NULL; |
---|
148 | |
---|
149 | return conf; |
---|
150 | } |
---|
151 | |
---|
152 | static void * |
---|
153 | mod_vhost_ldap_merge_server_config(apr_pool_t *p, void *parentv, void *childv) |
---|
154 | { |
---|
155 | mod_vhost_ldap_config_t *parent = (mod_vhost_ldap_config_t *) parentv; |
---|
156 | mod_vhost_ldap_config_t *child = (mod_vhost_ldap_config_t *) childv; |
---|
157 | mod_vhost_ldap_config_t *conf = |
---|
158 | (mod_vhost_ldap_config_t *)apr_pcalloc(p, sizeof(mod_vhost_ldap_config_t)); |
---|
159 | |
---|
160 | if (child->enabled == MVL_UNSET) { |
---|
161 | conf->enabled = parent->enabled; |
---|
162 | } else { |
---|
163 | conf->enabled = child->enabled; |
---|
164 | } |
---|
165 | |
---|
166 | if (child->have_ldap_url) { |
---|
167 | conf->have_ldap_url = child->have_ldap_url; |
---|
168 | conf->url = child->url; |
---|
169 | conf->host = child->host; |
---|
170 | conf->port = child->port; |
---|
171 | conf->basedn = child->basedn; |
---|
172 | conf->scope = child->scope; |
---|
173 | conf->filter = child->filter; |
---|
174 | conf->secure = child->secure; |
---|
175 | } else { |
---|
176 | conf->have_ldap_url = parent->have_ldap_url; |
---|
177 | conf->url = parent->url; |
---|
178 | conf->host = parent->host; |
---|
179 | conf->port = parent->port; |
---|
180 | conf->basedn = parent->basedn; |
---|
181 | conf->scope = parent->scope; |
---|
182 | conf->filter = parent->filter; |
---|
183 | conf->secure = parent->secure; |
---|
184 | } |
---|
185 | if (child->have_deref) { |
---|
186 | conf->have_deref = child->have_deref; |
---|
187 | conf->deref = child->deref; |
---|
188 | } else { |
---|
189 | conf->have_deref = parent->have_deref; |
---|
190 | conf->deref = parent->deref; |
---|
191 | } |
---|
192 | |
---|
193 | conf->binddn = (child->binddn ? child->binddn : parent->binddn); |
---|
194 | conf->bindpw = (child->bindpw ? child->bindpw : parent->bindpw); |
---|
195 | |
---|
196 | conf->fallback = (child->fallback ? child->fallback : parent->fallback); |
---|
197 | |
---|
198 | return conf; |
---|
199 | } |
---|
200 | |
---|
201 | /* |
---|
202 | * Use the ldap url parsing routines to break up the ldap url into |
---|
203 | * host and port. |
---|
204 | */ |
---|
205 | static const char *mod_vhost_ldap_parse_url(cmd_parms *cmd, |
---|
206 | void *dummy, |
---|
207 | const char *url) |
---|
208 | { |
---|
209 | int result; |
---|
210 | apr_ldap_url_desc_t *urld; |
---|
211 | #if (APR_MAJOR_VERSION >= 1) |
---|
212 | apr_ldap_err_t *result_err; |
---|
213 | #endif |
---|
214 | |
---|
215 | mod_vhost_ldap_config_t *conf = |
---|
216 | (mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config, |
---|
217 | &vhost_ldap_module); |
---|
218 | |
---|
219 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
220 | cmd->server, "[mod_vhost_ldap.c] url parse: `%s'", |
---|
221 | url); |
---|
222 | |
---|
223 | #if (APR_MAJOR_VERSION >= 1) /* for apache >= 2.2 */ |
---|
224 | result = apr_ldap_url_parse(cmd->pool, url, &(urld), &(result_err)); |
---|
225 | if (result != LDAP_SUCCESS) { |
---|
226 | return result_err->reason; |
---|
227 | } |
---|
228 | #else |
---|
229 | result = apr_ldap_url_parse(url, &(urld)); |
---|
230 | if (result != LDAP_SUCCESS) { |
---|
231 | switch (result) { |
---|
232 | case LDAP_URL_ERR_NOTLDAP: |
---|
233 | return "LDAP URL does not begin with ldap://"; |
---|
234 | case LDAP_URL_ERR_NODN: |
---|
235 | return "LDAP URL does not have a DN"; |
---|
236 | case LDAP_URL_ERR_BADSCOPE: |
---|
237 | return "LDAP URL has an invalid scope"; |
---|
238 | case LDAP_URL_ERR_MEM: |
---|
239 | return "Out of memory parsing LDAP URL"; |
---|
240 | default: |
---|
241 | return "Could not parse LDAP URL"; |
---|
242 | } |
---|
243 | } |
---|
244 | #endif |
---|
245 | conf->url = apr_pstrdup(cmd->pool, url); |
---|
246 | |
---|
247 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
248 | cmd->server, "[mod_vhost_ldap.c] url parse: Host: %s", urld->lud_host); |
---|
249 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
250 | cmd->server, "[mod_vhost_ldap.c] url parse: Port: %d", urld->lud_port); |
---|
251 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
252 | cmd->server, "[mod_vhost_ldap.c] url parse: DN: %s", urld->lud_dn); |
---|
253 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
254 | cmd->server, "[mod_vhost_ldap.c] url parse: attrib: %s", urld->lud_attrs? urld->lud_attrs[0] : "(null)"); |
---|
255 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
256 | cmd->server, "[mod_vhost_ldap.c] url parse: scope: %s", |
---|
257 | (urld->lud_scope == LDAP_SCOPE_SUBTREE? "subtree" : |
---|
258 | urld->lud_scope == LDAP_SCOPE_BASE? "base" : |
---|
259 | urld->lud_scope == LDAP_SCOPE_ONELEVEL? "onelevel" : "unknown")); |
---|
260 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, |
---|
261 | cmd->server, "[mod_vhost_ldap.c] url parse: filter: %s", urld->lud_filter); |
---|
262 | |
---|
263 | /* Set all the values, or at least some sane defaults */ |
---|
264 | if (conf->host) { |
---|
265 | char *p = apr_palloc(cmd->pool, strlen(conf->host) + strlen(urld->lud_host) + 2); |
---|
266 | strcpy(p, urld->lud_host); |
---|
267 | strcat(p, " "); |
---|
268 | strcat(p, conf->host); |
---|
269 | conf->host = p; |
---|
270 | } |
---|
271 | else { |
---|
272 | conf->host = urld->lud_host? apr_pstrdup(cmd->pool, urld->lud_host) : "localhost"; |
---|
273 | } |
---|
274 | conf->basedn = urld->lud_dn? apr_pstrdup(cmd->pool, urld->lud_dn) : ""; |
---|
275 | |
---|
276 | conf->scope = urld->lud_scope == LDAP_SCOPE_ONELEVEL ? |
---|
277 | LDAP_SCOPE_ONELEVEL : LDAP_SCOPE_SUBTREE; |
---|
278 | |
---|
279 | if (urld->lud_filter) { |
---|
280 | if (urld->lud_filter[0] == '(') { |
---|
281 | /* |
---|
282 | * Get rid of the surrounding parens; later on when generating the |
---|
283 | * filter, they'll be put back. |
---|
284 | */ |
---|
285 | conf->filter = apr_pstrdup(cmd->pool, urld->lud_filter+1); |
---|
286 | conf->filter[strlen(conf->filter)-1] = '\0'; |
---|
287 | } |
---|
288 | else { |
---|
289 | conf->filter = apr_pstrdup(cmd->pool, urld->lud_filter); |
---|
290 | } |
---|
291 | } |
---|
292 | else { |
---|
293 | conf->filter = "objectClass=apacheConfig"; |
---|
294 | } |
---|
295 | |
---|
296 | /* "ldaps" indicates secure ldap connections desired |
---|
297 | */ |
---|
298 | if (strncasecmp(url, "ldaps", 5) == 0) |
---|
299 | { |
---|
300 | conf->secure = 1; |
---|
301 | conf->port = urld->lud_port? urld->lud_port : LDAPS_PORT; |
---|
302 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, cmd->server, |
---|
303 | "LDAP: vhost_ldap using SSL connections"); |
---|
304 | } |
---|
305 | else |
---|
306 | { |
---|
307 | conf->secure = 0; |
---|
308 | conf->port = urld->lud_port? urld->lud_port : LDAP_PORT; |
---|
309 | ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, cmd->server, |
---|
310 | "LDAP: vhost_ldap not using SSL connections"); |
---|
311 | } |
---|
312 | |
---|
313 | conf->have_ldap_url = 1; |
---|
314 | #if (APR_MAJOR_VERSION < 1) /* free only required for older apr */ |
---|
315 | apr_ldap_free_urldesc(urld); |
---|
316 | #endif |
---|
317 | return NULL; |
---|
318 | } |
---|
319 | |
---|
320 | static const char *mod_vhost_ldap_set_enabled(cmd_parms *cmd, void *dummy, int enabled) |
---|
321 | { |
---|
322 | mod_vhost_ldap_config_t *conf = |
---|
323 | (mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config, |
---|
324 | &vhost_ldap_module); |
---|
325 | |
---|
326 | conf->enabled = (enabled) ? MVL_ENABLED : MVL_DISABLED; |
---|
327 | |
---|
328 | return NULL; |
---|
329 | } |
---|
330 | |
---|
331 | static const char *mod_vhost_ldap_set_binddn(cmd_parms *cmd, void *dummy, const char *binddn) |
---|
332 | { |
---|
333 | mod_vhost_ldap_config_t *conf = |
---|
334 | (mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config, |
---|
335 | &vhost_ldap_module); |
---|
336 | |
---|
337 | conf->binddn = apr_pstrdup(cmd->pool, binddn); |
---|
338 | return NULL; |
---|
339 | } |
---|
340 | |
---|
341 | static const char *mod_vhost_ldap_set_bindpw(cmd_parms *cmd, void *dummy, const char *bindpw) |
---|
342 | { |
---|
343 | mod_vhost_ldap_config_t *conf = |
---|
344 | (mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config, |
---|
345 | &vhost_ldap_module); |
---|
346 | |
---|
347 | conf->bindpw = apr_pstrdup(cmd->pool, bindpw); |
---|
348 | return NULL; |
---|
349 | } |
---|
350 | |
---|
351 | static const char *mod_vhost_ldap_set_deref(cmd_parms *cmd, void *dummy, const char *deref) |
---|
352 | { |
---|
353 | mod_vhost_ldap_config_t *conf = |
---|
354 | (mod_vhost_ldap_config_t *)ap_get_module_config (cmd->server->module_config, |
---|
355 | &vhost_ldap_module); |
---|
356 | |
---|
357 | if (strcmp(deref, "never") == 0 || strcasecmp(deref, "off") == 0) { |
---|
358 | conf->deref = never; |
---|
359 | conf->have_deref = 1; |
---|
360 | } |
---|
361 | else if (strcmp(deref, "searching") == 0) { |
---|
362 | conf->deref = searching; |
---|
363 | conf->have_deref = 1; |
---|
364 | } |
---|
365 | else if (strcmp(deref, "finding") == 0) { |
---|
366 | conf->deref = finding; |
---|
367 | conf->have_deref = 1; |
---|
368 | } |
---|
369 | else if (strcmp(deref, "always") == 0 || strcasecmp(deref, "on") == 0) { |
---|
370 | conf->deref = always; |
---|
371 | conf->have_deref = 1; |
---|
372 | } |
---|
373 | else { |
---|
374 | return "Unrecognized value for VhostLDAPAliasDereference directive"; |
---|
375 | } |
---|
376 | return NULL; |
---|
377 | } |
---|
378 | |
---|
379 | static const char *mod_vhost_ldap_set_fallback(cmd_parms *cmd, void *dummy, const char *fallback) |
---|
380 | { |
---|
381 | mod_vhost_ldap_config_t *conf = |
---|
382 | (mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config, |
---|
383 | &vhost_ldap_module); |
---|
384 | |
---|
385 | conf->fallback = apr_pstrdup(cmd->pool, fallback); |
---|
386 | return NULL; |
---|
387 | } |
---|
388 | |
---|
389 | command_rec mod_vhost_ldap_cmds[] = { |
---|
390 | AP_INIT_TAKE1("VhostLDAPURL", mod_vhost_ldap_parse_url, NULL, RSRC_CONF, |
---|
391 | "URL to define LDAP connection. This should be an RFC 2255 compliant\n" |
---|
392 | "URL of the form ldap://host[:port]/basedn[?attrib[?scope[?filter]]].\n" |
---|
393 | "<ul>\n" |
---|
394 | "<li>Host is the name of the LDAP server. Use a space separated list of hosts \n" |
---|
395 | "to specify redundant servers.\n" |
---|
396 | "<li>Port is optional, and specifies the port to connect to.\n" |
---|
397 | "<li>basedn specifies the base DN to start searches from\n" |
---|
398 | "</ul>\n"), |
---|
399 | |
---|
400 | AP_INIT_TAKE1 ("VhostLDAPBindDN", mod_vhost_ldap_set_binddn, NULL, RSRC_CONF, |
---|
401 | "DN to use to bind to LDAP server. If not provided, will do an anonymous bind."), |
---|
402 | |
---|
403 | AP_INIT_TAKE1("VhostLDAPBindPassword", mod_vhost_ldap_set_bindpw, NULL, RSRC_CONF, |
---|
404 | "Password to use to bind to LDAP server. If not provided, will do an anonymous bind."), |
---|
405 | |
---|
406 | AP_INIT_FLAG("VhostLDAPEnabled", mod_vhost_ldap_set_enabled, NULL, RSRC_CONF, |
---|
407 | "Set to off to disable vhost_ldap, even if it's been enabled in a higher tree"), |
---|
408 | |
---|
409 | AP_INIT_TAKE1("VhostLDAPDereferenceAliases", mod_vhost_ldap_set_deref, NULL, RSRC_CONF, |
---|
410 | "Determines how aliases are handled during a search. Can be one of the" |
---|
411 | "values \"never\", \"searching\", \"finding\", or \"always\". " |
---|
412 | "Defaults to always."), |
---|
413 | |
---|
414 | AP_INIT_TAKE1("VhostLDAPFallback", mod_vhost_ldap_set_fallback, NULL, RSRC_CONF, |
---|
415 | "Set default virtual host which will be used when requested hostname" |
---|
416 | "is not found in LDAP database. This option can be used to display" |
---|
417 | "\"virtual host not found\" type of page."), |
---|
418 | |
---|
419 | {NULL} |
---|
420 | }; |
---|
421 | |
---|
422 | char *mod_vhost_ldap_escape(apr_pool_t *p, const char *source) |
---|
423 | { |
---|
424 | char *target = apr_palloc(p, 3 * strlen(source) + 1); |
---|
425 | char *result = target; |
---|
426 | for (; *source; source++) { |
---|
427 | switch (*source) { |
---|
428 | case '*': case '(': case ')': case '\\': |
---|
429 | sprintf(target, "\\%02hhx", *source); |
---|
430 | target += 3; |
---|
431 | break; |
---|
432 | default: |
---|
433 | *target++ = *source; |
---|
434 | break; |
---|
435 | } |
---|
436 | } |
---|
437 | *target = '\0'; |
---|
438 | return result; |
---|
439 | } |
---|
440 | |
---|
441 | #define FILTER_LENGTH MAX_STRING_LEN |
---|
442 | static int mod_vhost_ldap_translate_name(request_rec *r) |
---|
443 | { |
---|
444 | request_rec *top = (r->main)?r->main:r; |
---|
445 | mod_vhost_ldap_request_t *reqc; |
---|
446 | apr_table_t *e; |
---|
447 | int failures = 0; |
---|
448 | const char **vals = NULL; |
---|
449 | char filtbuf[FILTER_LENGTH]; |
---|
450 | mod_vhost_ldap_config_t *conf = |
---|
451 | (mod_vhost_ldap_config_t *)ap_get_module_config(r->server->module_config, &vhost_ldap_module); |
---|
452 | core_server_config * core = |
---|
453 | (core_server_config *) ap_get_module_config(r->server->module_config, &core_module); |
---|
454 | util_ldap_connection_t *ldc = NULL; |
---|
455 | int result = 0; |
---|
456 | const char *dn = NULL; |
---|
457 | char *cgi; |
---|
458 | const char *hostname = NULL, *s_hostname = NULL; |
---|
459 | int is_fallback = 0; |
---|
460 | |
---|
461 | reqc = |
---|
462 | (mod_vhost_ldap_request_t *)apr_pcalloc(r->pool, sizeof(mod_vhost_ldap_request_t)); |
---|
463 | memset(reqc, 0, sizeof(mod_vhost_ldap_request_t)); |
---|
464 | |
---|
465 | ap_set_module_config(r->request_config, &vhost_ldap_module, reqc); |
---|
466 | |
---|
467 | // mod_vhost_ldap is disabled or we don't have LDAP Url |
---|
468 | if ((conf->enabled != MVL_ENABLED)||(!conf->have_ldap_url)) { |
---|
469 | return DECLINED; |
---|
470 | } |
---|
471 | |
---|
472 | start_over: |
---|
473 | |
---|
474 | if (conf->host) { |
---|
475 | ldc = util_ldap_connection_find(r, conf->host, conf->port, |
---|
476 | conf->binddn, conf->bindpw, conf->deref, |
---|
477 | conf->secure); |
---|
478 | } |
---|
479 | else { |
---|
480 | ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r, |
---|
481 | "[mod_vhost_ldap.c] translate: no conf->host - weird...?"); |
---|
482 | return DECLINED; |
---|
483 | } |
---|
484 | |
---|
485 | hostname = r->hostname; |
---|
486 | if (hostname == NULL) |
---|
487 | goto null; |
---|
488 | |
---|
489 | fallback: |
---|
490 | |
---|
491 | ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, |
---|
492 | "[mod_vhost_ldap.c]: translating %s", r->uri); |
---|
493 | |
---|
494 | s_hostname = mod_vhost_ldap_escape(r->pool, hostname); |
---|
495 | apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(|(apacheServerName=%s)(apacheServerAlias=%s)))", conf->filter, s_hostname, s_hostname); |
---|
496 | |
---|
497 | result = util_ldap_cache_getuserdn(r, ldc, conf->url, conf->basedn, conf->scope, |
---|
498 | attributes, filtbuf, &dn, &vals); |
---|
499 | |
---|
500 | util_ldap_connection_close(ldc); |
---|
501 | |
---|
502 | /* sanity check - if server is down, retry it up to 5 times */ |
---|
503 | if (result == LDAP_SERVER_DOWN) { |
---|
504 | if (failures++ <= 5) { |
---|
505 | goto start_over; |
---|
506 | } |
---|
507 | } |
---|
508 | |
---|
509 | if ((result == LDAP_NO_SUCH_OBJECT)) { |
---|
510 | if (strcmp(hostname, "*") != 0) { |
---|
511 | if (strncmp(hostname, "*.", 2) == 0) |
---|
512 | hostname += 2; |
---|
513 | hostname += strcspn(hostname, "."); |
---|
514 | hostname = apr_pstrcat(r->pool, "*", hostname, NULL); |
---|
515 | ap_log_rerror(APLOG_MARK, APLOG_NOTICE|APLOG_NOERRNO, 0, r, |
---|
516 | "[mod_vhost_ldap.c] translate: " |
---|
517 | "virtual host not found, trying wildcard %s", |
---|
518 | hostname); |
---|
519 | goto fallback; |
---|
520 | } |
---|
521 | |
---|
522 | null: |
---|
523 | if (conf->fallback && (is_fallback++ <= 0)) { |
---|
524 | ap_log_rerror(APLOG_MARK, APLOG_NOTICE|APLOG_NOERRNO, 0, r, |
---|
525 | "[mod_vhost_ldap.c] translate: " |
---|
526 | "virtual host %s not found, trying fallback %s", |
---|
527 | hostname, conf->fallback); |
---|
528 | hostname = conf->fallback; |
---|
529 | goto fallback; |
---|
530 | } |
---|
531 | |
---|
532 | ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r, |
---|
533 | "[mod_vhost_ldap.c] translate: " |
---|
534 | "virtual host %s not found", |
---|
535 | hostname); |
---|
536 | |
---|
537 | return DECLINED; |
---|
538 | } |
---|
539 | |
---|
540 | /* handle bind failure */ |
---|
541 | if (result != LDAP_SUCCESS) { |
---|
542 | ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r, |
---|
543 | "[mod_vhost_ldap.c] translate: " |
---|
544 | "translate failed; virtual host %s; URI %s [%s]", |
---|
545 | hostname, r->uri, ldap_err2string(result)); |
---|
546 | return DECLINED; |
---|
547 | } |
---|
548 | |
---|
549 | /* mark the user and DN */ |
---|
550 | reqc->dn = apr_pstrdup(r->pool, dn); |
---|
551 | |
---|
552 | /* Optimize */ |
---|
553 | if (vals) { |
---|
554 | int i = 0; |
---|
555 | while (attributes[i]) { |
---|
556 | |
---|
557 | if (strcasecmp (attributes[i], "apacheServerName") == 0) { |
---|
558 | reqc->name = apr_pstrdup (r->pool, vals[i]); |
---|
559 | } |
---|
560 | else if (strcasecmp (attributes[i], "apacheServerAdmin") == 0) { |
---|
561 | reqc->admin = apr_pstrdup (r->pool, vals[i]); |
---|
562 | } |
---|
563 | else if (strcasecmp (attributes[i], "apacheDocumentRoot") == 0) { |
---|
564 | reqc->docroot = apr_pstrdup (r->pool, vals[i]); |
---|
565 | } |
---|
566 | else if (strcasecmp (attributes[i], "apacheScriptAlias") == 0) { |
---|
567 | reqc->cgiroot = apr_pstrdup (r->pool, vals[i]); |
---|
568 | } |
---|
569 | else if (strcasecmp (attributes[i], "apacheSuexecUid") == 0) { |
---|
570 | reqc->uid = apr_pstrdup(r->pool, vals[i]); |
---|
571 | } |
---|
572 | else if (strcasecmp (attributes[i], "apacheSuexecGid") == 0) { |
---|
573 | reqc->gid = apr_pstrdup(r->pool, vals[i]); |
---|
574 | } |
---|
575 | i++; |
---|
576 | } |
---|
577 | } |
---|
578 | |
---|
579 | ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, |
---|
580 | "[mod_vhost_ldap.c]: loaded from ldap: " |
---|
581 | "apacheServerName: %s, " |
---|
582 | "apacheServerAdmin: %s, " |
---|
583 | "apacheDocumentRoot: %s, " |
---|
584 | "apacheScriptAlias: %s, " |
---|
585 | "apacheSuexecUid: %s, " |
---|
586 | "apacheSuexecGid: %s", |
---|
587 | reqc->name, reqc->admin, reqc->docroot, reqc->cgiroot, reqc->uid, reqc->gid); |
---|
588 | |
---|
589 | if ((reqc->name == NULL)||(reqc->docroot == NULL)) { |
---|
590 | ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, r, |
---|
591 | "[mod_vhost_ldap.c] translate: " |
---|
592 | "translate failed; ServerName or DocumentRoot not defined"); |
---|
593 | return DECLINED; |
---|
594 | } |
---|
595 | |
---|
596 | cgi = NULL; |
---|
597 | |
---|
598 | #if 0 |
---|
599 | if (reqc->cgiroot) { |
---|
600 | cgi = strstr(r->uri, "cgi-bin/"); |
---|
601 | if (cgi && (cgi != r->uri + strspn(r->uri, "/"))) { |
---|
602 | cgi = NULL; |
---|
603 | } |
---|
604 | } |
---|
605 | if (cgi) { |
---|
606 | r->filename = apr_pstrcat (r->pool, reqc->cgiroot, cgi + strlen("cgi-bin"), NULL); |
---|
607 | r->handler = "cgi-script"; |
---|
608 | apr_table_setn(r->notes, "alias-forced-type", r->handler); |
---|
609 | #endif |
---|
610 | /* This is a quick, dirty hack. I should be shot for taking 6.170 |
---|
611 | * this term and being willing to write a quick, dirty hack. */ |
---|
612 | |
---|
613 | if (strncmp(r->uri, "/~", 2) == 0) { |
---|
614 | char *username; |
---|
615 | uid_t uid = (uid_t)atoll(reqc->uid); |
---|
616 | if (apr_uid_name_get(&username, uid, r->pool) != APR_SUCCESS) { |
---|
617 | ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, r, |
---|
618 | "could not get username for uid %d", uid); |
---|
619 | return DECLINED; |
---|
620 | } |
---|
621 | if (strncmp(r->uri + 2, username, strlen(username)) == 0 && |
---|
622 | (r->uri[2 + strlen(username)] == '/' || |
---|
623 | r->uri[2 + strlen(username)] == '\0')) { |
---|
624 | char *homedir; |
---|
625 | if (apr_uid_homepath_get(&homedir, username, r->pool) != APR_SUCCESS) { |
---|
626 | ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, r, |
---|
627 | "could not get home directory for user %s", username); |
---|
628 | return DECLINED; |
---|
629 | } |
---|
630 | r->filename = apr_pstrcat(r->pool, homedir, "/", USERDIR, r->uri + 2 + strlen(username), NULL); |
---|
631 | } |
---|
632 | } else if (r->uri[0] == '/') { |
---|
633 | r->filename = apr_pstrcat (r->pool, reqc->docroot, r->uri, NULL); |
---|
634 | } else { |
---|
635 | return DECLINED; |
---|
636 | } |
---|
637 | |
---|
638 | top->server->server_hostname = apr_pstrdup (top->pool, reqc->name); |
---|
639 | |
---|
640 | if (reqc->admin) { |
---|
641 | top->server->server_admin = apr_pstrdup (top->pool, reqc->admin); |
---|
642 | } |
---|
643 | |
---|
644 | // set environment variables |
---|
645 | e = top->subprocess_env; |
---|
646 | apr_table_addn (e, "SERVER_ROOT", reqc->docroot); |
---|
647 | |
---|
648 | core->ap_document_root = apr_pstrdup(top->pool, reqc->docroot); |
---|
649 | |
---|
650 | ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, |
---|
651 | "[mod_vhost_ldap.c]: translated to %s", r->filename); |
---|
652 | |
---|
653 | return OK; |
---|
654 | } |
---|
655 | |
---|
656 | #ifdef HAVE_UNIX_SUEXEC |
---|
657 | static ap_unix_identity_t *mod_vhost_ldap_get_suexec_id_doer(const request_rec * r) |
---|
658 | { |
---|
659 | ap_unix_identity_t *ugid = NULL; |
---|
660 | mod_vhost_ldap_config_t *conf = |
---|
661 | (mod_vhost_ldap_config_t *)ap_get_module_config(r->server->module_config, |
---|
662 | &vhost_ldap_module); |
---|
663 | mod_vhost_ldap_request_t *req = |
---|
664 | (mod_vhost_ldap_request_t *)ap_get_module_config(r->request_config, |
---|
665 | &vhost_ldap_module); |
---|
666 | |
---|
667 | uid_t uid = -1; |
---|
668 | gid_t gid = -1; |
---|
669 | |
---|
670 | // mod_vhost_ldap is disabled or we don't have LDAP Url |
---|
671 | if ((conf->enabled != MVL_ENABLED)||(!conf->have_ldap_url)) { |
---|
672 | return NULL; |
---|
673 | } |
---|
674 | |
---|
675 | if ((req == NULL)||(req->uid == NULL)||(req->gid == NULL)) { |
---|
676 | return NULL; |
---|
677 | } |
---|
678 | |
---|
679 | if ((ugid = apr_palloc(r->pool, sizeof(ap_unix_identity_t))) == NULL) { |
---|
680 | return NULL; |
---|
681 | } |
---|
682 | |
---|
683 | uid = (uid_t)atoll(req->uid); |
---|
684 | gid = (gid_t)atoll(req->gid); |
---|
685 | |
---|
686 | if ((uid < MIN_UID)||(gid < MIN_GID)) { |
---|
687 | return NULL; |
---|
688 | } |
---|
689 | |
---|
690 | ugid->uid = uid; |
---|
691 | ugid->gid = gid; |
---|
692 | ugid->userdir = 0; |
---|
693 | |
---|
694 | return ugid; |
---|
695 | } |
---|
696 | #endif |
---|
697 | |
---|
698 | static void |
---|
699 | mod_vhost_ldap_register_hooks (apr_pool_t * p) |
---|
700 | { |
---|
701 | ap_hook_post_config(mod_vhost_ldap_post_config, NULL, NULL, APR_HOOK_MIDDLE); |
---|
702 | ap_hook_translate_name(mod_vhost_ldap_translate_name, NULL, NULL, APR_HOOK_MIDDLE); |
---|
703 | #ifdef HAVE_UNIX_SUEXEC |
---|
704 | ap_hook_get_suexec_identity(mod_vhost_ldap_get_suexec_id_doer, NULL, NULL, APR_HOOK_MIDDLE); |
---|
705 | #endif |
---|
706 | #if (APR_MAJOR_VERSION >= 1) |
---|
707 | ap_hook_optional_fn_retrieve(ImportULDAPOptFn,NULL,NULL,APR_HOOK_MIDDLE); |
---|
708 | #endif |
---|
709 | } |
---|
710 | |
---|
711 | module AP_MODULE_DECLARE_DATA vhost_ldap_module = { |
---|
712 | STANDARD20_MODULE_STUFF, |
---|
713 | NULL, |
---|
714 | NULL, |
---|
715 | mod_vhost_ldap_create_server_config, |
---|
716 | mod_vhost_ldap_merge_server_config, |
---|
717 | mod_vhost_ldap_cmds, |
---|
718 | mod_vhost_ldap_register_hooks, |
---|
719 | }; |
---|