/* * squid_ldap_auth: authentication via ldap for squid proxy server *  * Authors: * Henrik Nordstrom * hno@squid-cache.org * * Glen Newton  * glen.newton@nrc.ca * Advanced Services  * CISTI * National Research Council * * with contributions from others mentioned in the Changes section below *  * Usage: squid_ldap_auth -b basedn [-s searchscope] *                        [-f searchfilter] [-D binddn -w bindpasswd] *                        [-u attr] [-h host] [-p port] [-P] [-R] [ldap_server_name[:port]] ... *  * Dependencies: You need to get the OpenLDAP libraries * from http://www.openldap.org or another compatible LDAP C-API * implementation. * * If you want to make a TLS enabled connection you will also need the * OpenSSL libraries linked into openldap. See http://www.openssl.org/ *  * License: squid_ldap_auth is free software; you can redistribute it  * and/or modify it under the terms of the GNU General Public License  * as published by the Free Software Foundation; either version 2,  * or (at your option) any later version. * * Changes: * 2005-01-07: Henrik Nordstrom <hno@squid-cache.org> *             - Added some sanity checks on login names to avoid *               users bypassing equality checks by exploring the *               overly helpful match capabilities of LDAP * 2004-07-17: Henrik Nordstrom <hno@squid-cache.org> *             - Corrected non-persistent mode to only issue one *               ldap_bind per connection. *             - -U option to compare the users password rather *               than binding. * 2004-03-01: Henrik Nordstrom <hno@squid-cache.org> *             - corrected building of search filters to escape *               unsafe input *             - -d option for "debug" like squid_ldap_group * 2004-01-05: Henrik Nordstrom <hno@squid-cache.org> *             - Corrected TLS mode * 2003-03-01: David J N Begley *             - Support for Netscape API method of ldap over SSL *               connections *             - Timeout option for better recovery when using *               multiple LDAP servers * 2003-03-01: Christoph Lechleitner <lech@ibcl.at> *             - Added -W option to read bindpasswd from file * 2003-03-01: Juerg Michel *             - Added support for ldap URI via the -H option *               (requires OpenLDAP) * 2001-12-12: Michael Cunningham <m.cunningham@xpedite.com> *             - Added TLS support and partial ldap version 3 support.  * 2001-10-04: Henrik Nordstrom <hno@squid-cache.org> *             - Be consistent with the other helpers in how *               spaces are managed. If there is space characters *               then these are assumed to be part of the password * 2001-09-05: Henrik Nordstrom <hno@squid-cache.org> *             - Added ability to specify another default LDAP port to *               connect to. Persistent connections moved to -P * 2001-05-02: Henrik Nordstrom <hno@squid-cache.org> *             - Support newer OpenLDAP 2.x libraries using the *               revised Internet Draft API which unfortunately *               is not backwards compatible with RFC1823.. * 2001-04-15: Henrik Nordstrom <hno@squid-cache.org> *             - Added command line option for basedn *             - Added the ability to search for the user DN * 2001-04-16: Henrik Nordstrom <hno@squid-cache.org> *             - Added -D binddn -w bindpasswd. * 2001-04-17: Henrik Nordstrom <hno@squid-cache.org> *             - Added -R to disable referrals *             - Added -a to control alias dereferencing * 2001-04-17: Henrik Nordstrom <hno@squid-cache.org> *             - Added -u, DN username attribute name * 2001-04-18: Henrik Nordstrom <hno@squid-cache.org> *             - Allow full filter specifications in -f */#define LDAP_DEPRECATED 1#include "util.h"#include <stdio.h>#include <string.h>#include <stdlib.h>#include <ctype.h>#ifdef _SQUID_MSWIN_		/* Native Windows port and MinGW */#define snprintf _snprintf#include <windows.h>#include <winldap.h>#ifndef LDAPAPI#define LDAPAPI __cdecl#endif#ifdef LDAP_VERSION3#ifndef LDAP_OPT_X_TLS#define LDAP_OPT_X_TLS 0x6000#endif/* Some tricks to allow dynamic bind with ldap_start_tls_s entry point at * run time. */#undef ldap_start_tls_s#if LDAP_UNICODE#define LDAP_START_TLS_S "ldap_start_tls_sW"typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlW *, IN PLDAPControlW *);#else#define LDAP_START_TLS_S "ldap_start_tls_sA"typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlA *, IN PLDAPControlA *);#endif /* LDAP_UNICODE */PFldap_start_tls_s Win32_ldap_start_tls_s;#define ldap_start_tls_s(l,s,c) Win32_ldap_start_tls_s(l,NULL,NULL,s,c)#endif /* LDAP_VERSION3 */#else#include <lber.h>#include <ldap.h>#endif#define PROGRAM_NAME "squid_ldap_auth"/* Global options */static const char *basedn;static const char *searchfilter = NULL;static const char *binddn = NULL;static const char *bindpasswd = NULL;static const char *userattr = "uid";static const char *passwdattr = NULL;static int searchscope = LDAP_SCOPE_SUBTREE;static int persistent = 0;static int bind_once = 0;static int noreferrals = 0;static int aliasderef = LDAP_DEREF_NEVER;#if defined(NETSCAPE_SSL)static const char *sslpath = NULL;static int sslinit = 0;#endifstatic int connect_timeout = 0;static int timelimit = LDAP_NO_LIMIT;static int debug = 0;/* Added for TLS support and version 3 */static int use_tls = 0;static int version = -1;static int checkLDAP(LDAP * ld, const char *userid, const char *password, const char *server, int port);static int readSecret(const char *filename);/* Yuck.. we need to glue to different versions of the API */#ifndef LDAP_NO_ATTRS#define LDAP_NO_ATTRS "1.1"#endif#if defined(LDAP_API_VERSION) && LDAP_API_VERSION > 1823static intsquid_ldap_errno(LDAP * ld){    int err = 0;    ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &err);    return err;}static voidsquid_ldap_set_aliasderef(LDAP * ld, int deref){    ldap_set_option(ld, LDAP_OPT_DEREF, &deref);}static voidsquid_ldap_set_referrals(LDAP * ld, int referrals){    int *value = referrals ? LDAP_OPT_ON : LDAP_OPT_OFF;    ldap_set_option(ld, LDAP_OPT_REFERRALS, value);}static voidsquid_ldap_set_timelimit(LDAP * ld, int timelimit){    ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &timelimit);}static voidsquid_ldap_set_connect_timeout(LDAP * ld, int timelimit){#if defined(LDAP_OPT_NETWORK_TIMEOUT)    struct timeval tv;    tv.tv_sec = timelimit;    tv.tv_usec = 0;    ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);#elif defined(LDAP_X_OPT_CONNECT_TIMEOUT)    timelimit *= 1000;    ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timelimit);#endif}static voidsquid_ldap_memfree(char *p){    ldap_memfree(p);}#elsestatic intsquid_ldap_errno(LDAP * ld){    return ld->ld_errno;}static voidsquid_ldap_set_aliasderef(LDAP * ld, int deref){    ld->ld_deref = deref;}static voidsquid_ldap_set_referrals(LDAP * ld, int referrals){    if (referrals)	ld->ld_options |= ~LDAP_OPT_REFERRALS;    else	ld->ld_options &= ~LDAP_OPT_REFERRALS;}static voidsquid_ldap_set_timelimit(LDAP * ld, int timelimit){    ld->ld_timelimit = timelimit;}static voidsquid_ldap_set_connect_timeout(LDAP * ld, int timelimit){    fprintf(stderr, "Connect timeouts not supported in your LDAP library\n");}static voidsquid_ldap_memfree(char *p){    free(p);}#endif#ifdef LDAP_API_FEATURE_X_OPENLDAP#if LDAP_VENDOR_VERSION > 194#define HAS_URI_SUPPORT 1#endif#endifstatic LDAP *open_ldap_connection(const char *ldapServer, int port){    LDAP *ld = NULL;#if HAS_URI_SUPPORT    if (strstr(ldapServer, "://") != NULL) {	int rc = ldap_initialize(&ld, ldapServer);	if (rc != LDAP_SUCCESS) {	    fprintf(stderr, "\nUnable to connect to LDAPURI:%s\n", ldapServer);	    exit(1);	}    } else#endif#if NETSCAPE_SSL    if (sslpath) {	if (!sslinit && (ldapssl_client_init(sslpath, NULL) != LDAP_SUCCESS)) {	    fprintf(stderr, "\nUnable to initialise SSL with cert path %s\n",		sslpath);	    exit(1);	} else {	    sslinit++;	}	if ((ld = ldapssl_init(ldapServer, port, 1)) == NULL) {	    fprintf(stderr, "\nUnable to connect to SSL LDAP server: %s port:%d\n",		ldapServer, port);	    exit(1);	}    } else#endif    if ((ld = ldap_init(ldapServer, port)) == NULL) {	fprintf(stderr, "\nUnable to connect to LDAP server:%s port:%d\n",	    ldapServer, port);	exit(1);    }    if (connect_timeout)	squid_ldap_set_connect_timeout(ld, connect_timeout);#ifdef LDAP_VERSION3    if (version == -1) {	version = LDAP_VERSION2;    }    if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_SUCCESS) {	fprintf(stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",	    version);	exit(1);    }    if (use_tls) {#ifdef LDAP_OPT_X_TLS	if (version != LDAP_VERSION3) {	    fprintf(stderr, "TLS requires LDAP version 3\n");	    exit(1);	} else if (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS) {	    fprintf(stderr, "Could not Activate TLS connection\n");	    exit(1);	}#else	fprintf(stderr, "TLS not supported with your LDAP library\n");	exit(1);#endif    }#endif    squid_ldap_set_timelimit(ld, timelimit);    squid_ldap_set_referrals(ld, !noreferrals);    squid_ldap_set_aliasderef(ld, aliasderef);    return ld;}/* Make a sanity check on the username to reject oddly typed names */static intvalidUsername(const char *user){    const unsigned char *p = (const unsigned char *) user;    /* Leading whitespace? */    if (xisspace(p[0]))	return 0;    while (p[0] && p[1]) {	if (xisspace(p[0])) {	    /* More than one consequitive space? */	    if (xisspace(p[1]))		return 0;	    /* or odd space type character used? */	    if (p[0] != ' ')		return 0;	}	p++;    }    /* Trailing whitespace? */    if (xisspace(p[0]))	return 0;    return 1;}intmain(int argc, char **argv){    char buf[1024];    char *user, *passwd;    char *ldapServer = NULL;    LDAP *ld = NULL;    int tryagain;    int port = LDAP_PORT;    setbuf(stdout, NULL);    while (argc > 1 && argv[1][0] == '-') {	const char *value = "";	char option = argv[1][1];	switch (option) {	case 'P':	case 'R':	case 'z':	case 'Z':	case 'd':	case 'O':	    break;	default:	    if (strlen(argv[1]) > 2) {		value = argv[1] + 2;	    } else if (argc > 2) {		value = argv[2];		argv++;		argc--;	    } else		value = "";	    break;	}	argv++;	argc--;	switch (option) {	case 'H':#if !HAS_URI_SUPPORT	    fprintf(stderr, "ERROR: Your LDAP library does not have URI support\n");	    exit(1);#endif	    /* Fall thru to -h */	case 'h':	    if (ldapServer) {		int len = strlen(ldapServer) + 1 + strlen(value) + 1;		char *newhost = malloc(len);		snprintf(newhost, len, "%s %s", ldapServer, value);		free(ldapServer);		ldapServer = newhost;	    } else {		ldapServer = strdup(value);	    }	    break;