Annotation of embedaddon/lighttpd/src/mod_auth.c, revision 1.1.1.2.2.1
1.1 misho 1: #include "plugin.h"
2: #include "http_auth.h"
3: #include "log.h"
4: #include "response.h"
5:
6: #include <sys/types.h>
7: #include <sys/stat.h>
8:
9: #include <stdlib.h>
10: #include <string.h>
11: #include <errno.h>
12: #include <fcntl.h>
13: #include <unistd.h>
1.1.1.2.2.1! misho 14: #include <mysql/mysql.h>
1.1 misho 15:
16: handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
17:
18:
19: /**
20: * the basic and digest auth framework
21: *
22: * - config handling
23: * - protocol handling
24: *
25: * http_auth.c
26: * http_auth_digest.c
27: *
28: * do the real work
29: */
30:
31: INIT_FUNC(mod_auth_init) {
32: mod_auth_plugin_data *p;
33:
34: p = calloc(1, sizeof(*p));
35:
36: p->tmp_buf = buffer_init();
37:
38: p->auth_user = buffer_init();
39: #ifdef USE_LDAP
40: p->ldap_filter = buffer_init();
41: #endif
42:
43: return p;
44: }
45:
46: FREE_FUNC(mod_auth_free) {
47: mod_auth_plugin_data *p = p_d;
48:
49: UNUSED(srv);
50:
51: if (!p) return HANDLER_GO_ON;
52:
53: buffer_free(p->tmp_buf);
54: buffer_free(p->auth_user);
55: #ifdef USE_LDAP
56: buffer_free(p->ldap_filter);
57: #endif
58:
59: if (p->config_storage) {
60: size_t i;
61: for (i = 0; i < srv->config_context->used; i++) {
62: mod_auth_plugin_config *s = p->config_storage[i];
63:
64: if (!s) continue;
65:
66: array_free(s->auth_require);
67: buffer_free(s->auth_plain_groupfile);
68: buffer_free(s->auth_plain_userfile);
69: buffer_free(s->auth_htdigest_userfile);
70: buffer_free(s->auth_htpasswd_userfile);
71: buffer_free(s->auth_backend_conf);
72:
73: buffer_free(s->auth_ldap_hostname);
74: buffer_free(s->auth_ldap_basedn);
75: buffer_free(s->auth_ldap_binddn);
76: buffer_free(s->auth_ldap_bindpw);
77: buffer_free(s->auth_ldap_filter);
78: buffer_free(s->auth_ldap_cafile);
79:
80: #ifdef USE_LDAP
81: buffer_free(s->ldap_filter_pre);
82: buffer_free(s->ldap_filter_post);
83:
84: if (s->ldap) ldap_unbind_s(s->ldap);
85: #endif
86:
1.1.1.2.2.1! misho 87: buffer_free(s->auth_mysql_host);
! 88: buffer_free(s->auth_mysql_user);
! 89: buffer_free(s->auth_mysql_pass);
! 90: buffer_free(s->auth_mysql_db);
! 91: buffer_free(s->auth_mysql_socket);
! 92: buffer_free(s->auth_mysql_users_table);
! 93: buffer_free(s->auth_mysql_col_user);
! 94: buffer_free(s->auth_mysql_col_pass);
! 95: buffer_free(s->auth_mysql_col_realm);
! 96: buffer_free(s->auth_mysql_domains_table);
! 97: buffer_free(s->auth_mysql_col_domain);
! 98: buffer_free(s->auth_mysql_domains_table_col_domain_id);
! 99: buffer_free(s->auth_mysql_users_table_col_domain_id);
! 100:
1.1 misho 101: free(s);
102: }
103: free(p->config_storage);
104: }
105:
106: free(p);
107:
108: return HANDLER_GO_ON;
109: }
110:
111: #define PATCH(x) \
112: p->conf.x = s->x;
113: static int mod_auth_patch_connection(server *srv, connection *con, mod_auth_plugin_data *p) {
114: size_t i, j;
115: mod_auth_plugin_config *s = p->config_storage[0];
116:
117: PATCH(auth_backend);
118: PATCH(auth_plain_groupfile);
119: PATCH(auth_plain_userfile);
120: PATCH(auth_htdigest_userfile);
121: PATCH(auth_htpasswd_userfile);
122: PATCH(auth_require);
123: PATCH(auth_debug);
124: PATCH(auth_ldap_hostname);
125: PATCH(auth_ldap_basedn);
126: PATCH(auth_ldap_binddn);
127: PATCH(auth_ldap_bindpw);
128: PATCH(auth_ldap_filter);
129: PATCH(auth_ldap_cafile);
130: PATCH(auth_ldap_starttls);
131: PATCH(auth_ldap_allow_empty_pw);
132: #ifdef USE_LDAP
133: p->anon_conf = s;
134: PATCH(ldap_filter_pre);
135: PATCH(ldap_filter_post);
136: #endif
137:
1.1.1.2.2.1! misho 138: PATCH(auth_mysql_host);
! 139: PATCH(auth_mysql_user);
! 140: PATCH(auth_mysql_pass);
! 141: PATCH(auth_mysql_db);
! 142: PATCH(auth_mysql_port);
! 143: PATCH(auth_mysql_socket);
! 144: PATCH(auth_mysql_users_table);
! 145: PATCH(auth_mysql_col_user);
! 146: PATCH(auth_mysql_col_pass);
! 147: PATCH(auth_mysql_col_realm);
! 148: PATCH(auth_mysql_domains_table);
! 149: PATCH(auth_mysql_col_domain);
! 150: PATCH(auth_mysql_domains_table_col_domain_id);
! 151: PATCH(auth_mysql_users_table_col_domain_id);
! 152:
1.1 misho 153: /* skip the first, the global context */
154: for (i = 1; i < srv->config_context->used; i++) {
155: data_config *dc = (data_config *)srv->config_context->data[i];
156: s = p->config_storage[i];
157:
158: /* condition didn't match */
159: if (!config_check_cond(srv, con, dc)) continue;
160:
161: /* merge config */
162: for (j = 0; j < dc->value->used; j++) {
163: data_unset *du = dc->value->data[j];
164:
165: if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend"))) {
166: PATCH(auth_backend);
167: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.groupfile"))) {
168: PATCH(auth_plain_groupfile);
169: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.userfile"))) {
170: PATCH(auth_plain_userfile);
171: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htdigest.userfile"))) {
172: PATCH(auth_htdigest_userfile);
173: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htpasswd.userfile"))) {
174: PATCH(auth_htpasswd_userfile);
175: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.require"))) {
176: PATCH(auth_require);
177: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.debug"))) {
178: PATCH(auth_debug);
179: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.hostname"))) {
180: PATCH(auth_ldap_hostname);
181: #ifdef USE_LDAP
182: p->anon_conf = s;
183: #endif
184: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.base-dn"))) {
185: PATCH(auth_ldap_basedn);
186: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.filter"))) {
187: PATCH(auth_ldap_filter);
188: #ifdef USE_LDAP
189: PATCH(ldap_filter_pre);
190: PATCH(ldap_filter_post);
191: #endif
192: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.ca-file"))) {
193: PATCH(auth_ldap_cafile);
194: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.starttls"))) {
195: PATCH(auth_ldap_starttls);
196: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-dn"))) {
197: PATCH(auth_ldap_binddn);
198: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-pw"))) {
199: PATCH(auth_ldap_bindpw);
200: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.allow-empty-pw"))) {
201: PATCH(auth_ldap_allow_empty_pw);
1.1.1.2.2.1! misho 202: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.host"))) {
! 203: PATCH(auth_mysql_host);
! 204: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.user"))) {
! 205: PATCH(auth_mysql_user);
! 206: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.pass"))) {
! 207: PATCH(auth_mysql_pass);
! 208: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.db"))) {
! 209: PATCH(auth_mysql_db);
! 210: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.port"))) {
! 211: PATCH(auth_mysql_port);
! 212: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.socket"))) {
! 213: PATCH(auth_mysql_user);
! 214: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.users_table"))) {
! 215: PATCH(auth_mysql_users_table);
! 216: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.col_user"))) {
! 217: PATCH(auth_mysql_col_user);
! 218: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.col_pass"))) {
! 219: PATCH(auth_mysql_col_pass);
! 220: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.col_realm"))) {
! 221: PATCH(auth_mysql_col_realm);
! 222: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.domains_table"))) {
! 223: PATCH(auth_mysql_domains_table);
! 224: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.col_domain"))) {
! 225: PATCH(auth_mysql_col_domain);
! 226: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.domains_table_col_domain_id"))) {
! 227: PATCH(auth_mysql_domains_table_col_domain_id);
! 228: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.mysql.users_table_col_domain_id"))) {
! 229: PATCH(auth_mysql_users_table_col_domain_id);
1.1 misho 230: }
231: }
232: }
233:
234: return 0;
235: }
236: #undef PATCH
237:
238: static handler_t mod_auth_uri_handler(server *srv, connection *con, void *p_d) {
239: size_t k;
240: int auth_required = 0, auth_satisfied = 0;
241: char *http_authorization = NULL;
242: const char *auth_type = NULL;
243: data_string *ds;
244: mod_auth_plugin_data *p = p_d;
245: array *req;
246: data_string *req_method;
247:
248: /* select the right config */
249: mod_auth_patch_connection(srv, con, p);
250:
251: if (p->conf.auth_require == NULL) return HANDLER_GO_ON;
252:
253: /*
254: * AUTH
255: *
256: */
257:
258: /* do we have to ask for auth ? */
259:
260: auth_required = 0;
261: auth_satisfied = 0;
262:
263: /* search auth-directives for path */
264: for (k = 0; k < p->conf.auth_require->used; k++) {
265: buffer *require = p->conf.auth_require->data[k]->key;
266:
267: if (require->used == 0) continue;
268: if (con->uri.path->used < require->used) continue;
269:
270: /* if we have a case-insensitive FS we have to lower-case the URI here too */
271:
272: if (con->conf.force_lowercase_filenames) {
273: if (0 == strncasecmp(con->uri.path->ptr, require->ptr, require->used - 1)) {
274: auth_required = 1;
275: break;
276: }
277: } else {
278: if (0 == strncmp(con->uri.path->ptr, require->ptr, require->used - 1)) {
279: auth_required = 1;
280: break;
281: }
282: }
283: }
284:
285: /* nothing to do for us */
286: if (auth_required == 0) return HANDLER_GO_ON;
287:
288: req = ((data_array *)(p->conf.auth_require->data[k]))->value;
289: req_method = (data_string *)array_get_element(req, "method");
290:
291: if (0 == strcmp(req_method->value->ptr, "extern")) {
292: /* require REMOTE_USER to be already set */
293: if (NULL == (ds = (data_string *)array_get_element(con->environment, "REMOTE_USER"))) {
294: con->http_status = 401;
295: con->mode = DIRECT;
296: return HANDLER_FINISHED;
297: } else if (http_auth_match_rules(srv, req, ds->value->ptr, NULL, NULL)) {
298: log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match");
299: con->http_status = 401;
300: con->mode = DIRECT;
301: return HANDLER_FINISHED;
302: } else {
303: return HANDLER_GO_ON;
304: }
305: }
306:
307: /* try to get Authorization-header */
308:
309: if (NULL != (ds = (data_string *)array_get_element(con->request.headers, "Authorization")) && ds->value->used) {
310: char *auth_realm;
311:
312: http_authorization = ds->value->ptr;
313:
314: /* parse auth-header */
315: if (NULL != (auth_realm = strchr(http_authorization, ' '))) {
316: int auth_type_len = auth_realm - http_authorization;
317:
318: if ((auth_type_len == 5) &&
319: (0 == strncasecmp(http_authorization, "Basic", auth_type_len))) {
320: auth_type = "Basic";
321:
322: if (0 == strcmp(req_method->value->ptr, "basic")) {
323: auth_satisfied = http_auth_basic_check(srv, con, p, req, auth_realm+1);
324: }
325: } else if ((auth_type_len == 6) &&
326: (0 == strncasecmp(http_authorization, "Digest", auth_type_len))) {
327: auth_type = "Digest";
328: if (0 == strcmp(req_method->value->ptr, "digest")) {
329: if (-1 == (auth_satisfied = http_auth_digest_check(srv, con, p, req, auth_realm+1))) {
330: con->http_status = 400;
331: con->mode = DIRECT;
332:
333: /* a field was missing */
334:
335: return HANDLER_FINISHED;
336: }
337: }
338: } else {
339: log_error_write(srv, __FILE__, __LINE__, "ss",
340: "unknown authentification type:",
341: http_authorization);
342: }
343: }
344: }
345:
346: if (!auth_satisfied) {
347: data_string *method, *realm;
348: method = (data_string *)array_get_element(req, "method");
349: realm = (data_string *)array_get_element(req, "realm");
350:
351: con->http_status = 401;
352: con->mode = DIRECT;
353:
354: if (0 == strcmp(method->value->ptr, "basic")) {
355: buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Basic realm=\""));
356: buffer_append_string_buffer(p->tmp_buf, realm->value);
357: buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\""));
358:
359: response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
360: } else if (0 == strcmp(method->value->ptr, "digest")) {
361: char hh[33];
362: http_auth_digest_generate_nonce(srv, p, srv->tmp_buf, hh);
363:
364: buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Digest realm=\""));
365: buffer_append_string_buffer(p->tmp_buf, realm->value);
366: buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", nonce=\""));
367: buffer_append_string(p->tmp_buf, hh);
368: buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", qop=\"auth\""));
369:
370: response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
371: } else {
372: /* evil */
373: }
374: return HANDLER_FINISHED;
375: } else {
376: /* the REMOTE_USER header */
377:
378: if (NULL == (ds = (data_string *)array_get_element(con->environment, "REMOTE_USER"))) {
379: if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
380: ds = data_string_init();
381: }
382: buffer_copy_string(ds->key, "REMOTE_USER");
383: array_insert_unique(con->environment, (data_unset *)ds);
384: }
385: buffer_copy_string_buffer(ds->value, p->auth_user);
386:
387: /* AUTH_TYPE environment */
388:
389: if (NULL == (ds = (data_string *)array_get_element(con->environment, "AUTH_TYPE"))) {
390: if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
391: ds = data_string_init();
392: }
393: buffer_copy_string(ds->key, "AUTH_TYPE");
394: array_insert_unique(con->environment, (data_unset *)ds);
395: }
396: buffer_copy_string(ds->value, auth_type);
397: }
398:
399: return HANDLER_GO_ON;
400: }
401:
402: SETDEFAULTS_FUNC(mod_auth_set_defaults) {
403: mod_auth_plugin_data *p = p_d;
404: size_t i;
405:
406: config_values_t cv[] = {
407: { "auth.backend", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
408: { "auth.backend.plain.groupfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
409: { "auth.backend.plain.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
410: { "auth.require", NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 3 */
411: { "auth.backend.ldap.hostname", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 4 */
412: { "auth.backend.ldap.base-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 5 */
413: { "auth.backend.ldap.filter", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 6 */
414: { "auth.backend.ldap.ca-file", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 7 */
415: { "auth.backend.ldap.starttls", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 8 */
416: { "auth.backend.ldap.bind-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 9 */
417: { "auth.backend.ldap.bind-pw", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 10 */
1.1.1.2.2.1! misho 418: { "auth.backend.ldap.allow-empty-pw", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },
1.1 misho 419: { "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 12 */
420: { "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 13 */
421: { "auth.debug", NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION }, /* 14 */
1.1.1.2.2.1! misho 422: { "auth.backend.mysql.host", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 423: { "auth.backend.mysql.user", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 424: { "auth.backend.mysql.pass", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 425: { "auth.backend.mysql.db", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 426: { "auth.backend.mysql.port", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 427: { "auth.backend.mysql.socket", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 428: { "auth.backend.mysql.users_table", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 429: { "auth.backend.mysql.col_user", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 430: { "auth.backend.mysql.col_pass", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 431: { "auth.backend.mysql.col_realm", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 23 */
! 432: { "auth.backend.mysql.domains_table", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 433: { "auth.backend.mysql.col_domain", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 434: { "auth.backend.mysql.domains_table_col_domain_id", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
! 435: { "auth.backend.mysql.users_table_col_domain_id", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 27 */
1.1 misho 436: { NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
437: };
438:
1.1.1.2 misho 439: p->config_storage = calloc(1, srv->config_context->used * sizeof(mod_auth_plugin_config *));
1.1 misho 440:
441: for (i = 0; i < srv->config_context->used; i++) {
442: mod_auth_plugin_config *s;
443: size_t n;
444: data_array *da;
445: array *ca;
446:
447: s = calloc(1, sizeof(mod_auth_plugin_config));
448: s->auth_plain_groupfile = buffer_init();
449: s->auth_plain_userfile = buffer_init();
450: s->auth_htdigest_userfile = buffer_init();
451: s->auth_htpasswd_userfile = buffer_init();
452: s->auth_backend_conf = buffer_init();
453:
454: s->auth_ldap_hostname = buffer_init();
455: s->auth_ldap_basedn = buffer_init();
456: s->auth_ldap_binddn = buffer_init();
457: s->auth_ldap_bindpw = buffer_init();
458: s->auth_ldap_filter = buffer_init();
459: s->auth_ldap_cafile = buffer_init();
460: s->auth_ldap_starttls = 0;
461: s->auth_debug = 0;
462:
463: s->auth_require = array_init();
1.1.1.2.2.1! misho 464: s->mysql_conn = NULL;
! 465: s->auth_mysql_host = buffer_init();
! 466: s->auth_mysql_user = buffer_init();
! 467: s->auth_mysql_pass = buffer_init();
! 468: s->auth_mysql_db = buffer_init();
! 469: s->auth_mysql_port = buffer_init();
! 470: s->auth_mysql_socket = buffer_init();
! 471: s->auth_mysql_users_table = buffer_init();
! 472: s->auth_mysql_col_user = buffer_init();
! 473: s->auth_mysql_col_pass = buffer_init();
! 474: s->auth_mysql_col_realm = buffer_init();
! 475: s->auth_mysql_domains_table = buffer_init();
! 476: s->auth_mysql_col_domain = buffer_init();
! 477: s->auth_mysql_domains_table_col_domain_id = buffer_init();
! 478: s->auth_mysql_users_table_col_domain_id = buffer_init();
! 479:
1.1 misho 480:
481: #ifdef USE_LDAP
482: s->ldap_filter_pre = buffer_init();
483: s->ldap_filter_post = buffer_init();
484: s->ldap = NULL;
485: #endif
486:
487: cv[0].destination = s->auth_backend_conf;
488: cv[1].destination = s->auth_plain_groupfile;
489: cv[2].destination = s->auth_plain_userfile;
490: cv[3].destination = s->auth_require;
491: cv[4].destination = s->auth_ldap_hostname;
492: cv[5].destination = s->auth_ldap_basedn;
493: cv[6].destination = s->auth_ldap_filter;
494: cv[7].destination = s->auth_ldap_cafile;
495: cv[8].destination = &(s->auth_ldap_starttls);
496: cv[9].destination = s->auth_ldap_binddn;
497: cv[10].destination = s->auth_ldap_bindpw;
498: cv[11].destination = &(s->auth_ldap_allow_empty_pw);
499: cv[12].destination = s->auth_htdigest_userfile;
500: cv[13].destination = s->auth_htpasswd_userfile;
501: cv[14].destination = &(s->auth_debug);
1.1.1.2.2.1! misho 502: cv[15].destination = s->auth_mysql_host;
! 503: cv[16].destination = s->auth_mysql_user;
! 504: cv[17].destination = s->auth_mysql_pass;
! 505: cv[18].destination = s->auth_mysql_db;
! 506: cv[19].destination = s->auth_mysql_port;
! 507: cv[20].destination = s->auth_mysql_socket;
! 508: cv[21].destination = s->auth_mysql_users_table;
! 509: cv[22].destination = s->auth_mysql_col_user;
! 510: cv[23].destination = s->auth_mysql_col_pass;
! 511: cv[24].destination = s->auth_mysql_col_realm;
! 512: cv[25].destination = s->auth_mysql_domains_table;
! 513: cv[26].destination = s->auth_mysql_col_domain;
! 514: cv[27].destination = s->auth_mysql_domains_table_col_domain_id;
! 515: cv[28].destination = s->auth_mysql_users_table_col_domain_id;
1.1 misho 516: p->config_storage[i] = s;
517: ca = ((data_config *)srv->config_context->data[i])->value;
518:
519: if (0 != config_insert_values_global(srv, ca, cv)) {
520: return HANDLER_ERROR;
521: }
522:
523: if (s->auth_backend_conf->used) {
524: if (0 == strcmp(s->auth_backend_conf->ptr, "htpasswd")) {
525: s->auth_backend = AUTH_BACKEND_HTPASSWD;
526: } else if (0 == strcmp(s->auth_backend_conf->ptr, "htdigest")) {
527: s->auth_backend = AUTH_BACKEND_HTDIGEST;
528: } else if (0 == strcmp(s->auth_backend_conf->ptr, "plain")) {
529: s->auth_backend = AUTH_BACKEND_PLAIN;
530: } else if (0 == strcmp(s->auth_backend_conf->ptr, "ldap")) {
531: s->auth_backend = AUTH_BACKEND_LDAP;
1.1.1.2.2.1! misho 532: } else if (0 == strcmp(s->auth_backend_conf->ptr, "mysql")) {
! 533: s->auth_backend = AUTH_BACKEND_MYSQL;
1.1 misho 534: } else {
535: log_error_write(srv, __FILE__, __LINE__, "sb", "auth.backend not supported:", s->auth_backend_conf);
536:
537: return HANDLER_ERROR;
538: }
539: }
540:
541: #ifdef USE_LDAP
542: if (s->auth_ldap_filter->used) {
543: char *dollar;
544:
545: /* parse filter */
546:
547: if (NULL == (dollar = strchr(s->auth_ldap_filter->ptr, '$'))) {
548: log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.filter is missing a replace-operator '$'");
549:
550: return HANDLER_ERROR;
551: }
552:
553: buffer_copy_string_len(s->ldap_filter_pre, s->auth_ldap_filter->ptr, dollar - s->auth_ldap_filter->ptr);
554: buffer_copy_string(s->ldap_filter_post, dollar+1);
555: }
556: #endif
557:
558: /* no auth.require for this section */
559: if (NULL == (da = (data_array *)array_get_element(ca, "auth.require"))) continue;
560:
561: if (da->type != TYPE_ARRAY) continue;
562:
563: for (n = 0; n < da->value->used; n++) {
564: size_t m;
565: data_array *da_file = (data_array *)da->value->data[n];
566: const char *method, *realm, *require;
567:
568: if (da->value->data[n]->type != TYPE_ARRAY) {
569: log_error_write(srv, __FILE__, __LINE__, "ss",
570: "auth.require should contain an array as in:",
571: "auth.require = ( \"...\" => ( ..., ...) )");
572:
573: return HANDLER_ERROR;
574: }
575:
576: method = realm = require = NULL;
577:
578: for (m = 0; m < da_file->value->used; m++) {
579: if (da_file->value->data[m]->type == TYPE_STRING) {
580: if (0 == strcmp(da_file->value->data[m]->key->ptr, "method")) {
581: method = ((data_string *)(da_file->value->data[m]))->value->ptr;
582: } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "realm")) {
583: realm = ((data_string *)(da_file->value->data[m]))->value->ptr;
584: } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "require")) {
585: require = ((data_string *)(da_file->value->data[m]))->value->ptr;
586: } else {
587: log_error_write(srv, __FILE__, __LINE__, "ssbs",
588: "the field is unknown in:",
589: "auth.require = ( \"...\" => ( ..., -> \"",
590: da_file->value->data[m]->key,
591: "\" <- => \"...\" ) )");
592:
593: return HANDLER_ERROR;
594: }
595: } else {
596: log_error_write(srv, __FILE__, __LINE__, "ssbs",
597: "a string was expected for:",
598: "auth.require = ( \"...\" => ( ..., -> \"",
599: da_file->value->data[m]->key,
600: "\" <- => \"...\" ) )");
601:
602: return HANDLER_ERROR;
603: }
604: }
605:
606: if (method == NULL) {
607: log_error_write(srv, __FILE__, __LINE__, "ss",
608: "the method field is missing in:",
609: "auth.require = ( \"...\" => ( ..., \"method\" => \"...\" ) )");
610: return HANDLER_ERROR;
611: } else {
612: if (0 != strcmp(method, "basic") &&
613: 0 != strcmp(method, "digest") &&
614: 0 != strcmp(method, "extern")) {
615: log_error_write(srv, __FILE__, __LINE__, "ss",
616: "method has to be either \"basic\", \"digest\" or \"extern\" in",
617: "auth.require = ( \"...\" => ( ..., \"method\" => \"...\") )");
618: return HANDLER_ERROR;
619: }
620: }
621:
622: if (realm == NULL) {
623: log_error_write(srv, __FILE__, __LINE__, "ss",
624: "the realm field is missing in:",
625: "auth.require = ( \"...\" => ( ..., \"realm\" => \"...\" ) )");
626: return HANDLER_ERROR;
627: }
628:
629: if (require == NULL) {
630: log_error_write(srv, __FILE__, __LINE__, "ss",
631: "the require field is missing in:",
632: "auth.require = ( \"...\" => ( ..., \"require\" => \"...\" ) )");
633: return HANDLER_ERROR;
634: }
635:
636: if (method && realm && require) {
637: data_string *ds;
638: data_array *a;
639:
640: a = data_array_init();
641: buffer_copy_string_buffer(a->key, da_file->key);
642:
643: ds = data_string_init();
644:
645: buffer_copy_string_len(ds->key, CONST_STR_LEN("method"));
646: buffer_copy_string(ds->value, method);
647:
648: array_insert_unique(a->value, (data_unset *)ds);
649:
650: ds = data_string_init();
651:
652: buffer_copy_string_len(ds->key, CONST_STR_LEN("realm"));
653: buffer_copy_string(ds->value, realm);
654:
655: array_insert_unique(a->value, (data_unset *)ds);
656:
657: ds = data_string_init();
658:
659: buffer_copy_string_len(ds->key, CONST_STR_LEN("require"));
660: buffer_copy_string(ds->value, require);
661:
662: array_insert_unique(a->value, (data_unset *)ds);
663:
664: array_insert_unique(s->auth_require, (data_unset *)a);
665: }
666: }
667:
668: switch(s->auth_ldap_hostname->used) {
669: case AUTH_BACKEND_LDAP: {
670: handler_t ret = auth_ldap_init(srv, s);
671: if (ret == HANDLER_ERROR)
672: return (ret);
673: break;
674: }
1.1.1.2.2.1! misho 675: case AUTH_BACKEND_MYSQL: {
! 676: int port = atoi(s->auth_mysql_port->ptr);
! 677:
! 678: if (p->conf.auth_mysql_socket->ptr != NULL)
! 679: if (0 == strcmp(s->auth_mysql_socket->ptr, "")) s->auth_mysql_socket->ptr = NULL;
! 680:
! 681: s->mysql_conn = mysql_init(NULL);
! 682: if (!mysql_real_connect(s->mysql_conn, s->auth_mysql_host->ptr, s->auth_mysql_user->ptr, s->auth_mysql_pass->ptr, s->auth_mysql_db->ptr, port, NULL, 0))
! 683: {
! 684: log_error_write(srv, __FILE__, __LINE__, "sbsbsbsbss",
! 685: "opening connection to mysql:", s->auth_mysql_host,
! 686: "user:", s->auth_mysql_user,
! 687: "pass:", s->auth_mysql_pass,
! 688: "db:", s->auth_mysql_db,
! 689: "failed:", strerror(errno));
! 690:
! 691: return HANDLER_ERROR;
! 692: }
! 693: mysql_close(s->mysql_conn);
! 694:
! 695: break;
! 696: }
1.1 misho 697: default:
698: break;
699: }
700: }
701:
702: return HANDLER_GO_ON;
703: }
704:
705: handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s) {
706: #ifdef USE_LDAP
707: int ret;
708: #if 0
709: if (s->auth_ldap_basedn->used == 0) {
710: log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.base-dn has to be set");
711:
712: return HANDLER_ERROR;
713: }
714: #endif
715:
716: if (s->auth_ldap_hostname->used) {
717: /* free old context */
718: if (NULL != s->ldap) ldap_unbind_s(s->ldap);
719:
720: if (NULL == (s->ldap = ldap_init(s->auth_ldap_hostname->ptr, LDAP_PORT))) {
721: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
722:
723: return HANDLER_ERROR;
724: }
725:
726: ret = LDAP_VERSION3;
727: if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(s->ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
728: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
729:
730: return HANDLER_ERROR;
731: }
732:
733: if (s->auth_ldap_starttls) {
734: /* if no CA file is given, it is ok, as we will use encryption
735: * if the server requires a CAfile it will tell us */
736: if (!buffer_is_empty(s->auth_ldap_cafile)) {
737: if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,
738: s->auth_ldap_cafile->ptr))) {
739: log_error_write(srv, __FILE__, __LINE__, "ss",
740: "Loading CA certificate failed:", ldap_err2string(ret));
741:
742: return HANDLER_ERROR;
743: }
744: }
745:
746: if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(s->ldap, NULL, NULL))) {
747: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
748:
749: return HANDLER_ERROR;
750: }
751: }
752:
753:
754: /* 1. */
755: if (s->auth_ldap_binddn->used) {
756: if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, s->auth_ldap_binddn->ptr, s->auth_ldap_bindpw->ptr))) {
757: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
758:
759: return HANDLER_ERROR;
760: }
761: } else {
762: if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, NULL, NULL))) {
763: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
764:
765: return HANDLER_ERROR;
766: }
767: }
768: }
769: return HANDLER_GO_ON;
770: #else
771: UNUSED(s);
772: log_error_write(srv, __FILE__, __LINE__, "s", "no ldap support available");
773: return HANDLER_ERROR;
774: #endif
775: }
776:
777: int mod_auth_plugin_init(plugin *p);
778: int mod_auth_plugin_init(plugin *p) {
779: p->version = LIGHTTPD_VERSION_ID;
780: p->name = buffer_init_string("auth");
781: p->init = mod_auth_init;
782: p->set_defaults = mod_auth_set_defaults;
783: p->handle_uri_clean = mod_auth_uri_handler;
784: p->cleanup = mod_auth_free;
785:
786: p->data = NULL;
787:
788: return 0;
789: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to mod_auth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / src