Annotation of embedaddon/sudo/plugins/sudoers/ldap.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (c) 2003-2011 Todd C. Miller <Todd.Miller@courtesan.com>
! 3: *
! 4: * This code is derived from software contributed by Aaron Spangler.
! 5: *
! 6: * Permission to use, copy, modify, and distribute this software for any
! 7: * purpose with or without fee is hereby granted, provided that the above
! 8: * copyright notice and this permission notice appear in all copies.
! 9: *
! 10: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 11: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 12: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 13: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 14: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 15: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 16: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 17: */
! 18:
! 19: #include <config.h>
! 20:
! 21: #include <sys/types.h>
! 22: #include <sys/time.h>
! 23: #include <sys/param.h>
! 24: #include <sys/stat.h>
! 25: #include <stdio.h>
! 26: #ifdef STDC_HEADERS
! 27: # include <stdlib.h>
! 28: # include <stddef.h>
! 29: #else
! 30: # ifdef HAVE_STDLIB_H
! 31: # include <stdlib.h>
! 32: # endif
! 33: #endif /* STDC_HEADERS */
! 34: #ifdef HAVE_STRING_H
! 35: # include <string.h>
! 36: #endif /* HAVE_STRING_H */
! 37: #ifdef HAVE_STRINGS_H
! 38: # include <strings.h>
! 39: #endif /* HAVE_STRINGS_H */
! 40: #ifdef HAVE_UNISTD_H
! 41: # include <unistd.h>
! 42: #endif /* HAVE_UNISTD_H */
! 43: #if TIME_WITH_SYS_TIME
! 44: # include <time.h>
! 45: #endif
! 46: #include <ctype.h>
! 47: #include <pwd.h>
! 48: #include <grp.h>
! 49: #include <netinet/in.h>
! 50: #include <arpa/inet.h>
! 51: #include <netdb.h>
! 52: #ifdef HAVE_LBER_H
! 53: # include <lber.h>
! 54: #endif
! 55: #include <ldap.h>
! 56: #if defined(HAVE_LDAP_SSL_H)
! 57: # include <ldap_ssl.h>
! 58: #elif defined(HAVE_MPS_LDAP_SSL_H)
! 59: # include <mps/ldap_ssl.h>
! 60: #endif
! 61: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 62: # ifdef HAVE_SASL_SASL_H
! 63: # include <sasl/sasl.h>
! 64: # else
! 65: # include <sasl.h>
! 66: # endif
! 67: # if HAVE_GSS_KRB5_CCACHE_NAME
! 68: # if defined(HAVE_GSSAPI_GSSAPI_KRB5_H)
! 69: # include <gssapi/gssapi.h>
! 70: # include <gssapi/gssapi_krb5.h>
! 71: # elif defined(HAVE_GSSAPI_GSSAPI_H)
! 72: # include <gssapi/gssapi.h>
! 73: # else
! 74: # include <gssapi.h>
! 75: # endif
! 76: # endif
! 77: #endif
! 78:
! 79: #include "sudoers.h"
! 80: #include "parse.h"
! 81: #include "lbuf.h"
! 82:
! 83: #ifndef LDAP_OPT_SUCCESS
! 84: # define LDAP_OPT_SUCCESS LDAP_SUCCESS
! 85: #endif
! 86:
! 87: #ifndef LDAPS_PORT
! 88: # define LDAPS_PORT 636
! 89: #endif
! 90:
! 91: #if defined(HAVE_LDAP_SASL_INTERACTIVE_BIND_S) && !defined(LDAP_SASL_QUIET)
! 92: # define LDAP_SASL_QUIET 0
! 93: #endif
! 94:
! 95: #ifndef HAVE_LDAP_UNBIND_EXT_S
! 96: #define ldap_unbind_ext_s(a, b, c) ldap_unbind_s(a)
! 97: #endif
! 98:
! 99: #ifndef HAVE_LDAP_SEARCH_EXT_S
! 100: # ifdef HAVE_LDAP_SEARCH_ST
! 101: # define ldap_search_ext_s(a, b, c, d, e, f, g, h, i, j, k) \
! 102: ldap_search_st(a, b, c, d, e, f, i, k)
! 103: # else
! 104: # define ldap_search_ext_s(a, b, c, d, e, f, g, h, i, j, k) \
! 105: ldap_search_s(a, b, c, d, e, f, k)
! 106: # endif
! 107: #endif
! 108:
! 109: #define LDAP_FOREACH(var, ld, res) \
! 110: for ((var) = ldap_first_entry((ld), (res)); \
! 111: (var) != NULL; \
! 112: (var) = ldap_next_entry((ld), (var)))
! 113:
! 114: #define DPRINTF(args, level) if (ldap_conf.debug >= level) warningx args
! 115:
! 116: #define CONF_BOOL 0
! 117: #define CONF_INT 1
! 118: #define CONF_STR 2
! 119: #define CONF_LIST_STR 4
! 120: #define CONF_DEREF_VAL 5
! 121:
! 122: #define SUDO_LDAP_SSL 1
! 123: #define SUDO_LDAP_STARTTLS 2
! 124:
! 125: /* The TIMEFILTER_LENGTH includes the filter itself plus the global AND
! 126: wrapped around the user filter and the time filter when timed entries
! 127: are used. The length is computed as follows:
! 128: 85 for the filter
! 129: + 2 * 13 for the now timestamp
! 130: + 3 for the global AND
! 131: */
! 132: #define TIMEFILTER_LENGTH 114
! 133:
! 134: /*
! 135: * The ldap_search structure implements a linked list of ldap and
! 136: * search result pointers, which allows us to remove them after
! 137: * all search results have been combined in memory.
! 138: * XXX - should probably be a tailq since we do appends
! 139: */
! 140: struct ldap_search_list {
! 141: LDAP *ldap;
! 142: LDAPMessage *searchresult;
! 143: struct ldap_search_list *next;
! 144: };
! 145:
! 146: /*
! 147: * The ldap_entry_wrapper structure is used to implement sorted result entries.
! 148: * A double is used for the order to allow for insertion of new entries
! 149: * without having to renumber everything.
! 150: * Note: there is no standard floating point type in LDAP.
! 151: * As a result, some LDAP servers will only allow an integer.
! 152: */
! 153: struct ldap_entry_wrapper {
! 154: LDAPMessage *entry;
! 155: double order;
! 156: };
! 157:
! 158: /*
! 159: * The ldap_result structure contains the list of matching searches as
! 160: * well as an array of all result entries sorted by the sudoOrder attribute.
! 161: */
! 162: struct ldap_result {
! 163: struct ldap_search_list *searches;
! 164: struct ldap_entry_wrapper *entries;
! 165: int allocated_entries;
! 166: int nentries;
! 167: int user_matches;
! 168: int host_matches;
! 169: };
! 170: #define ALLOCATION_INCREMENT 100
! 171:
! 172: struct ldap_config_table {
! 173: const char *conf_str; /* config file string */
! 174: short type; /* CONF_BOOL, CONF_INT, CONF_STR */
! 175: short connected; /* connection-specific value? */
! 176: int opt_val; /* LDAP_OPT_* (or -1 for sudo internal) */
! 177: void *valp; /* pointer into ldap_conf */
! 178: };
! 179:
! 180: struct ldap_config_list_str {
! 181: struct ldap_config_list_str *next;
! 182: char val[1];
! 183: };
! 184:
! 185: /* LDAP configuration structure */
! 186: static struct ldap_config {
! 187: int port;
! 188: int version;
! 189: int debug;
! 190: int ldap_debug;
! 191: int tls_checkpeer;
! 192: int timelimit;
! 193: int timeout;
! 194: int bind_timelimit;
! 195: int use_sasl;
! 196: int rootuse_sasl;
! 197: int ssl_mode;
! 198: int timed;
! 199: int deref;
! 200: char *host;
! 201: struct ldap_config_list_str *uri;
! 202: char *binddn;
! 203: char *bindpw;
! 204: char *rootbinddn;
! 205: struct ldap_config_list_str *base;
! 206: char *search_filter;
! 207: char *ssl;
! 208: char *tls_cacertfile;
! 209: char *tls_cacertdir;
! 210: char *tls_random_file;
! 211: char *tls_cipher_suite;
! 212: char *tls_certfile;
! 213: char *tls_keyfile;
! 214: char *sasl_auth_id;
! 215: char *rootsasl_auth_id;
! 216: char *sasl_secprops;
! 217: char *krb5_ccname;
! 218: } ldap_conf;
! 219:
! 220: static struct ldap_config_table ldap_conf_table[] = {
! 221: { "sudoers_debug", CONF_INT, FALSE, -1, &ldap_conf.debug },
! 222: { "host", CONF_STR, FALSE, -1, &ldap_conf.host },
! 223: { "port", CONF_INT, FALSE, -1, &ldap_conf.port },
! 224: { "ssl", CONF_STR, FALSE, -1, &ldap_conf.ssl },
! 225: { "sslpath", CONF_STR, FALSE, -1, &ldap_conf.tls_certfile },
! 226: { "uri", CONF_LIST_STR, FALSE, -1, &ldap_conf.uri },
! 227: #ifdef LDAP_OPT_DEBUG_LEVEL
! 228: { "debug", CONF_INT, FALSE, LDAP_OPT_DEBUG_LEVEL, &ldap_conf.ldap_debug },
! 229: #endif
! 230: #ifdef LDAP_OPT_PROTOCOL_VERSION
! 231: { "ldap_version", CONF_INT, TRUE, LDAP_OPT_PROTOCOL_VERSION,
! 232: &ldap_conf.version },
! 233: #endif
! 234: #ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
! 235: { "tls_checkpeer", CONF_BOOL, FALSE, LDAP_OPT_X_TLS_REQUIRE_CERT,
! 236: &ldap_conf.tls_checkpeer },
! 237: #else
! 238: { "tls_checkpeer", CONF_BOOL, FALSE, -1, &ldap_conf.tls_checkpeer },
! 239: #endif
! 240: #ifdef LDAP_OPT_X_TLS_CACERTFILE
! 241: { "tls_cacertfile", CONF_STR, FALSE, LDAP_OPT_X_TLS_CACERTFILE,
! 242: &ldap_conf.tls_cacertfile },
! 243: { "tls_cacert", CONF_STR, FALSE, LDAP_OPT_X_TLS_CACERTFILE,
! 244: &ldap_conf.tls_cacertfile },
! 245: #endif
! 246: #ifdef LDAP_OPT_X_TLS_CACERTDIR
! 247: { "tls_cacertdir", CONF_STR, FALSE, LDAP_OPT_X_TLS_CACERTDIR,
! 248: &ldap_conf.tls_cacertdir },
! 249: #endif
! 250: #ifdef LDAP_OPT_X_TLS_RANDOM_FILE
! 251: { "tls_randfile", CONF_STR, FALSE, LDAP_OPT_X_TLS_RANDOM_FILE,
! 252: &ldap_conf.tls_random_file },
! 253: #endif
! 254: #ifdef LDAP_OPT_X_TLS_CIPHER_SUITE
! 255: { "tls_ciphers", CONF_STR, FALSE, LDAP_OPT_X_TLS_CIPHER_SUITE,
! 256: &ldap_conf.tls_cipher_suite },
! 257: #endif
! 258: #ifdef LDAP_OPT_X_TLS_CERTFILE
! 259: { "tls_cert", CONF_STR, FALSE, LDAP_OPT_X_TLS_CERTFILE,
! 260: &ldap_conf.tls_certfile },
! 261: #else
! 262: { "tls_cert", CONF_STR, FALSE, -1, &ldap_conf.tls_certfile },
! 263: #endif
! 264: #ifdef LDAP_OPT_X_TLS_KEYFILE
! 265: { "tls_key", CONF_STR, FALSE, LDAP_OPT_X_TLS_KEYFILE,
! 266: &ldap_conf.tls_keyfile },
! 267: #else
! 268: { "tls_key", CONF_STR, FALSE, -1, &ldap_conf.tls_keyfile },
! 269: #endif
! 270: #ifdef LDAP_OPT_NETWORK_TIMEOUT
! 271: { "bind_timelimit", CONF_INT, TRUE, -1 /* needs timeval, set manually */,
! 272: &ldap_conf.bind_timelimit },
! 273: { "network_timeout", CONF_INT, TRUE, -1 /* needs timeval, set manually */,
! 274: &ldap_conf.bind_timelimit },
! 275: #elif defined(LDAP_X_OPT_CONNECT_TIMEOUT)
! 276: { "bind_timelimit", CONF_INT, TRUE, LDAP_X_OPT_CONNECT_TIMEOUT,
! 277: &ldap_conf.bind_timelimit },
! 278: { "network_timeout", CONF_INT, TRUE, LDAP_X_OPT_CONNECT_TIMEOUT,
! 279: &ldap_conf.bind_timelimit },
! 280: #endif
! 281: { "timelimit", CONF_INT, TRUE, LDAP_OPT_TIMELIMIT, &ldap_conf.timelimit },
! 282: #ifdef LDAP_OPT_TIMEOUT
! 283: { "timeout", CONF_INT, TRUE, -1 /* needs timeval, set manually */,
! 284: &ldap_conf.timeout },
! 285: #endif
! 286: #ifdef LDAP_OPT_DEREF
! 287: { "deref", CONF_DEREF_VAL, TRUE, LDAP_OPT_DEREF, &ldap_conf.deref },
! 288: #endif
! 289: { "binddn", CONF_STR, FALSE, -1, &ldap_conf.binddn },
! 290: { "bindpw", CONF_STR, FALSE, -1, &ldap_conf.bindpw },
! 291: { "rootbinddn", CONF_STR, FALSE, -1, &ldap_conf.rootbinddn },
! 292: { "sudoers_base", CONF_LIST_STR, FALSE, -1, &ldap_conf.base },
! 293: { "sudoers_timed", CONF_BOOL, FALSE, -1, &ldap_conf.timed },
! 294: { "sudoers_search_filter", CONF_STR, FALSE, -1, &ldap_conf.search_filter },
! 295: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 296: { "use_sasl", CONF_BOOL, FALSE, -1, &ldap_conf.use_sasl },
! 297: { "sasl_auth_id", CONF_STR, FALSE, -1, &ldap_conf.sasl_auth_id },
! 298: { "rootuse_sasl", CONF_BOOL, FALSE, -1, &ldap_conf.rootuse_sasl },
! 299: { "rootsasl_auth_id", CONF_STR, FALSE, -1, &ldap_conf.rootsasl_auth_id },
! 300: # ifdef LDAP_OPT_X_SASL_SECPROPS
! 301: { "sasl_secprops", CONF_STR, TRUE, LDAP_OPT_X_SASL_SECPROPS,
! 302: &ldap_conf.sasl_secprops },
! 303: # endif
! 304: { "krb5_ccname", CONF_STR, FALSE, -1, &ldap_conf.krb5_ccname },
! 305: #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
! 306: { NULL }
! 307: };
! 308:
! 309: /* sudo_nss implementation */
! 310: static int sudo_ldap_open(struct sudo_nss *nss);
! 311: static int sudo_ldap_close(struct sudo_nss *nss);
! 312: static int sudo_ldap_parse(struct sudo_nss *nss);
! 313: static int sudo_ldap_setdefs(struct sudo_nss *nss);
! 314: static int sudo_ldap_lookup(struct sudo_nss *nss, int ret, int pwflag);
! 315: static int sudo_ldap_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
! 316: static int sudo_ldap_display_defaults(struct sudo_nss *nss, struct passwd *pw,
! 317: struct lbuf *lbuf);
! 318: static int sudo_ldap_display_bound_defaults(struct sudo_nss *nss,
! 319: struct passwd *pw, struct lbuf *lbuf);
! 320: static int sudo_ldap_display_privs(struct sudo_nss *nss, struct passwd *pw,
! 321: struct lbuf *lbuf);
! 322: static struct ldap_result *sudo_ldap_result_get(struct sudo_nss *nss,
! 323: struct passwd *pw);
! 324:
! 325: /*
! 326: * LDAP sudo_nss handle.
! 327: * We store the connection to the LDAP server, the cached ldap_result object
! 328: * (if any), and the name of the user the query was performed for.
! 329: * If a new query is launched with sudo_ldap_result_get() that specifies a
! 330: * different user, the old cached result is freed before the new query is run.
! 331: */
! 332: struct sudo_ldap_handle {
! 333: LDAP *ld;
! 334: struct ldap_result *result;
! 335: char *username;
! 336: struct group_list *grlist;
! 337: };
! 338:
! 339: struct sudo_nss sudo_nss_ldap = {
! 340: &sudo_nss_ldap,
! 341: NULL,
! 342: sudo_ldap_open,
! 343: sudo_ldap_close,
! 344: sudo_ldap_parse,
! 345: sudo_ldap_setdefs,
! 346: sudo_ldap_lookup,
! 347: sudo_ldap_display_cmnd,
! 348: sudo_ldap_display_defaults,
! 349: sudo_ldap_display_bound_defaults,
! 350: sudo_ldap_display_privs
! 351: };
! 352:
! 353: #ifdef HAVE_LDAP_CREATE
! 354: /*
! 355: * Rebuild the hosts list and include a specific port for each host.
! 356: * ldap_create() does not take a default port parameter so we must
! 357: * append one if we want something other than LDAP_PORT.
! 358: */
! 359: static void
! 360: sudo_ldap_conf_add_ports(void)
! 361: {
! 362:
! 363: char *host, *port, defport[13];
! 364: char hostbuf[LINE_MAX * 2];
! 365:
! 366: hostbuf[0] = '\0';
! 367: if (snprintf(defport, sizeof(defport), ":%d", ldap_conf.port) >= sizeof(defport))
! 368: errorx(1, _("sudo_ldap_conf_add_ports: port too large"));
! 369:
! 370: for ((host = strtok(ldap_conf.host, " \t")); host; (host = strtok(NULL, " \t"))) {
! 371: if (hostbuf[0] != '\0') {
! 372: if (strlcat(hostbuf, " ", sizeof(hostbuf)) >= sizeof(hostbuf))
! 373: goto toobig;
! 374: }
! 375:
! 376: if (strlcat(hostbuf, host, sizeof(hostbuf)) >= sizeof(hostbuf))
! 377: goto toobig;
! 378: /* Append port if there is not one already. */
! 379: if ((port = strrchr(host, ':')) == NULL ||
! 380: !isdigit((unsigned char)port[1])) {
! 381: if (strlcat(hostbuf, defport, sizeof(hostbuf)) >= sizeof(hostbuf))
! 382: goto toobig;
! 383: }
! 384: }
! 385:
! 386: efree(ldap_conf.host);
! 387: ldap_conf.host = estrdup(hostbuf);
! 388: return;
! 389:
! 390: toobig:
! 391: errorx(1, _("sudo_ldap_conf_add_ports: out of space expanding hostbuf"));
! 392: }
! 393: #endif
! 394:
! 395: #ifndef HAVE_LDAP_INITIALIZE
! 396: /*
! 397: * For each uri, convert to host:port pairs. For ldaps:// enable SSL
! 398: * Accepts: uris of the form ldap:/// or ldap://hostname:portnum/
! 399: * where the trailing slash is optional.
! 400: */
! 401: static int
! 402: sudo_ldap_parse_uri(const struct ldap_config_list_str *uri_list)
! 403: {
! 404: char *buf, *uri, *host, *cp, *port;
! 405: char hostbuf[LINE_MAX];
! 406: int nldap = 0, nldaps = 0;
! 407: int rc = -1;
! 408:
! 409: do {
! 410: buf = estrdup(uri_list->val);
! 411: hostbuf[0] = '\0';
! 412: for ((uri = strtok(buf, " \t")); uri != NULL; (uri = strtok(NULL, " \t"))) {
! 413: if (strncasecmp(uri, "ldap://", 7) == 0) {
! 414: nldap++;
! 415: host = uri + 7;
! 416: } else if (strncasecmp(uri, "ldaps://", 8) == 0) {
! 417: nldaps++;
! 418: host = uri + 8;
! 419: } else {
! 420: warningx(_("unsupported LDAP uri type: %s"), uri);
! 421: goto done;
! 422: }
! 423:
! 424: /* trim optional trailing slash */
! 425: if ((cp = strrchr(host, '/')) != NULL && cp[1] == '\0') {
! 426: *cp = '\0';
! 427: }
! 428:
! 429: if (hostbuf[0] != '\0') {
! 430: if (strlcat(hostbuf, " ", sizeof(hostbuf)) >= sizeof(hostbuf))
! 431: goto toobig;
! 432: }
! 433:
! 434: if (*host == '\0')
! 435: host = "localhost"; /* no host specified, use localhost */
! 436:
! 437: if (strlcat(hostbuf, host, sizeof(hostbuf)) >= sizeof(hostbuf))
! 438: goto toobig;
! 439:
! 440: /* If using SSL and no port specified, add port 636 */
! 441: if (nldaps) {
! 442: if ((port = strrchr(host, ':')) == NULL ||
! 443: !isdigit((unsigned char)port[1]))
! 444: if (strlcat(hostbuf, ":636", sizeof(hostbuf)) >= sizeof(hostbuf))
! 445: goto toobig;
! 446: }
! 447: }
! 448: if (hostbuf[0] == '\0') {
! 449: warningx(_("invalid uri: %s"), uri_list);
! 450: goto done;
! 451: }
! 452:
! 453: if (nldaps != 0) {
! 454: if (nldap != 0) {
! 455: warningx(_("unable to mix ldap and ldaps URIs"));
! 456: goto done;
! 457: }
! 458: if (ldap_conf.ssl_mode == SUDO_LDAP_STARTTLS) {
! 459: warningx(_("unable to mix ldaps and starttls"));
! 460: goto done;
! 461: }
! 462: ldap_conf.ssl_mode = SUDO_LDAP_SSL;
! 463: }
! 464:
! 465: efree(ldap_conf.host);
! 466: ldap_conf.host = estrdup(hostbuf);
! 467: efree(buf);
! 468: } while ((uri_list = uri_list->next));
! 469:
! 470: buf = NULL;
! 471: rc = 0;
! 472:
! 473: done:
! 474: efree(buf);
! 475: return rc;
! 476:
! 477: toobig:
! 478: errorx(1, _("sudo_ldap_parse_uri: out of space building hostbuf"));
! 479: }
! 480: #else
! 481: static char *
! 482: sudo_ldap_join_uri(struct ldap_config_list_str *uri_list)
! 483: {
! 484: struct ldap_config_list_str *uri;
! 485: size_t len = 0;
! 486: char *buf, *cp;
! 487:
! 488: /* Usually just a single entry. */
! 489: if (uri_list->next == NULL)
! 490: return estrdup(uri_list->val);
! 491:
! 492: for (uri = uri_list; uri != NULL; uri = uri->next) {
! 493: len += strlen(uri->val) + 1;
! 494: }
! 495: buf = cp = emalloc(len);
! 496: buf[0] = '\0';
! 497: for (uri = uri_list; uri != NULL; uri = uri->next) {
! 498: cp += strlcpy(cp, uri->val, len - (cp - buf));
! 499: *cp++ = ' ';
! 500: }
! 501: cp[-1] = '\0';
! 502: return buf;
! 503: }
! 504: #endif /* HAVE_LDAP_INITIALIZE */
! 505:
! 506: static int
! 507: sudo_ldap_init(LDAP **ldp, const char *host, int port)
! 508: {
! 509: LDAP *ld = NULL;
! 510: int rc = LDAP_CONNECT_ERROR;
! 511:
! 512: #ifdef HAVE_LDAPSSL_INIT
! 513: if (ldap_conf.ssl_mode == SUDO_LDAP_SSL) {
! 514: DPRINTF(("ldapssl_clientauth_init(%s, %s)",
! 515: ldap_conf.tls_certfile ? ldap_conf.tls_certfile : "NULL",
! 516: ldap_conf.tls_keyfile ? ldap_conf.tls_keyfile : "NULL"), 2);
! 517: rc = ldapssl_clientauth_init(ldap_conf.tls_certfile, NULL,
! 518: ldap_conf.tls_keyfile != NULL, ldap_conf.tls_keyfile, NULL);
! 519: /*
! 520: * Mozilla-derived SDKs have a bug starting with version 5.0
! 521: * where the path can no longer be a file name and must be a dir.
! 522: */
! 523: if (rc != LDAP_SUCCESS) {
! 524: char *cp;
! 525: if (ldap_conf.tls_certfile) {
! 526: cp = strrchr(ldap_conf.tls_certfile, '/');
! 527: if (cp != NULL && strncmp(cp + 1, "cert", 4) == 0)
! 528: *cp = '\0';
! 529: }
! 530: if (ldap_conf.tls_keyfile) {
! 531: cp = strrchr(ldap_conf.tls_keyfile, '/');
! 532: if (cp != NULL && strncmp(cp + 1, "key", 3) == 0)
! 533: *cp = '\0';
! 534: }
! 535: DPRINTF(("ldapssl_clientauth_init(%s, %s)",
! 536: ldap_conf.tls_certfile ? ldap_conf.tls_certfile : "NULL",
! 537: ldap_conf.tls_keyfile ? ldap_conf.tls_keyfile : "NULL"), 2);
! 538: rc = ldapssl_clientauth_init(ldap_conf.tls_certfile, NULL,
! 539: ldap_conf.tls_keyfile != NULL, ldap_conf.tls_keyfile, NULL);
! 540: if (rc != LDAP_SUCCESS) {
! 541: warningx(_("unable to initialize SSL cert and key db: %s"),
! 542: ldapssl_err2string(rc));
! 543: goto done;
! 544: }
! 545: }
! 546:
! 547: DPRINTF(("ldapssl_init(%s, %d, 1)", host, port), 2);
! 548: if ((ld = ldapssl_init(host, port, 1)) != NULL)
! 549: rc = LDAP_SUCCESS;
! 550: } else
! 551: #endif
! 552: {
! 553: #ifdef HAVE_LDAP_CREATE
! 554: DPRINTF(("ldap_create()"), 2);
! 555: if ((rc = ldap_create(&ld)) != LDAP_SUCCESS)
! 556: goto done;
! 557: DPRINTF(("ldap_set_option(LDAP_OPT_HOST_NAME, %s)", host), 2);
! 558: rc = ldap_set_option(ld, LDAP_OPT_HOST_NAME, host);
! 559: #else
! 560: DPRINTF(("ldap_init(%s, %d)", host, port), 2);
! 561: if ((ld = ldap_init(host, port)) != NULL)
! 562: rc = LDAP_SUCCESS;
! 563: #endif
! 564: }
! 565:
! 566: done:
! 567: *ldp = ld;
! 568: return rc;
! 569: }
! 570:
! 571: /*
! 572: * Walk through search results and return TRUE if we have a matching
! 573: * netgroup, else FALSE.
! 574: */
! 575: static int
! 576: sudo_ldap_check_user_netgroup(LDAP *ld, LDAPMessage *entry, char *user)
! 577: {
! 578: struct berval **bv, **p;
! 579: char *val;
! 580: int ret = FALSE;
! 581:
! 582: if (!entry)
! 583: return ret;
! 584:
! 585: /* get the values from the entry */
! 586: bv = ldap_get_values_len(ld, entry, "sudoUser");
! 587: if (bv == NULL)
! 588: return ret;
! 589:
! 590: /* walk through values */
! 591: for (p = bv; *p != NULL && !ret; p++) {
! 592: val = (*p)->bv_val;
! 593: /* match any */
! 594: if (netgr_matches(val, NULL, NULL, user))
! 595: ret = TRUE;
! 596: DPRINTF(("ldap sudoUser netgroup '%s' ... %s", val,
! 597: ret ? "MATCH!" : "not"), 2 + ((ret) ? 0 : 1));
! 598: }
! 599:
! 600: ldap_value_free_len(bv); /* cleanup */
! 601:
! 602: return ret;
! 603: }
! 604:
! 605: /*
! 606: * Walk through search results and return TRUE if we have a
! 607: * host match, else FALSE.
! 608: */
! 609: static int
! 610: sudo_ldap_check_host(LDAP *ld, LDAPMessage *entry)
! 611: {
! 612: struct berval **bv, **p;
! 613: char *val;
! 614: int ret = FALSE;
! 615:
! 616: if (!entry)
! 617: return ret;
! 618:
! 619: /* get the values from the entry */
! 620: bv = ldap_get_values_len(ld, entry, "sudoHost");
! 621: if (bv == NULL)
! 622: return ret;
! 623:
! 624: /* walk through values */
! 625: for (p = bv; *p != NULL && !ret; p++) {
! 626: val = (*p)->bv_val;
! 627: /* match any or address or netgroup or hostname */
! 628: if (!strcmp(val, "ALL") || addr_matches(val) ||
! 629: netgr_matches(val, user_host, user_shost, NULL) ||
! 630: hostname_matches(user_shost, user_host, val))
! 631: ret = TRUE;
! 632: DPRINTF(("ldap sudoHost '%s' ... %s", val,
! 633: ret ? "MATCH!" : "not"), 2);
! 634: }
! 635:
! 636: ldap_value_free_len(bv); /* cleanup */
! 637:
! 638: return ret;
! 639: }
! 640:
! 641: static int
! 642: sudo_ldap_check_runas_user(LDAP *ld, LDAPMessage *entry)
! 643: {
! 644: struct berval **bv, **p;
! 645: char *val;
! 646: int ret = FALSE;
! 647:
! 648: if (!runas_pw)
! 649: return UNSPEC;
! 650:
! 651: /* get the runas user from the entry */
! 652: bv = ldap_get_values_len(ld, entry, "sudoRunAsUser");
! 653: if (bv == NULL)
! 654: bv = ldap_get_values_len(ld, entry, "sudoRunAs"); /* old style */
! 655:
! 656: /*
! 657: * BUG:
! 658: *
! 659: * if runas is not specified on the command line, the only information
! 660: * as to which user to run as is in the runas_default option. We should
! 661: * check to see if we have the local option present. Unfortunately we
! 662: * don't parse these options until after this routine says yes or no.
! 663: * The query has already returned, so we could peek at the attribute
! 664: * values here though.
! 665: *
! 666: * For now just require users to always use -u option unless its set
! 667: * in the global defaults. This behaviour is no different than the global
! 668: * /etc/sudoers.
! 669: *
! 670: * Sigh - maybe add this feature later
! 671: */
! 672:
! 673: /*
! 674: * If there are no runas entries, match runas_default against
! 675: * what the user specified on the command line.
! 676: */
! 677: if (bv == NULL)
! 678: return !strcasecmp(runas_pw->pw_name, def_runas_default);
! 679:
! 680: /* walk through values returned, looking for a match */
! 681: for (p = bv; *p != NULL && !ret; p++) {
! 682: val = (*p)->bv_val;
! 683: switch (val[0]) {
! 684: case '+':
! 685: if (netgr_matches(val, NULL, NULL, runas_pw->pw_name))
! 686: ret = TRUE;
! 687: break;
! 688: case '%':
! 689: if (usergr_matches(val, runas_pw->pw_name, runas_pw))
! 690: ret = TRUE;
! 691: break;
! 692: case 'A':
! 693: if (strcmp(val, "ALL") == 0) {
! 694: ret = TRUE;
! 695: break;
! 696: }
! 697: /* FALLTHROUGH */
! 698: default:
! 699: if (strcasecmp(val, runas_pw->pw_name) == 0)
! 700: ret = TRUE;
! 701: break;
! 702: }
! 703: DPRINTF(("ldap sudoRunAsUser '%s' ... %s", val,
! 704: ret ? "MATCH!" : "not"), 2);
! 705: }
! 706:
! 707: ldap_value_free_len(bv); /* cleanup */
! 708:
! 709: return ret;
! 710: }
! 711:
! 712: static int
! 713: sudo_ldap_check_runas_group(LDAP *ld, LDAPMessage *entry)
! 714: {
! 715: struct berval **bv, **p;
! 716: char *val;
! 717: int ret = FALSE;
! 718:
! 719: /* runas_gr is only set if the user specified the -g flag */
! 720: if (!runas_gr)
! 721: return UNSPEC;
! 722:
! 723: /* get the values from the entry */
! 724: bv = ldap_get_values_len(ld, entry, "sudoRunAsGroup");
! 725: if (bv == NULL)
! 726: return ret;
! 727:
! 728: /* walk through values returned, looking for a match */
! 729: for (p = bv; *p != NULL && !ret; p++) {
! 730: val = (*p)->bv_val;
! 731: if (strcmp(val, "ALL") == 0 || group_matches(val, runas_gr))
! 732: ret = TRUE;
! 733: DPRINTF(("ldap sudoRunAsGroup '%s' ... %s", val,
! 734: ret ? "MATCH!" : "not"), 2);
! 735: }
! 736:
! 737: ldap_value_free_len(bv); /* cleanup */
! 738:
! 739: return ret;
! 740: }
! 741:
! 742: /*
! 743: * Walk through search results and return TRUE if we have a runas match,
! 744: * else FALSE. RunAs info is optional.
! 745: */
! 746: static int
! 747: sudo_ldap_check_runas(LDAP *ld, LDAPMessage *entry)
! 748: {
! 749: int ret;
! 750:
! 751: if (!entry)
! 752: return FALSE;
! 753:
! 754: ret = sudo_ldap_check_runas_user(ld, entry) != FALSE &&
! 755: sudo_ldap_check_runas_group(ld, entry) != FALSE;
! 756:
! 757: return ret;
! 758: }
! 759:
! 760: /*
! 761: * Walk through search results and return TRUE if we have a command match,
! 762: * FALSE if disallowed and UNSPEC if not matched.
! 763: */
! 764: static int
! 765: sudo_ldap_check_command(LDAP *ld, LDAPMessage *entry, int *setenv_implied)
! 766: {
! 767: struct berval **bv, **p;
! 768: char *allowed_cmnd, *allowed_args, *val;
! 769: int foundbang, ret = UNSPEC;
! 770:
! 771: if (!entry)
! 772: return ret;
! 773:
! 774: bv = ldap_get_values_len(ld, entry, "sudoCommand");
! 775: if (bv == NULL)
! 776: return ret;
! 777:
! 778: for (p = bv; *p != NULL && ret != FALSE; p++) {
! 779: val = (*p)->bv_val;
! 780: /* Match against ALL ? */
! 781: if (!strcmp(val, "ALL")) {
! 782: ret = TRUE;
! 783: if (setenv_implied != NULL)
! 784: *setenv_implied = TRUE;
! 785: DPRINTF(("ldap sudoCommand '%s' ... MATCH!", val), 2);
! 786: continue;
! 787: }
! 788:
! 789: /* check for !command */
! 790: if (*val == '!') {
! 791: foundbang = TRUE;
! 792: allowed_cmnd = estrdup(1 + val); /* !command */
! 793: } else {
! 794: foundbang = FALSE;
! 795: allowed_cmnd = estrdup(val); /* command */
! 796: }
! 797:
! 798: /* split optional args away from command */
! 799: allowed_args = strchr(allowed_cmnd, ' ');
! 800: if (allowed_args)
! 801: *allowed_args++ = '\0';
! 802:
! 803: /* check the command like normal */
! 804: if (command_matches(allowed_cmnd, allowed_args)) {
! 805: /*
! 806: * If allowed (no bang) set ret but keep on checking.
! 807: * If disallowed (bang), exit loop.
! 808: */
! 809: ret = foundbang ? FALSE : TRUE;
! 810: }
! 811: DPRINTF(("ldap sudoCommand '%s' ... %s", val,
! 812: ret == TRUE ? "MATCH!" : "not"), 2);
! 813:
! 814: efree(allowed_cmnd); /* cleanup */
! 815: }
! 816:
! 817: ldap_value_free_len(bv); /* more cleanup */
! 818:
! 819: return ret;
! 820: }
! 821:
! 822: /*
! 823: * Search for boolean "option" in sudoOption.
! 824: * Returns TRUE if found and allowed, FALSE if negated, else UNSPEC.
! 825: */
! 826: static int
! 827: sudo_ldap_check_bool(LDAP *ld, LDAPMessage *entry, char *option)
! 828: {
! 829: struct berval **bv, **p;
! 830: char ch, *var;
! 831: int ret = UNSPEC;
! 832:
! 833: if (entry == NULL)
! 834: return UNSPEC;
! 835:
! 836: bv = ldap_get_values_len(ld, entry, "sudoOption");
! 837: if (bv == NULL)
! 838: return ret;
! 839:
! 840: /* walk through options */
! 841: for (p = bv; *p != NULL; p++) {
! 842: var = (*p)->bv_val;;
! 843: DPRINTF(("ldap sudoOption: '%s'", var), 2);
! 844:
! 845: if ((ch = *var) == '!')
! 846: var++;
! 847: if (strcmp(var, option) == 0)
! 848: ret = (ch != '!');
! 849: }
! 850:
! 851: ldap_value_free_len(bv);
! 852:
! 853: return ret;
! 854: }
! 855:
! 856: /*
! 857: * Read sudoOption and modify the defaults as we go. This is used once
! 858: * from the cn=defaults entry and also once when a final sudoRole is matched.
! 859: */
! 860: static void
! 861: sudo_ldap_parse_options(LDAP *ld, LDAPMessage *entry)
! 862: {
! 863: struct berval **bv, **p;
! 864: char op, *var, *val;
! 865:
! 866: if (entry == NULL)
! 867: return;
! 868:
! 869: bv = ldap_get_values_len(ld, entry, "sudoOption");
! 870: if (bv == NULL)
! 871: return;
! 872:
! 873: /* walk through options */
! 874: for (p = bv; *p != NULL; p++) {
! 875: var = estrdup((*p)->bv_val);
! 876: DPRINTF(("ldap sudoOption: '%s'", var), 2);
! 877:
! 878: /* check for equals sign past first char */
! 879: val = strchr(var, '=');
! 880: if (val > var) {
! 881: *val++ = '\0'; /* split on = and truncate var */
! 882: op = *(val - 2); /* peek for += or -= cases */
! 883: if (op == '+' || op == '-') {
! 884: *(val - 2) = '\0'; /* found, remove extra char */
! 885: /* case var+=val or var-=val */
! 886: set_default(var, val, (int) op);
! 887: } else {
! 888: /* case var=val */
! 889: set_default(var, val, TRUE);
! 890: }
! 891: } else if (*var == '!') {
! 892: /* case !var Boolean False */
! 893: set_default(var + 1, NULL, FALSE);
! 894: } else {
! 895: /* case var Boolean True */
! 896: set_default(var, NULL, TRUE);
! 897: }
! 898: efree(var);
! 899: }
! 900:
! 901: ldap_value_free_len(bv);
! 902: }
! 903:
! 904: /*
! 905: * Build an LDAP timefilter.
! 906: *
! 907: * Stores a filter in the buffer that makes sure only entries
! 908: * are selected that have a sudoNotBefore in the past and a
! 909: * sudoNotAfter in the future, i.e. a filter of the following
! 910: * structure (spaced out a little more for better readability:
! 911: *
! 912: * (&
! 913: * (|
! 914: * (!(sudoNotAfter=*))
! 915: * (sudoNotAfter>__now__)
! 916: * )
! 917: * (|
! 918: * (!(sudoNotBefore=*))
! 919: * (sudoNotBefore<__now__)
! 920: * )
! 921: * )
! 922: *
! 923: * If either the sudoNotAfter or sudoNotBefore attributes are missing,
! 924: * no time restriction shall be imposed.
! 925: */
! 926: static int
! 927: sudo_ldap_timefilter(char *buffer, size_t buffersize)
! 928: {
! 929: struct tm *tp;
! 930: time_t now;
! 931: char timebuffer[16];
! 932: int bytes = 0;
! 933:
! 934: /* Make sure we have a formatted timestamp for __now__. */
! 935: time(&now);
! 936: if ((tp = gmtime(&now)) == NULL) {
! 937: warning(_("unable to get GMT time"));
! 938: goto done;
! 939: }
! 940:
! 941: /* Format the timestamp according to the RFC. */
! 942: if (strftime(timebuffer, sizeof(timebuffer), "%Y%m%d%H%M%SZ", tp) == 0) {
! 943: warning(_("unable to format timestamp"));
! 944: goto done;
! 945: }
! 946:
! 947: /* Build filter. */
! 948: bytes = snprintf(buffer, buffersize, "(&(|(!(sudoNotAfter=*))(sudoNotAfter>=%s))(|(!(sudoNotBefore=*))(sudoNotBefore<=%s)))",
! 949: timebuffer, timebuffer);
! 950: if (bytes < 0 || bytes >= buffersize) {
! 951: warning(_("unable to build time filter"));
! 952: bytes = 0;
! 953: }
! 954:
! 955: done:
! 956: return bytes;
! 957: }
! 958:
! 959: /*
! 960: * Builds up a filter to search for default settings
! 961: */
! 962: static char *
! 963: sudo_ldap_build_default_filter()
! 964: {
! 965: char *filt;
! 966:
! 967: if (ldap_conf.search_filter)
! 968: easprintf(&filt, "(&%s(cn=defaults))", ldap_conf.search_filter);
! 969: else
! 970: filt = estrdup("cn=defaults");
! 971: return filt;
! 972: }
! 973:
! 974: /*
! 975: * Builds up a filter to check against LDAP.
! 976: */
! 977: static char *
! 978: sudo_ldap_build_pass1(struct passwd *pw)
! 979: {
! 980: struct group *grp;
! 981: char *buf, timebuffer[TIMEFILTER_LENGTH];
! 982: struct group_list *grlist;
! 983: size_t sz = 0;
! 984: int i;
! 985:
! 986: /* Start with LDAP search filter length + 3 */
! 987: if (ldap_conf.search_filter)
! 988: sz += strlen(ldap_conf.search_filter) + 3;
! 989:
! 990: /* Then add (|(sudoUser=USERNAME)(sudoUser=ALL)) + NUL */
! 991: sz += 29 + strlen(pw->pw_name);
! 992:
! 993: /* Add space for primary and supplementary groups */
! 994: if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
! 995: sz += 12 + strlen(grp->gr_name);
! 996: }
! 997: if ((grlist = get_group_list(pw)) != NULL) {
! 998: for (i = 0; i < grlist->ngroups; i++) {
! 999: if (grp != NULL && strcasecmp(grlist->groups[i], grp->gr_name) == 0)
! 1000: continue;
! 1001: sz += 12 + strlen(grlist->groups[i]);
! 1002: }
! 1003: }
! 1004:
! 1005: /* If timed, add space for time limits. */
! 1006: if (ldap_conf.timed)
! 1007: sz += TIMEFILTER_LENGTH;
! 1008: buf = emalloc(sz);
! 1009: *buf = '\0';
! 1010:
! 1011: /*
! 1012: * If timed or using a search filter, start a global AND clause to
! 1013: * contain the search filter, search criteria, and time restriction.
! 1014: */
! 1015: if (ldap_conf.timed || ldap_conf.search_filter)
! 1016: (void) strlcpy(buf, "(&", sz);
! 1017:
! 1018: if (ldap_conf.search_filter)
! 1019: (void) strlcat(buf, ldap_conf.search_filter, sz);
! 1020:
! 1021: /* Global OR + sudoUser=user_name filter */
! 1022: (void) strlcat(buf, "(|(sudoUser=", sz);
! 1023: (void) strlcat(buf, pw->pw_name, sz);
! 1024: (void) strlcat(buf, ")", sz);
! 1025:
! 1026: /* Append primary group */
! 1027: if (grp != NULL) {
! 1028: (void) strlcat(buf, "(sudoUser=%", sz);
! 1029: (void) strlcat(buf, grp->gr_name, sz);
! 1030: (void) strlcat(buf, ")", sz);
! 1031: }
! 1032:
! 1033: /* Append supplementary groups */
! 1034: if (grlist != NULL) {
! 1035: for (i = 0; i < grlist->ngroups; i++) {
! 1036: if (grp != NULL && strcasecmp(grlist->groups[i], grp->gr_name) == 0)
! 1037: continue;
! 1038: (void) strlcat(buf, "(sudoUser=%", sz);
! 1039: (void) strlcat(buf, grlist->groups[i], sz);
! 1040: (void) strlcat(buf, ")", sz);
! 1041: }
! 1042: }
! 1043:
! 1044: /* Done with groups. */
! 1045: if (grlist != NULL)
! 1046: grlist_delref(grlist);
! 1047: if (grp != NULL)
! 1048: gr_delref(grp);
! 1049:
! 1050: /* Add ALL to list and end the global OR */
! 1051: if (strlcat(buf, "(sudoUser=ALL)", sz) >= sz)
! 1052: errorx(1, _("sudo_ldap_build_pass1 allocation mismatch"));
! 1053:
! 1054: /* Add the time restriction, or simply end the global OR. */
! 1055: if (ldap_conf.timed) {
! 1056: strlcat(buf, ")", sz); /* closes the global OR */
! 1057: sudo_ldap_timefilter(timebuffer, sizeof(timebuffer));
! 1058: strlcat(buf, timebuffer, sz);
! 1059: } else if (ldap_conf.search_filter) {
! 1060: strlcat(buf, ")", sz); /* closes the global OR */
! 1061: }
! 1062: strlcat(buf, ")", sz); /* closes the global OR or the global AND */
! 1063:
! 1064: return buf;
! 1065: }
! 1066:
! 1067: /*
! 1068: * Builds up a filter to check against netgroup entries in LDAP.
! 1069: */
! 1070: static char *
! 1071: sudo_ldap_build_pass2(void)
! 1072: {
! 1073: char *filt, timebuffer[TIMEFILTER_LENGTH];
! 1074:
! 1075: if (ldap_conf.timed)
! 1076: sudo_ldap_timefilter(timebuffer, sizeof(timebuffer));
! 1077:
! 1078: /*
! 1079: * Match all sudoUsers beginning with a '+'.
! 1080: * If a search filter or time restriction is specified,
! 1081: * those get ANDed in to the expression.
! 1082: */
! 1083: easprintf(&filt, "%s%s(sudoUser=+*)%s%s",
! 1084: (ldap_conf.timed || ldap_conf.search_filter) ? "(&" : "",
! 1085: ldap_conf.search_filter ? ldap_conf.search_filter : "",
! 1086: ldap_conf.timed ? timebuffer : "",
! 1087: (ldap_conf.timed || ldap_conf.search_filter) ? ")" : "");
! 1088:
! 1089: return filt;
! 1090: }
! 1091:
! 1092: static void
! 1093: sudo_ldap_read_secret(const char *path)
! 1094: {
! 1095: FILE *fp;
! 1096: char buf[LINE_MAX], *cp;
! 1097:
! 1098: if ((fp = fopen(_PATH_LDAP_SECRET, "r")) != NULL) {
! 1099: if (fgets(buf, sizeof(buf), fp) != NULL) {
! 1100: if ((cp = strchr(buf, '\n')) != NULL)
! 1101: *cp = '\0';
! 1102: /* copy to bindpw and binddn */
! 1103: efree(ldap_conf.bindpw);
! 1104: ldap_conf.bindpw = estrdup(buf);
! 1105: efree(ldap_conf.binddn);
! 1106: ldap_conf.binddn = ldap_conf.rootbinddn;
! 1107: ldap_conf.rootbinddn = NULL;
! 1108: }
! 1109: fclose(fp);
! 1110: }
! 1111: }
! 1112:
! 1113: static int
! 1114: sudo_ldap_read_config(void)
! 1115: {
! 1116: FILE *fp;
! 1117: char *cp, *keyword, *value;
! 1118: struct ldap_config_table *cur;
! 1119:
! 1120: /* defaults */
! 1121: ldap_conf.version = 3;
! 1122: ldap_conf.port = -1;
! 1123: ldap_conf.tls_checkpeer = -1;
! 1124: ldap_conf.timelimit = -1;
! 1125: ldap_conf.timeout = -1;
! 1126: ldap_conf.bind_timelimit = -1;
! 1127: ldap_conf.use_sasl = -1;
! 1128: ldap_conf.rootuse_sasl = -1;
! 1129: ldap_conf.deref = -1;
! 1130:
! 1131: if ((fp = fopen(_PATH_LDAP_CONF, "r")) == NULL)
! 1132: return FALSE;
! 1133:
! 1134: while ((cp = sudo_parseln(fp)) != NULL) {
! 1135: if (*cp == '\0')
! 1136: continue; /* skip empty line */
! 1137:
! 1138: /* split into keyword and value */
! 1139: keyword = cp;
! 1140: while (*cp && !isblank((unsigned char) *cp))
! 1141: cp++;
! 1142: if (*cp)
! 1143: *cp++ = '\0'; /* terminate keyword */
! 1144:
! 1145: /* skip whitespace before value */
! 1146: while (isblank((unsigned char) *cp))
! 1147: cp++;
! 1148: value = cp;
! 1149:
! 1150: /* Look up keyword in config table. */
! 1151: for (cur = ldap_conf_table; cur->conf_str != NULL; cur++) {
! 1152: if (strcasecmp(keyword, cur->conf_str) == 0) {
! 1153: switch (cur->type) {
! 1154: case CONF_DEREF_VAL:
! 1155: if (strcasecmp(value, "searching") == 0)
! 1156: *(int *)(cur->valp) = LDAP_DEREF_SEARCHING;
! 1157: else if (strcasecmp(value, "finding") == 0)
! 1158: *(int *)(cur->valp) = LDAP_DEREF_FINDING;
! 1159: else if (strcasecmp(value, "always") == 0)
! 1160: *(int *)(cur->valp) = LDAP_DEREF_ALWAYS;
! 1161: else
! 1162: *(int *)(cur->valp) = LDAP_DEREF_NEVER;
! 1163: break;
! 1164: case CONF_BOOL:
! 1165: *(int *)(cur->valp) = atobool(value) == TRUE;
! 1166: break;
! 1167: case CONF_INT:
! 1168: *(int *)(cur->valp) = atoi(value);
! 1169: break;
! 1170: case CONF_STR:
! 1171: efree(*(char **)(cur->valp));
! 1172: *(char **)(cur->valp) = estrdup(value);
! 1173: break;
! 1174: case CONF_LIST_STR:
! 1175: {
! 1176: struct ldap_config_list_str **p;
! 1177: size_t len = strlen(value);
! 1178:
! 1179: if (len > 0) {
! 1180: p = (struct ldap_config_list_str **)cur->valp;
! 1181: while (*p != NULL)
! 1182: p = &(*p)->next;
! 1183: *p = emalloc(sizeof(struct ldap_config_list_str) + len);
! 1184: memcpy((*p)->val, value, len + 1);
! 1185: (*p)->next = NULL;
! 1186: }
! 1187: }
! 1188: break;
! 1189: }
! 1190: break;
! 1191: }
! 1192: }
! 1193: }
! 1194: fclose(fp);
! 1195:
! 1196: if (!ldap_conf.host)
! 1197: ldap_conf.host = estrdup("localhost");
! 1198:
! 1199: if (ldap_conf.debug > 1) {
! 1200: sudo_printf(SUDO_CONV_ERROR_MSG, "LDAP Config Summary\n");
! 1201: sudo_printf(SUDO_CONV_ERROR_MSG, "===================\n");
! 1202: if (ldap_conf.uri) {
! 1203: struct ldap_config_list_str *uri = ldap_conf.uri;
! 1204:
! 1205: do {
! 1206: sudo_printf(SUDO_CONV_ERROR_MSG, "uri %s\n",
! 1207: uri->val);
! 1208: } while ((uri = uri->next) != NULL);
! 1209: } else {
! 1210: sudo_printf(SUDO_CONV_ERROR_MSG, "host %s\n",
! 1211: ldap_conf.host ? ldap_conf.host : "(NONE)");
! 1212: sudo_printf(SUDO_CONV_ERROR_MSG, "port %d\n",
! 1213: ldap_conf.port);
! 1214: }
! 1215: sudo_printf(SUDO_CONV_ERROR_MSG, "ldap_version %d\n",
! 1216: ldap_conf.version);
! 1217:
! 1218: if (ldap_conf.base) {
! 1219: struct ldap_config_list_str *base = ldap_conf.base;
! 1220: do {
! 1221: sudo_printf(SUDO_CONV_ERROR_MSG, "sudoers_base %s\n",
! 1222: base->val);
! 1223: } while ((base = base->next) != NULL);
! 1224: } else {
! 1225: sudo_printf(SUDO_CONV_ERROR_MSG, "sudoers_base %s\n",
! 1226: "(NONE: LDAP disabled)");
! 1227: }
! 1228: if (ldap_conf.search_filter) {
! 1229: sudo_printf(SUDO_CONV_ERROR_MSG, "search_filter %s\n",
! 1230: ldap_conf.search_filter);
! 1231: }
! 1232: sudo_printf(SUDO_CONV_ERROR_MSG, "binddn %s\n",
! 1233: ldap_conf.binddn ? ldap_conf.binddn : "(anonymous)");
! 1234: sudo_printf(SUDO_CONV_ERROR_MSG, "bindpw %s\n",
! 1235: ldap_conf.bindpw ? ldap_conf.bindpw : "(anonymous)");
! 1236: if (ldap_conf.bind_timelimit > 0) {
! 1237: sudo_printf(SUDO_CONV_ERROR_MSG, "bind_timelimit %d\n",
! 1238: ldap_conf.bind_timelimit);
! 1239: }
! 1240: if (ldap_conf.timelimit > 0) {
! 1241: sudo_printf(SUDO_CONV_ERROR_MSG, "timelimit %d\n",
! 1242: ldap_conf.timelimit);
! 1243: }
! 1244: if (ldap_conf.deref != -1) {
! 1245: sudo_printf(SUDO_CONV_ERROR_MSG, "deref %d\n",
! 1246: ldap_conf.deref);
! 1247: }
! 1248: sudo_printf(SUDO_CONV_ERROR_MSG, "ssl %s\n",
! 1249: ldap_conf.ssl ? ldap_conf.ssl : "(no)");
! 1250: if (ldap_conf.tls_checkpeer != -1) {
! 1251: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_checkpeer %s\n",
! 1252: ldap_conf.tls_checkpeer ? "(yes)" : "(no)");
! 1253: }
! 1254: if (ldap_conf.tls_cacertfile != NULL) {
! 1255: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_cacertfile %s\n",
! 1256: ldap_conf.tls_cacertfile);
! 1257: }
! 1258: if (ldap_conf.tls_cacertdir != NULL) {
! 1259: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_cacertdir %s\n",
! 1260: ldap_conf.tls_cacertdir);
! 1261: }
! 1262: if (ldap_conf.tls_random_file != NULL) {
! 1263: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_random_file %s\n",
! 1264: ldap_conf.tls_random_file);
! 1265: }
! 1266: if (ldap_conf.tls_cipher_suite != NULL) {
! 1267: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_cipher_suite %s\n",
! 1268: ldap_conf.tls_cipher_suite);
! 1269: }
! 1270: if (ldap_conf.tls_certfile != NULL) {
! 1271: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_certfile %s\n",
! 1272: ldap_conf.tls_certfile);
! 1273: }
! 1274: if (ldap_conf.tls_keyfile != NULL) {
! 1275: sudo_printf(SUDO_CONV_ERROR_MSG, "tls_keyfile %s\n",
! 1276: ldap_conf.tls_keyfile);
! 1277: }
! 1278: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 1279: if (ldap_conf.use_sasl != -1) {
! 1280: sudo_printf(SUDO_CONV_ERROR_MSG, "use_sasl %s\n",
! 1281: ldap_conf.use_sasl ? "yes" : "no");
! 1282: sudo_printf(SUDO_CONV_ERROR_MSG, "sasl_auth_id %s\n",
! 1283: ldap_conf.sasl_auth_id ? ldap_conf.sasl_auth_id : "(NONE)");
! 1284: sudo_printf(SUDO_CONV_ERROR_MSG, "rootuse_sasl %d\n",
! 1285: ldap_conf.rootuse_sasl);
! 1286: sudo_printf(SUDO_CONV_ERROR_MSG, "rootsasl_auth_id %s\n",
! 1287: ldap_conf.rootsasl_auth_id ? ldap_conf.rootsasl_auth_id : "(NONE)");
! 1288: sudo_printf(SUDO_CONV_ERROR_MSG, "sasl_secprops %s\n",
! 1289: ldap_conf.sasl_secprops ? ldap_conf.sasl_secprops : "(NONE)");
! 1290: sudo_printf(SUDO_CONV_ERROR_MSG, "krb5_ccname %s\n",
! 1291: ldap_conf.krb5_ccname ? ldap_conf.krb5_ccname : "(NONE)");
! 1292: }
! 1293: #endif
! 1294: sudo_printf(SUDO_CONV_ERROR_MSG, "===================\n");
! 1295: }
! 1296: if (!ldap_conf.base)
! 1297: return FALSE; /* if no base is defined, ignore LDAP */
! 1298:
! 1299: if (ldap_conf.bind_timelimit > 0)
! 1300: ldap_conf.bind_timelimit *= 1000; /* convert to ms */
! 1301:
! 1302: /*
! 1303: * Interpret SSL option
! 1304: */
! 1305: if (ldap_conf.ssl != NULL) {
! 1306: if (strcasecmp(ldap_conf.ssl, "start_tls") == 0)
! 1307: ldap_conf.ssl_mode = SUDO_LDAP_STARTTLS;
! 1308: else if (atobool(ldap_conf.ssl) == TRUE)
! 1309: ldap_conf.ssl_mode = SUDO_LDAP_SSL;
! 1310: }
! 1311:
! 1312: #if defined(HAVE_LDAPSSL_SET_STRENGTH) && !defined(LDAP_OPT_X_TLS_REQUIRE_CERT)
! 1313: if (ldap_conf.tls_checkpeer != -1) {
! 1314: ldapssl_set_strength(NULL,
! 1315: ldap_conf.tls_checkpeer ? LDAPSSL_AUTH_CERT : LDAPSSL_AUTH_WEAK);
! 1316: }
! 1317: #endif
! 1318:
! 1319: #ifndef HAVE_LDAP_INITIALIZE
! 1320: /* Convert uri list to host list if no ldap_initialize(). */
! 1321: if (ldap_conf.uri) {
! 1322: struct ldap_config_list_str *uri = ldap_conf.uri;
! 1323: if (sudo_ldap_parse_uri(uri) != 0)
! 1324: return FALSE;
! 1325: do {
! 1326: ldap_conf.uri = uri->next;
! 1327: efree(uri);
! 1328: } while ((uri = ldap_conf.uri));
! 1329: ldap_conf.port = LDAP_PORT;
! 1330: }
! 1331: #endif
! 1332:
! 1333: if (!ldap_conf.uri) {
! 1334: /* Use port 389 for plaintext LDAP and port 636 for SSL LDAP */
! 1335: if (ldap_conf.port < 0)
! 1336: ldap_conf.port =
! 1337: ldap_conf.ssl_mode == SUDO_LDAP_SSL ? LDAPS_PORT : LDAP_PORT;
! 1338:
! 1339: #ifdef HAVE_LDAP_CREATE
! 1340: /*
! 1341: * Cannot specify port directly to ldap_create(), each host must
! 1342: * include :port to override the default.
! 1343: */
! 1344: if (ldap_conf.port != LDAP_PORT)
! 1345: sudo_ldap_conf_add_ports();
! 1346: #endif
! 1347: }
! 1348:
! 1349: /* If search filter is not parenthesized, make it so. */
! 1350: if (ldap_conf.search_filter && ldap_conf.search_filter[0] != '(') {
! 1351: size_t len = strlen(ldap_conf.search_filter);
! 1352: cp = ldap_conf.search_filter;
! 1353: ldap_conf.search_filter = emalloc(len + 3);
! 1354: ldap_conf.search_filter[0] = '(';
! 1355: memcpy(ldap_conf.search_filter + 1, cp, len);
! 1356: ldap_conf.search_filter[len + 1] = ')';
! 1357: ldap_conf.search_filter[len + 2] = '\0';
! 1358: efree(cp);
! 1359: }
! 1360:
! 1361: /* If rootbinddn set, read in /etc/ldap.secret if it exists. */
! 1362: if (ldap_conf.rootbinddn)
! 1363: sudo_ldap_read_secret(_PATH_LDAP_SECRET);
! 1364:
! 1365: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 1366: /*
! 1367: * Make sure we can open the file specified by krb5_ccname.
! 1368: */
! 1369: if (ldap_conf.krb5_ccname != NULL) {
! 1370: if (strncasecmp(ldap_conf.krb5_ccname, "FILE:", 5) == 0 ||
! 1371: strncasecmp(ldap_conf.krb5_ccname, "WRFILE:", 7) == 0) {
! 1372: value = ldap_conf.krb5_ccname +
! 1373: (ldap_conf.krb5_ccname[4] == ':' ? 5 : 7);
! 1374: if ((fp = fopen(value, "r")) != NULL) {
! 1375: DPRINTF(("using krb5 credential cache: %s", value), 1);
! 1376: fclose(fp);
! 1377: } else {
! 1378: /* Can't open it, just ignore the entry. */
! 1379: DPRINTF(("unable to open krb5 credential cache: %s", value), 1);
! 1380: efree(ldap_conf.krb5_ccname);
! 1381: ldap_conf.krb5_ccname = NULL;
! 1382: }
! 1383: }
! 1384: }
! 1385: #endif
! 1386: return TRUE;
! 1387: }
! 1388:
! 1389: /*
! 1390: * Extract the dn from an entry and return the first rdn from it.
! 1391: */
! 1392: static char *
! 1393: sudo_ldap_get_first_rdn(LDAP *ld, LDAPMessage *entry)
! 1394: {
! 1395: #ifdef HAVE_LDAP_STR2DN
! 1396: char *dn, *rdn = NULL;
! 1397: LDAPDN tmpDN;
! 1398:
! 1399: if ((dn = ldap_get_dn(ld, entry)) == NULL)
! 1400: return NULL;
! 1401: if (ldap_str2dn(dn, &tmpDN, LDAP_DN_FORMAT_LDAP) == LDAP_SUCCESS) {
! 1402: ldap_rdn2str(tmpDN[0], &rdn, LDAP_DN_FORMAT_UFN);
! 1403: ldap_dnfree(tmpDN);
! 1404: }
! 1405: ldap_memfree(dn);
! 1406: return rdn;
! 1407: #else
! 1408: char *dn, **edn;
! 1409:
! 1410: if ((dn = ldap_get_dn(ld, entry)) == NULL)
! 1411: return NULL;
! 1412: edn = ldap_explode_dn(dn, 1);
! 1413: ldap_memfree(dn);
! 1414: return edn ? edn[0] : NULL;
! 1415: #endif
! 1416: }
! 1417:
! 1418: /*
! 1419: * Fetch and display the global Options.
! 1420: */
! 1421: static int
! 1422: sudo_ldap_display_defaults(struct sudo_nss *nss, struct passwd *pw,
! 1423: struct lbuf *lbuf)
! 1424: {
! 1425: struct berval **bv, **p;
! 1426: struct timeval tv, *tvp = NULL;
! 1427: struct ldap_config_list_str *base;
! 1428: struct sudo_ldap_handle *handle = nss->handle;
! 1429: LDAP *ld;
! 1430: LDAPMessage *entry, *result;
! 1431: char *prefix, *filt;
! 1432: int rc, count = 0;
! 1433:
! 1434: if (handle == NULL || handle->ld == NULL)
! 1435: goto done;
! 1436: ld = handle->ld;
! 1437:
! 1438: filt = sudo_ldap_build_default_filter();
! 1439: for (base = ldap_conf.base; base != NULL; base = base->next) {
! 1440: if (ldap_conf.timeout > 0) {
! 1441: tv.tv_sec = ldap_conf.timeout;
! 1442: tv.tv_usec = 0;
! 1443: tvp = &tv;
! 1444: }
! 1445: result = NULL;
! 1446: rc = ldap_search_ext_s(ld, base->val, LDAP_SCOPE_SUBTREE,
! 1447: filt, NULL, 0, NULL, NULL, tvp, 0, &result);
! 1448: if (rc == LDAP_SUCCESS && (entry = ldap_first_entry(ld, result))) {
! 1449: bv = ldap_get_values_len(ld, entry, "sudoOption");
! 1450: if (bv != NULL) {
! 1451: if (lbuf->len == 0 || isspace((unsigned char)lbuf->buf[lbuf->len - 1]))
! 1452: prefix = " ";
! 1453: else
! 1454: prefix = ", ";
! 1455: for (p = bv; *p != NULL; p++) {
! 1456: lbuf_append(lbuf, "%s%s", prefix, (*p)->bv_val);
! 1457: prefix = ", ";
! 1458: count++;
! 1459: }
! 1460: ldap_value_free_len(bv);
! 1461: }
! 1462: }
! 1463: if (result)
! 1464: ldap_msgfree(result);
! 1465: }
! 1466: efree(filt);
! 1467: done:
! 1468: return count;
! 1469: }
! 1470:
! 1471: /*
! 1472: * STUB
! 1473: */
! 1474: static int
! 1475: sudo_ldap_display_bound_defaults(struct sudo_nss *nss, struct passwd *pw,
! 1476: struct lbuf *lbuf)
! 1477: {
! 1478: return 0;
! 1479: }
! 1480:
! 1481: /*
! 1482: * Print a record in the short form, ala file sudoers.
! 1483: */
! 1484: static int
! 1485: sudo_ldap_display_entry_short(LDAP *ld, LDAPMessage *entry, struct lbuf *lbuf)
! 1486: {
! 1487: struct berval **bv, **p;
! 1488: int count = 0;
! 1489:
! 1490: lbuf_append(lbuf, " (");
! 1491:
! 1492: /* get the RunAsUser Values from the entry */
! 1493: bv = ldap_get_values_len(ld, entry, "sudoRunAsUser");
! 1494: if (bv == NULL)
! 1495: bv = ldap_get_values_len(ld, entry, "sudoRunAs");
! 1496: if (bv != NULL) {
! 1497: for (p = bv; *p != NULL; p++) {
! 1498: lbuf_append(lbuf, "%s%s", p != bv ? ", " : "", (*p)->bv_val);
! 1499: }
! 1500: ldap_value_free_len(bv);
! 1501: } else
! 1502: lbuf_append(lbuf, "%s", def_runas_default);
! 1503:
! 1504: /* get the RunAsGroup Values from the entry */
! 1505: bv = ldap_get_values_len(ld, entry, "sudoRunAsGroup");
! 1506: if (bv != NULL) {
! 1507: lbuf_append(lbuf, " : ");
! 1508: for (p = bv; *p != NULL; p++) {
! 1509: lbuf_append(lbuf, "%s%s", p != bv ? ", " : "", (*p)->bv_val);
! 1510: }
! 1511: ldap_value_free_len(bv);
! 1512: }
! 1513: lbuf_append(lbuf, ") ");
! 1514:
! 1515: /* get the Option Values from the entry */
! 1516: bv = ldap_get_values_len(ld, entry, "sudoOption");
! 1517: if (bv != NULL) {
! 1518: for (p = bv; *p != NULL; p++) {
! 1519: char *cp = (*p)->bv_val;
! 1520: if (*cp == '!')
! 1521: cp++;
! 1522: if (strcmp(cp, "authenticate") == 0)
! 1523: lbuf_append(lbuf, (*p)->bv_val[0] == '!' ?
! 1524: "NOPASSWD: " : "PASSWD: ");
! 1525: else if (strcmp(cp, "noexec") == 0)
! 1526: lbuf_append(lbuf, (*p)->bv_val[0] == '!' ?
! 1527: "EXEC: " : "NOEXEC: ");
! 1528: else if (strcmp(cp, "setenv") == 0)
! 1529: lbuf_append(lbuf, (*p)->bv_val[0] == '!' ?
! 1530: "NOSETENV: " : "SETENV: ");
! 1531: }
! 1532: ldap_value_free_len(bv);
! 1533: }
! 1534:
! 1535: /* get the Command Values from the entry */
! 1536: bv = ldap_get_values_len(ld, entry, "sudoCommand");
! 1537: if (bv != NULL) {
! 1538: for (p = bv; *p != NULL; p++) {
! 1539: lbuf_append(lbuf, "%s%s", p != bv ? ", " : "", (*p)->bv_val);
! 1540: count++;
! 1541: }
! 1542: ldap_value_free_len(bv);
! 1543: }
! 1544: lbuf_append(lbuf, "\n");
! 1545:
! 1546: return count;
! 1547: }
! 1548:
! 1549: /*
! 1550: * Print a record in the long form.
! 1551: */
! 1552: static int
! 1553: sudo_ldap_display_entry_long(LDAP *ld, LDAPMessage *entry, struct lbuf *lbuf)
! 1554: {
! 1555: struct berval **bv, **p;
! 1556: char *rdn;
! 1557: int count = 0;
! 1558:
! 1559: /* extract the dn, only show the first rdn */
! 1560: rdn = sudo_ldap_get_first_rdn(ld, entry);
! 1561: if (rdn != NULL)
! 1562: lbuf_append(lbuf, _("\nLDAP Role: %s\n"), rdn);
! 1563: else
! 1564: lbuf_append(lbuf, _("\nLDAP Role: UNKNOWN\n"));
! 1565: if (rdn)
! 1566: ldap_memfree(rdn);
! 1567:
! 1568: /* get the RunAsUser Values from the entry */
! 1569: lbuf_append(lbuf, " RunAsUsers: ");
! 1570: bv = ldap_get_values_len(ld, entry, "sudoRunAsUser");
! 1571: if (bv == NULL)
! 1572: bv = ldap_get_values_len(ld, entry, "sudoRunAs");
! 1573: if (bv != NULL) {
! 1574: for (p = bv; *p != NULL; p++) {
! 1575: lbuf_append(lbuf, "%s%s", p != bv ? ", " : "", (*p)->bv_val);
! 1576: }
! 1577: ldap_value_free_len(bv);
! 1578: } else
! 1579: lbuf_append(lbuf, "%s", def_runas_default);
! 1580: lbuf_append(lbuf, "\n");
! 1581:
! 1582: /* get the RunAsGroup Values from the entry */
! 1583: bv = ldap_get_values_len(ld, entry, "sudoRunAsGroup");
! 1584: if (bv != NULL) {
! 1585: lbuf_append(lbuf, " RunAsGroups: ");
! 1586: for (p = bv; *p != NULL; p++) {
! 1587: lbuf_append(lbuf, "%s%s", p != bv ? ", " : "", (*p)->bv_val);
! 1588: }
! 1589: ldap_value_free_len(bv);
! 1590: lbuf_append(lbuf, "\n");
! 1591: }
! 1592:
! 1593: /* get the Option Values from the entry */
! 1594: bv = ldap_get_values_len(ld, entry, "sudoOption");
! 1595: if (bv != NULL) {
! 1596: lbuf_append(lbuf, " Options: ");
! 1597: for (p = bv; *p != NULL; p++) {
! 1598: lbuf_append(lbuf, "%s%s", p != bv ? ", " : "", (*p)->bv_val);
! 1599: }
! 1600: ldap_value_free_len(bv);
! 1601: lbuf_append(lbuf, "\n");
! 1602: }
! 1603:
! 1604: /*
! 1605: * Display order attribute if present. This attribute is single valued,
! 1606: * so there is no need for a loop.
! 1607: */
! 1608: bv = ldap_get_values_len(ld, entry, "sudoOrder");
! 1609: if (bv != NULL) {
! 1610: if (*bv != NULL) {
! 1611: lbuf_append(lbuf, _(" Order: %s\n"), (*bv)->bv_val);
! 1612: }
! 1613: ldap_value_free_len(bv);
! 1614: }
! 1615:
! 1616: /* Get the command values from the entry. */
! 1617: bv = ldap_get_values_len(ld, entry, "sudoCommand");
! 1618: if (bv != NULL) {
! 1619: lbuf_append(lbuf, _(" Commands:\n"));
! 1620: for (p = bv; *p != NULL; p++) {
! 1621: lbuf_append(lbuf, "\t%s\n", (*p)->bv_val);
! 1622: count++;
! 1623: }
! 1624: ldap_value_free_len(bv);
! 1625: }
! 1626:
! 1627: return count;
! 1628: }
! 1629:
! 1630: /*
! 1631: * Like sudo_ldap_lookup(), except we just print entries.
! 1632: */
! 1633: static int
! 1634: sudo_ldap_display_privs(struct sudo_nss *nss, struct passwd *pw,
! 1635: struct lbuf *lbuf)
! 1636: {
! 1637: struct sudo_ldap_handle *handle = nss->handle;
! 1638: LDAP *ld;
! 1639: struct ldap_result *lres;
! 1640: LDAPMessage *entry;
! 1641: int i, count = 0;
! 1642:
! 1643: if (handle == NULL || handle->ld == NULL)
! 1644: goto done;
! 1645: ld = handle->ld;
! 1646:
! 1647: DPRINTF(("ldap search for command list"), 1);
! 1648: lres = sudo_ldap_result_get(nss, pw);
! 1649:
! 1650: /* Display all matching entries. */
! 1651: for (i = 0; i < lres->nentries; i++) {
! 1652: entry = lres->entries[i].entry;
! 1653: if (long_list)
! 1654: count += sudo_ldap_display_entry_long(ld, entry, lbuf);
! 1655: else
! 1656: count += sudo_ldap_display_entry_short(ld, entry, lbuf);
! 1657: }
! 1658:
! 1659: done:
! 1660: return count;
! 1661: }
! 1662:
! 1663: static int
! 1664: sudo_ldap_display_cmnd(struct sudo_nss *nss, struct passwd *pw)
! 1665: {
! 1666: struct sudo_ldap_handle *handle = nss->handle;
! 1667: LDAP *ld;
! 1668: struct ldap_result *lres;
! 1669: LDAPMessage *entry;
! 1670: int i, found = FALSE;
! 1671:
! 1672: if (handle == NULL || handle->ld == NULL)
! 1673: goto done;
! 1674: ld = handle->ld;
! 1675:
! 1676: /*
! 1677: * The sudo_ldap_result_get() function returns all nodes that match
! 1678: * the user and the host.
! 1679: */
! 1680: DPRINTF(("ldap search for command list"), 1);
! 1681: lres = sudo_ldap_result_get(nss, pw);
! 1682: for (i = 0; i < lres->nentries; i++) {
! 1683: entry = lres->entries[i].entry;
! 1684: if (sudo_ldap_check_command(ld, entry, NULL) &&
! 1685: sudo_ldap_check_runas(ld, entry)) {
! 1686: found = TRUE;
! 1687: goto done;
! 1688: }
! 1689: }
! 1690:
! 1691: done:
! 1692: if (found)
! 1693: printf("%s%s%s\n", safe_cmnd ? safe_cmnd : user_cmnd,
! 1694: user_args ? " " : "", user_args ? user_args : "");
! 1695: return !found;
! 1696: }
! 1697:
! 1698: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 1699: static int
! 1700: sudo_ldap_sasl_interact(LDAP *ld, unsigned int flags, void *_auth_id,
! 1701: void *_interact)
! 1702: {
! 1703: char *auth_id = (char *)_auth_id;
! 1704: sasl_interact_t *interact = (sasl_interact_t *)_interact;
! 1705:
! 1706: for (; interact->id != SASL_CB_LIST_END; interact++) {
! 1707: if (interact->id != SASL_CB_USER)
! 1708: return LDAP_PARAM_ERROR;
! 1709:
! 1710: if (auth_id != NULL)
! 1711: interact->result = auth_id;
! 1712: else if (interact->defresult != NULL)
! 1713: interact->result = interact->defresult;
! 1714: else
! 1715: interact->result = "";
! 1716:
! 1717: interact->len = strlen(interact->result);
! 1718: #if SASL_VERSION_MAJOR < 2
! 1719: interact->result = estrdup(interact->result);
! 1720: #endif /* SASL_VERSION_MAJOR < 2 */
! 1721: }
! 1722: return LDAP_SUCCESS;
! 1723: }
! 1724: #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
! 1725:
! 1726: /*
! 1727: * Set LDAP options based on the config table.
! 1728: */
! 1729: static int
! 1730: sudo_ldap_set_options(LDAP *ld)
! 1731: {
! 1732: struct ldap_config_table *cur;
! 1733: int rc;
! 1734:
! 1735: /* Set ber options */
! 1736: #ifdef LBER_OPT_DEBUG_LEVEL
! 1737: if (ldap_conf.ldap_debug)
! 1738: ber_set_option(NULL, LBER_OPT_DEBUG_LEVEL, &ldap_conf.ldap_debug);
! 1739: #endif
! 1740:
! 1741: /* Set simple LDAP options */
! 1742: for (cur = ldap_conf_table; cur->conf_str != NULL; cur++) {
! 1743: LDAP *conn;
! 1744: int ival;
! 1745: char *sval;
! 1746:
! 1747: if (cur->opt_val == -1)
! 1748: continue;
! 1749:
! 1750: conn = cur->connected ? ld : NULL;
! 1751: switch (cur->type) {
! 1752: case CONF_BOOL:
! 1753: case CONF_INT:
! 1754: ival = *(int *)(cur->valp);
! 1755: if (ival >= 0) {
! 1756: rc = ldap_set_option(conn, cur->opt_val, &ival);
! 1757: if (rc != LDAP_OPT_SUCCESS) {
! 1758: warningx("ldap_set_option: %s -> %d: %s",
! 1759: cur->conf_str, ival, ldap_err2string(rc));
! 1760: return -1;
! 1761: }
! 1762: DPRINTF(("ldap_set_option: %s -> %d", cur->conf_str, ival), 1);
! 1763: }
! 1764: break;
! 1765: case CONF_STR:
! 1766: sval = *(char **)(cur->valp);
! 1767: if (sval != NULL) {
! 1768: rc = ldap_set_option(conn, cur->opt_val, sval);
! 1769: if (rc != LDAP_OPT_SUCCESS) {
! 1770: warningx("ldap_set_option: %s -> %s: %s",
! 1771: cur->conf_str, sval, ldap_err2string(rc));
! 1772: return -1;
! 1773: }
! 1774: DPRINTF(("ldap_set_option: %s -> %s", cur->conf_str, sval), 1);
! 1775: }
! 1776: break;
! 1777: }
! 1778: }
! 1779:
! 1780: #ifdef LDAP_OPT_TIMEOUT
! 1781: /* Convert timeout to a timeval */
! 1782: if (ldap_conf.timeout > 0) {
! 1783: struct timeval tv;
! 1784: tv.tv_sec = ldap_conf.timeout;
! 1785: tv.tv_usec = 0;
! 1786: rc = ldap_set_option(ld, LDAP_OPT_TIMEOUT, &tv);
! 1787: if (rc != LDAP_OPT_SUCCESS) {
! 1788: warningx("ldap_set_option(TIMEOUT, %ld): %s",
! 1789: (long)tv.tv_sec, ldap_err2string(rc));
! 1790: return -1;
! 1791: }
! 1792: DPRINTF(("ldap_set_option(LDAP_OPT_TIMEOUT, %ld)",
! 1793: (long)tv.tv_sec), 1);
! 1794: }
! 1795: #endif
! 1796: #ifdef LDAP_OPT_NETWORK_TIMEOUT
! 1797: /* Convert bind_timelimit to a timeval */
! 1798: if (ldap_conf.bind_timelimit > 0) {
! 1799: struct timeval tv;
! 1800: tv.tv_sec = ldap_conf.bind_timelimit / 1000;
! 1801: tv.tv_usec = 0;
! 1802: rc = ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
! 1803: if (rc != LDAP_OPT_SUCCESS) {
! 1804: warningx("ldap_set_option(NETWORK_TIMEOUT, %ld): %s",
! 1805: (long)tv.tv_sec, ldap_err2string(rc));
! 1806: return -1;
! 1807: }
! 1808: DPRINTF(("ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, %ld)",
! 1809: (long)tv.tv_sec), 1);
! 1810: }
! 1811: #endif
! 1812:
! 1813: #if defined(LDAP_OPT_X_TLS) && !defined(HAVE_LDAPSSL_INIT)
! 1814: if (ldap_conf.ssl_mode == SUDO_LDAP_SSL) {
! 1815: int val = LDAP_OPT_X_TLS_HARD;
! 1816: rc = ldap_set_option(ld, LDAP_OPT_X_TLS, &val);
! 1817: if (rc != LDAP_SUCCESS) {
! 1818: warningx("ldap_set_option(LDAP_OPT_X_TLS, LDAP_OPT_X_TLS_HARD): %s",
! 1819: ldap_err2string(rc));
! 1820: return -1;
! 1821: }
! 1822: DPRINTF(("ldap_set_option(LDAP_OPT_X_TLS, LDAP_OPT_X_TLS_HARD)"), 1);
! 1823: }
! 1824: #endif
! 1825: return 0;
! 1826: }
! 1827:
! 1828: /*
! 1829: * Create a new sudo_ldap_result structure.
! 1830: */
! 1831: static struct ldap_result *
! 1832: sudo_ldap_result_alloc(void)
! 1833: {
! 1834: struct ldap_result *result;
! 1835:
! 1836: result = emalloc(sizeof(*result));
! 1837: result->searches = NULL;
! 1838: result->nentries = 0;
! 1839: result->entries = NULL;
! 1840: result->allocated_entries = 0;
! 1841: result->user_matches = FALSE;
! 1842: result->host_matches = FALSE;
! 1843: return result;
! 1844: }
! 1845:
! 1846: /*
! 1847: * Free the ldap result structure
! 1848: */
! 1849: static void
! 1850: sudo_ldap_result_free(struct ldap_result *lres)
! 1851: {
! 1852: struct ldap_search_list *s;
! 1853:
! 1854: if (lres != NULL) {
! 1855: if (lres->nentries) {
! 1856: efree(lres->entries);
! 1857: lres->entries = NULL;
! 1858: }
! 1859: if (lres->searches) {
! 1860: while ((s = lres->searches) != NULL) {
! 1861: ldap_msgfree(s->searchresult);
! 1862: lres->searches = s->next;
! 1863: efree(s);
! 1864: }
! 1865: }
! 1866: efree(lres);
! 1867: }
! 1868: }
! 1869:
! 1870: /*
! 1871: * Add a search result to the ldap_result structure.
! 1872: */
! 1873: static struct ldap_search_list *
! 1874: sudo_ldap_result_add_search(struct ldap_result *lres, LDAP *ldap,
! 1875: LDAPMessage *searchresult)
! 1876: {
! 1877: struct ldap_search_list *s, *news;
! 1878:
! 1879: news = emalloc(sizeof(struct ldap_search_list));
! 1880: news->next = NULL;
! 1881: news->ldap = ldap;
! 1882: news->searchresult = searchresult;
! 1883:
! 1884: /* Add entry to the end of the chain (XXX - tailq instead?). */
! 1885: if (lres->searches) {
! 1886: for (s = lres->searches; s->next != NULL; s = s->next)
! 1887: continue;
! 1888: s->next = news;
! 1889: } else {
! 1890: lres->searches = news;
! 1891: }
! 1892: return news;
! 1893: }
! 1894:
! 1895: /*
! 1896: * Connect to the LDAP server specified by ld
! 1897: */
! 1898: static int
! 1899: sudo_ldap_bind_s(LDAP *ld)
! 1900: {
! 1901: int rc;
! 1902: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 1903: const char *old_ccname = user_ccname;
! 1904: # ifdef HAVE_GSS_KRB5_CCACHE_NAME
! 1905: unsigned int status;
! 1906: # endif
! 1907: #endif
! 1908:
! 1909: #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
! 1910: if (ldap_conf.rootuse_sasl == TRUE ||
! 1911: (ldap_conf.rootuse_sasl != FALSE && ldap_conf.use_sasl == TRUE)) {
! 1912: void *auth_id = ldap_conf.rootsasl_auth_id ?
! 1913: ldap_conf.rootsasl_auth_id : ldap_conf.sasl_auth_id;
! 1914:
! 1915: if (ldap_conf.krb5_ccname != NULL) {
! 1916: # ifdef HAVE_GSS_KRB5_CCACHE_NAME
! 1917: if (gss_krb5_ccache_name(&status, ldap_conf.krb5_ccname, &old_ccname)
! 1918: != GSS_S_COMPLETE) {
! 1919: old_ccname = NULL;
! 1920: DPRINTF(("gss_krb5_ccache_name() failed: %d", status), 1);
! 1921: }
! 1922: # else
! 1923: setenv("KRB5CCNAME", ldap_conf.krb5_ccname, TRUE);
! 1924: # endif
! 1925: }
! 1926: rc = ldap_sasl_interactive_bind_s(ld, ldap_conf.binddn, "GSSAPI",
! 1927: NULL, NULL, LDAP_SASL_QUIET, sudo_ldap_sasl_interact, auth_id);
! 1928: if (ldap_conf.krb5_ccname != NULL) {
! 1929: # ifdef HAVE_GSS_KRB5_CCACHE_NAME
! 1930: if (gss_krb5_ccache_name(&status, old_ccname, NULL) != GSS_S_COMPLETE)
! 1931: DPRINTF(("gss_krb5_ccache_name() failed: %d", status), 1);
! 1932: # else
! 1933: if (old_ccname != NULL)
! 1934: setenv("KRB5CCNAME", old_ccname, TRUE);
! 1935: else
! 1936: unsetenv("KRB5CCNAME");
! 1937: # endif
! 1938: }
! 1939: if (rc != LDAP_SUCCESS) {
! 1940: warningx("ldap_sasl_interactive_bind_s(): %s",
! 1941: ldap_err2string(rc));
! 1942: return -1;
! 1943: }
! 1944: DPRINTF(("ldap_sasl_interactive_bind_s() ok"), 1);
! 1945: } else
! 1946: #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
! 1947: #ifdef HAVE_LDAP_SASL_BIND_S
! 1948: {
! 1949: struct berval bv;
! 1950:
! 1951: bv.bv_val = ldap_conf.bindpw ? ldap_conf.bindpw : "";
! 1952: bv.bv_len = strlen(bv.bv_val);
! 1953:
! 1954: rc = ldap_sasl_bind_s(ld, ldap_conf.binddn, LDAP_SASL_SIMPLE, &bv,
! 1955: NULL, NULL, NULL);
! 1956: if (rc != LDAP_SUCCESS) {
! 1957: warningx("ldap_sasl_bind_s(): %s", ldap_err2string(rc));
! 1958: return -1;
! 1959: }
! 1960: DPRINTF(("ldap_sasl_bind_s() ok"), 1);
! 1961: }
! 1962: #else
! 1963: {
! 1964: rc = ldap_simple_bind_s(ld, ldap_conf.binddn, ldap_conf.bindpw);
! 1965: if (rc != LDAP_SUCCESS) {
! 1966: warningx("ldap_simple_bind_s(): %s", ldap_err2string(rc));
! 1967: return -1;
! 1968: }
! 1969: DPRINTF(("ldap_simple_bind_s() ok"), 1);
! 1970: }
! 1971: #endif
! 1972: return 0;
! 1973: }
! 1974:
! 1975: /*
! 1976: * Open a connection to the LDAP server.
! 1977: * Returns 0 on success and non-zero on failure.
! 1978: */
! 1979: static int
! 1980: sudo_ldap_open(struct sudo_nss *nss)
! 1981: {
! 1982: LDAP *ld;
! 1983: int rc, ldapnoinit = FALSE;
! 1984: struct sudo_ldap_handle *handle;
! 1985:
! 1986: if (!sudo_ldap_read_config())
! 1987: return -1;
! 1988:
! 1989: /* Prevent reading of user ldaprc and system defaults. */
! 1990: if (getenv("LDAPNOINIT") == NULL) {
! 1991: ldapnoinit = TRUE;
! 1992: setenv("LDAPNOINIT", "1", TRUE);
! 1993: }
! 1994:
! 1995: /* Connect to LDAP server */
! 1996: #ifdef HAVE_LDAP_INITIALIZE
! 1997: if (ldap_conf.uri != NULL) {
! 1998: char *buf = sudo_ldap_join_uri(ldap_conf.uri);
! 1999: DPRINTF(("ldap_initialize(ld, %s)", buf), 2);
! 2000: rc = ldap_initialize(&ld, buf);
! 2001: efree(buf);
! 2002: } else
! 2003: #endif
! 2004: rc = sudo_ldap_init(&ld, ldap_conf.host, ldap_conf.port);
! 2005: if (rc != LDAP_SUCCESS) {
! 2006: warningx(_("unable to initialize LDAP: %s"), ldap_err2string(rc));
! 2007: return -1;
! 2008: }
! 2009:
! 2010: if (ldapnoinit)
! 2011: unsetenv("LDAPNOINIT");
! 2012:
! 2013: /* Set LDAP options */
! 2014: if (sudo_ldap_set_options(ld) < 0)
! 2015: return -1;
! 2016:
! 2017: if (ldap_conf.ssl_mode == SUDO_LDAP_STARTTLS) {
! 2018: #if defined(HAVE_LDAP_START_TLS_S)
! 2019: rc = ldap_start_tls_s(ld, NULL, NULL);
! 2020: if (rc != LDAP_SUCCESS) {
! 2021: warningx("ldap_start_tls_s(): %s", ldap_err2string(rc));
! 2022: return -1;
! 2023: }
! 2024: DPRINTF(("ldap_start_tls_s() ok"), 1);
! 2025: #elif defined(HAVE_LDAP_SSL_CLIENT_INIT) && defined(HAVE_LDAP_START_TLS_S_NP)
! 2026: if (ldap_ssl_client_init(NULL, NULL, 0, &rc) != LDAP_SUCCESS) {
! 2027: warningx("ldap_ssl_client_init(): %s", ldap_err2string(rc));
! 2028: return -1;
! 2029: }
! 2030: rc = ldap_start_tls_s_np(ld, NULL);
! 2031: if (rc != LDAP_SUCCESS) {
! 2032: warningx("ldap_start_tls_s_np(): %s", ldap_err2string(rc));
! 2033: return -1;
! 2034: }
! 2035: DPRINTF(("ldap_start_tls_s_np() ok"), 1);
! 2036: #else
! 2037: warningx(_("start_tls specified but LDAP libs do not support ldap_start_tls_s() or ldap_start_tls_s_np()"));
! 2038: #endif /* !HAVE_LDAP_START_TLS_S && !HAVE_LDAP_START_TLS_S_NP */
! 2039: }
! 2040:
! 2041: /* Actually connect */
! 2042: if (sudo_ldap_bind_s(ld) != 0)
! 2043: return -1;
! 2044:
! 2045: /* Create a handle container. */
! 2046: handle = emalloc(sizeof(struct sudo_ldap_handle));
! 2047: handle->ld = ld;
! 2048: handle->result = NULL;
! 2049: handle->username = NULL;
! 2050: handle->grlist = NULL;
! 2051: nss->handle = handle;
! 2052:
! 2053: return 0;
! 2054: }
! 2055:
! 2056: static int
! 2057: sudo_ldap_setdefs(struct sudo_nss *nss)
! 2058: {
! 2059: struct ldap_config_list_str *base;
! 2060: struct sudo_ldap_handle *handle = nss->handle;
! 2061: struct timeval tv, *tvp = NULL;
! 2062: LDAP *ld;
! 2063: LDAPMessage *entry, *result;
! 2064: char *filt;
! 2065: int rc;
! 2066:
! 2067: if (handle == NULL || handle->ld == NULL)
! 2068: return -1;
! 2069: ld = handle->ld;
! 2070:
! 2071: filt = sudo_ldap_build_default_filter();
! 2072: DPRINTF(("Looking for cn=defaults: %s", filt), 1);
! 2073:
! 2074: for (base = ldap_conf.base; base != NULL; base = base->next) {
! 2075: if (ldap_conf.timeout > 0) {
! 2076: tv.tv_sec = ldap_conf.timeout;
! 2077: tv.tv_usec = 0;
! 2078: tvp = &tv;
! 2079: }
! 2080: result = NULL;
! 2081: rc = ldap_search_ext_s(ld, base->val, LDAP_SCOPE_SUBTREE,
! 2082: filt, NULL, 0, NULL, NULL, tvp, 0, &result);
! 2083: if (rc == LDAP_SUCCESS && (entry = ldap_first_entry(ld, result))) {
! 2084: DPRINTF(("found:%s", ldap_get_dn(ld, entry)), 1);
! 2085: sudo_ldap_parse_options(ld, entry);
! 2086: } else
! 2087: DPRINTF(("no default options found in %s", base->val), 1);
! 2088:
! 2089: if (result)
! 2090: ldap_msgfree(result);
! 2091: }
! 2092: efree(filt);
! 2093:
! 2094: return 0;
! 2095: }
! 2096:
! 2097: /*
! 2098: * like sudoers_lookup() - only LDAP style
! 2099: */
! 2100: static int
! 2101: sudo_ldap_lookup(struct sudo_nss *nss, int ret, int pwflag)
! 2102: {
! 2103: struct sudo_ldap_handle *handle = nss->handle;
! 2104: LDAP *ld;
! 2105: LDAPMessage *entry;
! 2106: int i, rc, setenv_implied;
! 2107: struct ldap_result *lres = NULL;
! 2108:
! 2109: if (handle == NULL || handle->ld == NULL)
! 2110: return ret;
! 2111: ld = handle->ld;
! 2112:
! 2113: /* Fetch list of sudoRole entries that match user and host. */
! 2114: lres = sudo_ldap_result_get(nss, sudo_user.pw);
! 2115:
! 2116: /*
! 2117: * The following queries are only determine whether or not a
! 2118: * password is required, so the order of the entries doesn't matter.
! 2119: */
! 2120: if (pwflag) {
! 2121: int doauth = UNSPEC;
! 2122: int matched = UNSPEC;
! 2123: enum def_tuple pwcheck =
! 2124: (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
! 2125:
! 2126: DPRINTF(("perform search for pwflag %d", pwflag), 1);
! 2127: for (i = 0; i < lres->nentries; i++) {
! 2128: entry = lres->entries[i].entry;
! 2129: if ((pwcheck == any && doauth != FALSE) ||
! 2130: (pwcheck == all && doauth == FALSE)) {
! 2131: doauth = sudo_ldap_check_bool(ld, entry, "authenticate");
! 2132: }
! 2133: /* Only check the command when listing another user. */
! 2134: if (user_uid == 0 || list_pw == NULL ||
! 2135: user_uid == list_pw->pw_uid ||
! 2136: sudo_ldap_check_command(ld, entry, NULL)) {
! 2137: matched = TRUE;
! 2138: break;
! 2139: }
! 2140: }
! 2141: if (matched || user_uid == 0) {
! 2142: SET(ret, VALIDATE_OK);
! 2143: CLR(ret, VALIDATE_NOT_OK);
! 2144: if (def_authenticate) {
! 2145: switch (pwcheck) {
! 2146: case always:
! 2147: SET(ret, FLAG_CHECK_USER);
! 2148: break;
! 2149: case all:
! 2150: case any:
! 2151: if (doauth == FALSE)
! 2152: def_authenticate = FALSE;
! 2153: break;
! 2154: case never:
! 2155: def_authenticate = FALSE;
! 2156: break;
! 2157: default:
! 2158: break;
! 2159: }
! 2160: }
! 2161: }
! 2162: goto done;
! 2163: }
! 2164:
! 2165: DPRINTF(("searching LDAP for sudoers entries"), 1);
! 2166:
! 2167: setenv_implied = FALSE;
! 2168: for (i = 0; i < lres->nentries; i++) {
! 2169: entry = lres->entries[i].entry;
! 2170: if (!sudo_ldap_check_runas(ld, entry))
! 2171: continue;
! 2172: rc = sudo_ldap_check_command(ld, entry, &setenv_implied);
! 2173: if (rc != UNSPEC) {
! 2174: /* We have a match. */
! 2175: DPRINTF(("Command %sallowed", rc == TRUE ? "" : "NOT "), 1);
! 2176: if (rc == TRUE) {
! 2177: DPRINTF(("LDAP entry: %p", entry), 1);
! 2178: /* Apply entry-specific options. */
! 2179: if (setenv_implied)
! 2180: def_setenv = TRUE;
! 2181: sudo_ldap_parse_options(ld, entry);
! 2182: #ifdef HAVE_SELINUX
! 2183: /* Set role and type if not specified on command line. */
! 2184: if (user_role == NULL)
! 2185: user_role = def_role;
! 2186: if (user_type == NULL)
! 2187: user_type = def_type;
! 2188: #endif /* HAVE_SELINUX */
! 2189: SET(ret, VALIDATE_OK);
! 2190: CLR(ret, VALIDATE_NOT_OK);
! 2191: } else {
! 2192: SET(ret, VALIDATE_NOT_OK);
! 2193: CLR(ret, VALIDATE_OK);
! 2194: }
! 2195: break;
! 2196: }
! 2197: }
! 2198:
! 2199: done:
! 2200: DPRINTF(("done with LDAP searches"), 1);
! 2201: DPRINTF(("user_matches=%d", lres->user_matches), 1);
! 2202: DPRINTF(("host_matches=%d", lres->host_matches), 1);
! 2203:
! 2204: if (!ISSET(ret, VALIDATE_OK)) {
! 2205: /* No matching entries. */
! 2206: if (pwflag && list_pw == NULL)
! 2207: SET(ret, FLAG_NO_CHECK);
! 2208: }
! 2209: if (lres->user_matches)
! 2210: CLR(ret, FLAG_NO_USER);
! 2211: if (lres->host_matches)
! 2212: CLR(ret, FLAG_NO_HOST);
! 2213: DPRINTF(("sudo_ldap_lookup(%d)=0x%02x", pwflag, ret), 1);
! 2214:
! 2215: return ret;
! 2216: }
! 2217:
! 2218: /*
! 2219: * Comparison function for ldap_entry_wrapper structures, descending order.
! 2220: */
! 2221: static int
! 2222: ldap_entry_compare(const void *a, const void *b)
! 2223: {
! 2224: const struct ldap_entry_wrapper *aw = a;
! 2225: const struct ldap_entry_wrapper *bw = b;
! 2226:
! 2227: return bw->order < aw->order ? -1 :
! 2228: (bw->order > aw->order ? 1 : 0);
! 2229: }
! 2230:
! 2231: /*
! 2232: * Find the last entry in the list of searches, usually the
! 2233: * one currently being used to add entries.
! 2234: * XXX - use a tailq instead?
! 2235: */
! 2236: static struct ldap_search_list *
! 2237: sudo_ldap_result_last_search(struct ldap_result *lres)
! 2238: {
! 2239: struct ldap_search_list *result = lres->searches;
! 2240:
! 2241: if (result) {
! 2242: while (result->next)
! 2243: result = result->next;
! 2244: }
! 2245: return result;
! 2246: }
! 2247:
! 2248: /*
! 2249: * Add an entry to the result structure.
! 2250: */
! 2251: static struct ldap_entry_wrapper *
! 2252: sudo_ldap_result_add_entry(struct ldap_result *lres, LDAPMessage *entry)
! 2253: {
! 2254: struct ldap_search_list *last;
! 2255: struct berval **bv;
! 2256: double order = 0.0;
! 2257: char *ep;
! 2258:
! 2259: /* Determine whether the entry has the sudoOrder attribute. */
! 2260: last = sudo_ldap_result_last_search(lres);
! 2261: bv = ldap_get_values_len(last->ldap, entry, "sudoOrder");
! 2262: if (bv != NULL) {
! 2263: if (ldap_count_values_len(bv) > 0) {
! 2264: /* Get the value of this attribute, 0 if not present. */
! 2265: DPRINTF(("order attribute raw: %s", (*bv)->bv_val), 1);
! 2266: order = strtod((*bv)->bv_val, &ep);
! 2267: if (ep == (*bv)->bv_val || *ep != '\0') {
! 2268: warningx(_("invalid sudoOrder attribute: %s"), (*bv)->bv_val);
! 2269: order = 0.0;
! 2270: }
! 2271: DPRINTF(("order attribute: %f", order), 1);
! 2272: }
! 2273: ldap_value_free_len(bv);
! 2274: }
! 2275:
! 2276: /*
! 2277: * Enlarge the array of entry wrappers as needed, preallocating blocks
! 2278: * of 100 entries to save on allocation time.
! 2279: */
! 2280: if (++lres->nentries > lres->allocated_entries) {
! 2281: lres->allocated_entries += ALLOCATION_INCREMENT;
! 2282: lres->entries = erealloc3(lres->entries, lres->allocated_entries,
! 2283: sizeof(lres->entries[0]));
! 2284: }
! 2285:
! 2286: /* Fill in the new entry and return it. */
! 2287: lres->entries[lres->nentries - 1].entry = entry;
! 2288: lres->entries[lres->nentries - 1].order = order;
! 2289:
! 2290: return &lres->entries[lres->nentries - 1];
! 2291: }
! 2292:
! 2293: /*
! 2294: * Free the ldap result structure in the sudo_nss handle.
! 2295: */
! 2296: static void
! 2297: sudo_ldap_result_free_nss(struct sudo_nss *nss)
! 2298: {
! 2299: struct sudo_ldap_handle *handle = nss->handle;
! 2300:
! 2301: if (handle->result != NULL) {
! 2302: DPRINTF(("removing reusable search result"), 1);
! 2303: sudo_ldap_result_free(handle->result);
! 2304: if (handle->username) {
! 2305: efree(handle->username);
! 2306: handle->username = NULL;
! 2307: }
! 2308: handle->grlist = NULL;
! 2309: handle->result = NULL;
! 2310: }
! 2311: }
! 2312:
! 2313: /*
! 2314: * Perform the LDAP query for the user or return a cached query if
! 2315: * there is one for this user.
! 2316: */
! 2317: static struct ldap_result *
! 2318: sudo_ldap_result_get(struct sudo_nss *nss, struct passwd *pw)
! 2319: {
! 2320: struct sudo_ldap_handle *handle = nss->handle;
! 2321: struct ldap_config_list_str *base;
! 2322: struct ldap_result *lres;
! 2323: struct timeval tv, *tvp = NULL;
! 2324: LDAPMessage *entry, *result;
! 2325: LDAP *ld = handle->ld;
! 2326: int do_netgr, rc;
! 2327: char *filt;
! 2328:
! 2329: /*
! 2330: * If we already have a cached result, return it so we don't have to
! 2331: * have to contact the LDAP server again.
! 2332: */
! 2333: if (handle->result) {
! 2334: if (handle->grlist == user_group_list &&
! 2335: strcmp(pw->pw_name, handle->username) == 0) {
! 2336: DPRINTF(("reusing previous result (user %s) with %d entries",
! 2337: handle->username, handle->result->nentries), 1);
! 2338: return handle->result;
! 2339: }
! 2340: /* User mismatch, cached result cannot be used. */
! 2341: DPRINTF(("removing result (user %s), new search (user %s)",
! 2342: handle->username, pw->pw_name), 1);
! 2343: sudo_ldap_result_free_nss(nss);
! 2344: }
! 2345:
! 2346: /*
! 2347: * Okay - time to search for anything that matches this user
! 2348: * Lets limit it to only two queries of the LDAP server
! 2349: *
! 2350: * The first pass will look by the username, groups, and
! 2351: * the keyword ALL. We will then inspect the results that
! 2352: * came back from the query. We don't need to inspect the
! 2353: * sudoUser in this pass since the LDAP server already scanned
! 2354: * it for us.
! 2355: *
! 2356: * The second pass will return all the entries that contain
! 2357: * user netgroups. Then we take the netgroups returned and
! 2358: * try to match them against the username.
! 2359: *
! 2360: * Since we have to sort the possible entries before we make a
! 2361: * decision, we perform the queries and store all of the results in
! 2362: * an ldap_result object. The results are then sorted by sudoOrder.
! 2363: */
! 2364: lres = sudo_ldap_result_alloc();
! 2365: for (do_netgr = 0; do_netgr < 2; do_netgr++) {
! 2366: filt = do_netgr ? sudo_ldap_build_pass2() : sudo_ldap_build_pass1(pw);
! 2367: DPRINTF(("ldap search '%s'", filt), 1);
! 2368: for (base = ldap_conf.base; base != NULL; base = base->next) {
! 2369: DPRINTF(("searching from base '%s'", base->val), 1);
! 2370: if (ldap_conf.timeout > 0) {
! 2371: tv.tv_sec = ldap_conf.timeout;
! 2372: tv.tv_usec = 0;
! 2373: tvp = &tv;
! 2374: }
! 2375: result = NULL;
! 2376: rc = ldap_search_ext_s(ld, base->val, LDAP_SCOPE_SUBTREE, filt,
! 2377: NULL, 0, NULL, NULL, tvp, 0, &result);
! 2378: if (rc != LDAP_SUCCESS) {
! 2379: DPRINTF(("nothing found for '%s'", filt), 1);
! 2380: continue;
! 2381: }
! 2382: lres->user_matches = TRUE;
! 2383:
! 2384: /* Add the seach result to list of search results. */
! 2385: DPRINTF(("adding search result"), 1);
! 2386: sudo_ldap_result_add_search(lres, ld, result);
! 2387: LDAP_FOREACH(entry, ld, result) {
! 2388: if ((!do_netgr ||
! 2389: sudo_ldap_check_user_netgroup(ld, entry, pw->pw_name)) &&
! 2390: sudo_ldap_check_host(ld, entry)) {
! 2391: lres->host_matches = TRUE;
! 2392: sudo_ldap_result_add_entry(lres, entry);
! 2393: }
! 2394: }
! 2395: DPRINTF(("result now has %d entries", lres->nentries), 1);
! 2396: }
! 2397: efree(filt);
! 2398: }
! 2399:
! 2400: /* Sort the entries by the sudoOrder attribute. */
! 2401: DPRINTF(("sorting remaining %d entries", lres->nentries), 1);
! 2402: qsort(lres->entries, lres->nentries, sizeof(lres->entries[0]),
! 2403: ldap_entry_compare);
! 2404:
! 2405: /* Store everything in the sudo_nss handle. */
! 2406: handle->result = lres;
! 2407: handle->username = estrdup(pw->pw_name);
! 2408: handle->grlist = user_group_list;
! 2409:
! 2410: return lres;
! 2411: }
! 2412:
! 2413: /*
! 2414: * Shut down the LDAP connection.
! 2415: */
! 2416: static int
! 2417: sudo_ldap_close(struct sudo_nss *nss)
! 2418: {
! 2419: struct sudo_ldap_handle *handle = nss->handle;
! 2420:
! 2421: if (handle != NULL) {
! 2422: /* Free the result before unbinding; it may use the LDAP connection. */
! 2423: sudo_ldap_result_free_nss(nss);
! 2424:
! 2425: /* Unbind and close the LDAP connection. */
! 2426: if (handle->ld != NULL) {
! 2427: ldap_unbind_ext_s(handle->ld, NULL, NULL);
! 2428: handle->ld = NULL;
! 2429: }
! 2430:
! 2431: /* Free the handle container. */
! 2432: efree(nss->handle);
! 2433: nss->handle = NULL;
! 2434: }
! 2435: return 0;
! 2436: }
! 2437:
! 2438: /*
! 2439: * STUB
! 2440: */
! 2441: static int
! 2442: sudo_ldap_parse(struct sudo_nss *nss)
! 2443: {
! 2444: return 0;
! 2445: }
! 2446:
! 2447: #if 0
! 2448: /*
! 2449: * Create an ldap_result from an LDAP search result.
! 2450: *
! 2451: * This function is currently not used anywhere, it is left here as
! 2452: * an example of how to use the cached searches.
! 2453: */
! 2454: static struct ldap_result *
! 2455: sudo_ldap_result_from_search(LDAP *ldap, LDAPMessage *searchresult)
! 2456: {
! 2457: /*
! 2458: * An ldap_result is built from several search results, which are
! 2459: * organized in a list. The head of the list is maintained in the
! 2460: * ldap_result structure, together with the wrappers that point
! 2461: * to individual entries, this has to be initialized first.
! 2462: */
! 2463: struct ldap_result *result = sudo_ldap_result_alloc();
! 2464:
! 2465: /*
! 2466: * Build a new list node for the search result, this creates the
! 2467: * list node.
! 2468: */
! 2469: struct ldap_search_list *last = sudo_ldap_result_add_search(result,
! 2470: ldap, searchresult);
! 2471:
! 2472: /*
! 2473: * Now add each entry in the search result to the array of of entries
! 2474: * in the ldap_result object.
! 2475: */
! 2476: LDAPMessage *entry;
! 2477: LDAP_FOREACH(entry, last->ldap, last->searchresult) {
! 2478: sudo_ldap_result_add_entry(result, entry);
! 2479: }
! 2480: DPRINTF(("sudo_ldap_result_from_search: %d entries found",
! 2481: result->nentries), 2);
! 2482: return result;
! 2483: }
! 2484: #endif
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to ldap.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers