sr-dev February 2009

sr-dev@lists.kamailio.org

13 participants
478 discussions

git:janakj/ldap: tls encryption support added

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 110dd250960f81d1aa3238255234f228604db7ff URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=110dd25… Author: Gergely Kovacs <gergo(a)iptel.org> Committer: Gergely Kovacs <gergo(a)iptel.org> Date: Fri Jul 18 10:02:49 2008 +0000 tls encryption support added --- modules/db_ldap/Makefile | 2 ++ modules/db_ldap/ld_cfg.c | 18 +++++++++++++----- modules/db_ldap/ld_cfg.h | 3 +++ modules/db_ldap/ld_con.c | 33 ++++++++++++++++++++++++++++++++- modules/db_ldap/ld_uri.c | 23 +++++++++++++++++++++++ modules/db_ldap/ld_uri.h | 3 +++ modules/db_ldap/ldap.cfg | 12 ++++++++++++ 7 files changed, 88 insertions(+), 6 deletions(-) diff --git a/modules/db_ldap/Makefile b/modules/db_ldap/Makefile index f7b0507..e9309e2 100644 --- a/modules/db_ldap/Makefile +++ b/modules/db_ldap/Makefile @@ -8,6 +8,8 @@ NAME=ldap.so #DEFS += -DLD_TEST +DEFS += -Wall -DOPENLDAP23 + # Uncomment this if you have a recent version of libldap with # LD_SCOPE_CHILDREN defined #DEFS += -DHAVE_SCOPE_CHILDREN diff --git a/modules/db_ldap/ld_cfg.c b/modules/db_ldap/ld_cfg.c index 642c0b3..d3758ab 100644 --- a/modules/db_ldap/ld_cfg.c +++ b/modules/db_ldap/ld_cfg.c @@ -268,11 +268,14 @@ static cfg_option_t auth_values[] = { static cfg_option_t ldap_con_options[] = { - {"host", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"port", .f = cfg_parse_int_opt}, - {"username", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"password", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"authtype", .param = auth_values, .f = cfg_parse_enum_opt}, + {"host", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"port", .f = cfg_parse_int_opt}, + {"username", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"password", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"authtype", .param = auth_values, .f = cfg_parse_enum_opt}, + {"tls", .param = cfg_bool_values, .f = cfg_parse_enum_opt}, + {"ca_list", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"require_certificate", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, {0} }; @@ -342,6 +345,11 @@ static int parse_section(void* param, cfg_parser_t* st, unsigned int flags) for(i = 0; auth_values[i].name; i++) { auth_values[i].param = &con->authmech; } + for(i = 0; cfg_bool_values[i].name; i++) { + cfg_bool_values[i].param = &con->tls; + } + ldap_con_options[6].param = &con->ca_list; + ldap_con_options[7].param = &con->req_cert; } else { BUG("%s:%d:%d: Unsupported section type %c\n", st->file, t.start.line, t.start.col, t.type); diff --git a/modules/db_ldap/ld_cfg.h b/modules/db_ldap/ld_cfg.h index 1a36ee4..43abca0 100644 --- a/modules/db_ldap/ld_cfg.h +++ b/modules/db_ldap/ld_cfg.h @@ -49,6 +49,9 @@ struct ld_con_info { str username; str password; int authmech; + int tls; /**< TLS encryption enabled */ + str ca_list; /**< Path of the file that contains certificates of the CAs */ + str req_cert; /**< LDAP level of certificate request behaviour */ struct ld_con_info* next; }; diff --git a/modules/db_ldap/ld_con.c b/modules/db_ldap/ld_con.c index 103f1bb..b08a62b 100644 --- a/modules/db_ldap/ld_con.c +++ b/modules/db_ldap/ld_con.c @@ -42,7 +42,6 @@ #include <ldap.h> #include <stdlib.h> #include <string.h> - #include <sasl/sasl.h> /** Free all memory allocated for a ld_con structure. @@ -176,6 +175,7 @@ int ld_con_connect(db_con_t* con) struct ld_con* lcon; struct ld_uri* luri; int ret, version = 3; + char* err_str = NULL; lcon = DB_GET_PAYLOAD(con); luri = DB_GET_PAYLOAD(con->uri); @@ -193,6 +193,19 @@ int ld_con_connect(db_con_t* con) } } + /* we pass the TLS_REQCERT and TLS_REQCERT attributes over environment + variables to ldap library */ + if (luri->tls) { + if (setenv("LDAPTLS_CACERT", luri->ca_list, 1)) { + ERR("ldap: Can't set environment variable 'LDAPTLS_CACERT'\n"); + goto error; + } + if (setenv("LDAPTLS_REQCERT", luri->req_cert, 1)) { + ERR("ldap: Can't set environment variable 'LDAPTLS_REQCERT'\n"); + goto error; + } + } + ret = ldap_initialize(&lcon->con, luri->uri); if (lcon->con == NULL) { ERR("ldap: Error while initializing new LDAP connection to %s\n", @@ -207,6 +220,24 @@ int ld_con_connect(db_con_t* con) goto error; } + if (luri->tls) { + ret = ldap_start_tls_s(lcon->con, NULL, NULL); + if (ret != LDAP_SUCCESS) { + /* get addition info of this error */ +#ifdef OPENLDAP23 + ldap_get_option(lcon->con, LDAP_OPT_ERROR_STRING, &err_str); +#elif OPENLDAP24 + ldap_get_option(lcon->con, LDAP_OPT_DIAGNOSTIC_MESSAGE, &err_str); +#endif + ERR("ldap: Error while starting TLS: %s\n", ldap_err2string(ret)); + if (err_str) { + ERR("ldap: %s\n", err_str); + ldap_memfree(err_str); + } + goto error; + } + } + switch (luri->authmech) { case LDAP_AUTHMECH_NONE: ret = ldap_simple_bind_s(lcon->con, NULL, NULL); diff --git a/modules/db_ldap/ld_uri.c b/modules/db_ldap/ld_uri.c index 5476e51..1b18879 100644 --- a/modules/db_ldap/ld_uri.c +++ b/modules/db_ldap/ld_uri.c @@ -285,6 +285,19 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri) } res->authmech = cfg_conn_info->authmech; + res->tls = cfg_conn_info->tls; + if (cfg_conn_info->ca_list.s) { + if (!(res->ca_list = pkgstrdup(&cfg_conn_info->ca_list))) { + ERR("ldap: No memory left\n"); + goto err; + } + } + if (cfg_conn_info->req_cert.s) { + if (!(res->req_cert = pkgstrdup(&cfg_conn_info->req_cert))) { + ERR("ldap: No memory left\n"); + goto err; + } + } break; default: @@ -304,6 +317,14 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri) pkg_free(res->password); res->password = NULL; } + if (res->ca_list) { + pkg_free(res->ca_list); + res->ca_list = NULL; + } + if (res->req_cert) { + pkg_free(res->req_cert); + res->req_cert = NULL; + } return -1; } @@ -314,6 +335,8 @@ static void ld_uri_free(db_uri_t* uri, struct ld_uri* payload) if (payload->uri) pkg_free(payload->uri); if (payload->username) pkg_free(payload->username); if (payload->password) pkg_free(payload->password); + if (payload->ca_list) pkg_free(payload->ca_list); + if (payload->req_cert) pkg_free(payload->req_cert); db_drv_free(&payload->drv); pkg_free(payload); } diff --git a/modules/db_ldap/ld_uri.h b/modules/db_ldap/ld_uri.h index 27bfa15..43155f3 100644 --- a/modules/db_ldap/ld_uri.h +++ b/modules/db_ldap/ld_uri.h @@ -61,6 +61,9 @@ struct ld_uri { char* password; char* uri; /**< The whole URI, including scheme */ int authmech; + int tls; /**< TLS encryption enabled */ + char* ca_list; /**< Path of the file that contains certificates of the CAs */ + char* req_cert; /**< LDAP level of certificate request behaviour */ LDAPURLDesc* ldap_url; /**< URI parsed by the ldap client library */ }; diff --git a/modules/db_ldap/ldap.cfg b/modules/db_ldap/ldap.cfg index c21da52..d113bfb 100644 --- a/modules/db_ldap/ldap.cfg +++ b/modules/db_ldap/ldap.cfg @@ -24,6 +24,18 @@ password=heslo # Allowed values: none (default), simple, digest-md5, external authtype=simple +# tls encryption +tls=off + +# Specifies the file that contains certificates for all of the Certificate +# Authorities the ldap module will recognize. +ca_list=/home/kg/work/openssl/demoCA/cacert.pem + +# Specifies what checks to perform on server certificates in a TLS session +# allowed values are never/allow/try/demand +# see the TLS_REQCERT tls option part of ldap.conf(8) man page for more details +require_certificate=demand + # # Table credentials contains SIP digest authentication credentials. #

15 years, 9 months

git:janakj/ldap: - added an alias for generalized time syntax

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: e66572b0dddbc460bbc1536afeb60620673c554e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=e66572b… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jul 10 15:14:45 2008 +0000 - added an alias for generalized time syntax --- modules/db_ldap/ser.schema | 17 +++++++++-------- 1 files changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/db_ldap/ser.schema b/modules/db_ldap/ser.schema index 2c25c6d..6493d8f 100644 --- a/modules/db_ldap/ser.schema +++ b/modules/db_ldap/ser.schema @@ -31,14 +31,15 @@ objectIdentifier serObjectClass serLDAP:1 # # Convenience macros for commonly used syntax OIDs # -objectIdentifier ldapSyntax ldap3OID:115.121.1 -objectIdentifier stringSyntax ldapSyntax:15 -objectIdentifier octetStringSyntax ldapSyntax:40 -objectIdentifier bitStringSyntax ldapSyntax:6 -objectIdentifier intSyntax ldapSyntax:27 -objectIdentifier numericStringSyntax ldapSyntax:36 -objectIdentifier binarySyntax ldapSyntax:5 -objectIdentifier boolSyntax ldapSyntax:7 +objectIdentifier ldapSyntax ldap3OID:115.121.1 +objectIdentifier stringSyntax ldapSyntax:15 +objectIdentifier octetStringSyntax ldapSyntax:40 +objectIdentifier bitStringSyntax ldapSyntax:6 +objectIdentifier intSyntax ldapSyntax:27 +objectIdentifier numericStringSyntax ldapSyntax:36 +objectIdentifier binarySyntax ldapSyntax:5 +objectIdentifier boolSyntax ldapSyntax:7 +objectIdentifier genTimeSyntax ldapSyntax:24 # # This is the parent attribute type for various UID attributes of SER, such

15 years, 9 months

git:janakj/ldap: - ticket numbers added

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 0d7657b850b13160ad7ae2f46a09d9d539fe4977 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=0d7657b… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jul 10 14:14:02 2008 +0000 - ticket numbers added --- modules/db_ldap/todo.txt | 134 ++++++++++++++++++++++++---------------------- 1 files changed, 70 insertions(+), 64 deletions(-) diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index ce9c672..3849dee 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -1,35 +1,35 @@ X Simple Authentication - Implement support for simple LDAP authentication with username and - password. This will take a change in the URI parser because the one provided - by libldap (which we use to parse the URI right now) does not support - embedded usernames and passwords in the URI. + Implement support for simple LDAP authentication with username and password. + This will take a change in the URI parser because the one provided by + libldap (which we use to parse the URI right now) does not support embedded + usernames and passwords in the URI. -* SASL Authentication Support +* SASL Authentication Support (SER-392) The driver supports no authentication method at the moment, we should include support for simple authentication at least, but better SASL. -* TLS/SSL Support +* TLS/SSL Support (SER-394) The driver should support encrypted connections to LDAP servers and some level of certificate validation. Currently there are no options or parameters to configure SSL/TLS certificates and keys to use. -* Copy Data from Config Data Structure +* Copy Data from Config Data Structure (SER-395) - The driver maintains an internal data structure that gets initialized - from the supplied configuration file. The structure contains things like - search filters and field mapping tables. The LDAP specific extension - structures make a shallow copy of strings from the configuration - data structure, they should rather copy the whole string so that they - do not depend on the config structure. + The driver maintains an internal data structure that gets initialized from + the supplied configuration file. The structure contains things like search + filters and field mapping tables. The LDAP specific extension structures + make a shallow copy of strings from the configuration data structure, they + should rather copy the whole string so that they do not depend on the config + structure. X Implement Support For < And > Operators - The LDAP search filter syntax (RFC4515) does not support < and > - operators, only <= and >=. Currently the ldap driver simply uses <= instead - of < and >= instead of >. We need a better implementation of this. + The LDAP search filter syntax (RFC4515) does not support < and > operators, + only <= and >=. Currently the ldap driver simply uses <= instead of < and >= + instead of >. We need a better implementation of this. X Implement Support For Other Than str Parameters @@ -37,36 +37,36 @@ X Escape Values of Parameters Injected Into the Search Filter see RFC4515 for description of escaping. -* Proper handling of NULL Values in Parameter. +* Proper handling of NULL Values in Parameter (SER-396). - Is it correct that parameters with NULL values are represented as - paramName= in the filter? + Is it correct that parameters with NULL values are represented as paramName= + in the filter? -* Use Asynchronous API Functions Instead of Synchronous +* Use Asynchronous API Functions Instead of Synchronous (SER-397) - This would be useful when we have support for multiple database drivers + This would be useful when we have support for multiple database drivers within one database context, then we could initiate multiple searches simultaneously without being blocked waiting for the result. -* Support For Multi-Value Attributes +* Support For Multi-Value Attributes (SER-398) The module should support multi-value attributes. Objects containing - attributes with multi-values should be returned as multiple records, - each record containing one value of the multi-value attribute. Currently - the module will report an error if it encounters a multi-value attribute. + attributes with multi-values should be returned as multiple records, each + record containing one value of the multi-value attribute. Currently the + module will report an error if it encounters a multi-value attribute. -* Support For Time Zones in Generalized Times +* Support For Time Zones in Generalized Times (SER-399) The time conversion functions ignore time zones in GeneralizedTime attributes, this should be fixed. -* Handle Fractions of Seconds in Generalized Time +* Handle Fractions of Seconds in Generalized Time (SER-400) There is no need to account fractions of seconds because we store time - internally as time_t, but the parses should be able to skip fractions - of seconds gracefully. + internally as time_t, but the parses should be able to skip fractions of + seconds gracefully. -* Eliminate Use of All libldap Functions Marked as Deprecated +* Eliminate Use of All libldap Functions Marked as Deprecated (SER-401) We should eliminate the use of all functions that are marked as deprecated in the header field and remove LDAP_DEPRECATED define from all files. @@ -83,62 +83,68 @@ X Support for Syntax Specification in the Config File attributes in the configuration file so that the module knows how to convert DB API fields into attribute values in command parameters. -* Support DB_NEQ Operator in Integer Attributes +* Support DB_NEQ Operator in Integer Attributes (SER-402) fld!=10 could be converted to the search filter as: (|(fld<=9)(fld>=11)) -* Indicate Underflow/Overflow in Integer Attributes +* Indicate Underflow/Overflow in Integer Attributes (SER-403) The operators < and > cannot be used in LDAP search filter, RFC4515 only - supports <= and >= so we create the search filter like this: - fld<10 -> (fld<=9) - fld>10 -> (fld>=11) - The module should issue an warning when the incremented/decremented field - value overflows/underflows. + supports <= and >= so we create the search filter like this: fld<10 -> + (fld<=9) fld>10 -> (fld>=11) The module should issue an warning when the + incremented/decremented field value overflows/underflows. X Support for Older LDAP Libraries - Older versions of the openldap client library might not contain + Older versions of the openldap client library might not contain LDAP_SCOPE_CHILDREN. We need to handle this case in a graceful manner and make sure that the module compiles. -* Check that we escape strings properly according to RFC4514 +* Check that we escape strings properly according to RFC4514 (SER-404) -* Support for server-side compare operation (could be used for authentication +* Support for server side comparison (SER-405) + + Support for server-side compare operation (could be used for authentication where the client would send the digest credentials and the server replies whether or not they are valid, similar to RADIUS digest authentication) -* Support for alias-dereferencing +* Support for alias-dereferencing (SER-406) - Aliases represent links to other entries or partitions of the namespace. - When the distinguished name of an alias is used, the entry accessed is - the entry to which the alias refers. - Alias dereferencing specifies if aliases are dereferenced-- that is, if - the alias entry itself or the entry it points to is used. Aliases can be - dereferenced or not when locating the base object and/or when searching - under the base object. + Aliases represent links to other entries or partitions of the namespace. + When the distinguished name of an alias is used, the entry accessed is the + entry to which the alias refers. Alias dereferencing specifies if aliases + are dereferenced-- that is, if the alias entry itself or the entry it points + to is used. Aliases can be dereferenced or not when locating the base object + and/or when searching under the base object. + +* Support for handling of NULL Values in configuration parameters (SER-407) + + When an optional attribute is missing and also when the attribute is present + but has no value; e.g. DN=NULL for anonymous authentication. -* Support for handling of NULL Values in configuration parameters +* Support for unsolicited notifications (SER-408) - When an optional attribute is missing and also when the attribute is - present but has no value; e.g. DN=NULL for anonymous authentication. + The only standardized unsolicited notification seems to be "notice of + disconnection" so all that we can do is just log incoming asynchronous + notifications from the server -* Support for asynchronous notifications - The only standardized async. notification seems to be "notice of disconnection" - so all that we can do is just log incoming asynchronous notifications from the - server +* Support for asynchronous notifications (SER-409) -* Support for subscribing to notifications of changes in the DIT (optional) - This could be useful for updating data that is cached in SER, such as the list - of supported domains. This is a "nice to have" type of feature, so no time - estimation for implementation. + Support for subscribing to notifications of changes in the DIT (optional) + This could be useful for updating data that is cached in SER, such as the + list of supported domains. This is a "nice to have" type of feature, so no + time estimation for implementation. + +* Support for automatic reconnects (SER-410) + + (check if we do it and if we do it properly). -* Support for automatic reconnects (check if we do it and if we do it properly). +* Support for referrals (SER-411) -* Implement support for referrals (in the ldap module, not in the libldap library). - Including loop detection. + Implement support for referrals (in the ldap module, not in the libldap + library). Including loop detection. -* Support for time limited search operations +* Support for time limited search operations (SER-412) -* Support for size limited search operations +* Support for size limited search operations (SER-413)

15 years, 9 months

git:janakj/ldap: - new items added to the todo list

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: fd792300495f0de47885926ea4e0a6cb65710959 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=fd79230… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jul 10 12:54:55 2008 +0000 - new items added to the todo list --- modules/db_ldap/todo.txt | 38 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 38 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index da94661..ce9c672 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -104,3 +104,41 @@ X Support for Older LDAP Libraries * Check that we escape strings properly according to RFC4514 +* Support for server-side compare operation (could be used for authentication + where the client would send the digest credentials and the server replies + whether or not they are valid, similar to RADIUS digest authentication) + +* Support for alias-dereferencing + + Aliases represent links to other entries or partitions of the namespace. + When the distinguished name of an alias is used, the entry accessed is + the entry to which the alias refers. + Alias dereferencing specifies if aliases are dereferenced-- that is, if + the alias entry itself or the entry it points to is used. Aliases can be + dereferenced or not when locating the base object and/or when searching + under the base object. + +* Support for handling of NULL Values in configuration parameters + + When an optional attribute is missing and also when the attribute is + present but has no value; e.g. DN=NULL for anonymous authentication. + +* Support for asynchronous notifications + The only standardized async. notification seems to be "notice of disconnection" + so all that we can do is just log incoming asynchronous notifications from the + server + +* Support for subscribing to notifications of changes in the DIT (optional) + This could be useful for updating data that is cached in SER, such as the list + of supported domains. This is a "nice to have" type of feature, so no time + estimation for implementation. + +* Support for automatic reconnects (check if we do it and if we do it properly). + +* Implement support for referrals (in the ldap module, not in the libldap library). + Including loop detection. + +* Support for time limited search operations + +* Support for size limited search operations +

15 years, 9 months

git:janakj/ldap: - a set of minimalistic config files for testing purposes

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: f34750c8a38eaa9418e96a335db756d811aee7a1 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=f34750c… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jun 26 15:43:26 2008 +0000 - a set of minimalistic config files for testing purposes --- modules/db_ldap/ser-ldap.cfg | 51 ++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 51 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/ser-ldap.cfg b/modules/db_ldap/ser-ldap.cfg new file mode 100644 index 0000000..d09c101 --- /dev/null +++ b/modules/db_ldap/ser-ldap.cfg @@ -0,0 +1,51 @@ +# +# A minimalistic configuration file for SER which can be +# used to test the ldap module. +# +debug=4 # debug level (cmd line: -dddddddddd) +fork=no +log_stderror=yes + +children=1 + +loadpath "./modules" + +loadmodule "ldap" +loadmodule "auth" +loadmodule "sl" +loadmodule "textops" +loadmodule "auth_db" +loadmodule "xlog" +loadmodule "domain" + +modparam("auth_db|domain", "db_url", "ldap://127.0.0.1") + +modparam("ldap", "config", "ldap.cfg") + +# -- auth params -- +modparam("auth_db", "calculate_ha1", yes) +modparam("auth_db", "plain_password_column", "password") + + +modparam("domain", "db_mode", 1) + +route { + + # we want only authenticated users to be registered + if (!www_authenticate("iptel.org", "credentials")) { + if ($? == -2) { + sl_reply("500", "Internal Server Error"); + } else if ($? == -3) { + sl_reply("400", "Bad Request"); + } else { + if ($digest_challenge) { + append_to_reply("%$digest_challenge"); + } + sl_reply("401", "Unauthorized"); + } + drop; + } + sl_reply("200", "OK"); + break; +} +

15 years, 9 months

git:janakj/ldap: authtype connection section attribute example added

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 8e4f30b2eb2a9b70262039001438db405cf28154 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=8e4f30b… Author: Gergely Kovacs <gergo(a)iptel.org> Committer: Gergely Kovacs <gergo(a)iptel.org> Date: Thu Jun 26 13:28:10 2008 +0000 authtype connection section attribute example added --- modules/db_ldap/ldap.cfg | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/ldap.cfg b/modules/db_ldap/ldap.cfg index 6cd3613..c21da52 100644 --- a/modules/db_ldap/ldap.cfg +++ b/modules/db_ldap/ldap.cfg @@ -20,6 +20,9 @@ host=127.0.0.1 port=389 username=ser password=heslo +# LDAP or LDAP SASL authentication mechanism. +# Allowed values: none (default), simple, digest-md5, external +authtype=simple # # Table credentials contains SIP digest authentication credentials.

15 years, 9 months

git:janakj/ldap: ldap digest-md5 authentication support added

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 475e846da568742c555a629a622fa0a75ae9e5f8 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=475e846… Author: Gergely Kovacs <gergo(a)iptel.org> Committer: Gergely Kovacs <gergo(a)iptel.org> Date: Thu Jun 26 12:45:50 2008 +0000 ldap digest-md5 authentication support added --- modules/db_ldap/ld_cfg.c | 19 ++++++++++-- modules/db_ldap/ld_cfg.h | 1 + modules/db_ldap/ld_con.c | 72 +++++++++++++++++++++++++++++++++++++++++++-- modules/db_ldap/ld_uri.c | 2 + modules/db_ldap/ld_uri.h | 18 +++++++++-- 5 files changed, 102 insertions(+), 10 deletions(-) diff --git a/modules/db_ldap/ld_cfg.c b/modules/db_ldap/ld_cfg.c index 49ae339..642c0b3 100644 --- a/modules/db_ldap/ld_cfg.c +++ b/modules/db_ldap/ld_cfg.c @@ -24,6 +24,7 @@ #include "ld_cfg.h" #include "ld_mod.h" +#include "ld_uri.h" #include "../../cfg_parser.h" #include "../../mem/mem.h" @@ -43,7 +44,6 @@ enum section_type { LDAP_TABLE_SECTION }; - static struct ld_cfg* cfg = NULL; static struct ld_con_info* con = NULL; @@ -258,11 +258,21 @@ static cfg_option_t ldap_tab_options[] = { }; +static cfg_option_t auth_values[] = { + {"none", .val = LDAP_AUTHMECH_NONE}, + {"simple", .val = LDAP_AUTHMECH_SIMPLE}, + {"digest-md5", .val = LDAP_AUTHMECH_DIGESTMD5}, + {"external", .val = LDAP_AUTHMECH_EXTERNAL}, + {0} +}; + + static cfg_option_t ldap_con_options[] = { - {"host", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"port", .f = cfg_parse_int_opt}, + {"host", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"port", .f = cfg_parse_int_opt}, {"username", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, {"password", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"authtype", .param = auth_values, .f = cfg_parse_enum_opt}, {0} }; @@ -329,6 +339,9 @@ static int parse_section(void* param, cfg_parser_t* st, unsigned int flags) ldap_con_options[1].param = &con->port; ldap_con_options[2].param = &con->username; ldap_con_options[3].param = &con->password; + for(i = 0; auth_values[i].name; i++) { + auth_values[i].param = &con->authmech; + } } else { BUG("%s:%d:%d: Unsupported section type %c\n", st->file, t.start.line, t.start.col, t.type); diff --git a/modules/db_ldap/ld_cfg.h b/modules/db_ldap/ld_cfg.h index aaf7334..1a36ee4 100644 --- a/modules/db_ldap/ld_cfg.h +++ b/modules/db_ldap/ld_cfg.h @@ -48,6 +48,7 @@ struct ld_con_info { unsigned int port; str username; str password; + int authmech; struct ld_con_info* next; }; diff --git a/modules/db_ldap/ld_con.c b/modules/db_ldap/ld_con.c index 21df896..103f1bb 100644 --- a/modules/db_ldap/ld_con.c +++ b/modules/db_ldap/ld_con.c @@ -1,5 +1,5 @@ -/* - * $Id$ +/* + * $Id$ * * LDAP Database Driver for SER * @@ -18,7 +18,7 @@ * details. * * You should have received a copy of the GNU General Public License along - * with this program; if not, write to the Free Software Foundation, Inc., + * with this program; if not, write to the Free Software Foundation, Inc., * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. */ @@ -43,6 +43,7 @@ #include <stdlib.h> #include <string.h> +#include <sasl/sasl.h> /** Free all memory allocated for a ld_con structure. * This function function frees all memory that is in use by @@ -124,6 +125,52 @@ int ld_con(db_con_t* con) } +int lutil_sasl_interact( + LDAP *ld, + unsigned flags, + void *defaults, + void *in ) +{ + sasl_interact_t *interact = in; + const char *dflt = interact->defresult; + + + if (ld == NULL) + return LDAP_PARAM_ERROR; + + while (interact->id != SASL_CB_LIST_END) { + switch( interact->id ) { + // the username to authenticate + case SASL_CB_AUTHNAME: + if (defaults) + dflt = ((struct ld_uri*)defaults)->username; + break; + // the password for the provided username + case SASL_CB_PASS: + if (defaults) + dflt = ((struct ld_uri*)defaults)->password; + break; + // the realm for the authentication attempt + case SASL_CB_GETREALM: + // the username to use for proxy authorization + case SASL_CB_USER: + // generic prompt for input with input echoing disabled + case SASL_CB_NOECHOPROMPT: + // generic prompt for input with input echoing enabled + case SASL_CB_ECHOPROMPT: + break; + } + + interact->result = (dflt && *dflt) ? dflt : ""; + interact->len = strlen(interact->result); + + interact++; + } + + return LDAP_SUCCESS; +} + + int ld_con_connect(db_con_t* con) { struct ld_con* lcon; @@ -160,7 +207,24 @@ int ld_con_connect(db_con_t* con) goto error; } - ret = ldap_simple_bind_s(lcon->con, luri->username, luri->password); + switch (luri->authmech) { + case LDAP_AUTHMECH_NONE: + ret = ldap_simple_bind_s(lcon->con, NULL, NULL); + break; + case LDAP_AUTHMECH_SIMPLE: + ret = ldap_simple_bind_s(lcon->con, luri->username, luri->password); + break; + case LDAP_AUTHMECH_DIGESTMD5: + ret = ldap_sasl_interactive_bind_s( lcon->con, NULL, + LDAP_MECHANISM_STR_DIGESTMD5, NULL, NULL, + 0, lutil_sasl_interact, luri ); + break; + case LDAP_AUTHMECH_EXTERNAL: + default: + ret = !LDAP_SUCCESS; + break; + } + if (ret != LDAP_SUCCESS) { ERR("ldap: Bind to %s failed: %s\n", luri->uri, ldap_err2string(ret)); diff --git a/modules/db_ldap/ld_uri.c b/modules/db_ldap/ld_uri.c index d95807f..5476e51 100644 --- a/modules/db_ldap/ld_uri.c +++ b/modules/db_ldap/ld_uri.c @@ -284,6 +284,8 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri) } } + res->authmech = cfg_conn_info->authmech; + break; default: goto err; diff --git a/modules/db_ldap/ld_uri.h b/modules/db_ldap/ld_uri.h index f125767..27bfa15 100644 --- a/modules/db_ldap/ld_uri.h +++ b/modules/db_ldap/ld_uri.h @@ -1,5 +1,5 @@ -/* - * $Id$ +/* + * $Id$ * * LDAP Database Driver for SER * @@ -18,7 +18,7 @@ * details. * * You should have received a copy of the GNU General Public License along - * with this program; if not, write to the Free Software Foundation, Inc., + * with this program; if not, write to the Free Software Foundation, Inc., * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. */ @@ -38,6 +38,17 @@ #include <ldap.h> +enum auth_type { + LDAP_AUTHMECH_NONE = 0, + LDAP_AUTHMECH_SIMPLE, + LDAP_AUTHMECH_DIGESTMD5, + LDAP_AUTHMECH_EXTERNAL +}; + +#define LDAP_MECHANISM_STR_DIGESTMD5 "digest-md5" +#define LDAP_MECHANISM_STR_EXTERNAL "external" + + /** LDAP driver specific payload to attach to db_uri structures. * This is the LDAP specific structure that will be attached @@ -49,6 +60,7 @@ struct ld_uri { char* username; char* password; char* uri; /**< The whole URI, including scheme */ + int authmech; LDAPURLDesc* ldap_url; /**< URI parsed by the ldap client library */ };

15 years, 9 months

git:janakj/ldap: - todo updated

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 98afa6b7ab601686d95818262febb4988cd3a576 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=98afa6b… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Wed Jun 25 08:57:26 2008 +0000 - todo updated --- modules/db_ldap/todo.txt | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index 20f230b..da94661 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -101,3 +101,6 @@ X Support for Older LDAP Libraries Older versions of the openldap client library might not contain LDAP_SCOPE_CHILDREN. We need to handle this case in a graceful manner and make sure that the module compiles. + +* Check that we escape strings properly according to RFC4514 +

15 years, 9 months

git:janakj/ldap: - removed trailing line

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 11e670acb1039967c346c0e1f31bff45aab2a34e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=11e670a… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jun 12 16:06:12 2008 +0000 - removed trailing line --- modules/db_ldap/ld_cfg.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/modules/db_ldap/ld_cfg.c b/modules/db_ldap/ld_cfg.c index cebc680..49ae339 100644 --- a/modules/db_ldap/ld_cfg.c +++ b/modules/db_ldap/ld_cfg.c @@ -375,7 +375,6 @@ static int parse_section(void* param, cfg_parser_t* st, unsigned int flags) if (cfg_eat_eol(st, flags)) return -1; return 0; - }

15 years, 9 months

git:janakj/ldap: - Use the new configuration file parser

by Jan Janak

Module: sip-router Branch: janakj/ldap Commit: 85ab2d45039ebd3c2bdc3dde68f4dbc6ae307b81 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=85ab2d4… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Fri Jun 6 00:03:06 2008 +0000 - Use the new configuration file parser --- modules/db_ldap/ld_cfg.c | 328 ++++++++++ modules/db_ldap/{ld_config.h => ld_cfg.h} | 27 +- modules/db_ldap/ld_cmd.c | 13 +- modules/db_ldap/ld_config.c | 946 ----------------------------- modules/db_ldap/ld_fld.c | 2 +- modules/db_ldap/ld_fld.h | 6 +- modules/db_ldap/ld_mod.c | 25 +- 7 files changed, 367 insertions(+), 980 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=85a…

15 years, 9 months

← Newer
1
...
41
42
43
44
45
46
47
48
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev February 2009