The FreeRADIUS server  $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
rlm_ldap.c
Go to the documentation of this file.
1 /*
2  * This program is is free software; you can redistribute it and/or modify
3  * it under the terms of the GNU General Public License as published by
4  * the Free Software Foundation; either version 2 of the License, or (at
5  * your option) any later version.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15  */
16 
17 /**
18  * $Id: f4189ab2336d05b39863ec7b67eb85ce59007149 $
19  * @file rlm_ldap.c
20  * @brief LDAP authorization and authentication module.
21  *
22  * @author Arran Cudbard-Bell (a.cudbardb@freeradius.org)
23  * @author Alan DeKok (aland@freeradius.org)
24  *
25  * @copyright 2012,2015 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
26  * @copyright 2013,2015 Network RADIUS SAS (legal@networkradius.com)
27  * @copyright 2012 Alan DeKok (aland@freeradius.org)
28  * @copyright 1999-2013 The FreeRADIUS Server Project.
29  */
30 RCSID("$Id: f4189ab2336d05b39863ec7b67eb85ce59007149 $")
31 
32 USES_APPLE_DEPRECATED_API
33 
34 #include <freeradius-devel/util/debug.h>
35 #include <freeradius-devel/util/table.h>
36 #include <freeradius-devel/util/uri.h>
37 #include <freeradius-devel/util/value.h>
38 
39 #include <freeradius-devel/ldap/conf.h>
40 #include <freeradius-devel/ldap/base.h>
41 
42 #include <freeradius-devel/server/map_proc.h>
43 #include <freeradius-devel/server/module_rlm.h>
44 #include <freeradius-devel/server/rcode.h>
45 
46 #include <freeradius-devel/unlang/xlat_func.h>
47 #include <freeradius-devel/unlang/action.h>
48 
49 #include <ldap.h>
50 #include "rlm_ldap.h"
51 
52 typedef struct {
53  fr_dict_attr_t const *group_da;
54  fr_dict_attr_t const *cache_da;
55 } rlm_ldap_boot_t;
56 
57 typedef struct {
58  fr_value_box_t password;
59  tmpl_t const *password_tmpl;
60  fr_value_box_t user_base;
61  fr_value_box_t user_filter;
62  fr_value_box_t user_sasl_mech;
63  fr_value_box_t user_sasl_authname;
64  fr_value_box_t user_sasl_proxy;
65  fr_value_box_t user_sasl_realm;
66 } ldap_auth_call_env_t;
67 
68 typedef struct {
69  fr_value_box_t user_base;
70  fr_value_box_t user_filter;
71 } ldap_usermod_call_env_t;
72 
73 /** Call environment used in the profile xlat
74  */
75 typedef struct {
76  fr_value_box_t profile_filter; //!< Filter to use when searching for users.
77  map_list_t *profile_map; //!< List of maps to apply to the profile.
78 } ldap_xlat_profile_call_env_t;
79 
80 static int ldap_update_section_parse(TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, call_env_parser_t const *rule);
81 
82 static int ldap_group_filter_parse(TALLOC_CTX *ctx, void *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule);
83 
84 static const call_env_parser_t sasl_call_env[] = {
85  { FR_CALL_ENV_OFFSET("mech", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_mech) },
86  { FR_CALL_ENV_OFFSET("authname", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_authname) },
87  { FR_CALL_ENV_OFFSET("proxy", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_proxy) },
88  { FR_CALL_ENV_OFFSET("realm", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_realm) },
89  CALL_ENV_TERMINATOR
90 };
91 
92 static conf_parser_t profile_config[] = {
93  { FR_CONF_OFFSET("scope", rlm_ldap_t, profile_scope), .dflt = "base",
94  .func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
95  { FR_CONF_OFFSET("attribute", rlm_ldap_t, profile_attr) },
96  { FR_CONF_OFFSET("attribute_suspend", rlm_ldap_t, profile_attr_suspend) },
97  CONF_PARSER_TERMINATOR
98 };
99 
100 /*
101  * User configuration
102  */
103 static conf_parser_t user_config[] = {
104  { FR_CONF_OFFSET("scope", rlm_ldap_t, user.obj_scope), .dflt = "sub",
105  .func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
106  { FR_CONF_OFFSET("sort_by", rlm_ldap_t, user.obj_sort_by) },
107 
108  { FR_CONF_OFFSET("access_attribute", rlm_ldap_t, user.obj_access_attr) },
109  { FR_CONF_OFFSET("access_positive", rlm_ldap_t, user.access_positive), .dflt = "yes" },
110  { FR_CONF_OFFSET("access_value_negate", rlm_ldap_t, user.access_value_negate), .dflt = "false" },
111  { FR_CONF_OFFSET("access_value_suspend", rlm_ldap_t, user.access_value_suspend), .dflt = "suspended" },
112  { FR_CONF_OFFSET_IS_SET("expect_password", FR_TYPE_BOOL, 0, rlm_ldap_t, user.expect_password) },
113  CONF_PARSER_TERMINATOR
114 };
115 
116 /*
117  * Group configuration
118  */
119 static conf_parser_t group_config[] = {
120  { FR_CONF_OFFSET("filter", rlm_ldap_t, group.obj_filter) },
121  { FR_CONF_OFFSET("scope", rlm_ldap_t, group.obj_scope), .dflt = "sub",
122  .func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
123 
124  { FR_CONF_OFFSET("name_attribute", rlm_ldap_t, group.obj_name_attr), .dflt = "cn" },
125  { FR_CONF_OFFSET("membership_attribute", rlm_ldap_t, group.userobj_membership_attr) },
126  { FR_CONF_OFFSET_FLAGS("membership_filter", CONF_FLAG_XLAT, rlm_ldap_t, group.obj_membership_filter) },
127  { FR_CONF_OFFSET("cacheable_name", rlm_ldap_t, group.cacheable_name), .dflt = "no" },
128  { FR_CONF_OFFSET("cacheable_dn", rlm_ldap_t, group.cacheable_dn), .dflt = "no" },
129  { FR_CONF_OFFSET("cache_attribute", rlm_ldap_t, group.cache_attribute) },
130  { FR_CONF_OFFSET("group_attribute", rlm_ldap_t, group.attribute) },
131  { FR_CONF_OFFSET("allow_dangling_group_ref", rlm_ldap_t, group.allow_dangling_refs), .dflt = "no" },
132  { FR_CONF_OFFSET("skip_on_suspend", rlm_ldap_t, group.skip_on_suspend), .dflt = "yes"},
133  CONF_PARSER_TERMINATOR
134 };
135 
136 /*
137  * Reference for accounting updates
138  */
139 static const conf_parser_t acct_section_config[] = {
140  { FR_CONF_OFFSET_FLAGS("reference", CONF_FLAG_XLAT, ldap_acct_section_t, reference), .dflt = "." },
141  CONF_PARSER_TERMINATOR
142 };
143 
144 static const conf_parser_t module_config[] = {
145  /*
146  * Pool config items
147  */
148  { FR_CONF_OFFSET_FLAGS("server", CONF_FLAG_MULTI, rlm_ldap_t, handle_config.server_str) }, /* Do not set to required */
149 
150  /*
151  * Common LDAP conf parsers
152  */
153  FR_LDAP_COMMON_CONF(rlm_ldap_t),
154 
155  { FR_CONF_OFFSET("valuepair_attribute", rlm_ldap_t, valuepair_attr) },
156 
157 #ifdef LDAP_CONTROL_X_SESSION_TRACKING
158  { FR_CONF_OFFSET("session_tracking", rlm_ldap_t, session_tracking), .dflt = "no" },
159 #endif
160 
161 #ifdef WITH_EDIR
162  /* support for eDirectory Universal Password */
163  { FR_CONF_OFFSET("edir", rlm_ldap_t, edir) }, /* NULL defaults to "no" */
164 
165  /*
166  * Attempt to bind with the cleartext password we got from eDirectory
167  * Universal password for additional authorization checks.
168  */
169  { FR_CONF_OFFSET("edir_autz", rlm_ldap_t, edir_autz) }, /* NULL defaults to "no" */
170 #endif
171 
172  { FR_CONF_POINTER("user", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) user_config },
173 
174  { FR_CONF_POINTER("group", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) group_config },
175 
176  { FR_CONF_POINTER("profile", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) profile_config },
177 
178  { FR_CONF_OFFSET_SUBSECTION("pool", 0, rlm_ldap_t, trunk_conf, trunk_config ) },
179 
180  { FR_CONF_OFFSET_SUBSECTION("bind_pool", 0, rlm_ldap_t, bind_trunk_conf, trunk_config ) },
181 
182  CONF_PARSER_TERMINATOR
183 };
184 
185 #define USER_CALL_ENV_COMMON(_struct) \
186  { FR_CALL_ENV_OFFSET("base_dn", FR_TYPE_STRING, CALL_ENV_FLAG_REQUIRED | CALL_ENV_FLAG_CONCAT, _struct, user_base), .pair.dflt = "", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }, \
187  { FR_CALL_ENV_OFFSET("filter", FR_TYPE_STRING, CALL_ENV_FLAG_NULLABLE | CALL_ENV_FLAG_CONCAT, _struct, user_filter), .pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }
188 
189 static const call_env_method_t authenticate_method_env = {
190  FR_CALL_ENV_METHOD_OUT(ldap_auth_call_env_t),
191  .env = (call_env_parser_t[]) {
192  { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
193  ((call_env_parser_t[]) {
194  USER_CALL_ENV_COMMON(ldap_auth_call_env_t),
195  { FR_CALL_ENV_PARSE_OFFSET("password_attribute", FR_TYPE_STRING,
196  CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED | CALL_ENV_FLAG_NULLABLE | CALL_ENV_FLAG_CONCAT,
197  ldap_auth_call_env_t, password, password_tmpl),
198  .pair.dflt = "&User-Password", .pair.dflt_quote = T_BARE_WORD },
199  { FR_CALL_ENV_SUBSECTION("sasl", NULL, CALL_ENV_FLAG_NONE, sasl_call_env) },
200  CALL_ENV_TERMINATOR
201  })) },
202  CALL_ENV_TERMINATOR
203  }
204 };
205 
206 /** Parameters to allow ldap_update_section_parse to be reused
207  */
208 typedef struct {
209  size_t map_offset;
210  ssize_t expect_password_offset;
211 } ldap_update_rules_t;
212 
213 static const call_env_method_t authorize_method_env = {
214  FR_CALL_ENV_METHOD_OUT(ldap_autz_call_env_t),
215  .env = (call_env_parser_t[]) {
216  { FR_CALL_ENV_SUBSECTION_FUNC("update", CF_IDENT_ANY, CALL_ENV_FLAG_PARSE_MISSING, ldap_update_section_parse),
217  .uctx = &(ldap_update_rules_t){
218  .map_offset = offsetof(ldap_autz_call_env_t, user_map),
219  .expect_password_offset = offsetof(ldap_autz_call_env_t, expect_password)
220  } },
221  { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
222  ((call_env_parser_t[]) {
223  USER_CALL_ENV_COMMON(ldap_autz_call_env_t),
224  CALL_ENV_TERMINATOR
225  })) },
226  { FR_CALL_ENV_SUBSECTION("group", NULL, CALL_ENV_FLAG_NONE,
227  ((call_env_parser_t[]) {
228  { FR_CALL_ENV_OFFSET("base_dn", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_autz_call_env_t, group_base) },
229  { FR_CALL_ENV_PARSE_ONLY_OFFSET("membership_filter", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_autz_call_env_t, group_filter),
230  .pair.func = ldap_group_filter_parse,
231  .pair.escape = {
232  .func = fr_ldap_box_escape,
233  .safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
234  .mode = TMPL_ESCAPE_PRE_CONCAT
235  },
236  .pair.literals_safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
237  },
238  CALL_ENV_TERMINATOR
239  })) },
240  { FR_CALL_ENV_SUBSECTION("profile", NULL, CALL_ENV_FLAG_NONE,
241  ((call_env_parser_t[]) {
242  { FR_CALL_ENV_OFFSET("default", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_autz_call_env_t, default_profile) },
243  { FR_CALL_ENV_OFFSET("filter", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_autz_call_env_t, profile_filter),
244  .pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }, //!< Correct filter for when the DN is known.
245  CALL_ENV_TERMINATOR
246  } )) },
247  CALL_ENV_TERMINATOR
248  }
249 };
250 
251 static const call_env_method_t usermod_method_env = {
252  FR_CALL_ENV_METHOD_OUT(ldap_usermod_call_env_t),
253  .env = (call_env_parser_t[]) {
254  { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
255  ((call_env_parser_t[]) {
256  USER_CALL_ENV_COMMON(ldap_usermod_call_env_t),
257  CALL_ENV_TERMINATOR
258  })) },
259 
260  CALL_ENV_TERMINATOR
261  }
262 };
263 
264 static const call_env_method_t xlat_memberof_method_env = {
265  FR_CALL_ENV_METHOD_OUT(ldap_xlat_memberof_call_env_t),
266  .env = (call_env_parser_t[]) {
267  { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
268  ((call_env_parser_t[]) {
269  USER_CALL_ENV_COMMON(ldap_xlat_memberof_call_env_t),
270  CALL_ENV_TERMINATOR
271  })) },
272  { FR_CALL_ENV_SUBSECTION("group", NULL, CALL_ENV_FLAG_NONE,
273  ((call_env_parser_t[]) {
274  { FR_CALL_ENV_OFFSET("base_dn", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_xlat_memberof_call_env_t, group_base) },
275  { FR_CALL_ENV_PARSE_ONLY_OFFSET("membership_filter", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_xlat_memberof_call_env_t, group_filter),
276  .pair.func = ldap_group_filter_parse,
277  .pair.escape = {
278  .func = fr_ldap_box_escape,
279  .safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
280  .mode = TMPL_ESCAPE_PRE_CONCAT
281  },
282  .pair.literals_safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
283  },
284  CALL_ENV_TERMINATOR
285  })) },
286  CALL_ENV_TERMINATOR
287  }
288 };
289 
290 static const call_env_method_t xlat_profile_method_env = {
291  FR_CALL_ENV_METHOD_OUT(ldap_xlat_profile_call_env_t),
292  .env = (call_env_parser_t[]) {
293  { FR_CALL_ENV_SUBSECTION_FUNC("update", CF_IDENT_ANY, CALL_ENV_FLAG_PARSE_MISSING, ldap_update_section_parse),
294  .uctx = &(ldap_update_rules_t){
295  .map_offset = offsetof(ldap_xlat_profile_call_env_t, profile_map),
296  .expect_password_offset = -1
297  } },
298  { FR_CALL_ENV_SUBSECTION("profile", NULL, CALL_ENV_FLAG_NONE,
299  ((call_env_parser_t[]) {
300  { FR_CALL_ENV_OFFSET("filter", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_xlat_profile_call_env_t, profile_filter),
301  .pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }, //!< Correct filter for when the DN is known.
302  CALL_ENV_TERMINATOR
303  })) },
304  CALL_ENV_TERMINATOR
305  }
306 };
307 
308 static fr_dict_t const *dict_freeradius;
309 
310 extern fr_dict_autoload_t rlm_ldap_dict[];
311 fr_dict_autoload_t rlm_ldap_dict[] = {
312  { .out = &dict_freeradius, .proto = "freeradius" },
313  { NULL }
314 };
315 
316 fr_dict_attr_t const *attr_password;
317 fr_dict_attr_t const *attr_cleartext_password;
318 fr_dict_attr_t const *attr_crypt_password;
319 fr_dict_attr_t const *attr_ldap_userdn;
320 fr_dict_attr_t const *attr_nt_password;
321 fr_dict_attr_t const *attr_password_with_header;
322 static fr_dict_attr_t const *attr_expr_bool_enum;
323 
324 extern fr_dict_attr_autoload_t rlm_ldap_dict_attr[];
325 fr_dict_attr_autoload_t rlm_ldap_dict_attr[] = {
326  { .out = &attr_password, .name = "Password", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
327  { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
328  { .out = &attr_crypt_password, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
329  { .out = &attr_ldap_userdn, .name = "LDAP-UserDN", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
330  { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
331  { .out = &attr_password_with_header, .name = "Password.With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
332  { .out = &attr_expr_bool_enum, .name = "Expr-Bool-Enum", .type = FR_TYPE_BOOL, .dict = &dict_freeradius },
333 
334  { NULL }
335 };
336 
337 extern global_lib_autoinst_t const *rlm_ldap_lib[];
338 global_lib_autoinst_t const *rlm_ldap_lib[] = {
339  &fr_libldap_global_config,
340  GLOBAL_LIB_TERMINATOR
341 };
342 
343 /** Holds state of in progress async authentication
344  *
345  */
346 typedef struct {
347  char const *dn;
348  char const *password;
349  rlm_ldap_t const *inst;
350  fr_ldap_thread_t *thread;
351  ldap_auth_call_env_t *call_env;
352 } ldap_auth_ctx_t;
353 
354 /** Holds state of in progress ldap user modifications
355  *
356  */
357 typedef struct {
358  rlm_ldap_t const *inst;
359  ldap_usermod_call_env_t *call_env;
360  char const *dn;
361  char *passed[LDAP_MAX_ATTRMAP * 2];
362  LDAPMod *mod_p[LDAP_MAX_ATTRMAP + 1];
363  LDAPMod mod_s[LDAP_MAX_ATTRMAP];
364  fr_ldap_thread_trunk_t *ttrunk;
365  fr_ldap_query_t *query;
366 } ldap_user_modify_ctx_t;
367 
368 /** Holds state of in progress LDAP map
369  *
370  */
371 typedef struct {
372  map_list_t const *maps;
373  LDAPURLDesc *ldap_url;
374  fr_ldap_query_t *query;
375  fr_ldap_map_exp_t expanded;
376 } ldap_map_ctx_t;
377 
378 typedef enum {
379  LDAP_SCHEME_UNIX = 0,
380  LDAP_SCHEME_TCP,
381  LDAP_SCHEME_TCP_SSL
382 } ldap_schemes_t;
383 
384 static fr_table_num_sorted_t const ldap_uri_scheme_table[] = {
385  { L("ldap://"), LDAP_SCHEME_UNIX },
386  { L("ldapi://"), LDAP_SCHEME_TCP },
387  { L("ldaps://"), LDAP_SCHEME_TCP_SSL },
388 };
389 static size_t ldap_uri_scheme_table_len = NUM_ELEMENTS(ldap_uri_scheme_table);
390 
391 /** This is the common function that actually ends up doing all the URI escaping
392  */
393 #define LDAP_URI_SAFE_FOR (fr_value_box_safe_for_t)fr_ldap_uri_escape_func
394 
395 static xlat_arg_parser_t const ldap_uri_escape_xlat_arg[] = {
396  { .required = true, .concat = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
397  XLAT_ARG_PARSER_TERMINATOR
398 };
399 
400 static xlat_arg_parser_t const ldap_safe_xlat_arg[] = {
401  { .required = true, .concat = true, .type = FR_TYPE_STRING },
402  XLAT_ARG_PARSER_TERMINATOR
403 };
404 
405 /** Escape LDAP string
406  *
407  * @ingroup xlat_functions
408  */
409 static xlat_action_t ldap_uri_escape_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
410  UNUSED xlat_ctx_t const *xctx,
411  request_t *request, fr_value_box_list_t *in)
412 {
413  fr_value_box_t *vb, *in_vb = fr_value_box_list_head(in);
414  fr_sbuff_t sbuff;
415  fr_sbuff_uctx_talloc_t sbuff_ctx;
416  size_t len;
417 
418  MEM(vb = fr_value_box_alloc_null(ctx));
419 
420  /*
421  * If it's already safe, just copy it over.
422  */
423  if (fr_value_box_is_safe_for(in_vb, LDAP_URI_SAFE_FOR)) {
424  fr_value_box_copy(vb, vb, in_vb);
425 
426  fr_dcursor_append(out, vb);
427  return XLAT_ACTION_DONE;
428  }
429 
430  /*
431  * Maximum space needed for output would be 3 times the input if every
432  * char needed escaping
433  */
434  if (!fr_sbuff_init_talloc(vb, &sbuff, &sbuff_ctx, in_vb->vb_length * 3, in_vb->vb_length * 3)) {
435  REDEBUG("Failed to allocate buffer for escaped string");
436  talloc_free(vb);
437  return XLAT_ACTION_FAIL;
438  }
439 
440  /*
441  * Call the escape function, including the space for the trailing NULL
442  */
443  len = fr_ldap_uri_escape_func(request, fr_sbuff_buff(&sbuff), in_vb->vb_length * 3 + 1, in_vb->vb_strvalue, NULL);
444 
445  /*
446  * Trim buffer to fit used space and assign to box
447  */
448  fr_sbuff_trim_talloc(&sbuff, len);
449  fr_value_box_strdup_shallow(vb, NULL, fr_sbuff_buff(&sbuff), in_vb->tainted);
450 
451  fr_dcursor_append(out, vb);
452  return XLAT_ACTION_DONE;
453 }
454 
455 static xlat_arg_parser_t const ldap_uri_unescape_xlat_arg[] = {
456  { .required = true, .concat = true, .type = FR_TYPE_STRING },
457  XLAT_ARG_PARSER_TERMINATOR
458 };
459 
460 /** Unescape LDAP string
461  *
462  * @ingroup xlat_functions
463  */
464 static xlat_action_t ldap_uri_unescape_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
465  UNUSED xlat_ctx_t const *xctx,
466  request_t *request, fr_value_box_list_t *in)
467 {
468  fr_value_box_t *vb, *in_vb = fr_value_box_list_head(in);
469  fr_sbuff_t sbuff;
470  fr_sbuff_uctx_talloc_t sbuff_ctx;
471  size_t len;
472 
473  MEM(vb = fr_value_box_alloc_null(ctx));
474  /*
475  * Maximum space needed for output will be the same as the input
476  */
477  if (!fr_sbuff_init_talloc(vb, &sbuff, &sbuff_ctx, in_vb->vb_length, in_vb->vb_length)) {
478  REDEBUG("Failed to allocate buffer for unescaped string");
479  talloc_free(vb);
480  return XLAT_ACTION_FAIL;
481  }
482 
483  /*
484  * Call the unescape function, including the space for the trailing NULL
485  */
486  len = fr_ldap_uri_unescape_func(request, fr_sbuff_buff(&sbuff), in_vb->vb_length + 1, in_vb->vb_strvalue, NULL);
487 
488  /*
489  * Trim buffer to fit used space and assign to box
490  */
491  fr_sbuff_trim_talloc(&sbuff, len);
492  fr_value_box_strdup_shallow(vb, NULL, fr_sbuff_buff(&sbuff), in_vb->tainted);
493  fr_dcursor_append(out, vb);
494 
495  return XLAT_ACTION_DONE;
496 }
497 
498 /** Escape function for a part of an LDAP URI
499  *
500  */
501 static int ldap_uri_part_escape(fr_value_box_t *vb, UNUSED void *uctx)
502 {
503  fr_sbuff_t sbuff;
504  fr_sbuff_uctx_talloc_t sbuff_ctx;
505  size_t len;
506 
507  /*
508  * Maximum space needed for output would be 3 times the input if every
509  * char needed escaping
510  */
511  if (!fr_sbuff_init_talloc(vb, &sbuff, &sbuff_ctx, vb->vb_length * 3, vb->vb_length * 3)) {
512  fr_strerror_printf_push("Failed to allocate buffer for escaped argument");
513  return -1;
514  }
515 
516  /*
517  * Call the escape function, including the space for the trailing NULL
518  */
519  len = fr_ldap_uri_escape_func(NULL, fr_sbuff_buff(&sbuff), vb->vb_length * 3 + 1, vb->vb_strvalue, NULL);
520 
521  fr_sbuff_trim_talloc(&sbuff, len);
522  fr_value_box_clear_value(vb);
523  fr_value_box_strdup_shallow(vb, NULL, fr_sbuff_buff(&sbuff), vb->tainted);
524 
525  return 0;
526 }
527 
528 /** Callback when LDAP query times out
529  *
530  */
531 static void ldap_query_timeout(UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
532 {
533  fr_ldap_query_t *query = talloc_get_type_abort(uctx, fr_ldap_query_t);
534  trunk_request_t *treq;
535  request_t *request;
536 
537  /*
538  * If the trunk request has completed but the query
539  * has not yet resumed, query->treq will be NULL
540  */
541  if (!query->treq) return;
542 
543  treq = talloc_get_type_abort(query->treq, trunk_request_t);
544  request = treq->request;
545 
546  ROPTIONAL(RERROR, ERROR, "Timeout waiting for LDAP query");
547 
548  trunk_request_signal_cancel(query->treq);
549 
550  query->ret = LDAP_RESULT_TIMEOUT;
551  unlang_interpret_mark_runnable(request);
552 }
553 
554 /** Callback when resuming after async ldap query is completed
555  *
556  */
557 static xlat_action_t ldap_xlat_resume(TALLOC_CTX *ctx, fr_dcursor_t *out,
558  xlat_ctx_t const *xctx,
559  request_t *request, UNUSED fr_value_box_list_t *in)
560 {
561  fr_ldap_query_t *query = talloc_get_type_abort(xctx->rctx, fr_ldap_query_t);
562  fr_ldap_connection_t *ldap_conn = query->ldap_conn;
563  fr_value_box_t *vb = NULL;
564  LDAPMessage *msg;
565  struct berval **values;
566  char const **attr;
567  int count, i;
568 
569  if (query->ret != LDAP_RESULT_SUCCESS) return XLAT_ACTION_FAIL;
570 
571  /*
572  * We only parse "entries"
573  */
574  for (msg = ldap_first_entry(ldap_conn->handle, query->result); msg; msg = ldap_next_entry(ldap_conn->handle, msg)) {
575  for (attr = query->search.attrs; *attr; attr++) {
576  values = ldap_get_values_len(ldap_conn->handle, msg, *attr);
577  if (!values) {
578  RDEBUG2("No \"%s\" attributes found in specified object", *attr);
579  continue;
580  }
581 
582  count = ldap_count_values_len(values);
583  for (i = 0; i < count; i++) {
584  MEM(vb = fr_value_box_alloc_null(ctx));
585  if (fr_value_box_bstrndup(vb, vb, NULL, values[i]->bv_val, values[i]->bv_len, true) < 0) {
586  talloc_free(vb);
587  RPERROR("Failed creating value from LDAP response");
588  break;
589  }
590  fr_dcursor_append(out, vb);
591  }
592  ldap_value_free_len(values);
593  }
594  }
595 
596  talloc_free(query);
597 
598  return XLAT_ACTION_DONE;
599 }
600 
601 /** Callback for signalling async ldap query
602  *
603  */
604 static void ldap_xlat_signal(xlat_ctx_t const *xctx, request_t *request, UNUSED fr_signal_t action)
605 {
606  fr_ldap_query_t *query = talloc_get_type_abort(xctx->rctx, fr_ldap_query_t);
607 
608  if (!query->treq) return;
609 
610  RDEBUG2("Forcefully cancelling pending LDAP query");
611 
612  trunk_request_signal_cancel(query->treq);
613 }
614 
615 /*
616  * If a part doesn't have an escaping function, parsing will fail unless the input
617  * was marked up with a safe_for value by the ldap arg parsing, i.e. was a literal
618  * input argument to the xlat.
619  *
620  * This is equivalent to the old "tainted_allowed" flag.
621  */
622 static fr_uri_part_t const ldap_uri_parts[] = {
623  { .name = "scheme", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L(":")), .part_adv = { [':'] = 1 }, .extra_skip = 2 },
624  { .name = "host", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L(":"), L("/")), .part_adv = { [':'] = 1, ['/'] = 2 } },
625  { .name = "port", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("/")), .part_adv = { ['/'] = 1 } },
626  { .name = "dn", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }, .func = ldap_uri_part_escape },
627  { .name = "attrs", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }},
628  { .name = "scope", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }, .func = ldap_uri_part_escape },
629  { .name = "filter", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1}, .func = ldap_uri_part_escape },
630  { .name = "exts", .safe_for = LDAP_URI_SAFE_FOR, .func = ldap_uri_part_escape },
631  XLAT_URI_PART_TERMINATOR
632 };
633 
634 static fr_uri_part_t const ldap_dn_parts[] = {
635  { .name = "dn", .safe_for = LDAP_URI_SAFE_FOR , .func = ldap_uri_part_escape },
636  XLAT_URI_PART_TERMINATOR
637 };
638 
639 static xlat_arg_parser_t const ldap_xlat_arg[] = {
640  { .required = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
641  XLAT_ARG_PARSER_TERMINATOR
642 };
643 
644 /** Produce canonical LDAP host URI for finding trunks
645  *
646  */
647 static inline CC_HINT(always_inline)
648 char *host_uri_canonify(request_t *request, LDAPURLDesc *url_parsed, fr_value_box_t *url_in)
649 {
650  char *host;
651 
652  LDAPURLDesc tmp_desc = {
653  .lud_scheme = url_parsed->lud_scheme,
654  .lud_host = url_parsed->lud_host,
655  .lud_port = url_parsed->lud_port,
656  .lud_scope = -1
657  };
658  host = ldap_url_desc2str(&tmp_desc);
659  if (unlikely(host == NULL)) REDEBUG("Invalid LDAP URL - %pV", url_in); \
660 
661  return host;
662 }
663 
664 /** Utility function for parsing LDAP URLs
665  *
666  * All LDAP xlat functions that work with LDAP URLs should call this function to parse the URL.
667  *
668  * @param[out] uri_parsed LDAP URL parsed. Must be freed with ldap_url_desc_free.
669  * @param[out] host_out host name to use for the query. Must be freed with ldap_mem_free
670  * if free_host_out is true.
671  * @param[out] free_host_out True if host_out should be freed.
672  * @param[in] request Request being processed.
673  * @param[in] host_default Default host to use if the URL does not specify a host.
674  * @param[in] uri_in URI to parse.
675  * @return
676  * - 0 on success.
677  * - -1 on failure.
678  */
679 static int ldap_xlat_uri_parse(LDAPURLDesc **uri_parsed, char **host_out, bool *free_host_out,
680  request_t *request, char *host_default, fr_value_box_t *uri_in)
681 {
682  fr_value_box_t *uri;
683  int ldap_url_ret;
684 
685  *free_host_out = false;
686 
687  if (fr_uri_escape_list(&uri_in->vb_group, ldap_uri_parts, NULL) < 0){
688  RPERROR("Failed to escape LDAP URI");
689  error:
690  *uri_parsed = NULL;
691  return -1;
692  }
693 
694  /*
695  * Smush everything into the first URI box
696  */
697  uri = fr_value_box_list_head(&uri_in->vb_group);
698 
699  if (fr_value_box_list_concat_in_place(uri, uri, &uri_in->vb_group,
700  FR_TYPE_STRING, FR_VALUE_BOX_LIST_FREE, true, SIZE_MAX) < 0) {
701  REDEBUG("Failed concattenating input");
702  goto error;
703  }
704 
705  if (!ldap_is_ldap_url(uri->vb_strvalue)) {
706  REDEBUG("String passed does not look like an LDAP URL");
707  goto error;
708  }
709 
710  ldap_url_ret = ldap_url_parse(uri->vb_strvalue, uri_parsed);
711  if (ldap_url_ret != LDAP_URL_SUCCESS){
712  RPEDEBUG("Parsing LDAP URL failed - %s", fr_ldap_url_err_to_str(ldap_url_ret));
713  goto error;
714  }
715 
716  /*
717  * If the URL is <scheme>:/// the parsed host will be NULL - use config default
718  */
719  if (!(*uri_parsed)->lud_host) {
720  *host_out = host_default;
721  } else {
722  *host_out = host_uri_canonify(request, *uri_parsed, uri);
723  if (unlikely(*host_out == NULL)) {
724  ldap_free_urldesc(*uri_parsed);
725  *uri_parsed = NULL;
726  return -1;
727  }
728  *free_host_out = true;
729  }
730 
731  return 0;
732 }
733 
734 /** Expand an LDAP URL into a query, and return a string result from that query.
735  *
736  * @ingroup xlat_functions
737  */
738 static xlat_action_t ldap_xlat(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
739  xlat_ctx_t const *xctx,
740  request_t *request, fr_value_box_list_t *in)
741 {
742  fr_ldap_thread_t *t = talloc_get_type_abort(xctx->mctx->thread, fr_ldap_thread_t);
743  fr_value_box_t *uri;
744  char *host;
745  bool free_host = false;
746  fr_ldap_config_t const *handle_config = t->config;
747  fr_ldap_thread_trunk_t *ttrunk;
748  fr_ldap_query_t *query = NULL;
749 
750  LDAPURLDesc *ldap_url;
751 
752  XLAT_ARGS(in, &uri);
753 
754  if (ldap_xlat_uri_parse(&ldap_url, &host, &free_host, request, handle_config->server, uri) < 0) return XLAT_ACTION_FAIL;
755 
756  /*
757  * Nothing, empty string, "*" string, or got 2 things, die.
758  */
759  if (!ldap_url->lud_attrs || !ldap_url->lud_attrs[0] || !*ldap_url->lud_attrs[0] ||
760  (strcmp(ldap_url->lud_attrs[0], "*") == 0) || ldap_url->lud_attrs[1]) {
761  REDEBUG("Bad attributes list in LDAP URL. URL must specify exactly one attribute to retrieve");
762  ldap_free_urldesc(ldap_url);
763  }
764 
765  query = fr_ldap_search_alloc(unlang_interpret_frame_talloc_ctx(request),
766  ldap_url->lud_dn, ldap_url->lud_scope, ldap_url->lud_filter,
767  (char const * const*)ldap_url->lud_attrs, NULL, NULL);
768  query->ldap_url = ldap_url; /* query destructor will free URL */
769 
770  if (ldap_url->lud_exts) {
771  LDAPControl *serverctrls[LDAP_MAX_CONTROLS];
772  int i;
773 
774  if (fr_ldap_parse_url_extensions(serverctrls, NUM_ELEMENTS(serverctrls),
775  query->ldap_url->lud_exts) < 0) {
776  RPERROR("Parsing URL extensions failed");
777  if (free_host) ldap_memfree(host);
778 
779  query_error:
780  talloc_free(query);
781  return XLAT_ACTION_FAIL;
782  }
783 
784  for (i = 0; i < LDAP_MAX_CONTROLS; i++) {
785  if (!serverctrls[i]) break;
786  query->serverctrls[i].control = serverctrls[i];
787  query->serverctrls[i].freeit = true;
788  }
789  }
790 
791  /*
792  * Figure out what trunked connection we can use
793  * to communicate with the host.
794  *
795  * If free_host is true, we must free the host
796  * after deciding on a trunk connection as it
797  * was allocated by host_uri_canonify.
798  */
799  ttrunk = fr_thread_ldap_trunk_get(t, host, handle_config->admin_identity,
800  handle_config->admin_password, request, handle_config);
801  if (free_host) ldap_memfree(host);
802  if (!ttrunk) {
803  REDEBUG("Unable to get LDAP query for xlat");
804  goto query_error;
805  }
806 
807  switch (trunk_request_enqueue(&query->treq, ttrunk->trunk, request, query, NULL)) {
808  case TRUNK_ENQUEUE_OK:
809  case TRUNK_ENQUEUE_IN_BACKLOG:
810  break;
811 
812  default:
813  REDEBUG("Unable to enqueue LDAP query for xlat");
814  goto query_error;
815  }
816 
817  if (fr_event_timer_in(query, unlang_interpret_event_list(request), &query->ev, handle_config->res_timeout,
818  ldap_query_timeout, query) < 0) {
819  REDEBUG("Unable to set timeout for LDAP query");
820  trunk_request_signal_cancel(query->treq);
821  goto query_error;
822  }
823 
824  return unlang_xlat_yield(request, ldap_xlat_resume, ldap_xlat_signal, ~FR_SIGNAL_CANCEL, query);
825 }
826 
827 /** User object lookup as part of group membership xlat
828  *
829  * Called if the ldap membership xlat is used and the user DN is not already known
830  */
831 static unlang_action_t ldap_group_xlat_user_find(UNUSED rlm_rcode_t *p_result, UNUSED int *priority,
832  request_t *request, void *uctx)
833 {
834  ldap_group_xlat_ctx_t *xlat_ctx = talloc_get_type_abort(uctx, ldap_group_xlat_ctx_t);
835 
836  if (xlat_ctx->env_data->user_filter.type == FR_TYPE_STRING) xlat_ctx->filter = &xlat_ctx->env_data->user_filter;
837 
838  xlat_ctx->basedn = &xlat_ctx->env_data->user_base;
839 
840  return rlm_ldap_find_user_async(xlat_ctx, xlat_ctx->inst, request, xlat_ctx->basedn, xlat_ctx->filter,
841  xlat_ctx->ttrunk, xlat_ctx->attrs, &xlat_ctx->query);
842 }
843 
844 /** Cancel an in-progress query for the LDAP group membership xlat
845  *
846  */
847 static void ldap_group_xlat_cancel(UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
848 {
849  ldap_group_xlat_ctx_t *xlat_ctx = talloc_get_type_abort(uctx, ldap_group_xlat_ctx_t);
850 
851  if (!xlat_ctx->query || !xlat_ctx->query->treq) return;
852 
853  trunk_request_signal_cancel(xlat_ctx->query->treq);
854 }
855 
856 #define REPEAT_LDAP_MEMBEROF_XLAT_RESULTS \
857  if (unlang_function_repeat_set(request, ldap_group_xlat_results) < 0) do { \
858  rcode = RLM_MODULE_FAIL; \
859  goto finish; \
860  } while (0)
861 
862 /** Run the state machine for the LDAP membership xlat
863  *
864  * This is called after each async lookup is completed
865  */
866 static unlang_action_t ldap_group_xlat_results(rlm_rcode_t *p_result, UNUSED int *priority,
867  request_t *request, void *uctx)
868 {
869  ldap_group_xlat_ctx_t *xlat_ctx = talloc_get_type_abort(uctx, ldap_group_xlat_ctx_t);
870  rlm_ldap_t const *inst = xlat_ctx->inst;
871  rlm_rcode_t rcode = RLM_MODULE_NOTFOUND;
872 
873  switch (xlat_ctx->status) {
874  case GROUP_XLAT_FIND_USER:
875  if (!xlat_ctx->dn) xlat_ctx->dn = rlm_find_user_dn_cached(request);
876  if (!xlat_ctx->dn) RETURN_MODULE_FAIL;
877 
878  if (inst->group.obj_membership_filter) {
879  REPEAT_LDAP_MEMBEROF_XLAT_RESULTS;
880  if (rlm_ldap_check_groupobj_dynamic(&rcode, request, xlat_ctx) == UNLANG_ACTION_PUSHED_CHILD) {
881  xlat_ctx->status = GROUP_XLAT_MEMB_FILTER;
882  return UNLANG_ACTION_PUSHED_CHILD;
883  }
884  }
885  FALL_THROUGH;
886 
887  case GROUP_XLAT_MEMB_FILTER:
888  if (xlat_ctx->found) {
889  rcode = RLM_MODULE_OK;
890  goto finish;
891  }
892 
893  if (inst->group.userobj_membership_attr) {
894  REPEAT_LDAP_MEMBEROF_XLAT_RESULTS;
895  if (rlm_ldap_check_userobj_dynamic(&rcode, request, xlat_ctx) == UNLANG_ACTION_PUSHED_CHILD) {
896  xlat_ctx->status = GROUP_XLAT_MEMB_ATTR;
897  return UNLANG_ACTION_PUSHED_CHILD;
898  }
899  }
900  FALL_THROUGH;
901 
902  case GROUP_XLAT_MEMB_ATTR:
903  if (xlat_ctx->found) rcode = RLM_MODULE_OK;
904  break;
905  }
906 
907 finish:
908  RETURN_MODULE_RCODE(rcode);
909 }
910 
911 /** Process the results of evaluating LDAP group membership
912  *
913  */
914 static xlat_action_t ldap_group_xlat_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx,
915  UNUSED request_t *request, UNUSED fr_value_box_list_t *in)
916 {
917  ldap_group_xlat_ctx_t *xlat_ctx = talloc_get_type_abort(xctx->rctx, ldap_group_xlat_ctx_t);
918  fr_value_box_t *vb;
919 
920  MEM(vb = fr_value_box_alloc(ctx, FR_TYPE_BOOL, attr_expr_bool_enum));
921  vb->vb_bool = xlat_ctx->found;
922  fr_dcursor_append(out, vb);
923 
924  return XLAT_ACTION_DONE;
925 }
926 
927 static xlat_arg_parser_t const ldap_group_xlat_arg[] = {
928  { .required = true, .concat = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
929  XLAT_ARG_PARSER_TERMINATOR
930 };
931 
932 /** Check for a user being in a LDAP group
933  *
934  * @ingroup xlat_functions
935  */
936 static xlat_action_t ldap_group_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx,
937  request_t *request, fr_value_box_list_t *in)
938 {
939  fr_value_box_t *vb = NULL, *group_vb = fr_value_box_list_pop_head(in);
940  rlm_ldap_t const *inst = talloc_get_type_abort_const(xctx->mctx->mi->data, rlm_ldap_t);
941  fr_ldap_thread_t *t = talloc_get_type_abort(xctx->mctx->thread, fr_ldap_thread_t);
942  ldap_xlat_memberof_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, ldap_xlat_memberof_call_env_t);
943  bool group_is_dn;
944  ldap_group_xlat_ctx_t *xlat_ctx;
945 
946  RDEBUG2("Searching for user in group \"%pV\"", group_vb);
947 
948  if (group_vb->vb_length == 0) {
949  REDEBUG("Cannot do comparison (group name is empty)");
950  return XLAT_ACTION_FAIL;
951  }
952 
953  group_is_dn = fr_ldap_util_is_dn(group_vb->vb_strvalue, group_vb->vb_length);
954  if (group_is_dn) {
955  char *norm;
956  size_t len;
957 
958  MEM(norm = talloc_array(group_vb, char, talloc_array_length(group_vb->vb_strvalue)));
959  len = fr_ldap_util_normalise_dn(norm, group_vb->vb_strvalue);
960 
961  /*
962  * Will clear existing buffer (i.e. group_vb->vb_strvalue)
963  */
964  fr_value_box_bstrdup_buffer_shallow(group_vb, group_vb, NULL, norm, group_vb->tainted);
965 
966  /*
967  * Trim buffer to match normalised DN
968  */
969  fr_value_box_bstr_realloc(group_vb, NULL, group_vb, len);
970  }
971 
972  if ((group_is_dn && inst->group.cacheable_dn) || (!group_is_dn && inst->group.cacheable_name)) {
973  rlm_rcode_t our_rcode;
974 
975  rlm_ldap_check_cached(&our_rcode, inst, request, group_vb);
976  switch (our_rcode) {
977  case RLM_MODULE_NOTFOUND:
978  RDEBUG2("User is not a member of \"%pV\"", group_vb);
979  return XLAT_ACTION_DONE;
980 
981  case RLM_MODULE_OK:
982  MEM(vb = fr_value_box_alloc(ctx, FR_TYPE_BOOL, NULL));
983  vb->vb_bool = true;
984  fr_dcursor_append(out, vb);
985  return XLAT_ACTION_DONE;
986 
987  /*
988  * Fallback to dynamic search
989  */
990  default:
991  break;
992  }
993  }
994 
995  MEM(xlat_ctx = talloc(unlang_interpret_frame_talloc_ctx(request), ldap_group_xlat_ctx_t));
996 
997  *xlat_ctx = (ldap_group_xlat_ctx_t){
998  .inst = inst,
999  .group = group_vb,
1000  .dn = rlm_find_user_dn_cached(request),
1001  .attrs = { inst->group.userobj_membership_attr, NULL },
1002  .group_is_dn = group_is_dn,
1003  .env_data = env_data
1004  };
1005 
1006  xlat_ctx->ttrunk = fr_thread_ldap_trunk_get(t, inst->handle_config.server, inst->handle_config.admin_identity,
1007  inst->handle_config.admin_password, request, &inst->handle_config);
1008 
1009  if (!xlat_ctx->ttrunk) {
1010  REDEBUG("Unable to get LDAP trunk for group membership check");
1011  error:
1012  talloc_free(xlat_ctx);
1013  return XLAT_ACTION_FAIL;
1014  }
1015 
1016  if (unlang_xlat_yield(request, ldap_group_xlat_resume, NULL, 0, xlat_ctx) != XLAT_ACTION_YIELD) goto error;
1017 
1018  if (unlang_function_push(request, xlat_ctx->dn ? NULL : ldap_group_xlat_user_find,
1019  ldap_group_xlat_results, ldap_group_xlat_cancel, ~FR_SIGNAL_CANCEL,
1020  UNLANG_SUB_FRAME, xlat_ctx) < 0) goto error;
1021 
1022  return XLAT_ACTION_PUSH_UNLANG;
1023 }
1024 
1025 typedef struct {
1026  fr_ldap_result_code_t ret;
1027  LDAPURLDesc *url;
1028  fr_ldap_map_exp_t expanded;
1029 } ldap_xlat_profile_ctx_t;
1030 
1031 /** Return whether evaluating the profile was successful
1032  *
1033  */
1034 static xlat_action_t ldap_profile_xlat_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx,
1035  UNUSED request_t *request, UNUSED fr_value_box_list_t *in)
1036 {
1037  ldap_xlat_profile_ctx_t *xlat_ctx = talloc_get_type_abort(xctx->rctx, ldap_xlat_profile_ctx_t);
1038  fr_value_box_t *vb;
1039 
1040  MEM(vb = fr_value_box_alloc(ctx, FR_TYPE_BOOL, attr_expr_bool_enum));
1041  vb->vb_bool = xlat_ctx->ret == LDAP_RESULT_SUCCESS;
1042  fr_dcursor_append(out, vb);
1043 
1044  return XLAT_ACTION_DONE;
1045 }
1046 
1047 static int ldap_xlat_profile_ctx_free(ldap_xlat_profile_ctx_t *to_free)
1048 {
1049  if (to_free->url) {
1050  ldap_free_urldesc(to_free->url);
1051  to_free->url = NULL;
1052  }
1053  return 0;
1054 }
1055 
1056 /** Expand an LDAP URL into a query, applying the results using the user update map.
1057  *
1058  * For fetching profiles by DN.
1059  *
1060  * @ingroup xlat_functions
1061  */
1062 static xlat_action_t ldap_profile_xlat(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
1063  xlat_ctx_t const *xctx,
1064  request_t *request, fr_value_box_list_t *in)
1065 {
1066  rlm_ldap_t const *inst = talloc_get_type_abort_const(xctx->mctx->mi->data, rlm_ldap_t);
1067  fr_ldap_thread_t *t = talloc_get_type_abort(xctx->mctx->thread, fr_ldap_thread_t);
1068  ldap_xlat_profile_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, ldap_xlat_profile_call_env_t);
1069  fr_value_box_t *uri_components, *uri;
1070  char *host_url, *host = NULL;
1071  fr_ldap_config_t const *handle_config = t->config;
1072  fr_ldap_thread_trunk_t *ttrunk;
1073  ldap_xlat_profile_ctx_t *xlat_ctx = NULL;
1074 
1075  int ldap_url_ret;
1076 
1077  char const *dn;
1078  char const *filter;
1079  int scope;
1080 
1081  bool is_dn;
1082 
1083  XLAT_ARGS(in, &uri_components);
1084 
1085  is_dn = (fr_uri_has_scheme(&uri_components->vb_group, ldap_uri_scheme_table, ldap_uri_scheme_table_len, -1) < 0);
1086 
1087  /*
1088  * Apply different escaping rules based on whether the first
1089  * arg lookgs like a URI or a DN.
1090  */
1091  if (is_dn) {
1092  if (fr_uri_escape_list(&uri_components->vb_group, ldap_dn_parts, NULL) < 0) {
1093  RPERROR("Failed to escape LDAP DN");
1094  return XLAT_ACTION_FAIL;
1095  }
1096  } else {
1097  if (fr_uri_escape_list(&uri_components->vb_group, ldap_uri_parts, NULL) < 0) {
1098  RPERROR("Failed to escape LDAP URI");
1099  return XLAT_ACTION_FAIL;
1100  }
1101  }
1102 
1103  /*
1104  * Smush everything into the first URI box
1105  */
1106  uri = fr_value_box_list_head(&uri_components->vb_group);
1107  if (fr_value_box_list_concat_in_place(uri, uri, &uri_components->vb_group,
1108  FR_TYPE_STRING, FR_VALUE_BOX_LIST_FREE, true, SIZE_MAX) < 0) {
1109  REDEBUG("Failed concattenating input");
1110  return XLAT_ACTION_FAIL;
1111  }
1112 
1113  /*
1114  * Allocate a resumption context to store temporary resource and results
1115  */
1116  MEM(xlat_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), ldap_xlat_profile_ctx_t));
1117  talloc_set_destructor(xlat_ctx, ldap_xlat_profile_ctx_free);
1118 
1119  if (is_dn) {
1120  host_url = handle_config->server;
1121  dn = talloc_typed_strdup_buffer(xlat_ctx, uri->vb_strvalue);
1122  filter = env_data->profile_filter.vb_strvalue;
1123  scope = inst->profile_scope;
1124  } else {
1125  ldap_url_ret = ldap_url_parse(uri->vb_strvalue, &xlat_ctx->url);
1126  if (ldap_url_ret != LDAP_URL_SUCCESS){
1127  RPEDEBUG("Parsing LDAP URL failed - %s", fr_ldap_url_err_to_str(ldap_url_ret));
1128  error:
1129  talloc_free(xlat_ctx);
1130  return XLAT_ACTION_FAIL;
1131  }
1132 
1133  /*
1134  * The URL must specify a DN
1135  */
1136  if (!xlat_ctx->url->lud_dn) {
1137  REDEBUG("LDAP URI must specify a profile DN");
1138  goto error;
1139  }
1140 
1141  dn = xlat_ctx->url->lud_dn;
1142  /*
1143  * Either we use the filter from the URL or we use the default filter
1144  * configured for profiles.
1145  */
1146  filter = xlat_ctx->url->lud_filter ? xlat_ctx->url->lud_filter : env_data->profile_filter.vb_strvalue;
1147 
1148  /*
1149  * Determine if the URL includes a scope.
1150  */
1151  scope = xlat_ctx->url->lud_scope == LDAP_SCOPE_DEFAULT ? inst->profile_scope : xlat_ctx->url->lud_scope;
1152 
1153  /*
1154  * If the URL is <scheme>:/// the parsed host will be NULL - use config default
1155  */
1156  if (!xlat_ctx->url->lud_host) {
1157  host_url = handle_config->server;
1158  } else {
1159  host_url = host = host_uri_canonify(request, xlat_ctx->url, uri);
1160  if (unlikely(host_url == NULL)) goto error;
1161  }
1162  }
1163 
1164  /*
1165  * Synchronous expansion of maps (fixme!)
1166  */
1167  if (fr_ldap_map_expand(xlat_ctx, &xlat_ctx->expanded, request, env_data->profile_map,
1168  inst->valuepair_attr) < 0) goto error;
1169  ttrunk = fr_thread_ldap_trunk_get(t, host_url, handle_config->admin_identity,
1170  handle_config->admin_password, request, handle_config);
1171  if (host) ldap_memfree(host);
1172  if (!ttrunk) {
1173  REDEBUG("Unable to get LDAP query for xlat");
1174  goto error;
1175  }
1176 
1177  if (unlang_xlat_yield(request, ldap_profile_xlat_resume, NULL, 0, xlat_ctx) != XLAT_ACTION_YIELD) goto error;
1178 
1179  /*
1180  * Pushes a frame onto the stack to retrieve and evaluate a profile
1181  */
1182  if (rlm_ldap_map_profile(&xlat_ctx->ret, inst, request, ttrunk, dn, scope, filter, &xlat_ctx->expanded) < 0) goto error;
1183 
1184  return XLAT_ACTION_PUSH_UNLANG;
1185 }
1186 
1187 /*
1188  * Verify the result of the map.
1189  */
1190 static int ldap_map_verify(CONF_SECTION *cs, UNUSED void const *mod_inst, UNUSED void *proc_inst,
1191  tmpl_t const *src, UNUSED map_list_t const *maps)
1192 {
1193  if (!src) {
1194  cf_log_err(cs, "Missing LDAP URI");
1195 
1196  return -1;
1197  }
1198 
1199  return 0;
1200 }
1201 
1202 /** Process the results of an LDAP map query
1203  *
1204  * @param[out] p_result Result of applying the map.
1205  * @param[in] priority Unused.
1206  * @param[in] request Current request.
1207  * @param[in] uctx Map context.
1208  * @return One of UNLANG_ACTION_*
1209  */
1210 static unlang_action_t mod_map_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
1211 {
1212  ldap_map_ctx_t *map_ctx = talloc_get_type_abort(uctx, ldap_map_ctx_t);
1213  fr_ldap_query_t *query = map_ctx->query;
1214  fr_ldap_map_exp_t *expanded = &map_ctx->expanded;
1215  rlm_rcode_t rcode = RLM_MODULE_NOTFOUND;
1216  LDAPMessage *entry;
1217  map_t const *map;
1218 
1219  switch (query->ret) {
1220  case LDAP_RESULT_SUCCESS:
1221  rcode = RLM_MODULE_UPDATED;
1222  break;
1223 
1224  case LDAP_RESULT_NO_RESULT:
1225  case LDAP_RESULT_BAD_DN:
1226  goto finish;
1227 
1228  default:
1229  rcode = RLM_MODULE_FAIL;
1230  goto finish;
1231  }
1232 
1233  for (entry = ldap_first_entry(query->ldap_conn->handle, query->result);
1234  entry;
1235  entry = ldap_next_entry(query->ldap_conn->handle, entry)) {
1236  char *dn = NULL;
1237  int i;
1238 
1239  if (RDEBUG_ENABLED2) {
1240  dn = ldap_get_dn(query->ldap_conn->handle, entry);
1241  RDEBUG2("Processing \"%s\"", dn);
1242  }
1243 
1244  RINDENT();
1245  for (map = map_list_head(map_ctx->maps), i = 0;
1246  map != NULL;
1247  map = map_list_next(map_ctx->maps, map), i++) {
1248  int ret;
1249  fr_ldap_result_t attr;
1250 
1251  attr.values = ldap_get_values_len(query->ldap_conn->handle, entry, expanded->attrs[i]);
1252  if (!attr.values) {
1253  /*
1254  * Many LDAP directories don't expose the DN of
1255  * the object as an attribute, so we need this
1256  * hack, to allow the user to retrieve it.
1257  */
1258  if (strcmp(LDAP_VIRTUAL_DN_ATTR, expanded->attrs[i]) == 0) {
1259  struct berval value;
1260  struct berval *values[2] = { &value, NULL };
1261 
1262  if (!dn) dn = ldap_get_dn(query->ldap_conn->handle, entry);
1263  value.bv_val = dn;
1264  value.bv_len = strlen(dn);
1265 
1266  attr.values = values;
1267  attr.count = 1;
1268 
1269  ret = map_to_request(request, map, fr_ldap_map_getvalue, &attr);
1270  if (ret == -1) {
1271  rcode = RLM_MODULE_FAIL;
1272  ldap_memfree(dn);
1273  goto finish;
1274  }
1275  continue;
1276  }
1277 
1278  RDEBUG3("Attribute \"%s\" not found in LDAP object", expanded->attrs[i]);
1279 
1280  continue;
1281  }
1282  attr.count = ldap_count_values_len(attr.values);
1283 
1284  ret = map_to_request(request, map, fr_ldap_map_getvalue, &attr);
1285  ldap_value_free_len(attr.values);
1286  if (ret == -1) {
1287  rcode = RLM_MODULE_FAIL;
1288  ldap_memfree(dn);
1289  goto finish;
1290  }
1291  }
1292  ldap_memfree(dn);
1293  REXDENT();
1294  }
1295 
1296 finish:
1297  RETURN_MODULE_RCODE(rcode);
1298 }
1299 
1300 /** Ensure map context is properly cleared up
1301  *
1302  */
1303 static int map_ctx_free(ldap_map_ctx_t *map_ctx)
1304 {
1305  talloc_free(map_ctx->expanded.ctx);
1306  ldap_free_urldesc(map_ctx->ldap_url);
1307  return (0);
1308 }
1309 
1310 /** Perform a search and map the result of the search to server attributes
1311  *
1312  * Unlike LDAP xlat, this can be used to process attributes from multiple entries.
1313  *
1314  * @todo For xlat expansions we need to parse the raw URL first, and then apply
1315  * different escape functions to the different parts.
1316  *
1317  * @param[out] p_result Result of map expansion:
1318  * - #RLM_MODULE_NOOP no rows were returned.
1319  * - #RLM_MODULE_UPDATED if one or more #fr_pair_t were added to the #request_t.
1320  * - #RLM_MODULE_FAIL if an error occurred.
1321  * @param[in] mod_inst #rlm_ldap_t
1322  * @param[in] proc_inst unused.
1323  * @param[in,out] request The current request.
1324  * @param[in] url LDAP url specifying base DN and filter.
1325  * @param[in] maps Head of the map list.
1326  * @return UNLANG_ACTION_CALCULATE_RESULT
1327  */
1328 static unlang_action_t mod_map_proc(rlm_rcode_t *p_result, void const *mod_inst, UNUSED void *proc_inst, request_t *request,
1329  fr_value_box_list_t *url, map_list_t const *maps)
1330 {
1331  rlm_ldap_t const *inst = talloc_get_type_abort_const(mod_inst, rlm_ldap_t);
1332  fr_ldap_thread_t *thread = talloc_get_type_abort(module_thread(inst->mi)->data, fr_ldap_thread_t);
1333 
1334  LDAPURLDesc *ldap_url;
1335  int ldap_url_ret;
1336  fr_ldap_thread_trunk_t *ttrunk;
1337 
1338  fr_value_box_t *url_head;
1339  ldap_map_ctx_t *map_ctx;
1340  char *host_url, *host = NULL;
1341 
1342  if (fr_uri_escape_list(url, ldap_uri_parts, NULL) < 0) {
1343  RPERROR("Failed to escape LDAP URI");
1344  RETURN_MODULE_FAIL;
1345  }
1346 
1347  url_head = fr_value_box_list_head(url);
1348  if (!url_head) {
1349  REDEBUG("LDAP URL cannot be (null)");
1350  RETURN_MODULE_FAIL;
1351  }
1352 
1353  if (fr_value_box_list_concat_in_place(url_head, url_head, url, FR_TYPE_STRING,
1354  FR_VALUE_BOX_LIST_FREE, true, SIZE_MAX) < 0) {
1355  REDEBUG("Failed concatenating input");
1356  RETURN_MODULE_FAIL;
1357  }
1358 
1359  if (!ldap_is_ldap_url(url_head->vb_strvalue)) {
1360  REDEBUG("Map query string does not look like a valid LDAP URI");
1361  RETURN_MODULE_FAIL;
1362  }
1363 
1364  MEM(map_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), ldap_map_ctx_t));
1365  talloc_set_destructor(map_ctx, map_ctx_free);
1366  map_ctx->maps = maps;
1367 
1368  ldap_url_ret = ldap_url_parse(url_head->vb_strvalue, &map_ctx->ldap_url);
1369  if (ldap_url_ret != LDAP_URL_SUCCESS){
1370  RPEDEBUG("Parsing LDAP URL failed - %s", fr_ldap_url_err_to_str(ldap_url_ret));
1371  fail:
1372  talloc_free(map_ctx);
1373  RETURN_MODULE_FAIL;
1374  }
1375  ldap_url = map_ctx->ldap_url;
1376 
1377  /*
1378  * Expand the RHS of the maps to get the name of the attributes.
1379  */
1380  if (fr_ldap_map_expand(map_ctx, &map_ctx->expanded, request, maps, NULL) < 0) goto fail;
1381 
1382  /*
1383  * If the URL is <scheme>:/// the parsed host will be NULL - use config default
1384  */
1385  if (!ldap_url->lud_host) {
1386  host_url = inst->handle_config.server;
1387  } else {
1388  host_url = host = host_uri_canonify(request, ldap_url, url_head);
1389  if (unlikely(host_url == NULL)) goto fail;
1390  }
1391 
1392  ttrunk = fr_thread_ldap_trunk_get(thread, host_url, inst->handle_config.admin_identity,
1393  inst->handle_config.admin_password, request, &inst->handle_config);
1394  if (host) ldap_memfree(host);
1395  if (!ttrunk) goto fail;
1396 
1397  if (unlang_function_push(request, NULL, mod_map_resume, NULL, 0,
1398  UNLANG_SUB_FRAME, map_ctx) != UNLANG_ACTION_PUSHED_CHILD) goto fail;
1399 
1400  return fr_ldap_trunk_search(map_ctx, &map_ctx->query, request, ttrunk, ldap_url->lud_dn,
1401  ldap_url->lud_scope, ldap_url->lud_filter, map_ctx->expanded.attrs,
1402  NULL, NULL);
1403 }
1404 
1405 /** Perform async lookup of user DN if required for authentication
1406  *
1407  */
1408 static unlang_action_t mod_authenticate_start(rlm_rcode_t *p_result, UNUSED int *priority,
1409  request_t *request, void *uctx)
1410 {
1411  ldap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, ldap_auth_ctx_t);
1412  fr_ldap_thread_trunk_t *ttrunk;
1413  rlm_ldap_t const *inst = auth_ctx->inst;
1414 
1415  ttrunk = fr_thread_ldap_trunk_get(auth_ctx->thread, inst->handle_config.server, inst->handle_config.admin_identity,
1416  inst->handle_config.admin_password, request, &inst->handle_config);
1417  if (!ttrunk) RETURN_MODULE_FAIL;
1418 
1419  return rlm_ldap_find_user_async(auth_ctx, auth_ctx->inst, request, &auth_ctx->call_env->user_base,
1420  &auth_ctx->call_env->user_filter, ttrunk, NULL, NULL);
1421 }
1422 
1423 /** Initiate async LDAP bind to authenticate user
1424  *
1425  */
1426 static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority,
1427  request_t *request, void *uctx)
1428 {
1429  ldap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, ldap_auth_ctx_t);
1430 
1431  /*
1432  * SASL bind auth will have the mech set.
1433  */
1434  if (auth_ctx->call_env->user_sasl_mech.type == FR_TYPE_STRING) {
1435 #ifdef WITH_SASL
1436  ldap_auth_call_env_t *call_env = auth_ctx->call_env;
1437 
1438  RDEBUG2("Login attempt using identity \"%pV\"", &call_env->user_sasl_authname);
1439 
1440  return fr_ldap_sasl_bind_auth_async(request, auth_ctx->thread, call_env->user_sasl_mech.vb_strvalue,
1441  call_env->user_sasl_authname.vb_strvalue,
1442  auth_ctx->password, call_env->user_sasl_proxy.vb_strvalue,
1443  call_env->user_sasl_realm.vb_strvalue);
1444 #else
1445  RDEBUG("Configuration item 'sasl.mech' is not supported. "
1446  "The linked version of libldap does not provide ldap_sasl_bind( function");
1447  RETURN_MODULE_FAIL;
1448 #endif
1449  }
1450 
1451  /*
1452  * Arriving here from an LDAP search will mean the dn in auth_ctx is NULL.
1453  */
1454  if (!auth_ctx->dn) auth_ctx->dn = rlm_find_user_dn_cached(request);
1455 
1456  /*
1457  * No DN found - can't authenticate the user with a simple bind.
1458  */
1459  if (!auth_ctx->dn) {
1460  talloc_free(auth_ctx);
1461  RETURN_MODULE_FAIL;
1462  }
1463 
1464  RDEBUG2("Login attempt as \"%s\"", auth_ctx->dn);
1465 
1466  return fr_ldap_bind_auth_async(request, auth_ctx->thread, auth_ctx->dn, auth_ctx->password);
1467 }
1468 
1469 static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
1470 {
1471  rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_ldap_t);
1472  fr_ldap_thread_t *thread = talloc_get_type_abort(module_thread(inst->mi)->data, fr_ldap_thread_t);
1473  ldap_auth_ctx_t *auth_ctx;
1474  ldap_auth_call_env_t *call_env = talloc_get_type_abort(mctx->env_data, ldap_auth_call_env_t);
1475 
1476  if (call_env->password.type != FR_TYPE_STRING) {
1477  RWDEBUG("You have set \"Auth-Type := LDAP\" somewhere");
1478  RWDEBUG("without checking if %s is present", call_env->password_tmpl->name);
1479  RWDEBUG("*********************************************");
1480  RWDEBUG("* THAT CONFIGURATION IS WRONG. DELETE IT. ");
1481  RWDEBUG("* YOU ARE PREVENTING THE SERVER FROM WORKING");
1482  RWDEBUG("*********************************************");
1483 
1484  REDEBUG("Attribute \"%s\" is required for authentication", call_env->password_tmpl->name);
1485  RETURN_MODULE_INVALID;
1486  }
1487 
1488  /*
1489  * Log the password
1490  */
1491  if (RDEBUG_ENABLED3) {
1492  RDEBUG("Login attempt with password \"%pV\"", &call_env->password);
1493  } else {
1494  RDEBUG2("Login attempt with password");
1495  }
1496 
1497  auth_ctx = talloc(unlang_interpret_frame_talloc_ctx(request), ldap_auth_ctx_t);
1498  *auth_ctx = (ldap_auth_ctx_t){
1499  .password = call_env->password.vb_strvalue,
1500  .thread = thread,
1501  .inst = inst,
1502  .call_env = call_env
1503  };
1504 
1505  /*
1506  * Check for a cached copy of the DN
1507  */
1508  auth_ctx->dn = rlm_find_user_dn_cached(request);
1509 
1510  if (unlang_function_push(request, auth_ctx->dn || (call_env->user_sasl_mech.type == FR_TYPE_STRING) ?
1511  NULL : mod_authenticate_start, mod_authenticate_resume,
1512  NULL, 0, UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
1513 
1514  return UNLANG_ACTION_PUSHED_CHILD;
1515 }
1516 
1517 /** Start LDAP authorization with async lookup of user DN
1518  *
1519  */
1520 static unlang_action_t mod_authorize_start(UNUSED rlm_rcode_t *p_result, UNUSED int *priority,
1521  request_t *request, void *uctx)
1522 {
1523  ldap_autz_ctx_t *autz_ctx = talloc_get_type_abort(uctx, ldap_autz_ctx_t);
1524  return rlm_ldap_find_user_async(autz_ctx, autz_ctx->inst, request, &autz_ctx->call_env->user_base,
1525  &autz_ctx->call_env->user_filter, autz_ctx->ttrunk, autz_ctx->expanded.attrs,
1526  &autz_ctx->query);
1527 }
1528 
1529 #define REPEAT_MOD_AUTHORIZE_RESUME \
1530  if (unlang_function_repeat_set(request, mod_authorize_resume) < 0) do { \
1531  rcode = RLM_MODULE_FAIL; \
1532  goto finish; \
1533  } while (0)
1534 
1535 /** Resume function called after each potential yield in LDAP authorization
1536  *
1537  * Some operations may or may not yield. E.g. if group membership is
1538  * read from an attribute returned with the user object and is already
1539  * in the correct form, that will not yield.
1540  * Hence, each state may fall through to the next.
1541  *
1542  * @param p_result Result of current authorization.
1543  * @param priority Unused.
1544  * @param request Current request.
1545  * @param uctx Current authorization context.
1546  * @return One of the RLM_MODULE_* values.
1547  */
1548 static unlang_action_t mod_authorize_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
1549 {
1550  ldap_autz_ctx_t *autz_ctx = talloc_get_type_abort(uctx, ldap_autz_ctx_t);
1551  rlm_ldap_t const *inst = talloc_get_type_abort_const(autz_ctx->inst, rlm_ldap_t);
1552  ldap_autz_call_env_t *call_env = talloc_get_type_abort(autz_ctx->call_env, ldap_autz_call_env_t);
1553  int ldap_errno;
1554  rlm_rcode_t rcode = RLM_MODULE_OK;
1555  LDAP *handle = fr_ldap_handle_thread_local();
1556 
1557  /*
1558  * If a previous async call returned one of the "failure" results just return.
1559  */
1560  switch (*p_result) {
1561  case RLM_MODULE_REJECT:
1562  case RLM_MODULE_FAIL:
1563  case RLM_MODULE_HANDLED:
1564  case RLM_MODULE_INVALID:
1565  case RLM_MODULE_DISALLOW:
1566  rcode = *p_result;
1567  goto finish;
1568 
1569  default:
1570  break;
1571  }
1572 
1573  switch (autz_ctx->status) {
1574  case LDAP_AUTZ_FIND:
1575  /*
1576  * If a user entry has been found the current rcode will be OK
1577  */
1578  if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
1579 
1580  autz_ctx->entry = ldap_first_entry(handle, autz_ctx->query->result);
1581  if (!autz_ctx->entry) {
1582  ldap_get_option(handle, LDAP_OPT_RESULT_CODE, &ldap_errno);
1583  REDEBUG("Failed retrieving entry: %s", ldap_err2string(ldap_errno));
1584 
1585  goto finish;
1586  }
1587 
1588  /*
1589  * Check for access.
1590  */
1591  if (inst->user.obj_access_attr) {
1592  autz_ctx->access_state = rlm_ldap_check_access(inst, request, autz_ctx->entry);
1593  switch (autz_ctx->access_state) {
1594  case LDAP_ACCESS_ALLOWED:
1595  break;
1596 
1597  case LDAP_ACCESS_SUSPENDED:
1598  if (inst->group.skip_on_suspend) goto post_group;
1599  break;
1600 
1601  case LDAP_ACCESS_DISALLOWED:
1602  rcode = RLM_MODULE_DISALLOW;
1603  goto finish;
1604  }
1605  }
1606 
1607  /*
1608  * Check if we need to cache group memberships
1609  */
1610  if ((inst->group.cacheable_dn || inst->group.cacheable_name) && (inst->group.userobj_membership_attr)) {
1611  REPEAT_MOD_AUTHORIZE_RESUME;
1612  if (rlm_ldap_cacheable_userobj(&rcode, request, autz_ctx,
1613  inst->group.userobj_membership_attr) == UNLANG_ACTION_PUSHED_CHILD) {
1614  autz_ctx->status = LDAP_AUTZ_GROUP;
1615  return UNLANG_ACTION_PUSHED_CHILD;
1616  }
1617  if (rcode != RLM_MODULE_OK) goto finish;
1618  }
1619  FALL_THROUGH;
1620 
1621  case LDAP_AUTZ_GROUP:
1622  if (inst->group.cacheable_dn || inst->group.cacheable_name) {
1623  REPEAT_MOD_AUTHORIZE_RESUME;
1624  if (rlm_ldap_cacheable_groupobj(&rcode, request, autz_ctx) == UNLANG_ACTION_PUSHED_CHILD) {
1625  autz_ctx->status = LDAP_AUTZ_POST_GROUP;
1626  return UNLANG_ACTION_PUSHED_CHILD;
1627  }
1628  if (rcode != RLM_MODULE_OK) goto finish;
1629  }
1630  FALL_THROUGH;
1631 
1632  case LDAP_AUTZ_POST_GROUP:
1633  post_group:
1634 #ifdef WITH_EDIR
1635  /*
1636  * We already have a Password.Cleartext. Skip edir.
1637  */
1638  if (fr_pair_find_by_da_nested(&request->control_pairs, NULL, attr_cleartext_password)) goto skip_edir;
1639 
1640  /*
1641  * Retrieve Universal Password if we use eDirectory
1642  */
1643  if (inst->edir) {
1644  autz_ctx->dn = rlm_find_user_dn_cached(request);
1645 
1646  /*
1647  * Retrieve universal password
1648  */
1649  REPEAT_MOD_AUTHORIZE_RESUME;
1650  autz_ctx->status = LDAP_AUTZ_EDIR_BIND;
1651  return fr_ldap_edir_get_password(request, autz_ctx->dn, autz_ctx->ttrunk,
1652  attr_cleartext_password);
1653  }
1654  FALL_THROUGH;
1655 
1656  case LDAP_AUTZ_EDIR_BIND:
1657  if (inst->edir && inst->edir_autz) {
1658  fr_pair_t *password = fr_pair_find_by_da(&request->control_pairs,
1659  NULL, attr_cleartext_password);
1660  fr_ldap_thread_t *thread = talloc_get_type_abort(module_thread(inst->mi)->data,
1661  fr_ldap_thread_t);
1662 
1663  if (!password) {
1664  REDEBUG("Failed to find &control.Password.Cleartext");
1665  rcode = RLM_MODULE_FAIL;
1666  goto finish;
1667  }
1668 
1669  RDEBUG2("Binding as %s for eDirectory authorization checks", autz_ctx->dn);
1670 
1671  /*
1672  * Bind as the user
1673  */
1674  REPEAT_MOD_AUTHORIZE_RESUME;
1675  autz_ctx->status = LDAP_AUTZ_POST_EDIR;
1676  return fr_ldap_bind_auth_async(request, thread, autz_ctx->dn, password->vp_strvalue);
1677  }
1678  goto skip_edir;
1679 
1680  case LDAP_AUTZ_POST_EDIR:
1681  {
1682  /*
1683  * The result of the eDirectory user bind will be in p_result.
1684  * Anything other than RLM_MODULE_OK is a failure.
1685  */
1686  if (*p_result != RLM_MODULE_OK) {
1687  rcode = *p_result;
1688  goto finish;
1689  }
1690 
1691  }
1692  FALL_THROUGH;
1693 
1694 #endif
1695  case LDAP_AUTZ_MAP:
1696 #ifdef WITH_EDIR
1697  skip_edir:
1698 #endif
1699  if (!map_list_empty(call_env->user_map) || inst->valuepair_attr) {
1700  RDEBUG2("Processing user attributes");
1701  RINDENT();
1702  if (fr_ldap_map_do(request, inst->valuepair_attr,
1703  &autz_ctx->expanded, autz_ctx->entry) > 0) rcode = RLM_MODULE_UPDATED;
1704  REXDENT();
1705  rlm_ldap_check_reply(request, inst, autz_ctx->dlinst->name, call_env->expect_password->vb_bool, autz_ctx->ttrunk);
1706  }
1707  FALL_THROUGH;
1708 
1709  case LDAP_AUTZ_DEFAULT_PROFILE:
1710  /*
1711  * Apply ONE user profile, or a default user profile.
1712  */
1713  if (call_env->default_profile.type == FR_TYPE_STRING) {
1714  unlang_action_t ret;
1715 
1716  REPEAT_MOD_AUTHORIZE_RESUME;
1717  ret = rlm_ldap_map_profile(NULL, inst, request, autz_ctx->ttrunk, autz_ctx->profile_value,
1718  inst->profile_scope, call_env->default_profile.vb_strvalue, &autz_ctx->expanded);
1719  switch (ret) {
1720  case UNLANG_ACTION_FAIL:
1721  rcode = RLM_MODULE_FAIL;
1722  goto finish;
1723 
1724  case UNLANG_ACTION_PUSHED_CHILD:
1725  autz_ctx->status = LDAP_AUTZ_POST_DEFAULT_PROFILE;
1726  return UNLANG_ACTION_PUSHED_CHILD;
1727 
1728  default:
1729  break;
1730  }
1731  }
1732  FALL_THROUGH;
1733 
1734  case LDAP_AUTZ_POST_DEFAULT_PROFILE:
1735  /*
1736  * Did we jump back her after applying the default profile?
1737  */
1738  if (autz_ctx->status == LDAP_AUTZ_POST_DEFAULT_PROFILE) {
1739  rcode = RLM_MODULE_UPDATED;
1740  }
1741  /*
1742  * Apply a SET of user profiles.
1743  */
1744  switch (autz_ctx->access_state) {
1745  case LDAP_ACCESS_ALLOWED:
1746  if (inst->profile_attr) {
1747  int count;
1748 
1749  autz_ctx->profile_values = ldap_get_values_len(handle, autz_ctx->entry, inst->profile_attr);
1750  count = ldap_count_values_len(autz_ctx->profile_values);
1751  if (count > 0) {
1752  RDEBUG2("Processing %i profile(s) found in attribute \"%s\"", count, inst->profile_attr);
1753  if (RDEBUG_ENABLED3) {
1754  for (struct berval **bv_p = autz_ctx->profile_values; *bv_p; bv_p++) {
1755  RDEBUG3("Will evaluate profile with DN \"%pV\"", fr_box_strvalue_len((*bv_p)->bv_val, (*bv_p)->bv_len));
1756  }
1757  }
1758  } else {
1759  RDEBUG2("No profile(s) found in attribute \"%s\"", inst->profile_attr);
1760  }
1761  }
1762  break;
1763 
1764  case LDAP_ACCESS_SUSPENDED:
1765  if (inst->profile_attr_suspend) {
1766  int count;
1767 
1768  autz_ctx->profile_values = ldap_get_values_len(handle, autz_ctx->entry, inst->profile_attr_suspend);
1769  count = ldap_count_values_len(autz_ctx->profile_values);
1770  if (count > 0) {
1771  RDEBUG2("Processing %i suspension profile(s) found in attribute \"%s\"", count, inst->profile_attr_suspend);
1772  if (RDEBUG_ENABLED3) {
1773  for (struct berval **bv_p = autz_ctx->profile_values; *bv_p; bv_p++) {
1774  RDEBUG3("Will evaluate suspenension profile with DN \"%pV\"",
1775  fr_box_strvalue_len((*bv_p)->bv_val, (*bv_p)->bv_len));
1776  }
1777  }
1778  } else {
1779  RDEBUG2("No suspension profile(s) found in attribute \"%s\"", inst->profile_attr_suspend);
1780  }
1781  }
1782  break;
1783 
1784  case LDAP_ACCESS_DISALLOWED:
1785  break;
1786  }
1787 
1788  FALL_THROUGH;
1789 
1790  case LDAP_AUTZ_USER_PROFILE:
1791  /*
1792  * After each profile has been applied, execution will restart here.
1793  * Start by clearing the previously used value.
1794  */
1795  if (autz_ctx->profile_value) {
1796  TALLOC_FREE(autz_ctx->profile_value);
1797  rcode = RLM_MODULE_UPDATED; /* We're back here after applying a profile successfully */
1798  }
1799 
1800  if (autz_ctx->profile_values && autz_ctx->profile_values[autz_ctx->value_idx]) {
1801  unlang_action_t ret;
1802 
1803  autz_ctx->profile_value = fr_ldap_berval_to_string(autz_ctx, autz_ctx->profile_values[autz_ctx->value_idx++]);
1804  REPEAT_MOD_AUTHORIZE_RESUME;
1805  ret = rlm_ldap_map_profile(NULL, inst, request, autz_ctx->ttrunk, autz_ctx->profile_value,
1806  inst->profile_scope, autz_ctx->call_env->profile_filter.vb_strvalue, &autz_ctx->expanded);
1807  switch (ret) {
1808  case UNLANG_ACTION_FAIL:
1809  rcode = RLM_MODULE_FAIL;
1810  goto finish;
1811 
1812  case UNLANG_ACTION_PUSHED_CHILD:
1813  autz_ctx->status = LDAP_AUTZ_USER_PROFILE;
1814  return UNLANG_ACTION_PUSHED_CHILD;
1815 
1816  default:
1817  break;
1818  }
1819  }
1820  break;
1821  }
1822 
1823 finish:
1824  talloc_free(autz_ctx);
1825 
1826  RETURN_MODULE_RCODE(rcode);
1827 }
1828 
1829 /** Clear up when cancelling a mod_authorize call
1830  *
1831  */
1832 static void mod_authorize_cancel(UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
1833 {
1834  ldap_autz_ctx_t *autz_ctx = talloc_get_type_abort(uctx, ldap_autz_ctx_t);
1835 
1836  if (autz_ctx->query && autz_ctx->query->treq) trunk_request_signal_cancel(autz_ctx->query->treq);
1837 }
1838 
1839 /** Ensure authorization context is properly cleared up
1840  *
1841  */
1842 static int autz_ctx_free(ldap_autz_ctx_t *autz_ctx)
1843 {
1844  talloc_free(autz_ctx->expanded.ctx);
1845  if (autz_ctx->profile_values) ldap_value_free_len(autz_ctx->profile_values);
1846  return 0;
1847 }
1848 
1849 static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
1850 {
1851  rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_ldap_t);
1852  fr_ldap_thread_t *thread = talloc_get_type_abort(module_thread(inst->mi)->data, fr_ldap_thread_t);
1853  ldap_autz_ctx_t *autz_ctx;
1854  fr_ldap_map_exp_t *expanded;
1855  ldap_autz_call_env_t *call_env = talloc_get_type_abort(mctx->env_data, ldap_autz_call_env_t);
1856 
1857  MEM(autz_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), ldap_autz_ctx_t));
1858  talloc_set_destructor(autz_ctx, autz_ctx_free);
1859  expanded = &autz_ctx->expanded;
1860 
1861  /*
1862  * Don't be tempted to add a check for User-Name or
1863  * User-Password here. LDAP authorization can be used
1864  * for many things besides searching for users.
1865  */
1866  if (fr_ldap_map_expand(autz_ctx, expanded, request, call_env->user_map, inst->valuepair_attr) < 0) {
1867  fail:
1868  talloc_free(autz_ctx);
1869  RETURN_MODULE_FAIL;
1870  }
1871 
1872  autz_ctx->ttrunk = fr_thread_ldap_trunk_get(thread, inst->handle_config.server, inst->handle_config.admin_identity,
1873  inst->handle_config.admin_password, request, &inst->handle_config);
1874  if (!autz_ctx->ttrunk) goto fail;
1875 
1876 #define CHECK_EXPANDED_SPACE(_expanded) fr_assert((size_t)_expanded->count < (NUM_ELEMENTS(_expanded->attrs) - 1));
1877 
1878  /*
1879  * Add any additional attributes we need for checking access, memberships, and profiles
1880  */
1881  if (inst->user.obj_access_attr) {
1882  CHECK_EXPANDED_SPACE(expanded);
1883  expanded->attrs[expanded->count++] = inst->user.obj_access_attr;
1884  }
1885 
1886  if (inst->group.userobj_membership_attr && (inst->group.cacheable_dn || inst->group.cacheable_name)) {
1887  CHECK_EXPANDED_SPACE(expanded);
1888  expanded->attrs[expanded->count++] = inst->group.userobj_membership_attr;
1889  }
1890 
1891  if (inst->profile_attr) {
1892  CHECK_EXPANDED_SPACE(expanded);
1893  expanded->attrs[expanded->count++] = inst->profile_attr;
1894  }
1895 
1896  if (inst->profile_attr_suspend) {
1897  CHECK_EXPANDED_SPACE(expanded);
1898  expanded->attrs[expanded->count++] = inst->profile_attr_suspend;
1899  }
1900  expanded->attrs[expanded->count] = NULL;
1901 
1902  autz_ctx->dlinst = mctx->mi;
1903  autz_ctx->inst = inst;
1904  autz_ctx->call_env = call_env;
1905  autz_ctx->status = LDAP_AUTZ_FIND;
1906 
1907  if (unlang_function_push(request, mod_authorize_start, mod_authorize_resume, mod_authorize_cancel,
1908  ~FR_SIGNAL_CANCEL, UNLANG_SUB_FRAME, autz_ctx) < 0) RETURN_MODULE_FAIL;
1909 
1910  return UNLANG_ACTION_PUSHED_CHILD;
1911 }
1912 
1913 /** Perform async lookup of user DN if required for user modification
1914  *
1915  */
1916 static unlang_action_t user_modify_start(UNUSED rlm_rcode_t *p_result, UNUSED int *priority,
1917  request_t *request, void *uctx)
1918 {
1919  ldap_user_modify_ctx_t *usermod_ctx = talloc_get_type_abort(uctx, ldap_user_modify_ctx_t);
1920 
1921  return rlm_ldap_find_user_async(usermod_ctx, usermod_ctx->inst, request, &usermod_ctx->call_env->user_base,
1922  &usermod_ctx->call_env->user_filter, usermod_ctx->ttrunk, NULL, NULL);
1923 }
1924 
1925 /** Cancel an in progress user modification.
1926  *
1927  */
1928 static void user_modify_cancel(UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
1929 {
1930  ldap_user_modify_ctx_t *usermod_ctx = talloc_get_type_abort(uctx, ldap_user_modify_ctx_t);
1931 
1932  if (!usermod_ctx->query || !usermod_ctx->query->treq) return;
1933 
1934  trunk_request_signal_cancel(usermod_ctx->query->treq);
1935 }
1936 
1937 /** Handle results of user modification.
1938  *
1939  */
1940 static unlang_action_t user_modify_final(rlm_rcode_t *p_result, UNUSED int *priority,
1941  request_t *request, void *uctx)
1942 {
1943  ldap_user_modify_ctx_t *usermod_ctx = talloc_get_type_abort(uctx, ldap_user_modify_ctx_t);
1944  fr_ldap_query_t *query = usermod_ctx->query;
1945  rlm_rcode_t rcode = RLM_MODULE_OK;
1946 
1947  switch (query->ret) {
1948  case LDAP_RESULT_SUCCESS:
1949  break;
1950 
1951  case LDAP_RESULT_NO_RESULT:
1952  case LDAP_RESULT_BAD_DN:
1953  RDEBUG2("User object \"%s\" not modified", usermod_ctx->dn);
1954  rcode = RLM_MODULE_INVALID;
1955  break;
1956 
1957  default:
1958  rcode = RLM_MODULE_FAIL;
1959  break;
1960  }
1961 
1962  talloc_free(usermod_ctx);
1963  RETURN_MODULE_RCODE(rcode);
1964 }
1965 
1966 /** Take the retrieved user DN and launch the async modification.
1967  *
1968  */
1969 static unlang_action_t user_modify_resume(rlm_rcode_t *p_result, UNUSED int *priority,
1970  request_t *request, void *uctx)
1971 {
1972  ldap_user_modify_ctx_t *usermod_ctx = talloc_get_type_abort(uctx, ldap_user_modify_ctx_t);
1973  LDAPMod **modify = usermod_ctx->mod_p;
1974 
1975  /*
1976  * If an LDAP search was used to find the user DN
1977  * usermod_ctx->dn will be NULL.
1978  */
1979  if (!usermod_ctx->dn) usermod_ctx->dn = rlm_find_user_dn_cached(request);
1980 
1981  if (!usermod_ctx->dn) {
1982  fail:
1983  talloc_free(usermod_ctx);
1984  RETURN_MODULE_FAIL;
1985  }
1986 
1987  if (unlang_function_push(request, NULL, user_modify_final, user_modify_cancel, ~FR_SIGNAL_CANCEL,
1988  UNLANG_SUB_FRAME, usermod_ctx) < 0) goto fail;
1989 
1990  return fr_ldap_trunk_modify(usermod_ctx, &usermod_ctx->query, request, usermod_ctx->ttrunk,
1991  usermod_ctx->dn, modify, NULL, NULL);
1992 }
1993 
1994 /** Modify user's object in LDAP
1995  *
1996  * Process a modification map to update a user object in the LDAP directory.
1997  *
1998  * @param[out] p_result the result of the modification.
1999  * @param[in] inst rlm_ldap instance.
2000  * @param[in] request Current request.
2001  * @param[in] section that holds the map to process.
2002  * @param[in] call_env Call environment. Contains expanded base and filter to find user.
2003  * @return one of the RLM_MODULE_* values.
2004  */
2005 static unlang_action_t user_modify(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request,
2006  ldap_acct_section_t *section, ldap_usermod_call_env_t *call_env)
2007 {
2008  rlm_rcode_t rcode = RLM_MODULE_FAIL;
2009  fr_ldap_thread_t *thread = talloc_get_type_abort(module_thread(inst->mi)->data, fr_ldap_thread_t);
2010  ldap_user_modify_ctx_t *usermod_ctx = NULL;
2011 
2012  int total = 0, last_pass = 0;
2013 
2014  char const *attr;
2015  char const *value;
2016 
2017  /*
2018  * Build our set of modifications using the update sections in
2019  * the config.
2020  */
2021  CONF_ITEM *ci;
2022  CONF_PAIR *cp;
2023  CONF_SECTION *cs;
2024  fr_token_t op;
2025  char path[FR_MAX_STRING_LEN];
2026 
2027  char *p = path;
2028 
2029  fr_assert(section);
2030 
2031  /*
2032  * Locate the update section were going to be using
2033  */
2034  if (section->reference[0] != '.') *p++ = '.';
2035 
2036  if (xlat_eval(p, (sizeof(path) - (p - path)) - 1, request, section->reference, NULL, NULL) < 0) goto error;
2037 
2038  ci = cf_reference_item(NULL, section->cs, path);
2039  if (!ci) goto error;
2040 
2041  if (!cf_item_is_section(ci)){
2042  REDEBUG("Reference must resolve to a section");
2043 
2044  goto error;
2045  }
2046 
2047  cs = cf_section_find(cf_item_to_section(ci), "update", NULL);
2048  if (!cs) {
2049  REDEBUG("Section must contain 'update' subsection");
2050 
2051  goto error;
2052  }
2053 
2054  MEM(usermod_ctx = talloc(unlang_interpret_frame_talloc_ctx(request), ldap_user_modify_ctx_t));
2055  *usermod_ctx = (ldap_user_modify_ctx_t) {
2056  .inst = inst,
2057  .call_env = call_env
2058  };
2059 
2060  /*
2061  * Iterate over all the pairs, building our mods array
2062  */
2063  for (ci = cf_item_next(cs, NULL); ci != NULL; ci = cf_item_next(cs, ci)) {
2064  bool do_xlat = false;
2065 
2066  if (total == LDAP_MAX_ATTRMAP) {
2067  REDEBUG("Modify map size exceeded");
2068 
2069  goto error;
2070  }
2071 
2072  if (!cf_item_is_pair(ci)) {
2073  REDEBUG("Entry is not in \"ldap-attribute = value\" format");
2074 
2075  goto error;
2076  }
2077 
2078  /*
2079  * Retrieve all the information we need about the pair
2080  */
2081  cp = cf_item_to_pair(ci);
2082  value = cf_pair_value(cp);
2083  attr = cf_pair_attr(cp);
2084  op = cf_pair_operator(cp);
2085 
2086  if (!value || (*value == '\0')) {
2087  RDEBUG2("Empty value string, skipping attribute \"%s\"", attr);
2088 
2089  continue;
2090  }
2091 
2092  switch (cf_pair_value_quote(cp)) {
2093  case T_BARE_WORD:
2094  case T_SINGLE_QUOTED_STRING:
2095  break;
2096 
2097  case T_BACK_QUOTED_STRING:
2098  case T_DOUBLE_QUOTED_STRING:
2099  do_xlat = true;
2100  break;
2101 
2102  default:
2103  fr_assert(0);
2104  goto error;
2105  }
2106 
2107  if (op == T_OP_CMP_FALSE) {
2108  usermod_ctx->passed[last_pass] = NULL;
2109  } else if (do_xlat) {
2110  char *exp = NULL;
2111 
2112  if (xlat_aeval(usermod_ctx, &exp, request, value, NULL, NULL) <= 0) {
2113  RDEBUG2("Skipping attribute \"%s\"", attr);
2114  talloc_free(exp);
2115 
2116  continue;
2117  }
2118 
2119  usermod_ctx->passed[last_pass] = exp;
2120  /*
2121  * Static strings
2122  */
2123  } else {
2124  memcpy(&(usermod_ctx->passed[last_pass]), &value, sizeof(usermod_ctx->passed[last_pass]));
2125  }
2126 
2127  usermod_ctx->passed[last_pass + 1] = NULL;
2128  usermod_ctx->mod_s[total].mod_values = &(usermod_ctx->passed[last_pass]);
2129  last_pass += 2;
2130 
2131  switch (op) {
2132  /*
2133  * T_OP_EQ is *NOT* supported, it is impossible to
2134  * support because of the lack of transactions in LDAP
2135  */
2136  case T_OP_ADD_EQ:
2137  usermod_ctx->mod_s[total].mod_op = LDAP_MOD_ADD;
2138  break;
2139 
2140  case T_OP_SET:
2141  usermod_ctx->mod_s[total].mod_op = LDAP_MOD_REPLACE;
2142  break;
2143 
2144  case T_OP_SUB_EQ:
2145  case T_OP_CMP_FALSE:
2146  usermod_ctx->mod_s[total].mod_op = LDAP_MOD_DELETE;
2147  break;
2148 
2149  case T_OP_INCRM:
2150  usermod_ctx->mod_s[total].mod_op = LDAP_MOD_INCREMENT;
2151  break;
2152 
2153  default:
2154  REDEBUG("Operator '%s' is not supported for LDAP modify operations",
2155  fr_table_str_by_value(fr_tokens_table, op, "<INVALID>"));
2156 
2157  goto error;
2158  }
2159 
2160  /*
2161  * Now we know the value is ok, copy the pointers into
2162  * the ldapmod struct.
2163  */
2164  memcpy(&(usermod_ctx->mod_s[total].mod_type), &attr, sizeof(usermod_ctx->mod_s[total].mod_type));
2165 
2166  usermod_ctx->mod_p[total] = &(usermod_ctx->mod_s[total]);
2167  total++;
2168  }
2169 
2170  if (total == 0) {
2171  rcode = RLM_MODULE_NOOP;
2172  goto release;
2173  }
2174 
2175  usermod_ctx->mod_p[total] = NULL;
2176 
2177  usermod_ctx->ttrunk = fr_thread_ldap_trunk_get(thread, inst->handle_config.server,
2178  inst->handle_config.admin_identity,
2179  inst->handle_config.admin_password,
2180  request, &inst->handle_config);
2181  if (!usermod_ctx->ttrunk) {
2182  REDEBUG("Unable to get LDAP trunk for update");
2183  talloc_free(usermod_ctx);
2184  RETURN_MODULE_FAIL;
2185  }
2186 
2187  usermod_ctx->dn = rlm_find_user_dn_cached(request);
2188 
2189  if (unlang_function_push(request, usermod_ctx->dn ? NULL : user_modify_start, user_modify_resume,
2190  NULL, 0, UNLANG_SUB_FRAME, usermod_ctx) < 0) goto error;
2191 
2192  return UNLANG_ACTION_PUSHED_CHILD;
2193 
2194 release:
2195 error:
2196  TALLOC_FREE(usermod_ctx);
2197  RETURN_MODULE_RCODE(rcode);
2198 }
2199 
2200 static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
2201 {
2202  rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_ldap_t);
2203  ldap_usermod_call_env_t *call_env = talloc_get_type_abort(mctx->env_data, ldap_usermod_call_env_t);
2204 
2205  if (inst->accounting) return user_modify(p_result, inst, request, inst->accounting, call_env);
2206 
2207  RETURN_MODULE_NOOP;
2208 }
2209 
2210 static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
2211 {
2212  rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_ldap_t);
2213  ldap_usermod_call_env_t *call_env = talloc_get_type_abort(mctx->env_data, ldap_usermod_call_env_t);
2214 
2215  if (inst->postauth) return user_modify(p_result, inst, request, inst->postauth, call_env);
2216 
2217  RETURN_MODULE_NOOP;
2218 }
2219 
2220 
2221 /** Detach from the LDAP server and cleanup internal state.
2222  *
2223  */
2224 static int mod_detach(module_detach_ctx_t const *mctx)
2225 {
2226  rlm_ldap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_ldap_t);
2227 
2228  if (inst->user.obj_sort_ctrl) ldap_control_free(inst->user.obj_sort_ctrl);
2229 
2230  return 0;
2231 }
2232 
2233 /** Parse an accounting sub section.
2234  *
2235  * Allocate a new ldap_acct_section_t and write the config data into it.
2236  *
2237  * @param[in] mctx rlm_ldap configuration.
2238  * @param[in] parent of the config section.
2239  * @param[out] config to write the sub section parameters to.
2240  * @return
2241  * - 0 on success.
2242  * - < 0 on failure.
2243  */
2244 static int parse_sub_section(module_inst_ctx_t const *mctx,
2245  CONF_SECTION *parent, ldap_acct_section_t **config,
2246  char const *name)
2247 {
2248  rlm_ldap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_ldap_t);
2249  CONF_SECTION *cs;
2250 
2251  cs = cf_section_find(parent, name, NULL);
2252  if (!cs) {
2253  DEBUG2("rlm_ldap (%s) - Couldn't find configuration for %s, will return NOOP for calls "
2254  "from this section", mctx->mi->name, name);
2255 
2256  return 0;
2257  }
2258 
2259  if (cf_section_rules_push(cs, acct_section_config) < 0) return -1;
2260 
2261  *config = talloc_zero(inst, ldap_acct_section_t);
2262  if (cf_section_parse(*config, *config, cs) < 0) {
2263  PERROR("rlm_ldap (%s) - Failed parsing configuration for section %s", mctx->mi->name, name);
2264 
2265  return -1;
2266  }
2267 
2268  (*config)->cs = cs;
2269 
2270  return 0;
2271 }
2272 
2273 static int ldap_update_section_parse(TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules,
2274  CONF_ITEM *ci,
2275  UNUSED call_env_ctx_t const *cec, call_env_parser_t const *rule)
2276 {
2277  map_list_t *maps;
2278  CONF_SECTION *update = cf_item_to_section(ci);
2279  ldap_update_rules_t const *ur = rule->uctx;
2280 
2281  bool expect_password = false;
2282 
2283  /*
2284  * Build the attribute map
2285  */
2286  {
2287  map_t const *map = NULL;
2288  tmpl_attr_t const *ar;
2289  call_env_parsed_t *parsed;
2290 
2291  MEM(parsed = call_env_parsed_add(ctx, out,
2292  &(call_env_parser_t){
2293  .name = "update",
2294  .flags = CALL_ENV_FLAG_PARSE_ONLY,
2295  .pair = {
2296  .parsed = {
2297  .offset = ur->map_offset,
2298  .type = CALL_ENV_PARSE_TYPE_VOID
2299  }
2300  }
2301  }));
2302 
2303  MEM(maps = talloc(parsed, map_list_t));
2304  map_list_init(maps);
2305 
2306  if (update && (map_afrom_cs(maps, maps, update, t_rules, t_rules, fr_ldap_map_verify,
2307  NULL, LDAP_MAX_ATTRMAP)) < 0) {
2308  call_env_parsed_free(out, parsed);
2309  return -1;
2310  }
2311  /*
2312  * Check map to see if a password is being retrieved.
2313  * fr_ldap_map_verify ensures that all maps have attributes on the LHS.
2314  * All passwords have a common parent attribute of attr_password
2315  */
2316  while ((map = map_list_next(maps, map))) {
2317  ar = tmpl_attr_tail(map->lhs);
2318  if (ar->da->parent == attr_password) {
2319  expect_password = true;
2320  break;
2321  }
2322  }
2323  call_env_parsed_set_data(parsed, maps);
2324  }
2325 
2326  /*
2327  * Write out whether we expect a password to be returned from the ldap data
2328  */
2329  if (ur->expect_password_offset >= 0) {
2330  call_env_parsed_t *parsed;
2331  fr_value_box_t *vb;
2332 
2333  MEM(parsed = call_env_parsed_add(ctx, out,
2334  &(call_env_parser_t){
2335  .name = "expect_password",
2336  .flags = CALL_ENV_FLAG_PARSE_ONLY,
2337  .pair = {
2338  .parsed = {
2339  .offset = ur->expect_password_offset,
2340  .type = CALL_ENV_PARSE_TYPE_VALUE_BOX
2341  }
2342  }
2343  }));
2344  MEM(vb = fr_value_box_alloc(parsed, FR_TYPE_BOOL, NULL));
2345  vb->vb_bool = expect_password;
2346  call_env_parsed_set_value(parsed, vb);
2347  }
2348 
2349  return 0;
2350 }
2351 
2352 static int ldap_group_filter_parse(TALLOC_CTX *ctx, void *out, tmpl_rules_t const *t_rules, UNUSED CONF_ITEM *ci,
2353  call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
2354 {
2355  rlm_ldap_t const *inst = talloc_get_type_abort_const(cec->mi->data, rlm_ldap_t);
2356  char const *filters[] = { inst->group.obj_filter, inst->group.obj_membership_filter };
2357  tmpl_t *parsed;
2358 
2359  if (fr_ldap_filter_to_tmpl(ctx, t_rules, filters, NUM_ELEMENTS(filters), &parsed) < 0) return -1;
2360 
2361  *(void **)out = parsed;
2362  return 0;
2363 }
2364 
2365 /** Clean up thread specific data structure
2366  *
2367  */
2368 static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
2369 {
2370  fr_ldap_thread_t *t = talloc_get_type_abort(mctx->thread, fr_ldap_thread_t);
2371  void **trunks_to_free;
2372  int i;
2373 
2374  if (fr_rb_flatten_inorder(NULL, &trunks_to_free, t->trunks) < 0) return -1;
2375 
2376  for (i = talloc_array_length(trunks_to_free) - 1; i >= 0; i--) talloc_free(trunks_to_free[i]);
2377  talloc_free(trunks_to_free);
2378  talloc_free(t->trunks);
2379 
2380  return 0;
2381 }
2382 
2383 /** Initialise thread specific data structure
2384  *
2385  */
2386 static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2387 {
2388  rlm_ldap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_ldap_t);
2389  fr_ldap_thread_t *t = talloc_get_type_abort(mctx->thread, fr_ldap_thread_t);
2390  fr_ldap_thread_trunk_t *ttrunk;
2391 
2392  /*
2393  * Initialise tree for connection trunks used by this thread
2394  */
2395  MEM(t->trunks = fr_rb_inline_talloc_alloc(t, fr_ldap_thread_trunk_t, node, fr_ldap_trunk_cmp, NULL));
2396 
2397  t->config = &inst->handle_config;
2398  t->trunk_conf = &inst->trunk_conf;
2399  t->bind_trunk_conf = &inst->bind_trunk_conf;
2400  t->el = mctx->el;
2401 
2402  /*
2403  * Launch trunk for module default connection
2404  */
2405  ttrunk = fr_thread_ldap_trunk_get(t, inst->handle_config.server, inst->handle_config.admin_identity,
2406  inst->handle_config.admin_password, NULL, &inst->handle_config);
2407  if (!ttrunk) {
2408  ERROR("Unable to launch LDAP trunk");
2409  return -1;
2410  }
2411 
2412  /*
2413  * Set up a per-thread LDAP trunk to use for bind auths
2414  */
2415  t->bind_trunk = fr_thread_ldap_bind_trunk_get(t);
2416 
2417  MEM(t->binds = fr_rb_inline_talloc_alloc(t, fr_ldap_bind_auth_ctx_t, node, fr_ldap_bind_auth_cmp, NULL));
2418 
2419  return 0;
2420 }
2421 
2422 /** Instantiate the module
2423  *
2424  * Creates a new instance of the module reading parameters from a configuration section.
2425  *
2426  * @param [in] mctx configuration data.
2427  * @return
2428  * - 0 on success.
2429  * - < 0 on failure.
2430  */
2431 static int mod_instantiate(module_inst_ctx_t const *mctx)
2432 {
2433  size_t i;
2434 
2435  CONF_SECTION *options;
2436  rlm_ldap_boot_t const *boot = talloc_get_type_abort(mctx->mi->boot, rlm_ldap_boot_t);
2437  rlm_ldap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_ldap_t);
2438  CONF_SECTION *conf = mctx->mi->conf;
2439 
2440  inst->mi = mctx->mi; /* Cached for IO callbacks */
2441  inst->group.da = boot->group_da;
2442  inst->group.cache_da = boot->cache_da;
2443 
2444  inst->handle_config.name = talloc_typed_asprintf(inst, "rlm_ldap (%s)", mctx->mi->name);
2445 
2446  /*
2447  * Trunks used for bind auth can only have one request in flight per connection.
2448  */
2449  inst->bind_trunk_conf.target_req_per_conn = 1;
2450  inst->bind_trunk_conf.max_req_per_conn = 1;
2451 
2452  /*
2453  * Set sizes for trunk request pool.
2454  */
2455  inst->bind_trunk_conf.req_pool_headers = 2;
2456  inst->bind_trunk_conf.req_pool_size = sizeof(fr_ldap_bind_auth_ctx_t) + sizeof(fr_ldap_sasl_ctx_t);
2457 
2458  options = cf_section_find(conf, "options", NULL);
2459  if (!options || !cf_pair_find(options, "chase_referrals")) {
2460  inst->handle_config.chase_referrals_unset = true; /* use OpenLDAP defaults */
2461  }
2462 
2463  /*
2464  * If the configuration parameters can't be parsed, then fail.
2465  */
2466  if ((parse_sub_section(mctx, conf, &inst->accounting, "accounting") < 0) ||
2467  (parse_sub_section(mctx, conf, &inst->postauth, "post-auth") < 0)) {
2468  cf_log_err(conf, "Failed parsing configuration");
2469 
2470  goto error;
2471  }
2472 
2473  /*
2474  * Sanity checks for cacheable groups code.
2475  */
2476  if (inst->group.cacheable_name && inst->group.obj_membership_filter) {
2477  if (!inst->group.obj_name_attr) {
2478  cf_log_err(conf, "Configuration item 'group.name_attribute' must be set if cacheable "
2479  "group names are enabled");
2480 
2481  goto error;
2482  }
2483  }
2484 
2485  /*
2486  * If we have a *pair* as opposed to a *section*
2487  * then the module is referencing another ldap module's
2488  * connection pool.
2489  */
2490  if (!cf_pair_find(conf, "pool")) {
2491  if (!inst->handle_config.server_str) {
2492  cf_log_err(conf, "Configuration item 'server' must have a value");
2493  goto error;
2494  }
2495  }
2496 
2497 #ifndef WITH_SASL
2498  if (inst->handle_config.admin_sasl.mech) {
2499  cf_log_err(conf, "Configuration item 'sasl.mech' not supported. "
2500  "Linked libldap does not provide ldap_sasl_interactive_bind function");
2501  goto error;
2502  }
2503 #endif
2504 
2505  /*
2506  * Initialise server with zero length string to
2507  * make code below simpler.
2508  */
2509  inst->handle_config.server = talloc_strdup(inst, "");
2510 
2511  /*
2512  * Now iterate over all the 'server' config items
2513  */
2514  for (i = 0; i < talloc_array_length(inst->handle_config.server_str); i++) {
2515  char const *value = inst->handle_config.server_str[i];
2516  size_t j;
2517 
2518  /*
2519  * Explicitly prevent multiple server definitions
2520  * being used in the same string.
2521  */
2522  for (j = 0; j < talloc_array_length(value) - 1; j++) {
2523  switch (value[j]) {
2524  case ' ':
2525  case ',':
2526  case ';':
2527  cf_log_err(conf, "Invalid character '%c' found in 'server' configuration item",
2528  value[j]);
2529  goto error;
2530 
2531  default:
2532  continue;
2533  }
2534  }
2535 
2536  /*
2537  * Split original server value out into URI, server and port
2538  * so whatever initialization function we use later will have
2539  * the server information in the format it needs.
2540  */
2541  if (ldap_is_ldap_url(value)) {
2542  if (fr_ldap_server_url_check(&inst->handle_config, value, conf) < 0) return -1;
2543  } else
2544  /*
2545  * If it's not an URL, then just treat server as a hostname.
2546  */
2547  {
2548  if (fr_ldap_server_config_check(&inst->handle_config, value, conf) < 0) return -1;
2549  }
2550  }
2551 
2552  /*
2553  * inst->handle_config.server be unset if connection pool sharing is used.
2554  */
2555  if (inst->handle_config.server) {
2556  inst->handle_config.server[talloc_array_length(inst->handle_config.server) - 2] = '\0';
2557  DEBUG4("rlm_ldap (%s) - LDAP server string: %s", mctx->mi->name, inst->handle_config.server);
2558  }
2559 
2560  /*
2561  * Workaround for servers which support LDAPS but not START TLS
2562  */
2563  if (inst->handle_config.port == LDAPS_PORT || inst->handle_config.tls_mode) {
2564  inst->handle_config.tls_mode = LDAP_OPT_X_TLS_HARD;
2565  } else {
2566  inst->handle_config.tls_mode = 0;
2567  }
2568 
2569  /*
2570  * Convert dereference strings to enumerated constants
2571  */
2572  if (inst->handle_config.dereference_str) {
2573  inst->handle_config.dereference = fr_table_value_by_str(fr_ldap_dereference,
2574  inst->handle_config.dereference_str, -1);
2575  if (inst->handle_config.dereference < 0) {
2576  cf_log_err(conf, "Invalid 'dereference' value \"%s\", expected 'never', 'searching', "
2577  "'finding' or 'always'", inst->handle_config.dereference_str);
2578  goto error;
2579  }
2580  }
2581 
2582  /*
2583  * Build the server side sort control for user objects
2584  */
2585  if (inst->user.obj_sort_by) {
2586  LDAPSortKey **keys;
2587  int ret;
2588 
2589  ret = ldap_create_sort_keylist(&keys, UNCONST(char *, inst->user.obj_sort_by));
2590  if (ret != LDAP_SUCCESS) {
2591  cf_log_err(conf, "Invalid user.sort_by value \"%s\": %s",
2592  inst->user.obj_sort_by, ldap_err2string(ret));
2593  goto error;
2594  }
2595 
2596  /*
2597  * Always set the control as critical, if it's not needed
2598  * the user can comment it out...
2599  */
2600  ret = ldap_create_sort_control(ldap_global_handle, keys, 1, &inst->user.obj_sort_ctrl);
2601  ldap_free_sort_keylist(keys);
2602  if (ret != LDAP_SUCCESS) {
2603  ERROR("Failed creating server sort control: %s", ldap_err2string(ret));
2604  goto error;
2605  }
2606  }
2607 
2608  if (inst->handle_config.tls_require_cert_str) {
2609  /*
2610  * Convert cert strictness to enumerated constants
2611  */
2612  inst->handle_config.tls_require_cert = fr_table_value_by_str(fr_ldap_tls_require_cert,
2613  inst->handle_config.tls_require_cert_str, -1);
2614  if (inst->handle_config.tls_require_cert < 0) {
2615  cf_log_err(conf, "Invalid 'tls.require_cert' value \"%s\", expected 'never', "
2616  "'demand', 'allow', 'try' or 'hard'", inst->handle_config.tls_require_cert_str);
2617  goto error;
2618  }
2619  }
2620 
2621  if (inst->handle_config.tls_min_version_str) {
2622  if (strcmp(inst->handle_config.tls_min_version_str, "1.2") == 0) {
2623  inst->handle_config.tls_min_version = LDAP_OPT_X_TLS_PROTOCOL_TLS1_2;
2624 
2625  } else if (strcmp(inst->handle_config.tls_min_version_str, "1.1") == 0) {
2626  inst->handle_config.tls_min_version = LDAP_OPT_X_TLS_PROTOCOL_TLS1_1;
2627 
2628  } else if (strcmp(inst->handle_config.tls_min_version_str, "1.0") == 0) {
2629  inst->handle_config.tls_min_version = LDAP_OPT_X_TLS_PROTOCOL_TLS1_0;
2630 
2631  } else {
2632  cf_log_err(conf, "Invalid 'tls.tls_min_version' value \"%s\"", inst->handle_config.tls_min_version_str);
2633  goto error;
2634  }
2635  }
2636 
2637  return 0;
2638 
2639 error:
2640  return -1;
2641 }
2642 
2643 /** Bootstrap the module
2644  *
2645  * Define attributes.
2646  *
2647  * @param[in] mctx configuration data.
2648  * @return
2649  * - 0 on success.
2650  * - < 0 on failure.
2651  */
2652 static int mod_bootstrap(module_inst_ctx_t const *mctx)
2653 {
2654  rlm_ldap_boot_t *boot = talloc_get_type_abort(mctx->mi->boot, rlm_ldap_boot_t);
2655  rlm_ldap_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_ldap_t);
2656  CONF_SECTION *conf = mctx->mi->conf;
2657  char buffer[256];
2658  char const *group_attribute;
2659  xlat_t *xlat;
2660 
2661  if (inst->group.attribute) {
2662  group_attribute = inst->group.attribute;
2663  } else if (cf_section_name2(conf)) {
2664  snprintf(buffer, sizeof(buffer), "%s-LDAP-Group", mctx->mi->name);
2665  group_attribute = buffer;
2666  } else {
2667  group_attribute = "LDAP-Group";
2668  }
2669 
2670  boot->group_da = fr_dict_attr_by_name(NULL, fr_dict_root(dict_freeradius), group_attribute);
2671 
2672  /*
2673  * If the group attribute was not in the dictionary, create it
2674  */
2675  if (!boot->group_da) {
2676  if (fr_dict_attr_add_name_only(fr_dict_unconst(dict_freeradius), fr_dict_root(dict_freeradius),
2677  group_attribute, FR_TYPE_STRING, NULL) < 0) {
2678  PERROR("Error creating group attribute");
2679  return -1;
2680 
2681  }
2682  boot->group_da = fr_dict_attr_by_name(NULL, fr_dict_root(dict_freeradius), group_attribute);
2683  }
2684 
2685  /*
2686  * Setup the cache attribute
2687  */
2688 
2689  if (inst->group.cache_attribute) {
2690  boot->cache_da = fr_dict_attr_by_name(NULL, fr_dict_root(dict_freeradius), inst->group.cache_attribute);
2691  if (!boot->cache_da) {
2692  if (fr_dict_attr_add_name_only(fr_dict_unconst(dict_freeradius), fr_dict_root(dict_freeradius),
2693  inst->group.cache_attribute, FR_TYPE_STRING, NULL) < 0) {
2694  PERROR("Error creating cache attribute");
2695  return -1;
2696  }
2697  boot->cache_da = fr_dict_attr_by_name(NULL, fr_dict_root(dict_freeradius), inst->group.cache_attribute);
2698  }
2699  } else {
2700  boot->cache_da = boot->group_da; /* Default to the group_da */
2701  }
2702 
2703  xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, NULL, ldap_xlat, FR_TYPE_STRING);
2704  xlat_func_args_set(xlat, ldap_xlat_arg);
2705 
2706  if (unlikely(!(xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, "group", ldap_group_xlat,
2707  FR_TYPE_BOOL)))) return -1;
2708  xlat_func_args_set(xlat, ldap_group_xlat_arg);
2709  xlat_func_call_env_set(xlat, &xlat_memberof_method_env);
2710 
2711  if (unlikely(!(xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, "profile", ldap_profile_xlat,
2712  FR_TYPE_BOOL)))) return -1;
2713  xlat_func_args_set(xlat, ldap_xlat_arg);
2714  xlat_func_call_env_set(xlat, &xlat_profile_method_env);
2715 
2716  map_proc_register(mctx->mi->boot, inst, mctx->mi->name, mod_map_proc, ldap_map_verify, 0, LDAP_URI_SAFE_FOR);
2717 
2718  return 0;
2719 }
2720 
2721 static int mod_load(void)
2722 {
2723  xlat_t *xlat;
2724 
2725  if (unlikely(!(xlat = xlat_func_register(NULL, "ldap.uri.escape", ldap_uri_escape_xlat, FR_TYPE_STRING)))) return -1;
2726  xlat_func_args_set(xlat, ldap_uri_escape_xlat_arg);
2727  xlat_func_flags_set(xlat, XLAT_FUNC_FLAG_PURE);
2728  xlat_func_safe_for_set(xlat, LDAP_URI_SAFE_FOR); /* Used for all LDAP escaping */
2729 
2730  if (unlikely(!(xlat = xlat_func_register(NULL, "ldap.uri.safe", xlat_transparent, FR_TYPE_STRING)))) return -1;
2731  xlat_func_args_set(xlat, ldap_safe_xlat_arg);
2732  xlat_func_flags_set(xlat, XLAT_FUNC_FLAG_PURE);
2733  xlat_func_safe_for_set(xlat, LDAP_URI_SAFE_FOR);
2734 
2735  if (unlikely(!(xlat = xlat_func_register(NULL, "ldap.uri.unescape", ldap_uri_unescape_xlat, FR_TYPE_STRING)))) return -1;
2736  xlat_func_args_set(xlat, ldap_uri_unescape_xlat_arg);
2737  xlat_func_flags_set(xlat, XLAT_FUNC_FLAG_PURE);
2738 
2739  return 0;
2740 }
2741 
2742 static void mod_unload(void)
2743 {
2744  xlat_func_unregister("ldap.uri.escape");
2745  xlat_func_unregister("ldap.uri.safe");
2746  xlat_func_unregister("ldap.uri.unescape");
2747 }
2748 
2749 /* globally exported name */
2750 extern module_rlm_t rlm_ldap;
2751 module_rlm_t rlm_ldap = {
2752  .common = {
2753  .magic = MODULE_MAGIC_INIT,
2754  .name = "ldap",
2755  .flags = 0,
2756  .boot_size = sizeof(rlm_ldap_boot_t),
2757  .boot_type = "rlm_ldap_boot_t",
2758  .inst_size = sizeof(rlm_ldap_t),
2759  .config = module_config,
2760  .onload = mod_load,
2761  .unload = mod_unload,
2762  .bootstrap = mod_bootstrap,
2763  .instantiate = mod_instantiate,
2764  .detach = mod_detach,
2765  .thread_inst_size = sizeof(fr_ldap_thread_t),
2766  .thread_inst_type = "fr_ldap_thread_t",
2767  .thread_instantiate = mod_thread_instantiate,
2768  .thread_detach = mod_thread_detach,
2769  },
2770  .method_group = {
2771  .bindings = (module_method_binding_t[]){
2772  /*
2773  * Hack to support old configurations
2774  */
2775  { .section = SECTION_NAME("accounting", CF_IDENT_ANY), .method = mod_accounting, .method_env = &usermod_method_env },
2776  { .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &authenticate_method_env },
2777  { .section = SECTION_NAME("authorize", CF_IDENT_ANY), .method = mod_authorize, .method_env = &authorize_method_env },
2778 
2779  { .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &authorize_method_env },
2780  { .section = SECTION_NAME("send", CF_IDENT_ANY), .method = mod_post_auth, .method_env = &usermod_method_env },
2781  MODULE_BINDING_TERMINATOR
2782  }
2783  }
2784 };
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition: action.h:35
UNLANG_ACTION_PUSHED_CHILD
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
Definition: action.h:39
UNLANG_ACTION_FAIL
@ UNLANG_ACTION_FAIL
Encountered an unexpected error.
Definition: action.h:36
UNLANG_ACTION_CALCULATE_RESULT
@ UNLANG_ACTION_CALCULATE_RESULT
Calculate a new section rlm_rcode_t value.
Definition: action.h:37
buffer
static int const char char buffer[256]
Definition: acutest.h:574
msg
log_entry msg
Definition: acutest.h:794
UNCONST
#define UNCONST(_type, _ptr)
Remove const qualification from a pointer.
Definition: build.h:165
USES_APPLE_DEPRECATED_API
#define USES_APPLE_DEPRECATED_API
Definition: build.h:468
RCSID
#define RCSID(id)
Definition: build.h:481
L
#define L(_str)
Helper for initialising arrays of string literals.
Definition: build.h:207
FALL_THROUGH
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition: build.h:320
unlikely
#define unlikely(_x)
Definition: build.h:379
UNUSED
#define UNUSED
Definition: build.h:313
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition: build.h:335
call_env_parsed_free
void call_env_parsed_free(call_env_parsed_head_t *parsed, call_env_parsed_t *ptr)
Remove a call_env_parsed_t from the list of parsed call envs.
Definition: call_env.c:718
call_env_parsed_add
call_env_parsed_t * call_env_parsed_add(TALLOC_CTX *ctx, call_env_parsed_head_t *head, call_env_parser_t const *rule)
Allocate a new call_env_parsed_t structure and add it to the list of parsed call envs.
Definition: call_env.c:631
call_env_parsed_set_data
void call_env_parsed_set_data(call_env_parsed_t *parsed, void const *data)
Assign data to a call_env_parsed_t.
Definition: call_env.c:688
call_env_parsed_set_value
void call_env_parsed_set_value(call_env_parsed_t *parsed, fr_value_box_t const *vb)
Assign a value box to a call_env_parsed_t.
Definition: call_env.c:674
call_env_parsed_s
Definition: call_env.c:42
CALL_ENV_TERMINATOR
#define CALL_ENV_TERMINATOR
Definition: call_env.h:231
FR_CALL_ENV_PARSE_OFFSET
#define FR_CALL_ENV_PARSE_OFFSET(_name, _cast_type, _flags, _struct, _field, _parse_field)
Specify a call_env_parser_t which writes out runtime results and the result of the parsing phase to t...
Definition: call_env.h:360
FR_CALL_ENV_METHOD_OUT
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition: call_env.h:235
call_env_parser_s::uctx
void const * uctx
User context for callback functions.
Definition: call_env.h:213
FR_CALL_ENV_SUBSECTION
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition: call_env.h:397
CALL_ENV_FLAG_CONCAT
@ CALL_ENV_FLAG_CONCAT
If the tmpl produced multiple boxes they should be concatenated.
Definition: call_env.h:76
CALL_ENV_FLAG_ATTRIBUTE
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl must contain an attribute reference.
Definition: call_env.h:86
CALL_ENV_FLAG_PARSE_ONLY
@ CALL_ENV_FLAG_PARSE_ONLY
The result of parsing will not be evaluated at runtime.
Definition: call_env.h:85
CALL_ENV_FLAG_NONE
@ CALL_ENV_FLAG_NONE
Definition: call_env.h:74
CALL_ENV_FLAG_REQUIRED
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition: call_env.h:75
CALL_ENV_FLAG_PARSE_MISSING
@ CALL_ENV_FLAG_PARSE_MISSING
If this subsection is missing, still parse it.
Definition: call_env.h:88
CALL_ENV_FLAG_NULLABLE
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition: call_env.h:80
CALL_ENV_PARSE_TYPE_VALUE_BOX
@ CALL_ENV_PARSE_TYPE_VALUE_BOX
Output of the parsing phase is a single value box (static data).
Definition: call_env.h:61
CALL_ENV_PARSE_TYPE_VOID
@ CALL_ENV_PARSE_TYPE_VOID
Output of the parsing phase is undefined (a custom structure).
Definition: call_env.h:62
call_env_ctx_s::mi
module_instance_t const * mi
Module instance that the callenv is registered to.
Definition: call_env.h:224
FR_CALL_ENV_SUBSECTION_FUNC
#define FR_CALL_ENV_SUBSECTION_FUNC(_name, _name2, _flags, _func)
Specify a call_env_parser_t which parses a subsection using a callback function.
Definition: call_env.h:407
FR_CALL_ENV_OFFSET
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition: call_env.h:335
FR_CALL_ENV_PARSE_ONLY_OFFSET
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition: call_env.h:384
call_env_ctx_s
Definition: call_env.h:221
call_env_method_s
Definition: call_env.h:239
call_env_parser_s
Per method call config.
Definition: call_env.h:175
cf_reference_item
CONF_ITEM * cf_reference_item(CONF_SECTION const *parent_cs, CONF_SECTION const *outer_cs, char const *ptr)
Definition: cf_file.c:3611
cf_section_parse
int cf_section_parse(TALLOC_CTX *ctx, void *base, CONF_SECTION *cs)
Parse a configuration section into user-supplied variables.
Definition: cf_parse.c:985
cf_table_parse_int
int cf_table_parse_int(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, conf_parser_t const *rule)
Generic function for parsing conf pair values as int.
Definition: cf_parse.c:1474
CONF_PARSER_TERMINATOR
#define CONF_PARSER_TERMINATOR
Definition: cf_parse.h:627
FR_CONF_OFFSET
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition: cf_parse.h:268
cf_section_rules_push
#define cf_section_rules_push(_cs, _rule)
Definition: cf_parse.h:659
FR_CONF_POINTER
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
Definition: cf_parse.h:310
FR_CONF_OFFSET_IS_SET
#define FR_CONF_OFFSET_IS_SET(_name, _type, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct,...
Definition: cf_parse.h:282
FR_CONF_OFFSET_FLAGS
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition: cf_parse.h:256
FR_CONF_OFFSET_SUBSECTION
#define FR_CONF_OFFSET_SUBSECTION(_name, _flags, _struct, _field, _subcs)
conf_parser_t which populates a sub-struct using a CONF_SECTION
Definition: cf_parse.h:297
CONF_FLAG_MULTI
@ CONF_FLAG_MULTI
CONF_PAIR can have multiple copies.
Definition: cf_parse.h:419
CONF_FLAG_XLAT
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition: cf_parse.h:416
CONF_FLAG_SUBSECTION
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Definition: cf_parse.h:399
cf_table_parse_ctx_t
Definition: cf_parse.h:622
conf_parser_s
Defines a CONF_PAIR to C data type mapping.
Definition: cf_parse.h:564
cf_item
Common header for all CONF_* types.
Definition: cf_priv.h:49
cf_pair
Configuration AVP similar to a fr_pair_t.
Definition: cf_priv.h:70
cf_section
A section grouping multiple CONF_PAIR.
Definition: cf_priv.h:101
cf_item_is_pair
bool cf_item_is_pair(CONF_ITEM const *ci)
Determine if CONF_ITEM is a CONF_PAIR.
Definition: cf_util.c:632
cf_item_to_pair
CONF_PAIR * cf_item_to_pair(CONF_ITEM const *ci)
Cast a CONF_ITEM to a CONF_PAIR.
Definition: cf_util.c:664
cf_pair_attr
char const * cf_pair_attr(CONF_PAIR const *pair)
Return the attr of a CONF_PAIR.
Definition: cf_util.c:1578
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition: cf_util.c:1028
cf_pair_find
CONF_PAIR * cf_pair_find(CONF_SECTION const *cs, char const *attr)
Search for a CONF_PAIR with a specific name.
Definition: cf_util.c:1439
cf_section_name2
char const * cf_section_name2(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition: cf_util.c:1185
cf_pair_value
char const * cf_pair_value(CONF_PAIR const *pair)
Return the value of a CONF_PAIR.
Definition: cf_util.c:1594
cf_pair_operator
fr_token_t cf_pair_operator(CONF_PAIR const *pair)
Return the operator of a pair.
Definition: cf_util.c:1608
cf_item_to_section
CONF_SECTION * cf_item_to_section(CONF_ITEM const *ci)
Cast a CONF_ITEM to a CONF_SECTION.
Definition: cf_util.c:684
cf_pair_value_quote
fr_token_t cf_pair_value_quote(CONF_PAIR const *pair)
Return the value (rhs) quoting of a pair.
Definition: cf_util.c:1638
cf_item_is_section
bool cf_item_is_section(CONF_ITEM const *ci)
Determine if CONF_ITEM is a CONF_SECTION.
Definition: cf_util.c:618
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition: cf_util.h:289
cf_item_next
#define cf_item_next(_ci, _curr)
Definition: cf_util.h:92
CF_IDENT_ANY
#define CF_IDENT_ANY
Definition: cf_util.h:78
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition: dcursor.h:406
uctx
fr_dcursor_eval_t void const * uctx
Definition: dcursor.h:546
fr_dcursor_s
Definition: dcursor.h:93
ERROR
#define ERROR(fmt,...)
Definition: dhcpclient.c:41
fr_dict_attr_add_name_only
int fr_dict_attr_add_name_only(fr_dict_t *dict, fr_dict_attr_t const *parent, char const *name, fr_type_t type, fr_dict_attr_flags_t const *flags))
Add an attribute to the dictionary.
Definition: dict_util.c:1738
fr_dict_attr_by_name
fr_dict_attr_t const * fr_dict_attr_by_name(fr_dict_attr_err_t *err, fr_dict_attr_t const *parent, char const *attr))
Locate a fr_dict_attr_t by its name.
Definition: dict_util.c:3263
fr_dict_attr_autoload_t::out
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
Definition: dict.h:267
fr_dict_autoload_t::out
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
Definition: dict.h:280
fr_dict_root
fr_dict_attr_t const * fr_dict_root(fr_dict_t const *dict)
Return the root attribute of a dictionary.
Definition: dict_util.c:2400
fr_dict_unconst
fr_dict_t * fr_dict_unconst(fr_dict_t const *dict)
Coerce to non-const.
Definition: dict_util.c:4585
in
static fr_slen_t in
Definition: dict.h:821
fr_dict_attr_autoload_t
Specifies an attribute which must be present for the module to function.
Definition: dict.h:266
fr_dict_autoload_t
Specifies a dictionary which must be loaded/loadable for the module to function.
Definition: dict.h:279
value
Test enumeration values.
Definition: dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition: dl_module.h:63
fr_event_timer_in
#define fr_event_timer_in(...)
Definition: event.h:255
unlang_function_push
#define unlang_function_push(_request, _func, _repeat, _signal, _sigmask, _top_frame, _uctx)
Push a generic function onto the unlang stack.
Definition: function.h:111
GLOBAL_LIB_TERMINATOR
#define GLOBAL_LIB_TERMINATOR
Definition: global_lib.h:51
global_lib_autoinst_t
Structure to define how to initialise libraries with global configuration.
Definition: global_lib.h:38
ldap_uri_escape_xlat
static xlat_action_t ldap_uri_escape_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, UNUSED xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Escape LDAP string.
Definition: rlm_ldap.c:409
ldap_xlat
static xlat_action_t ldap_xlat(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Expand an LDAP URL into a query, and return a string result from that query.
Definition: rlm_ldap.c:738
ldap_group_xlat
static xlat_action_t ldap_group_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Check for a user being in a LDAP group.
Definition: rlm_ldap.c:936
ldap_profile_xlat
static xlat_action_t ldap_profile_xlat(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Expand an LDAP URL into a query, applying the results using the user update map.
Definition: rlm_ldap.c:1062
ldap_uri_unescape_xlat
static xlat_action_t ldap_uri_unescape_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, UNUSED xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Unescape LDAP string.
Definition: rlm_ldap.c:464
rlm_ldap_cacheable_userobj
unlang_action_t rlm_ldap_cacheable_userobj(rlm_rcode_t *p_result, request_t *request, ldap_autz_ctx_t *autz_ctx, char const *attr)
Convert group membership information into attributes.
Definition: groups.c:443
rlm_ldap_check_userobj_dynamic
unlang_action_t rlm_ldap_check_userobj_dynamic(rlm_rcode_t *p_result, request_t *request, ldap_group_xlat_ctx_t *xlat_ctx)
Query the LDAP directory to check if a user object is a member of a group.
Definition: groups.c:1117
rlm_ldap_check_cached
unlang_action_t rlm_ldap_check_cached(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request, fr_value_box_t const *check)
Check group membership attributes to see if a user is a member.
Definition: groups.c:1155
rlm_ldap_cacheable_groupobj
unlang_action_t rlm_ldap_cacheable_groupobj(rlm_rcode_t *p_result, request_t *request, ldap_autz_ctx_t *autz_ctx)
Convert group membership information into attributes.
Definition: groups.c:700
rlm_ldap_check_groupobj_dynamic
unlang_action_t rlm_ldap_check_groupobj_dynamic(rlm_rcode_t *p_result, request_t *request, ldap_group_xlat_ctx_t *xlat_ctx)
Initiate an LDAP search to determine group membership, querying group objects.
Definition: groups.c:786
unlang_interpret_event_list
fr_event_list_t * unlang_interpret_event_list(request_t *request)
Get the event list for the current interpreter.
Definition: interpret.c:1764
unlang_interpret_mark_runnable
void unlang_interpret_mark_runnable(request_t *request)
Mark a request as resumable.
Definition: interpret.c:1359
unlang_interpret_frame_talloc_ctx
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
Definition: interpret.c:1403
UNLANG_SUB_FRAME
#define UNLANG_SUB_FRAME
Definition: interpret.h:36
fr_ldap_map_verify
int fr_ldap_map_verify(map_t *map, void *instance)
fr_ldap_uri_unescape_func
size_t fr_ldap_uri_unescape_func(UNUSED request_t *request, char *out, size_t outlen, char const *in, UNUSED void *arg))
Converts escaped DNs and filter strings into normal.
Definition: util.c:164
fr_ldap_util_normalise_dn
size_t fr_ldap_util_normalise_dn(char *out, char const *in)
Normalise escape sequences in a DN.
Definition: util.c:439
fr_ldap_map_getvalue
int fr_ldap_map_getvalue(TALLOC_CTX *ctx, fr_pair_list_t *out, request_t *request, map_t const *map, void *uctx)
Callback for map_to_request.
Definition: map.c:39
fr_ldap_uri_escape_func
size_t fr_ldap_uri_escape_func(UNUSED request_t *request, char *out, size_t outlen, char const *in, UNUSED void *arg))
Converts "bad" strings into ones which are safe for LDAP.
Definition: util.c:70
fr_ldap_filter_to_tmpl
int fr_ldap_filter_to_tmpl(TALLOC_CTX *ctx, tmpl_rules_t const *t_rules, char const **sub, size_t sublen, tmpl_t **out))
Combine filters and tokenize to a tmpl.
Definition: util.c:517
fr_ldap_result_t::values
struct berval ** values
libldap struct containing bv_val (char *) and length bv_len.
Definition: base.h:361
fr_ldap_query_s::serverctrls
fr_ldap_control_t serverctrls[LDAP_MAX_CONTROLS]
Server controls specific to this query.
Definition: base.h:450
fr_ldap_config_t::res_timeout
fr_time_delta_t res_timeout
How long we wait for results.
Definition: base.h:298
fr_ldap_config_t::admin_password
char const * admin_password
Password used in administrative bind.
Definition: base.h:231
fr_ldap_thread_t::config
fr_ldap_config_t * config
Module instance config.
Definition: base.h:383
fr_ldap_map_exp_t::count
int count
Index on next free element.
Definition: base.h:375
fr_ldap_query_s::ev
fr_event_timer_t const * ev
Event for timing out the query.
Definition: base.h:459
fr_ldap_util_is_dn
bool fr_ldap_util_is_dn(char const *in, size_t inlen)
Check whether a string looks like a DN.
Definition: util.c:211
fr_ldap_config_t::server
char * server
Initial server to bind to.
Definition: base.h:224
fr_ldap_bind_auth_cmp
static int8_t fr_ldap_bind_auth_cmp(void const *one, void const *two)
Compare two ldap bind auth structures on msgid.
Definition: base.h:724
fr_ldap_connection_t::handle
LDAP * handle
libldap handle.
Definition: base.h:333
fr_thread_ldap_trunk_get
fr_ldap_thread_trunk_t * fr_thread_ldap_trunk_get(fr_ldap_thread_t *thread, char const *uri, char const *bind_dn, char const *bind_password, request_t *request, fr_ldap_config_t const *config)
Find a thread specific LDAP connection for a specific URI / bind DN.
Definition: connection.c:918
fr_ldap_config_t::admin_identity
char const * admin_identity
Identity we bind as when we need to query the LDAP directory.
Definition: base.h:229
fr_ldap_query_s::ret
fr_ldap_result_code_t ret
Result code.
Definition: base.h:470
fr_ldap_control_t::freeit
bool freeit
Whether the control should be freed after we've finished using it.
Definition: base.h:136
fr_ldap_thread_t::trunks
fr_rb_tree_t * trunks
Tree of LDAP trunks used by this thread.
Definition: base.h:382
fr_ldap_thread_t::trunk_conf
trunk_conf_t * trunk_conf
Module trunk config.
Definition: base.h:384
fr_ldap_query_s::treq
trunk_request_t * treq
Trunk request this query is associated with.
Definition: base.h:456
fr_ldap_url_err_to_str
char const * fr_ldap_url_err_to_str(int ldap_url_err)
Translate the error code emitted from ldap_url_parse and friends into something accessible with fr_st...
Definition: util.c:742
fr_ldap_server_url_check
int fr_ldap_server_url_check(fr_ldap_config_t *handle_config, char const *server, CONF_SECTION const *cs)
Check an LDAP server entry in URL format is valid.
Definition: util.c:605
fr_ldap_result_t::count
int count
Number of values.
Definition: base.h:363
LDAP_MAX_ATTRMAP
#define LDAP_MAX_ATTRMAP
Maximum number of mappings between LDAP and.
Definition: base.h:96
fr_ldap_box_escape
int fr_ldap_box_escape(fr_value_box_t *vb, UNUSED void *uctx)
Definition: util.c:110
fr_ldap_trunk_cmp
static int8_t fr_ldap_trunk_cmp(void const *one, void const *two)
Compare two ldap trunk structures on connection URI / DN.
Definition: base.h:695
fr_ldap_server_config_check
int fr_ldap_server_config_check(fr_ldap_config_t *handle_config, char const *server, CONF_SECTION *cs)
Check an LDAP server config in server:port format is valid.
Definition: util.c:701
fr_ldap_berval_to_string
char * fr_ldap_berval_to_string(TALLOC_CTX *ctx, struct berval const *in)
Convert a berval to a talloced string.
Definition: util.c:390
fr_ldap_query_s::ldap_conn
fr_ldap_connection_t * ldap_conn
LDAP connection this query is running on.
Definition: base.h:457
fr_thread_ldap_bind_trunk_get
fr_ldap_thread_trunk_t * fr_thread_ldap_bind_trunk_get(fr_ldap_thread_t *thread)
Find the thread specific trunk to use for LDAP bind auths.
Definition: connection.c:1295
fr_ldap_result_code_t
fr_ldap_result_code_t
LDAP query result codes.
Definition: base.h:188
LDAP_RESULT_TIMEOUT
@ LDAP_RESULT_TIMEOUT
The query timed out.
Definition: base.h:192
LDAP_RESULT_SUCCESS
@ LDAP_RESULT_SUCCESS
Successfully got LDAP results.
Definition: base.h:190
LDAP_RESULT_NO_RESULT
@ LDAP_RESULT_NO_RESULT
No results returned.
Definition: base.h:194
LDAP_RESULT_BAD_DN
@ LDAP_RESULT_BAD_DN
The requested DN does not exist.
Definition: base.h:193
fr_ldap_map_expand
int fr_ldap_map_expand(TALLOC_CTX *ctx, fr_ldap_map_exp_t *expanded, request_t *request, map_list_t const *maps, char const *generic_attr)
Expand values in an attribute map where needed.
Definition: map.c:271
LDAP_MAX_CONTROLS
#define LDAP_MAX_CONTROLS
Maximum number of client/server controls.
Definition: base.h:94
fr_ldap_thread_t::bind_trunk_conf
trunk_conf_t * bind_trunk_conf
Trunk config for bind auth trunk.
Definition: base.h:385
LDAP_VIRTUAL_DN_ATTR
#define LDAP_VIRTUAL_DN_ATTR
'Virtual' attribute which maps to the DN of the object.
Definition: base.h:113
fr_ldap_parse_url_extensions
int fr_ldap_parse_url_extensions(LDAPControl **sss, size_t sss_len, char *extensions[])
Parse a subset (just server side sort for now) of LDAP URL extensions.
Definition: util.c:309
fr_ldap_query_s::result
LDAPMessage * result
Head of LDAP results list.
Definition: base.h:468
fr_ldap_thread_t::el
fr_event_list_t * el
Thread event list for callbacks / timeouts.
Definition: base.h:386
fr_ldap_control_t::control
LDAPControl * control
LDAP control.
Definition: base.h:135
fr_ldap_map_do
int fr_ldap_map_do(request_t *request, char const *valuepair_attr, fr_ldap_map_exp_t const *expanded, LDAPMessage *entry)
Convert attribute map into valuepairs.
Definition: map.c:323
fr_ldap_edir_get_password
unlang_action_t fr_ldap_edir_get_password(request_t *request, char const *dn, fr_ldap_thread_trunk_t *ttrunk, fr_dict_attr_t const *password_da)
Initiate retrieval of the universal password from Novell eDirectory.
Definition: edir.c:295
fr_ldap_map_exp_t::attrs
char const * attrs[LDAP_MAX_ATTRMAP+LDAP_MAP_RESERVED+1]
Reserve some space for access attributes.
Definition: base.h:372
fr_ldap_thread_t::bind_trunk
fr_ldap_thread_trunk_t * bind_trunk
LDAP trunk used for bind auths.
Definition: base.h:387
fr_ldap_bind_auth_async
unlang_action_t fr_ldap_bind_auth_async(request_t *request, fr_ldap_thread_t *thread, char const *bind_dn, char const *password)
Initiate an async LDAP bind for authentication.
Definition: bind.c:319
fr_ldap_thread_trunk_s::trunk
trunk_t * trunk
Connection trunk.
Definition: base.h:405
fr_ldap_map_exp_t::ctx
TALLOC_CTX * ctx
Context to allocate new attributes in.
Definition: base.h:374
fr_ldap_thread_t::binds
fr_rb_tree_t * binds
Tree of outstanding bind auths.
Definition: base.h:388
fr_ldap_query_s::ldap_url
LDAPURLDesc * ldap_url
parsed URL for current query if the source of the query was a URL.
Definition: base.h:426
fr_ldap_bind_auth_ctx_t
Holds arguments for async bind auth requests.
Definition: base.h:613
fr_ldap_config_t
Connection configuration.
Definition: base.h:221
fr_ldap_connection_t
Tracks the state of a libldap connection handle.
Definition: base.h:332
fr_ldap_map_exp_t
Result of expanding the RHS of a set of maps.
Definition: base.h:370
fr_ldap_query_s
LDAP query structure.
Definition: base.h:422
fr_ldap_result_t
Contains a collection of values.
Definition: base.h:360
fr_ldap_sasl_ctx_t
Holds arguments for the async SASL bind operation.
Definition: base.h:506
fr_ldap_thread_t
Thread specific structure to manage LDAP trunk connections.
Definition: base.h:381
fr_ldap_thread_trunk_s
Thread LDAP trunk structure.
Definition: base.h:399
FR_LDAP_COMMON_CONF
#define FR_LDAP_COMMON_CONF(_conf)
Definition: conf.h:19
ldap_global_handle
LDAP * ldap_global_handle
Hack for OpenLDAP libldap global initialisation.
Definition: base.c:39
fr_ldap_handle_thread_local
LDAP * fr_ldap_handle_thread_local(void)
Get a thread local dummy LDAP handle.
Definition: base.c:1105
fr_ldap_scope_len
size_t fr_ldap_scope_len
Definition: base.c:75
fr_libldap_global_config
global_lib_autoinst_t fr_libldap_global_config
Definition: base.c:134
fr_ldap_trunk_modify
unlang_action_t fr_ldap_trunk_modify(TALLOC_CTX *ctx, fr_ldap_query_t **out, request_t *request, fr_ldap_thread_trunk_t *ttrunk, char const *dn, LDAPMod *mods[], LDAPControl **serverctrls, LDAPControl **clientctrls)
Run an async modification LDAP query on a trunk connection.
Definition: base.c:754
fr_ldap_tls_require_cert
fr_table_num_sorted_t const fr_ldap_tls_require_cert[]
Definition: base.c:77
fr_ldap_dereference
fr_table_num_sorted_t const fr_ldap_dereference[]
Definition: base.c:86
fr_ldap_search_alloc
fr_ldap_query_t * fr_ldap_search_alloc(TALLOC_CTX *ctx, char const *base_dn, int scope, char const *filter, char const *const *attrs, LDAPControl **serverctrls, LDAPControl **clientctrls)
Allocate a new search object.
Definition: base.c:1026
fr_ldap_trunk_search
unlang_action_t fr_ldap_trunk_search(TALLOC_CTX *ctx, fr_ldap_query_t **out, request_t *request, fr_ldap_thread_trunk_t *ttrunk, char const *base_dn, int scope, char const *filter, char const *const *attrs, LDAPControl **serverctrls, LDAPControl **clientctrls)
Run an async search LDAP query on a trunk connection.
Definition: base.c:708
fr_ldap_scope
fr_table_num_sorted_t const fr_ldap_scope[]
Definition: base.c:69
PERROR
#define PERROR(_fmt,...)
Definition: log.h:228
REXDENT
#define REXDENT()
Exdent (unindent) R* messages by one level.
Definition: log.h:443
ROPTIONAL
#define ROPTIONAL(_l_request, _l_global, _fmt,...)
Use different logging functions depending on whether request is NULL or not.
Definition: log.h:528
RWDEBUG
#define RWDEBUG(fmt,...)
Definition: log.h:361
RDEBUG_ENABLED3
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
Definition: log.h:335
RDEBUG3
#define RDEBUG3(fmt,...)
Definition: log.h:343
RERROR
#define RERROR(fmt,...)
Definition: log.h:298
DEBUG4
#define DEBUG4(_fmt,...)
Definition: log.h:267
RPERROR
#define RPERROR(fmt,...)
Definition: log.h:302
RPEDEBUG
#define RPEDEBUG(fmt,...)
Definition: log.h:376
RINDENT
#define RINDENT()
Indent R* messages by one level.
Definition: log.h:430
map_afrom_cs
int map_afrom_cs(TALLOC_CTX *ctx, map_list_t *out, CONF_SECTION *cs, tmpl_rules_t const *lhs_rules, tmpl_rules_t const *rhs_rules, map_validate_t validate, void *uctx, unsigned int max)
Convert a config section into an attribute map.
Definition: map.c:1014
map_to_request
int map_to_request(request_t *request, map_t const *map, radius_map_getvalue_t func, void *ctx)
Convert map_t to fr_pair_t (s) and add them to a request_t.
Definition: map.c:1781
talloc_free
talloc_free(reap)
fr_event_list
Stores all information relating to an event list.
Definition: event.c:411
map_proc_register
int map_proc_register(TALLOC_CTX *ctx, void const *mod_inst, char const *name, map_proc_func_t evaluate, map_proc_instantiate_t instantiate, size_t inst_size, fr_value_box_safe_for_t literals_safe_for)
Register a map processor.
Definition: map_proc.c:131
FR_TYPE_TLV
@ FR_TYPE_TLV
Contains nested attributes.
Definition: merged_model.c:118
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition: merged_model.c:83
FR_TYPE_BOOL
@ FR_TYPE_BOOL
A truth value.
Definition: merged_model.c:95
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition: merged_model.c:84
ssize_t
long int ssize_t
Definition: merged_model.c:24
xlat_eval
ssize_t xlat_eval(char *out, size_t outlen, request_t *request, char const *fmt, xlat_escape_legacy_t escape, void const *escape_ctx)
Definition: merged_model.c:215
fr_dict_attr_t
Definition: merged_model.c:133
fr_dict_t
Definition: merged_model.c:198
fr_sbuff_t
Definition: merged_model.c:37
fr_value_box_t
Definition: merged_model.c:136
request_t
Definition: merged_model.c:210
tmpl_t
Definition: merged_model.c:225
module_ctx_t::env_data
void * env_data
Per call environment data.
Definition: module_ctx.h:44
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition: module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition: module_ctx.h:43
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition: module_ctx.h:68
module_detach_ctx_t::mi
module_instance_t * mi
Module instance to detach.
Definition: module_ctx.h:57
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition: module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition: module_ctx.h:64
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition: module_ctx.h:51
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition: module_ctx.h:41
module_detach_ctx_t
Temporary structure to hold arguments for detach calls.
Definition: module_ctx.h:56
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition: module_ctx.h:50
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition: module_ctx.h:63
module_rlm_xlat_register
xlat_t * module_rlm_xlat_register(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Definition: module_rlm.c:257
module_rlm_s::common
module_t common
Common fields presented by all modules.
Definition: module_rlm.h:39
module_rlm_s
Definition: module_rlm.h:38
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition: pair.c:693
fr_pair_find_by_da_nested
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
Definition: pair.c:770
config
static const conf_parser_t config[]
Definition: base.c:183
rlm_ldap_map_profile
unlang_action_t rlm_ldap_map_profile(fr_ldap_result_code_t *ret, rlm_ldap_t const *inst, request_t *request, fr_ldap_thread_trunk_t *ttrunk, char const *dn, int scope, char const *filter, fr_ldap_map_exp_t const *expanded)
Search for and apply an LDAP profile.
Definition: profile.c:144
REDEBUG
#define REDEBUG(fmt,...)
Definition: radclient.h:52
RDEBUG_ENABLED2
#define RDEBUG_ENABLED2()
Definition: radclient.h:50
RDEBUG2
#define RDEBUG2(fmt,...)
Definition: radclient.h:54
RDEBUG
#define RDEBUG(fmt,...)
Definition: radclient.h:53
DEBUG2
#define DEBUG2(fmt,...)
Definition: radclient.h:43
thread_detach
static void thread_detach(UNUSED void *uctx)
Explicitly cleanup module/xlat resources.
Definition: radiusd.c:148
thread_instantiate
static int thread_instantiate(TALLOC_CTX *ctx, fr_event_list_t *el, UNUSED void *uctx)
Create module and xlat per-thread instances.
Definition: radiusd.c:131
conf
static rs_t * conf
Definition: radsniff.c:53
fr_rb_inline_talloc_alloc
#define fr_rb_inline_talloc_alloc(_ctx, _type, _field, _data_cmp, _data_free)
Allocs a red black that verifies elements are of a specific talloc type.
Definition: rb.h:246
fr_rb_flatten_inorder
int fr_rb_flatten_inorder(TALLOC_CTX *ctx, void **out[], fr_rb_tree_t *tree)
RETURN_MODULE_NOOP
#define RETURN_MODULE_NOOP
Definition: rcode.h:62
RETURN_MODULE_RCODE
#define RETURN_MODULE_RCODE(_rcode)
Definition: rcode.h:64
RETURN_MODULE_INVALID
#define RETURN_MODULE_INVALID
Definition: rcode.h:59
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition: rcode.h:40
RLM_MODULE_INVALID
@ RLM_MODULE_INVALID
The module considers the request invalid.
Definition: rcode.h:45
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition: rcode.h:43
RLM_MODULE_FAIL
@ RLM_MODULE_FAIL
Module failed, don't reply.
Definition: rcode.h:42
RLM_MODULE_DISALLOW
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
Definition: rcode.h:46
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition: rcode.h:41
RLM_MODULE_NOTFOUND
@ RLM_MODULE_NOTFOUND
User not found.
Definition: rcode.h:47
RLM_MODULE_UPDATED
@ RLM_MODULE_UPDATED
OK (pairs modified).
Definition: rcode.h:49
RLM_MODULE_NOOP
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
Definition: rcode.h:48
RLM_MODULE_HANDLED
@ RLM_MODULE_HANDLED
The module handled the request, so stop.
Definition: rcode.h:44
xlat_memberof_method_env
static const call_env_method_t xlat_memberof_method_env
Definition: rlm_ldap.c:264
mod_detach
static int mod_detach(module_detach_ctx_t const *mctx)
Detach from the LDAP server and cleanup internal state.
Definition: rlm_ldap.c:2224
mod_load
static int mod_load(void)
Definition: rlm_ldap.c:2721
ldap_profile_xlat_resume
static xlat_action_t ldap_profile_xlat_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, UNUSED request_t *request, UNUSED fr_value_box_list_t *in)
Return whether evaluating the profile was successful.
Definition: rlm_ldap.c:1034
ldap_xlat_profile_call_env_t::profile_map
map_list_t * profile_map
List of maps to apply to the profile.
Definition: rlm_ldap.c:77
REPEAT_LDAP_MEMBEROF_XLAT_RESULTS
#define REPEAT_LDAP_MEMBEROF_XLAT_RESULTS
Definition: rlm_ldap.c:856
ldap_auth_call_env_t::user_base
fr_value_box_t user_base
Definition: rlm_ldap.c:60
ldap_user_modify_ctx_t::mod_s
LDAPMod mod_s[LDAP_MAX_ATTRMAP]
Definition: rlm_ldap.c:363
profile_config
static conf_parser_t profile_config[]
Definition: rlm_ldap.c:92
ldap_map_verify
static int ldap_map_verify(CONF_SECTION *cs, UNUSED void const *mod_inst, UNUSED void *proc_inst, tmpl_t const *src, UNUSED map_list_t const *maps)
Definition: rlm_ldap.c:1190
attr_nt_password
fr_dict_attr_t const * attr_nt_password
Definition: rlm_ldap.c:320
user_modify_cancel
static void user_modify_cancel(UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
Cancel an in progress user modification.
Definition: rlm_ldap.c:1928
ldap_safe_xlat_arg
static xlat_arg_parser_t const ldap_safe_xlat_arg[]
Definition: rlm_ldap.c:400
mod_map_proc
static unlang_action_t mod_map_proc(rlm_rcode_t *p_result, void const *mod_inst, UNUSED void *proc_inst, request_t *request, fr_value_box_list_t *url, map_list_t const *maps)
Perform a search and map the result of the search to server attributes.
Definition: rlm_ldap.c:1328
ldap_auth_ctx_t::call_env
ldap_auth_call_env_t * call_env
Definition: rlm_ldap.c:351
ldap_group_xlat_results
static unlang_action_t ldap_group_xlat_results(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Run the state machine for the LDAP membership xlat.
Definition: rlm_ldap.c:866
authenticate_method_env
static const call_env_method_t authenticate_method_env
Definition: rlm_ldap.c:189
ldap_uri_escape_xlat_arg
static xlat_arg_parser_t const ldap_uri_escape_xlat_arg[]
Definition: rlm_ldap.c:395
ldap_xlat_profile_ctx_t::ret
fr_ldap_result_code_t ret
Definition: rlm_ldap.c:1026
attr_ldap_userdn
fr_dict_attr_t const * attr_ldap_userdn
Definition: rlm_ldap.c:319
rlm_ldap_lib
global_lib_autoinst_t const * rlm_ldap_lib[]
Definition: rlm_ldap.c:338
authorize_method_env
static const call_env_method_t authorize_method_env
Definition: rlm_ldap.c:213
ldap_auth_call_env_t::password
fr_value_box_t password
Definition: rlm_ldap.c:58
mod_map_resume
static unlang_action_t mod_map_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Process the results of an LDAP map query.
Definition: rlm_ldap.c:1210
ldap_uri_unescape_xlat_arg
static xlat_arg_parser_t const ldap_uri_unescape_xlat_arg[]
Definition: rlm_ldap.c:455
xlat_profile_method_env
static const call_env_method_t xlat_profile_method_env
Definition: rlm_ldap.c:290
CHECK_EXPANDED_SPACE
#define CHECK_EXPANDED_SPACE(_expanded)
ldap_map_ctx_t::maps
map_list_t const * maps
Definition: rlm_ldap.c:372
user_modify_resume
static unlang_action_t user_modify_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Take the retrieved user DN and launch the async modification.
Definition: rlm_ldap.c:1969
attr_crypt_password
fr_dict_attr_t const * attr_crypt_password
Definition: rlm_ldap.c:318
ldap_usermod_call_env_t::user_filter
fr_value_box_t user_filter
Definition: rlm_ldap.c:70
ldap_group_filter_parse
static int ldap_group_filter_parse(TALLOC_CTX *ctx, void *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
dict_freeradius
static fr_dict_t const * dict_freeradius
Definition: rlm_ldap.c:308
ldap_query_timeout
static void ldap_query_timeout(UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
Callback when LDAP query times out.
Definition: rlm_ldap.c:531
map_ctx_free
static int map_ctx_free(ldap_map_ctx_t *map_ctx)
Ensure map context is properly cleared up.
Definition: rlm_ldap.c:1303
mod_authenticate_start
static unlang_action_t mod_authenticate_start(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Perform async lookup of user DN if required for authentication.
Definition: rlm_ldap.c:1408
ldap_user_modify_ctx_t::mod_p
LDAPMod * mod_p[LDAP_MAX_ATTRMAP+1]
Definition: rlm_ldap.c:362
rlm_ldap_boot_t::cache_da
fr_dict_attr_t const * cache_da
Definition: rlm_ldap.c:54
user_config
static conf_parser_t user_config[]
Definition: rlm_ldap.c:103
attr_expr_bool_enum
static fr_dict_attr_t const * attr_expr_bool_enum
Definition: rlm_ldap.c:322
ldap_uri_scheme_table
static fr_table_num_sorted_t const ldap_uri_scheme_table[]
Definition: rlm_ldap.c:384
ldap_xlat_arg
static xlat_arg_parser_t const ldap_xlat_arg[]
Definition: rlm_ldap.c:639
mod_authorize_start
static unlang_action_t mod_authorize_start(UNUSED rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Start LDAP authorization with async lookup of user DN.
Definition: rlm_ldap.c:1520
ldap_uri_part_escape
static int ldap_uri_part_escape(fr_value_box_t *vb, UNUSED void *uctx)
Escape function for a part of an LDAP URI.
Definition: rlm_ldap.c:501
rlm_ldap_boot_t::group_da
fr_dict_attr_t const * group_da
Definition: rlm_ldap.c:53
attr_password
fr_dict_attr_t const * attr_password
Definition: rlm_ldap.c:316
mod_authenticate
static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition: rlm_ldap.c:1469
mod_bootstrap
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Bootstrap the module.
Definition: rlm_ldap.c:2652
REPEAT_MOD_AUTHORIZE_RESUME
#define REPEAT_MOD_AUTHORIZE_RESUME
Definition: rlm_ldap.c:1529
acct_section_config
static const conf_parser_t acct_section_config[]
Definition: rlm_ldap.c:139
ldap_auth_call_env_t::user_sasl_proxy
fr_value_box_t user_sasl_proxy
Definition: rlm_ldap.c:64
ldap_user_modify_ctx_t::ttrunk
fr_ldap_thread_trunk_t * ttrunk
Definition: rlm_ldap.c:364
ldap_auth_call_env_t::user_sasl_authname
fr_value_box_t user_sasl_authname
Definition: rlm_ldap.c:63
attr_password_with_header
fr_dict_attr_t const * attr_password_with_header
Definition: rlm_ldap.c:321
ldap_update_section_parse
static int ldap_update_section_parse(TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, call_env_parser_t const *rule)
ldap_user_modify_ctx_t::inst
rlm_ldap_t const * inst
Definition: rlm_ldap.c:358
group_config
static conf_parser_t group_config[]
Definition: rlm_ldap.c:119
ldap_map_ctx_t::query
fr_ldap_query_t * query
Definition: rlm_ldap.c:374
mod_unload
static void mod_unload(void)
Definition: rlm_ldap.c:2742
rlm_ldap_dict_attr
fr_dict_attr_autoload_t rlm_ldap_dict_attr[]
Definition: rlm_ldap.c:325
ldap_group_xlat_resume
static xlat_action_t ldap_group_xlat_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, UNUSED request_t *request, UNUSED fr_value_box_list_t *in)
Process the results of evaluating LDAP group membership.
Definition: rlm_ldap.c:914
ldap_group_xlat_cancel
static void ldap_group_xlat_cancel(UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
Cancel an in-progress query for the LDAP group membership xlat.
Definition: rlm_ldap.c:847
ldap_update_rules_t::expect_password_offset
ssize_t expect_password_offset
Definition: rlm_ldap.c:210
mod_accounting
static unlang_action_t mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition: rlm_ldap.c:2200
ldap_xlat_uri_parse
static int ldap_xlat_uri_parse(LDAPURLDesc **uri_parsed, char **host_out, bool *free_host_out, request_t *request, char *host_default, fr_value_box_t *uri_in)
Utility function for parsing LDAP URLs.
Definition: rlm_ldap.c:679
ldap_xlat_profile_ctx_free
static int ldap_xlat_profile_ctx_free(ldap_xlat_profile_ctx_t *to_free)
Definition: rlm_ldap.c:1047
attr_cleartext_password
fr_dict_attr_t const * attr_cleartext_password
Definition: rlm_ldap.c:317
ldap_auth_call_env_t::password_tmpl
tmpl_t const * password_tmpl
Definition: rlm_ldap.c:59
mod_authorize
static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition: rlm_ldap.c:1849
ldap_xlat_resume
static xlat_action_t ldap_xlat_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, UNUSED fr_value_box_list_t *in)
Callback when resuming after async ldap query is completed.
Definition: rlm_ldap.c:557
ldap_auth_call_env_t::user_sasl_mech
fr_value_box_t user_sasl_mech
Definition: rlm_ldap.c:62
mod_authenticate_resume
static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Initiate async LDAP bind to authenticate user.
Definition: rlm_ldap.c:1426
user_modify_start
static unlang_action_t user_modify_start(UNUSED rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Perform async lookup of user DN if required for user modification.
Definition: rlm_ldap.c:1916
rlm_ldap_dict
fr_dict_autoload_t rlm_ldap_dict[]
Definition: rlm_ldap.c:311
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Initialise thread specific data structure.
Definition: rlm_ldap.c:2386
rlm_ldap
module_rlm_t rlm_ldap
Definition: rlm_ldap.c:2751
ldap_auth_ctx_t::password
char const * password
Definition: rlm_ldap.c:348
autz_ctx_free
static int autz_ctx_free(ldap_autz_ctx_t *autz_ctx)
Ensure authorization context is properly cleared up.
Definition: rlm_ldap.c:1842
ldap_schemes_t
ldap_schemes_t
Definition: rlm_ldap.c:378
LDAP_SCHEME_UNIX
@ LDAP_SCHEME_UNIX
Definition: rlm_ldap.c:379
LDAP_SCHEME_TCP_SSL
@ LDAP_SCHEME_TCP_SSL
Definition: rlm_ldap.c:381
LDAP_SCHEME_TCP
@ LDAP_SCHEME_TCP
Definition: rlm_ldap.c:380
ldap_xlat_profile_ctx_t::url
LDAPURLDesc * url
Definition: rlm_ldap.c:1027
ldap_usermod_call_env_t::user_base
fr_value_box_t user_base
Definition: rlm_ldap.c:69
ldap_xlat_profile_ctx_t::expanded
fr_ldap_map_exp_t expanded
Definition: rlm_ldap.c:1028
ldap_group_xlat_user_find
static unlang_action_t ldap_group_xlat_user_find(UNUSED rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
User object lookup as part of group membership xlat.
Definition: rlm_ldap.c:831
ldap_xlat_signal
static void ldap_xlat_signal(xlat_ctx_t const *xctx, request_t *request, UNUSED fr_signal_t action)
Callback for signalling async ldap query.
Definition: rlm_ldap.c:604
ldap_user_modify_ctx_t::query
fr_ldap_query_t * query
Definition: rlm_ldap.c:365
ldap_user_modify_ctx_t::passed
char * passed[LDAP_MAX_ATTRMAP *2]
Definition: rlm_ldap.c:361
ldap_auth_call_env_t::user_filter
fr_value_box_t user_filter
Definition: rlm_ldap.c:61
host_uri_canonify
static char * host_uri_canonify(request_t *request, LDAPURLDesc *url_parsed, fr_value_box_t *url_in)
Produce canonical LDAP host URI for finding trunks.
Definition: rlm_ldap.c:648
ldap_auth_ctx_t::thread
fr_ldap_thread_t * thread
Definition: rlm_ldap.c:350
ldap_uri_scheme_table_len
static size_t ldap_uri_scheme_table_len
Definition: rlm_ldap.c:389
ldap_user_modify_ctx_t::dn
char const * dn
Definition: rlm_ldap.c:360
LDAP_URI_SAFE_FOR
#define LDAP_URI_SAFE_FOR
This is the common function that actually ends up doing all the URI escaping.
Definition: rlm_ldap.c:393
ldap_dn_parts
static fr_uri_part_t const ldap_dn_parts[]
Definition: rlm_ldap.c:634
user_modify_final
static unlang_action_t user_modify_final(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Handle results of user modification.
Definition: rlm_ldap.c:1940
user_modify
static unlang_action_t user_modify(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request, ldap_acct_section_t *section, ldap_usermod_call_env_t *call_env)
Modify user's object in LDAP.
Definition: rlm_ldap.c:2005
module_config
static const conf_parser_t module_config[]
Definition: rlm_ldap.c:144
usermod_method_env
static const call_env_method_t usermod_method_env
Definition: rlm_ldap.c:251
USER_CALL_ENV_COMMON
#define USER_CALL_ENV_COMMON(_struct)
Definition: rlm_ldap.c:185
ldap_user_modify_ctx_t::call_env
ldap_usermod_call_env_t * call_env
Definition: rlm_ldap.c:359
mod_authorize_resume
static unlang_action_t mod_authorize_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Resume function called after each potential yield in LDAP authorization.
Definition: rlm_ldap.c:1548
mod_authorize_cancel
static void mod_authorize_cancel(UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
Clear up when cancelling a mod_authorize call.
Definition: rlm_ldap.c:1832
ldap_xlat_profile_call_env_t::profile_filter
fr_value_box_t profile_filter
Filter to use when searching for users.
Definition: rlm_ldap.c:76
mod_thread_detach
static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
Clean up thread specific data structure.
Definition: rlm_ldap.c:2368
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Instantiate the module.
Definition: rlm_ldap.c:2431
ldap_map_ctx_t::expanded
fr_ldap_map_exp_t expanded
Definition: rlm_ldap.c:375
ldap_map_ctx_t::ldap_url
LDAPURLDesc * ldap_url
Definition: rlm_ldap.c:373
parse_sub_section
static int parse_sub_section(module_inst_ctx_t const *mctx, CONF_SECTION *parent, ldap_acct_section_t **config, char const *name)
Parse an accounting sub section.
Definition: rlm_ldap.c:2244
sasl_call_env
static const call_env_parser_t sasl_call_env[]
Definition: rlm_ldap.c:84
ldap_update_rules_t::map_offset
size_t map_offset
Definition: rlm_ldap.c:209
ldap_auth_call_env_t::user_sasl_realm
fr_value_box_t user_sasl_realm
Definition: rlm_ldap.c:65
ldap_uri_parts
static fr_uri_part_t const ldap_uri_parts[]
Definition: rlm_ldap.c:622
ldap_auth_ctx_t::dn
char const * dn
Definition: rlm_ldap.c:347
ldap_group_xlat_arg
static xlat_arg_parser_t const ldap_group_xlat_arg[]
Definition: rlm_ldap.c:927
mod_post_auth
static unlang_action_t mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition: rlm_ldap.c:2210
ldap_auth_ctx_t::inst
rlm_ldap_t const * inst
Definition: rlm_ldap.c:349
ldap_auth_call_env_t
Definition: rlm_ldap.c:57
ldap_auth_ctx_t
Holds state of in progress async authentication.
Definition: rlm_ldap.c:346
ldap_map_ctx_t
Holds state of in progress LDAP map.
Definition: rlm_ldap.c:371
ldap_update_rules_t
Parameters to allow ldap_update_section_parse to be reused.
Definition: rlm_ldap.c:208
ldap_user_modify_ctx_t
Holds state of in progress ldap user modifications.
Definition: rlm_ldap.c:357
ldap_usermod_call_env_t
Definition: rlm_ldap.c:68
ldap_xlat_profile_call_env_t
Call environment used in the profile xlat.
Definition: rlm_ldap.c:75
ldap_xlat_profile_ctx_t
Definition: rlm_ldap.c:1025
rlm_ldap_boot_t
Definition: rlm_ldap.c:52
rlm_ldap.h
LDAP authorization and authentication module headers.
ldap_autz_ctx_t::expanded
fr_ldap_map_exp_t expanded
Definition: rlm_ldap.h:196
ldap_autz_ctx_t::call_env
ldap_autz_call_env_t * call_env
Definition: rlm_ldap.h:199
ldap_autz_ctx_t::profile_values
struct berval ** profile_values
Definition: rlm_ldap.h:202
LDAP_ACCESS_SUSPENDED
@ LDAP_ACCESS_SUSPENDED
User account has been suspended.
Definition: rlm_ldap.h:187
LDAP_ACCESS_ALLOWED
@ LDAP_ACCESS_ALLOWED
User is allowed to login.
Definition: rlm_ldap.h:185
LDAP_ACCESS_DISALLOWED
@ LDAP_ACCESS_DISALLOWED
User it not allow to login (disabled)
Definition: rlm_ldap.h:186
ldap_autz_ctx_t::ttrunk
fr_ldap_thread_trunk_t * ttrunk
Definition: rlm_ldap.h:198
ldap_autz_ctx_t::value_idx
int value_idx
Definition: rlm_ldap.h:203
ldap_autz_ctx_t::inst
rlm_ldap_t const * inst
Definition: rlm_ldap.h:195
ldap_autz_call_env_t::profile_filter
fr_value_box_t profile_filter
Filter to use when searching for profiles.
Definition: rlm_ldap.h:146
ldap_autz_call_env_t::user_filter
fr_value_box_t user_filter
Filter to use when searching for users.
Definition: rlm_ldap.h:139
ldap_autz_ctx_t::entry
LDAPMessage * entry
Definition: rlm_ldap.h:200
LDAP_AUTZ_GROUP
@ LDAP_AUTZ_GROUP
Definition: rlm_ldap.h:169
LDAP_AUTZ_FIND
@ LDAP_AUTZ_FIND
Definition: rlm_ldap.h:168
LDAP_AUTZ_DEFAULT_PROFILE
@ LDAP_AUTZ_DEFAULT_PROFILE
Definition: rlm_ldap.h:176
LDAP_AUTZ_USER_PROFILE
@ LDAP_AUTZ_USER_PROFILE
Definition: rlm_ldap.h:178
LDAP_AUTZ_MAP
@ LDAP_AUTZ_MAP
Definition: rlm_ldap.h:175
LDAP_AUTZ_POST_DEFAULT_PROFILE
@ LDAP_AUTZ_POST_DEFAULT_PROFILE
Definition: rlm_ldap.h:177
LDAP_AUTZ_POST_GROUP
@ LDAP_AUTZ_POST_GROUP
Definition: rlm_ldap.h:170
ldap_autz_ctx_t::status
ldap_autz_status_t status
Definition: rlm_ldap.h:201
ldap_autz_ctx_t::query
fr_ldap_query_t * query
Definition: rlm_ldap.h:197
ldap_autz_ctx_t::profile_value
char * profile_value
Definition: rlm_ldap.h:204
ldap_autz_ctx_t::access_state
ldap_access_state_t access_state
What state a user's account is in.
Definition: rlm_ldap.h:206
ldap_autz_call_env_t::user_base
fr_value_box_t user_base
Base DN in which to search for users.
Definition: rlm_ldap.h:138
rlm_ldap_find_user_async
unlang_action_t rlm_ldap_find_user_async(TALLOC_CTX *ctx, rlm_ldap_t const *inst, request_t *request, fr_value_box_t *base, fr_value_box_t *filter_box, fr_ldap_thread_trunk_t *ttrunk, char const *attrs[], fr_ldap_query_t **query_out)
Initiate asynchronous retrieval of the DN of a user object.
Definition: user.c:159
ldap_autz_ctx_t::dn
char const * dn
Definition: rlm_ldap.h:205
ldap_autz_call_env_t::user_map
map_list_t * user_map
Attribute map applied to users and profiles.
Definition: rlm_ldap.h:148
rlm_ldap_check_reply
void rlm_ldap_check_reply(request_t *request, rlm_ldap_t const *inst, char const *inst_name, bool expect_password, fr_ldap_thread_trunk_t const *ttrunk)
Verify we got a password from the search.
Definition: user.c:251
ldap_autz_call_env_t::expect_password
fr_value_box_t const * expect_password
True if the user_map included a mapping between an LDAP attribute and one of our password reference a...
Definition: rlm_ldap.h:150
rlm_find_user_dn_cached
static char const * rlm_find_user_dn_cached(request_t *request)
Definition: rlm_ldap.h:248
ldap_acct_section_t::reference
char const * reference
Configuration reference string.
Definition: rlm_ldap.h:23
ldap_acct_section_t::cs
CONF_SECTION * cs
Section configuration.
Definition: rlm_ldap.h:21
ldap_autz_call_env_t::default_profile
fr_value_box_t default_profile
If this is set, we will search for a profile object with this name, and map any attributes it contain...
Definition: rlm_ldap.h:142
GROUP_XLAT_MEMB_FILTER
@ GROUP_XLAT_MEMB_FILTER
Definition: rlm_ldap.h:213
GROUP_XLAT_MEMB_ATTR
@ GROUP_XLAT_MEMB_ATTR
Definition: rlm_ldap.h:214
GROUP_XLAT_FIND_USER
@ GROUP_XLAT_FIND_USER
Definition: rlm_ldap.h:212
ldap_autz_ctx_t::dlinst
module_instance_t const * dlinst
Definition: rlm_ldap.h:194
rlm_ldap_check_access
ldap_access_state_t rlm_ldap_check_access(rlm_ldap_t const *inst, request_t *request, LDAPMessage *entry)
Check for presence of access attribute in result.
Definition: user.c:199
ldap_acct_section_t
Definition: rlm_ldap.h:20
ldap_autz_call_env_t
Call environment used in LDAP authorization.
Definition: rlm_ldap.h:137
ldap_autz_ctx_t
Holds state of in progress async authorization.
Definition: rlm_ldap.h:193
ldap_group_xlat_ctx_t
Holds state of in progress group membership check xlat.
Definition: rlm_ldap.h:220
ldap_xlat_memberof_call_env_t
Call environment used in group membership xlat.
Definition: rlm_ldap.h:157
rlm_ldap_t
Definition: rlm_ldap.h:26
name
static char const * name
Definition: rlm_redis_ippool_tool.c:156
fr_ldap_sasl_bind_auth_async
unlang_action_t fr_ldap_sasl_bind_auth_async(request_t *request, fr_ldap_thread_t *thread, char const *mechs, char const *identity, char const *password, char const *proxy, char const *realm)
Initiate an async SASL LDAP bind for authentication.
Definition: sasl.c:504
fr_sbuff_trim_talloc
int fr_sbuff_trim_talloc(fr_sbuff_t *sbuff, size_t len)
Trim a talloced sbuff to the minimum length required to represent the contained string.
Definition: sbuff.c:407
FR_SBUFF_TERMS
#define FR_SBUFF_TERMS(...)
Initialise a terminal structure with a list of sorted strings.
Definition: sbuff.h:167
fr_sbuff_buff
#define fr_sbuff_buff(_sbuff_or_marker)
fr_sbuff_uctx_talloc_t
Talloc sbuff extension structure.
Definition: sbuff.h:114
SECTION_NAME
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition: section.h:40
module_instance_s::name
char const * name
Instance name e.g. user_database.
Definition: module.h:335
module_thread
static module_thread_instance_t * module_thread(module_instance_t const *mi)
Retrieve module/thread specific instance for a module.
Definition: module.h:481
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition: module.h:329
module_instance_s::data
void * data
Module's instance data.
Definition: module.h:271
module_instance_s::boot
void * boot
Data allocated during the boostrap phase.
Definition: module.h:274
module_thread_instance_s::data
void * data
Thread specific instance data.
Definition: module.h:352
MODULE_BINDING_TERMINATOR
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition: module.h:151
module_method_binding_s
Named methods exported by a module.
Definition: module.h:173
tmpl_attr_tail
static tmpl_attr_t const * tmpl_attr_tail(tmpl_t const *vpt)
Return the last attribute reference.
Definition: tmpl.h:801
tmpl_rules_s
Optional arguments passed to vp_tmpl functions.
Definition: tmpl.h:341
fr_signal_t
fr_signal_t
Definition: signal.h:48
snprintf
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
Definition: snprintf.c:689
count
return count
Definition: module.c:163
RETURN_MODULE_FAIL
RETURN_MODULE_FAIL
Definition: state_machine.c:1215
fr_assert
fr_assert(0)
MEM
MEM(pair_append_request(&vp, attr_eap_aka_sim_identity) >=0)
inst
eap_aka_sim_process_conf_t * inst
Definition: state_machine.c:3620
map_s
Value pair map.
Definition: map.h:77
map_s::lhs
tmpl_t * lhs
Typically describes the attribute to add, modify or compare.
Definition: map.h:78
tmpl_attr_t
An element in a list of nested attribute references.
Definition: tmpl.h:439
tmpl_attr_t::da
fr_dict_attr_t const *_CONST da
Resolved dictionary attribute.
Definition: tmpl.h:443
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition: pair.h:68
fr_table_value_by_str
#define fr_table_value_by_str(_table, _name, _def)
Convert a string to a value using a sorted or ordered table.
Definition: table.h:653
fr_table_str_by_value
#define fr_table_str_by_value(_table, _number, _def)
Convert an integer to a string.
Definition: table.h:772
fr_table_num_sorted_t
An element in a lexicographically sorted array of name to num mappings.
Definition: table.h:49
talloc_typed_strdup_buffer
char * talloc_typed_strdup_buffer(TALLOC_CTX *ctx, char const *p)
Call talloc_strndup, setting the type on the new chunk correctly.
Definition: talloc.c:469
talloc_typed_asprintf
char * talloc_typed_asprintf(TALLOC_CTX *ctx, char const *fmt,...)
Call talloc vasprintf, setting the type on the new chunk correctly.
Definition: talloc.c:492
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition: talloc.h:282
fr_time_s
"server local" time.
Definition: time.h:69
TMPL_ESCAPE_PRE_CONCAT
@ TMPL_ESCAPE_PRE_CONCAT
Pre-concatenation escaping is useful for DSLs where elements of the expansion are static,...
Definition: tmpl_escape.h:61
fr_tokens_table
fr_table_num_ordered_t const fr_tokens_table[]
Definition: token.c:33
fr_token_t
enum fr_token fr_token_t
T_OP_SUB_EQ
@ T_OP_SUB_EQ
Definition: token.h:70
T_SINGLE_QUOTED_STRING
@ T_SINGLE_QUOTED_STRING
Definition: token.h:122
T_BARE_WORD
@ T_BARE_WORD
Definition: token.h:120
T_BACK_QUOTED_STRING
@ T_BACK_QUOTED_STRING
Definition: token.h:123
T_OP_SET
@ T_OP_SET
Definition: token.h:84
T_OP_ADD_EQ
@ T_OP_ADD_EQ
Definition: token.h:69
T_OP_CMP_FALSE
@ T_OP_CMP_FALSE
Definition: token.h:105
T_DOUBLE_QUOTED_STRING
@ T_DOUBLE_QUOTED_STRING
Definition: token.h:121
T_OP_INCRM
@ T_OP_INCRM
Definition: token.h:113
trunk_request_enqueue
trunk_enqueue_t trunk_request_enqueue(trunk_request_t **treq_out, trunk_t *trunk, request_t *request, void *preq, void *rctx)
Enqueue a request that needs data written to the trunk.
Definition: trunk.c:2575
trunk_request_signal_cancel
void trunk_request_signal_cancel(trunk_request_t *treq)
Cancel a trunk request.
Definition: trunk.c:2140
trunk_config
conf_parser_t const trunk_config[]
Config parser definitions to populate a trunk_conf_t.
Definition: trunk.c:312
trunk_request_s
Wraps a normal request.
Definition: trunk.c:97
TRUNK_ENQUEUE_OK
@ TRUNK_ENQUEUE_OK
Operation was successful.
Definition: trunk.h:150
TRUNK_ENQUEUE_IN_BACKLOG
@ TRUNK_ENQUEUE_IN_BACKLOG
Request should be enqueued in backlog.
Definition: trunk.h:149
el
static fr_event_list_t * el
Definition: unit_test_attribute.c:270
unlang_xlat_yield
xlat_action_t unlang_xlat_yield(request_t *request, xlat_func_t resume, xlat_func_signal_t signal, fr_signal_t sigmask, void *rctx)
Yield a request back to the interpreter from within a module.
Definition: xlat.c:561
xlat_arg_parser_t::required
bool required
Argument must be present, and non-empty.
Definition: xlat.h:146
xlat_transparent
xlat_action_t xlat_transparent(UNUSED TALLOC_CTX *ctx, fr_dcursor_t *out, UNUSED xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
XLAT_ARGS
#define XLAT_ARGS(_list,...)
Populate local variables with value boxes from the input list.
Definition: xlat.h:365
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition: xlat.h:166
xlat_action_t
xlat_action_t
Definition: xlat.h:35
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition: xlat.h:42
XLAT_ACTION_YIELD
@ XLAT_ACTION_YIELD
An xlat function pushed a resume frame onto the stack.
Definition: xlat.h:40
XLAT_ACTION_PUSH_UNLANG
@ XLAT_ACTION_PUSH_UNLANG
An xlat function pushed an unlang frame onto the unlang stack.
Definition: xlat.h:37
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition: xlat.h:41
xlat_aeval
ssize_t xlat_aeval(TALLOC_CTX *ctx, char **out, request_t *request, char const *fmt, xlat_escape_legacy_t escape, void const *escape_ctx))
Definition: xlat_eval.c:1545
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition: xlat.h:145
fr_uri_escape_list
int fr_uri_escape_list(fr_value_box_list_t *uri, fr_uri_part_t const *uri_parts, void *uctx)
Parse a list of value boxes representing a URI.
Definition: uri.c:141
fr_uri_has_scheme
int fr_uri_has_scheme(fr_value_box_list_t *uri, fr_table_num_sorted_t const *schemes, size_t schemes_len, int def)
Searches for a matching scheme in the table of schemes, using a list of value boxes representing the ...
Definition: uri.c:168
XLAT_URI_PART_TERMINATOR
#define XLAT_URI_PART_TERMINATOR
Definition: uri.h:66
fr_uri_part_t::name
char const * name
Name of this part of the URI.
Definition: uri.h:47
fr_uri_part_t
Definition for a single part of a URI.
Definition: uri.h:46
parent
static fr_slen_t parent
Definition: pair.h:851
fr_strerror_printf_push
#define fr_strerror_printf_push(_fmt,...)
Add a message to an existing stack of messages at the tail.
Definition: strerror.h:84
fr_value_box_copy
int fr_value_box_copy(TALLOC_CTX *ctx, fr_value_box_t *dst, const fr_value_box_t *src)
Copy value data verbatim duplicating any buffers.
Definition: value.c:3740
fr_value_box_clear_value
void fr_value_box_clear_value(fr_value_box_t *data)
Clear/free any existing value.
Definition: value.c:3681
fr_value_box_strdup_shallow
void fr_value_box_strdup_shallow(fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Assign a buffer containing a nul terminated string to a box, but don't copy it.
Definition: value.c:4036
fr_value_box_bstr_realloc
int fr_value_box_bstr_realloc(TALLOC_CTX *ctx, char **out, fr_value_box_t *dst, size_t len)
Change the length of a buffer already allocated to a value box.
Definition: value.c:4104
fr_value_box_bstrndup
int fr_value_box_bstrndup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, size_t len, bool tainted)
Copy a string to to a fr_value_box_t.
Definition: value.c:4148
fr_value_box_bstrdup_buffer_shallow
int fr_value_box_bstrdup_buffer_shallow(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Assign a talloced buffer containing a nul terminated string to a box, but don't copy it.
Definition: value.c:4253
fr_value_box_list_concat_in_place
int fr_value_box_list_concat_in_place(TALLOC_CTX *ctx, fr_value_box_t *out, fr_value_box_list_t *list, fr_type_t type, fr_value_box_list_action_t proc_action, bool flatten, size_t max_size)
Concatenate a list of value boxes.
Definition: value.c:5777
FR_VALUE_BOX_LIST_FREE
@ FR_VALUE_BOX_LIST_FREE
Definition: value.h:221
fr_value_box_alloc
#define fr_value_box_alloc(_ctx, _type, _enumv)
Allocate a value box of a specific type.
Definition: value.h:621
fr_box_strvalue_len
#define fr_box_strvalue_len(_val, _len)
Definition: value.h:286
fr_value_box_is_safe_for
#define fr_value_box_is_safe_for(_box, _safe_for)
Definition: value.h:1055
FR_MAX_STRING_LEN
#define FR_MAX_STRING_LEN
Definition: value.h:30
fr_value_box_safe_for_t
uintptr_t fr_value_box_safe_for_t
Escaping that's been applied to a value box.
Definition: value.h:155
nonnull
int nonnull(2, 5))
fr_value_box_alloc_null
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
Definition: value.h:632
out
static size_t char ** out
Definition: value.h:997
xlat_ctx
static TALLOC_CTX * xlat_ctx
Definition: xlat_builtin.c:65
xlat_ctx_s::rctx
void * rctx
Resume context.
Definition: xlat_ctx.h:54
xlat_ctx_s::env_data
void * env_data
Expanded call env data.
Definition: xlat_ctx.h:53
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition: xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition: xlat_ctx.h:49
xlat_func_flags_set
void xlat_func_flags_set(xlat_t *x, xlat_func_flags_t flags)
Specify flags that alter the xlat's behaviour.
Definition: xlat_func.c:402
xlat_func_args_set
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
Definition: xlat_func.c:365
xlat_func_register
xlat_t * xlat_func_register(TALLOC_CTX *ctx, char const *name, xlat_func_t func, fr_type_t return_type)
Register an xlat function.
Definition: xlat_func.c:218
xlat_func_call_env_set
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
Definition: xlat_func.c:392
xlat_func_unregister
void xlat_func_unregister(char const *name)
Unregister an xlat function.
Definition: xlat_func.c:519
xlat_func_safe_for_set
#define xlat_func_safe_for_set(_xlat, _escaped)
Set the escaped values for output boxes.
Definition: xlat_func.h:82
XLAT_FUNC_FLAG_PURE
@ XLAT_FUNC_FLAG_PURE
Definition: xlat_func.h:38
xlat_s
Definition: xlat_priv.h:59
Generated by   doxygen 1.9.1