src/mod_auth.c

   1 #include "first.h"
   2
   3 #include "plugin.h"
   4 #include "http_auth.h"
   5 #include "log.h"
   6 #include "response.h"
   7
   8 #include <sys/types.h>
   9 #include <sys/stat.h>
  10
  11 #include <stdlib.h>
  12 #include <string.h>
  13 #include <errno.h>
  14 #include <fcntl.h>
  15 #include <unistd.h>
  16
  17 handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
  18
  19
  20 /**
  21  * the basic and digest auth framework
  22  *
  23  * - config handling
  24  * - protocol handling
  25  *
  26  * http_auth.c
  27  * http_auth_digest.c
  28  *
  29  * do the real work
  30  */
  31
  32 INIT_FUNC(mod_auth_init) {
  33         mod_auth_plugin_data *p;
  34
  35         p = calloc(1, sizeof(*p));
  36
  37         p->tmp_buf = buffer_init();
  38
  39         p->auth_user = buffer_init();
  40 #ifdef USE_LDAP
  41         p->ldap_filter = buffer_init();
  42 #endif
  43
  44         return p;
  45 }
  46
  47 FREE_FUNC(mod_auth_free) {
  48         mod_auth_plugin_data *p = p_d;
  49
  50         UNUSED(srv);
  51
  52         if (!p) return HANDLER_GO_ON;
  53
  54         buffer_free(p->tmp_buf);
  55         buffer_free(p->auth_user);
  56 #ifdef USE_LDAP
  57         buffer_free(p->ldap_filter);
  58 #endif
  59
  60         if (p->config_storage) {
  61                 size_t i;
  62                 for (i = 0; i < srv->config_context->used; i++) {
  63                         mod_auth_plugin_config *s = p->config_storage[i];
  64
  65                         if (NULL == s) continue;
  66
  67                         array_free(s->auth_require);
  68                         buffer_free(s->auth_plain_groupfile);
  69                         buffer_free(s->auth_plain_userfile);
  70                         buffer_free(s->auth_htdigest_userfile);
  71                         buffer_free(s->auth_htpasswd_userfile);
  72                         buffer_free(s->auth_backend_conf);
  73
  74                         buffer_free(s->auth_ldap_hostname);
  75                         buffer_free(s->auth_ldap_basedn);
  76                         buffer_free(s->auth_ldap_binddn);
  77                         buffer_free(s->auth_ldap_bindpw);
  78                         buffer_free(s->auth_ldap_filter);
  79                         buffer_free(s->auth_ldap_cafile);
  80
  81 #ifdef USE_LDAP
  82                         buffer_free(s->ldap_filter_pre);
  83                         buffer_free(s->ldap_filter_post);
  84
  85                         if (s->ldap) ldap_unbind_s(s->ldap);
  86 #endif
  87
  88                         free(s);
  89                 }
  90                 free(p->config_storage);
  91         }
  92
  93         free(p);
  94
  95         return HANDLER_GO_ON;
  96 }
  97
  98 #define PATCH(x) \
  99         p->conf.x = s->x;
 100 static int mod_auth_patch_connection(server *srv, connection *con, mod_auth_plugin_data *p) {
 101         size_t i, j;
 102         mod_auth_plugin_config *s = p->config_storage[0];
 103
 104         PATCH(auth_backend);
 105         PATCH(auth_plain_groupfile);
 106         PATCH(auth_plain_userfile);
 107         PATCH(auth_htdigest_userfile);
 108         PATCH(auth_htpasswd_userfile);
 109         PATCH(auth_require);
 110         PATCH(auth_debug);
 111         PATCH(auth_ldap_hostname);
 112         PATCH(auth_ldap_basedn);
 113         PATCH(auth_ldap_binddn);
 114         PATCH(auth_ldap_bindpw);
 115         PATCH(auth_ldap_filter);
 116         PATCH(auth_ldap_cafile);
 117         PATCH(auth_ldap_starttls);
 118         PATCH(auth_ldap_allow_empty_pw);
 119 #ifdef USE_LDAP
 120         p->anon_conf = s;
 121         PATCH(ldap_filter_pre);
 122         PATCH(ldap_filter_post);
 123 #endif
 124
 125         /* skip the first, the global context */
 126         for (i = 1; i < srv->config_context->used; i++) {
 127                 data_config *dc = (data_config *)srv->config_context->data[i];
 128                 s = p->config_storage[i];
 129
 130                 /* condition didn't match */
 131                 if (!config_check_cond(srv, con, dc)) continue;
 132
 133                 /* merge config */
 134                 for (j = 0; j < dc->value->used; j++) {
 135                         data_unset *du = dc->value->data[j];
 136
 137                         if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend"))) {
 138                                 PATCH(auth_backend);
 139                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.groupfile"))) {
 140                                 PATCH(auth_plain_groupfile);
 141                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.userfile"))) {
 142                                 PATCH(auth_plain_userfile);
 143                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htdigest.userfile"))) {
 144                                 PATCH(auth_htdigest_userfile);
 145                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htpasswd.userfile"))) {
 146                                 PATCH(auth_htpasswd_userfile);
 147                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.require"))) {
 148                                 PATCH(auth_require);
 149                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.debug"))) {
 150                                 PATCH(auth_debug);
 151                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.hostname"))) {
 152                                 PATCH(auth_ldap_hostname);
 153 #ifdef USE_LDAP
 154                                 p->anon_conf = s;
 155 #endif
 156                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.base-dn"))) {
 157                                 PATCH(auth_ldap_basedn);
 158                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.filter"))) {
 159                                 PATCH(auth_ldap_filter);
 160 #ifdef USE_LDAP
 161                                 PATCH(ldap_filter_pre);
 162                                 PATCH(ldap_filter_post);
 163 #endif
 164                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.ca-file"))) {
 165                                 PATCH(auth_ldap_cafile);
 166                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.starttls"))) {
 167                                 PATCH(auth_ldap_starttls);
 168                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-dn"))) {
 169                                 PATCH(auth_ldap_binddn);
 170                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-pw"))) {
 171                                 PATCH(auth_ldap_bindpw);
 172                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.allow-empty-pw"))) {
 173                                 PATCH(auth_ldap_allow_empty_pw);
 174                         }
 175                 }
 176         }
 177
 178         return 0;
 179 }
 180 #undef PATCH
 181
 182 static handler_t mod_auth_uri_handler(server *srv, connection *con, void *p_d) {
 183         size_t k;
 184         int auth_required = 0, auth_satisfied = 0;
 185         char *http_authorization = NULL;
 186         const char *auth_type = NULL;
 187         data_string *ds;
 188         mod_auth_plugin_data *p = p_d;
 189         array *req;
 190         data_string *req_method;
 191
 192         /* select the right config */
 193         mod_auth_patch_connection(srv, con, p);
 194
 195         if (p->conf.auth_require == NULL) return HANDLER_GO_ON;
 196
 197         /*
 198          * AUTH
 199          *
 200          */
 201
 202         /* do we have to ask for auth ? */
 203
 204         auth_required = 0;
 205         auth_satisfied = 0;
 206
 207         /* search auth-directives for path */
 208         for (k = 0; k < p->conf.auth_require->used; k++) {
 209                 buffer *require = p->conf.auth_require->data[k]->key;
 210
 211                 if (buffer_is_empty(require)) continue;
 212                 if (buffer_string_length(con->uri.path) < buffer_string_length(require)) continue;
 213
 214                 /* if we have a case-insensitive FS we have to lower-case the URI here too */
 215
 216                 if (con->conf.force_lowercase_filenames) {
 217                         if (0 == strncasecmp(con->uri.path->ptr, require->ptr, buffer_string_length(require))) {
 218                                 auth_required = 1;
 219                                 break;
 220                         }
 221                 } else {
 222                         if (0 == strncmp(con->uri.path->ptr, require->ptr, buffer_string_length(require))) {
 223                                 auth_required = 1;
 224                                 break;
 225                         }
 226                 }
 227         }
 228
 229         /* nothing to do for us */
 230         if (auth_required == 0) return HANDLER_GO_ON;
 231
 232         req = ((data_array *)(p->conf.auth_require->data[k]))->value;
 233         req_method = (data_string *)array_get_element(req, "method");
 234
 235         if (0 == strcmp(req_method->value->ptr, "extern")) {
 236                 /* require REMOTE_USER to be already set */
 237                 if (NULL == (ds = (data_string *)array_get_element(con->environment, "REMOTE_USER"))) {
 238                         con->http_status = 401;
 239                         con->mode = DIRECT;
 240                         return HANDLER_FINISHED;
 241                 } else if (http_auth_match_rules(srv, req, ds->value->ptr, NULL, NULL)) {
 242                         log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match");
 243                         con->http_status = 401;
 244                         con->mode = DIRECT;
 245                         return HANDLER_FINISHED;
 246                 } else {
 247                         return HANDLER_GO_ON;
 248                 }
 249         }
 250
 251         /* try to get Authorization-header */
 252
 253         if (NULL != (ds = (data_string *)array_get_element(con->request.headers, "Authorization")) && !buffer_is_empty(ds->value)) {
 254                 char *auth_realm;
 255
 256                 http_authorization = ds->value->ptr;
 257
 258                 /* parse auth-header */
 259                 if (NULL != (auth_realm = strchr(http_authorization, ' '))) {
 260                         int auth_type_len = auth_realm - http_authorization;
 261
 262                         if ((auth_type_len == 5) &&
 263                             (0 == strncasecmp(http_authorization, "Basic", auth_type_len))) {
 264                                 auth_type = "Basic";
 265
 266                                 if (0 == strcmp(req_method->value->ptr, "basic")) {
 267                                         auth_satisfied = http_auth_basic_check(srv, con, p, req, auth_realm+1);
 268                                 }
 269                         } else if ((auth_type_len == 6) &&
 270                                    (0 == strncasecmp(http_authorization, "Digest", auth_type_len))) {
 271                                 auth_type = "Digest";
 272                                 if (0 == strcmp(req_method->value->ptr, "digest")) {
 273                                         if (-1 == (auth_satisfied = http_auth_digest_check(srv, con, p, req, auth_realm+1))) {
 274                                                 con->http_status = 400;
 275                                                 con->mode = DIRECT;
 276
 277                                                 /* a field was missing */
 278
 279                                                 return HANDLER_FINISHED;
 280                                         }
 281                                 }
 282                         } else {
 283                                 log_error_write(srv, __FILE__, __LINE__, "ss",
 284                                                 "unknown authentication type:",
 285                                                 http_authorization);
 286                         }
 287                 }
 288         }
 289
 290         if (!auth_satisfied) {
 291                 data_string *method, *realm;
 292                 method = (data_string *)array_get_element(req, "method");
 293                 realm = (data_string *)array_get_element(req, "realm");
 294
 295                 con->http_status = 401;
 296                 con->mode = DIRECT;
 297
 298                 if (0 == strcmp(method->value->ptr, "basic")) {
 299                         buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Basic realm=\""));
 300                         buffer_append_string_buffer(p->tmp_buf, realm->value);
 301                         buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", charset=\"UTF-8\""));
 302
 303                         response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
 304                 } else if (0 == strcmp(method->value->ptr, "digest")) {
 305                         char hh[33];
 306                         http_auth_digest_generate_nonce(srv, p, srv->tmp_buf, &hh);
 307
 308                         buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Digest realm=\""));
 309                         buffer_append_string_buffer(p->tmp_buf, realm->value);
 310                         buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", charset=\"UTF-8\", nonce=\""));
 311                         buffer_append_string(p->tmp_buf, hh);
 312                         buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", qop=\"auth\""));
 313
 314                         response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
 315                 } else {
 316                         /* evil */
 317                 }
 318                 return HANDLER_FINISHED;
 319         } else {
 320                 /* the REMOTE_USER header */
 321
 322                 if (NULL == (ds = (data_string *)array_get_element(con->environment, "REMOTE_USER"))) {
 323                         if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
 324                                 ds = data_string_init();
 325                         }
 326                         buffer_copy_string(ds->key, "REMOTE_USER");
 327                         array_insert_unique(con->environment, (data_unset *)ds);
 328                 }
 329                 buffer_copy_buffer(ds->value, p->auth_user);
 330
 331                 /* AUTH_TYPE environment */
 332
 333                 if (NULL == (ds = (data_string *)array_get_element(con->environment, "AUTH_TYPE"))) {
 334                         if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
 335                                 ds = data_string_init();
 336                         }
 337                         buffer_copy_string(ds->key, "AUTH_TYPE");
 338                         array_insert_unique(con->environment, (data_unset *)ds);
 339                 }
 340                 buffer_copy_string(ds->value, auth_type);
 341         }
 342
 343         return HANDLER_GO_ON;
 344 }
 345
 346 SETDEFAULTS_FUNC(mod_auth_set_defaults) {
 347         mod_auth_plugin_data *p = p_d;
 348         size_t i;
 349
 350         config_values_t cv[] = {
 351                 { "auth.backend",                   NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
 352                 { "auth.backend.plain.groupfile",   NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
 353                 { "auth.backend.plain.userfile",    NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
 354                 { "auth.require",                   NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION },  /* 3 */
 355                 { "auth.backend.ldap.hostname",     NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 4 */
 356                 { "auth.backend.ldap.base-dn",      NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 5 */
 357                 { "auth.backend.ldap.filter",       NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 6 */
 358                 { "auth.backend.ldap.ca-file",      NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 7 */
 359                 { "auth.backend.ldap.starttls",     NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 8 */
 360                 { "auth.backend.ldap.bind-dn",      NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 9 */
 361                 { "auth.backend.ldap.bind-pw",      NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 10 */
 362                 { "auth.backend.ldap.allow-empty-pw",     NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 11 */
 363                 { "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 12 */
 364                 { "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 13 */
 365                 { "auth.debug",                     NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION },  /* 14 */
 366                 { NULL,                             NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
 367         };
 368
 369         p->config_storage = calloc(1, srv->config_context->used * sizeof(mod_auth_plugin_config *));
 370
 371         for (i = 0; i < srv->config_context->used; i++) {
 372                 data_config const* config = (data_config const*)srv->config_context->data[i];
 373                 mod_auth_plugin_config *s;
 374                 size_t n;
 375                 data_array *da;
 376
 377                 s = calloc(1, sizeof(mod_auth_plugin_config));
 378                 s->auth_plain_groupfile = buffer_init();
 379                 s->auth_plain_userfile = buffer_init();
 380                 s->auth_htdigest_userfile = buffer_init();
 381                 s->auth_htpasswd_userfile = buffer_init();
 382                 s->auth_backend_conf = buffer_init();
 383
 384                 s->auth_ldap_hostname = buffer_init();
 385                 s->auth_ldap_basedn = buffer_init();
 386                 s->auth_ldap_binddn = buffer_init();
 387                 s->auth_ldap_bindpw = buffer_init();
 388                 s->auth_ldap_filter = buffer_init();
 389                 s->auth_ldap_cafile = buffer_init();
 390                 s->auth_ldap_starttls = 0;
 391                 s->auth_debug = 0;
 392
 393                 s->auth_require = array_init();
 394
 395 #ifdef USE_LDAP
 396                 s->ldap_filter_pre = buffer_init();
 397                 s->ldap_filter_post = buffer_init();
 398                 s->ldap = NULL;
 399 #endif
 400
 401                 cv[0].destination = s->auth_backend_conf;
 402                 cv[1].destination = s->auth_plain_groupfile;
 403                 cv[2].destination = s->auth_plain_userfile;
 404                 cv[3].destination = s->auth_require;
 405                 cv[4].destination = s->auth_ldap_hostname;
 406                 cv[5].destination = s->auth_ldap_basedn;
 407                 cv[6].destination = s->auth_ldap_filter;
 408                 cv[7].destination = s->auth_ldap_cafile;
 409                 cv[8].destination = &(s->auth_ldap_starttls);
 410                 cv[9].destination = s->auth_ldap_binddn;
 411                 cv[10].destination = s->auth_ldap_bindpw;
 412                 cv[11].destination = &(s->auth_ldap_allow_empty_pw);
 413                 cv[12].destination = s->auth_htdigest_userfile;
 414                 cv[13].destination = s->auth_htpasswd_userfile;
 415                 cv[14].destination = &(s->auth_debug);
 416
 417                 p->config_storage[i] = s;
 418
 419                 if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
 420                         return HANDLER_ERROR;
 421                 }
 422
 423                 if (!buffer_string_is_empty(s->auth_backend_conf)) {
 424                         if (0 == strcmp(s->auth_backend_conf->ptr, "htpasswd")) {
 425                                 s->auth_backend = AUTH_BACKEND_HTPASSWD;
 426                         } else if (0 == strcmp(s->auth_backend_conf->ptr, "htdigest")) {
 427                                 s->auth_backend = AUTH_BACKEND_HTDIGEST;
 428                         } else if (0 == strcmp(s->auth_backend_conf->ptr, "plain")) {
 429                                 s->auth_backend = AUTH_BACKEND_PLAIN;
 430                         } else if (0 == strcmp(s->auth_backend_conf->ptr, "ldap")) {
 431                                 s->auth_backend = AUTH_BACKEND_LDAP;
 432                         } else {
 433                                 log_error_write(srv, __FILE__, __LINE__, "sb", "auth.backend not supported:", s->auth_backend_conf);
 434
 435                                 return HANDLER_ERROR;
 436                         }
 437                 }
 438
 439 #ifdef USE_LDAP
 440                 if (!buffer_string_is_empty(s->auth_ldap_filter)) {
 441                         char *dollar;
 442
 443                         /* parse filter */
 444
 445                         if (NULL == (dollar = strchr(s->auth_ldap_filter->ptr, '$'))) {
 446                                 log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.filter is missing a replace-operator '$'");
 447
 448                                 return HANDLER_ERROR;
 449                         }
 450
 451                         buffer_copy_string_len(s->ldap_filter_pre, s->auth_ldap_filter->ptr, dollar - s->auth_ldap_filter->ptr);
 452                         buffer_copy_string(s->ldap_filter_post, dollar+1);
 453                 }
 454 #endif
 455
 456                 /* no auth.require for this section */
 457                 if (NULL == (da = (data_array *)array_get_element(config->value, "auth.require"))) continue;
 458
 459                 if (da->type != TYPE_ARRAY) continue;
 460
 461                 for (n = 0; n < da->value->used; n++) {
 462                         size_t m;
 463                         data_array *da_file = (data_array *)da->value->data[n];
 464                         const char *method, *realm, *require;
 465
 466                         if (da->value->data[n]->type != TYPE_ARRAY) {
 467                                 log_error_write(srv, __FILE__, __LINE__, "ss",
 468                                                 "auth.require should contain an array as in:",
 469                                                 "auth.require = ( \"...\" => ( ..., ...) )");
 470
 471                                 return HANDLER_ERROR;
 472                         }
 473
 474                         method = realm = require = NULL;
 475
 476                         for (m = 0; m < da_file->value->used; m++) {
 477                                 if (da_file->value->data[m]->type == TYPE_STRING) {
 478                                         if (0 == strcmp(da_file->value->data[m]->key->ptr, "method")) {
 479                                                 method = ((data_string *)(da_file->value->data[m]))->value->ptr;
 480                                         } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "realm")) {
 481                                                 realm = ((data_string *)(da_file->value->data[m]))->value->ptr;
 482                                         } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "require")) {
 483                                                 require = ((data_string *)(da_file->value->data[m]))->value->ptr;
 484                                         } else {
 485                                                 log_error_write(srv, __FILE__, __LINE__, "ssbs",
 486                                                         "the field is unknown in:",
 487                                                         "auth.require = ( \"...\" => ( ..., -> \"",
 488                                                         da_file->value->data[m]->key,
 489                                                         "\" <- => \"...\" ) )");
 490
 491                                                 return HANDLER_ERROR;
 492                                         }
 493                                 } else {
 494                                         log_error_write(srv, __FILE__, __LINE__, "ssbs",
 495                                                 "a string was expected for:",
 496                                                 "auth.require = ( \"...\" => ( ..., -> \"",
 497                                                 da_file->value->data[m]->key,
 498                                                 "\" <- => \"...\" ) )");
 499
 500                                         return HANDLER_ERROR;
 501                                 }
 502                         }
 503
 504                         if (method == NULL) {
 505                                 log_error_write(srv, __FILE__, __LINE__, "ss",
 506                                                 "the method field is missing in:",
 507                                                 "auth.require = ( \"...\" => ( ..., \"method\" => \"...\" ) )");
 508                                 return HANDLER_ERROR;
 509                         } else {
 510                                 if (0 != strcmp(method, "basic") &&
 511                                     0 != strcmp(method, "digest") &&
 512                                     0 != strcmp(method, "extern")) {
 513                                         log_error_write(srv, __FILE__, __LINE__, "ss",
 514                                                         "method has to be either \"basic\", \"digest\" or \"extern\" in",
 515                                                         "auth.require = ( \"...\" => ( ..., \"method\" => \"...\") )");
 516                                         return HANDLER_ERROR;
 517                                 }
 518                         }
 519
 520                         if (realm == NULL) {
 521                                 log_error_write(srv, __FILE__, __LINE__, "ss",
 522                                                 "the realm field is missing in:",
 523                                                 "auth.require = ( \"...\" => ( ..., \"realm\" => \"...\" ) )");
 524                                 return HANDLER_ERROR;
 525                         }
 526
 527                         if (require == NULL) {
 528                                 log_error_write(srv, __FILE__, __LINE__, "ss",
 529                                                 "the require field is missing in:",
 530                                                 "auth.require = ( \"...\" => ( ..., \"require\" => \"...\" ) )");
 531                                 return HANDLER_ERROR;
 532                         }
 533
 534                         if (method && realm && require) {
 535                                 data_string *ds;
 536                                 data_array *a;
 537
 538                                 a = data_array_init();
 539                                 buffer_copy_buffer(a->key, da_file->key);
 540
 541                                 ds = data_string_init();
 542
 543                                 buffer_copy_string_len(ds->key, CONST_STR_LEN("method"));
 544                                 buffer_copy_string(ds->value, method);
 545
 546                                 array_insert_unique(a->value, (data_unset *)ds);
 547
 548                                 ds = data_string_init();
 549
 550                                 buffer_copy_string_len(ds->key, CONST_STR_LEN("realm"));
 551                                 buffer_copy_string(ds->value, realm);
 552
 553                                 array_insert_unique(a->value, (data_unset *)ds);
 554
 555                                 ds = data_string_init();
 556
 557                                 buffer_copy_string_len(ds->key, CONST_STR_LEN("require"));
 558                                 buffer_copy_string(ds->value, require);
 559
 560                                 array_insert_unique(a->value, (data_unset *)ds);
 561
 562                                 array_insert_unique(s->auth_require, (data_unset *)a);
 563                         }
 564                 }
 565
 566                 switch(s->auth_backend) {
 567                 case AUTH_BACKEND_LDAP: {
 568                         handler_t ret = auth_ldap_init(srv, s);
 569                         if (ret == HANDLER_ERROR)
 570                                 return (ret);
 571                         break;
 572                 }
 573                 default:
 574                         break;
 575                 }
 576         }
 577
 578         return HANDLER_GO_ON;
 579 }
 580
 581 handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s) {
 582 #ifdef USE_LDAP
 583         int ret;
 584 #if 0
 585         if (s->auth_ldap_basedn->used == 0) {
 586                 log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.base-dn has to be set");
 587
 588                 return HANDLER_ERROR;
 589         }
 590 #endif
 591
 592         if (!buffer_string_is_empty(s->auth_ldap_hostname)) {
 593                 /* free old context */
 594                 if (NULL != s->ldap) ldap_unbind_s(s->ldap);
 595
 596                 if (NULL == (s->ldap = ldap_init(s->auth_ldap_hostname->ptr, LDAP_PORT))) {
 597                         log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
 598
 599                         return HANDLER_ERROR;
 600                 }
 601
 602                 ret = LDAP_VERSION3;
 603                 if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(s->ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
 604                         log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
 605
 606                         return HANDLER_ERROR;
 607                 }
 608
 609                 if (s->auth_ldap_starttls) {
 610                         /* if no CA file is given, it is ok, as we will use encryption
 611                                 * if the server requires a CAfile it will tell us */
 612                         if (!buffer_string_is_empty(s->auth_ldap_cafile)) {
 613                                 if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,
 614                                                                 s->auth_ldap_cafile->ptr))) {
 615                                         log_error_write(srv, __FILE__, __LINE__, "ss",
 616                                                         "Loading CA certificate failed:", ldap_err2string(ret));
 617
 618                                         return HANDLER_ERROR;
 619                                 }
 620                         }
 621
 622                         if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(s->ldap, NULL,  NULL))) {
 623                                 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
 624
 625                                 return HANDLER_ERROR;
 626                         }
 627                 }
 628
 629
 630                 /* 1. */
 631                 if (!buffer_string_is_empty(s->auth_ldap_binddn)) {
 632                         if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, s->auth_ldap_binddn->ptr, s->auth_ldap_bindpw->ptr))) {
 633                                 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
 634
 635                                 return HANDLER_ERROR;
 636                         }
 637                 } else {
 638                         if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, NULL, NULL))) {
 639                                 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
 640
 641                                 return HANDLER_ERROR;
 642                         }
 643                 }
 644         }
 645         return HANDLER_GO_ON;
 646 #else
 647         UNUSED(s);
 648         log_error_write(srv, __FILE__, __LINE__, "s", "no ldap support available");
 649         return HANDLER_ERROR;
 650 #endif
 651 }
 652
 653 int mod_auth_plugin_init(plugin *p);
 654 int mod_auth_plugin_init(plugin *p) {
 655         p->version     = LIGHTTPD_VERSION_ID;
 656         p->name        = buffer_init_string("auth");
 657         p->init        = mod_auth_init;
 658         p->set_defaults = mod_auth_set_defaults;
 659         p->handle_uri_clean = mod_auth_uri_handler;
 660         p->cleanup     = mod_auth_free;
 661
 662         p->data        = NULL;
 663
 664         return 0;
 665 }