usertab.c

   1 /*
   2  * SARG Squid Analysis Report Generator      http://sarg.sourceforge.net
   3  *                                                            1998, 2013
   4  *
   5  * SARG donations:
   6  *      please look at http://sarg.sourceforge.net/donations.php
   7  * Support:
   8  *     http://sourceforge.net/projects/sarg/forums/forum/363374
   9  * ---------------------------------------------------------------------
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  24  *
  25  */
  26
  27 #include "include/conf.h"
  28 #include "include/defs.h"
  29
  30 #ifdef HAVE_LDAP_H
  31 #define LDAP_DEPRECATED 1
  32
  33 #include <ldap.h>
  34 #include <ldap_cdefs.h>
  35 #include <ldap_features.h>
  36
  37 #if defined(HAVE_ICONV_H)
  38 #include <iconv.h>
  39 #define USE_ICONV 1
  40 #endif //HAVE_ICONV_H
  41
  42 #endif //HAVE_LDAP_H
  43
  44 enum UserTabEnum
  45 {
  46         //! Users matched against the ::UserTabFile file.
  47         UTT_File,
  48         //! Users matched agains a LDAP.
  49         UTT_Ldap,
  50         //! No user matching performed.
  51         UTT_None
  52 };
  53
  54 enum UserTabEnum which_usertab=UTT_None;
  55
  56 static char *userfile=NULL;
  57
  58 #ifdef HAVE_LDAP_H
  59 static LDAP *ldap_handle=NULL;
  60 #endif //HAVE_LDAP_H
  61
  62 #ifdef USE_ICONV
  63 //! iconv conversion descriptor to convert the string returned by LDAP.
  64 static iconv_t ldapiconv=(iconv_t)-1;
  65 //! Buffer to store the converted string.
  66 static char *ldapconvbuffer=NULL;
  67 //! Size of the converted string buffer.
  68 static int ldapconvbuffersize=0;
  69 #endif
  70
  71 static void init_file_usertab(const char *UserTabFile)
  72 {
  73         FILE *fp_usr;
  74         long int nreg;
  75         char buf[MAXLEN];
  76         int z1, z2;
  77
  78         if((fp_usr=fopen(UserTabFile,"r"))==NULL) {
  79                 debuga(_("Cannot open file \"%s\": %s\n"),UserTabFile,strerror(errno));
  80                 exit(EXIT_FAILURE);
  81         }
  82         if (fseek(fp_usr, 0, SEEK_END)==-1) {
  83                 debuga(_("Failed to move till the end of the usertab file %s: %s\n"),UserTabFile,strerror(errno));
  84                 exit(EXIT_FAILURE);
  85         }
  86         nreg = ftell(fp_usr);
  87         if (nreg<0) {
  88                 debuga(_("Cannot get the size of file %s\n"),UserTabFile);
  89                 exit(EXIT_FAILURE);
  90         }
  91         nreg += 100;
  92         if (fseek(fp_usr, 0, SEEK_SET)==-1) {
  93                 debuga(_("Failed to rewind the usertab file %s: %s\n"),UserTabFile,strerror(errno));
  94                 exit(EXIT_FAILURE);
  95         }
  96         if((userfile=(char *) malloc(nreg))==NULL){
  97                 debuga(_("ERROR: Cannot load. Memory fault\n"));
  98                 exit(EXIT_FAILURE);
  99         }
 100         userfile[0]='\t';
 101         z2=1;
 102         while(fgets(buf,sizeof(buf),fp_usr)!=NULL) {
 103                 if (buf[0]=='#') continue;
 104                 fixendofline(buf);
 105                 z1=0;
 106                 while(buf[z1] && (unsigned char)buf[z1]>' ') {
 107                         if (z2+3>=nreg) { //need at least 3 additional bytes for the minimum string "\n\t\0"
 108                                 debuga(_("The list of the users is too long in your %s file.\n"),UserTabFile);
 109                                 exit(EXIT_FAILURE);
 110                         }
 111                         userfile[z2++]=buf[z1++];
 112                 }
 113                 while(buf[z1] && (unsigned char)buf[z1]<=' ') z1++;
 114                 userfile[z2++]='\n';
 115                 while(buf[z1] && (unsigned char)buf[z1]>=' ') {
 116                         if (z2+2>=nreg) { //need at least 2 additional bytes for "\t\0"
 117                                 debuga(_("The list of the users is too long in your %s file.\n"),UserTabFile);
 118                                 exit(EXIT_FAILURE);
 119                         }
 120                         userfile[z2++]=buf[z1++];
 121                 }
 122                 while(userfile[z2-1]==' ') z2--;
 123                 userfile[z2++]='\t';
 124         }
 125         userfile[z2]='\0';
 126         if (fclose(fp_usr)==EOF) {
 127                 debuga(_("Read error in \"%s\": %s\n"),UserTabFile,strerror(errno));
 128                 exit(EXIT_FAILURE);
 129         }
 130 }
 131
 132 static void get_usertab_name(const char *user,char *name,int namelen)
 133 {
 134         char warea[MAXLEN];
 135         char *str;
 136
 137         sprintf(warea,"\t%s\n",user);
 138         if((str=(char *) strstr(userfile,warea)) == (char *) NULL ) {
 139                 safe_strcpy(name,user,namelen);
 140         } else {
 141                 str=strchr(str+1,'\n');
 142                 str++;
 143                 namelen--;
 144                 for(z1=0; *str != '\t' && z1<namelen ; z1++) {
 145                         name[z1]=*str++;
 146                 }
 147                 name[z1]='\0';
 148         }
 149 }
 150
 151 #ifdef HAVE_LDAP_H
 152 static void init_ldap_usertab(void) {
 153         char *ldapuri;
 154         LDAPURLDesc url;
 155         int rc;
 156
 157         ldap_handle = NULL;
 158
 159         /* Setting LDAP connection and initializing cache */
 160         memset(&url,0,sizeof(url));
 161         url.lud_scheme = "ldap";
 162         url.lud_host = LDAPHost;
 163         url.lud_port = LDAPPort;
 164         url.lud_scope = LDAP_SCOPE_DEFAULT;
 165         ldapuri = ldap_url_desc2str(&url);
 166         if (ldapuri==NULL) {
 167                 debuga(_("Cannot prepare ldap URI for server %s on port %d\n"),LDAPHost,LDAPPort);
 168                 exit(EXIT_FAILURE);
 169         }
 170
 171         rc = ldap_initialize(&ldap_handle, ldapuri);
 172         if (rc != LDAP_SUCCESS) {
 173                 debuga(_("Unable to connect to LDAP server %s on port %d: %d (%s)\n"), LDAPHost, LDAPPort, rc, ldap_err2string(rc));
 174                 exit(EXIT_FAILURE);
 175         }
 176         ldap_memfree(ldapuri);
 177
 178         if (ldap_set_option(ldap_handle, LDAP_OPT_REFERRALS, LDAP_OPT_OFF) != LDAP_OPT_SUCCESS) {
 179                 debuga(_("Could not disable LDAP_OPT_REFERRALS\n"));
 180                 exit(EXIT_FAILURE);
 181         }
 182         int ldap_protocol_version = LDAPProtocolVersion;
 183         if (ldap_set_option(ldap_handle, LDAP_OPT_PROTOCOL_VERSION, &ldap_protocol_version) != LDAP_SUCCESS) {
 184                 debuga(_("Could not set LDAP protocol version %d\n"), ldap_protocol_version);
 185                 exit(EXIT_FAILURE);
 186         }
 187
 188         /* Bind to the LDAP server. */
 189         rc = ldap_simple_bind_s( ldap_handle, LDAPBindDN, LDAPBindPW );
 190         if ( rc != LDAP_SUCCESS ) {
 191                 debuga(_("Cannot bind to LDAP server: %s\n"), ldap_err2string(rc));
 192                 exit(EXIT_FAILURE);
 193         }
 194
 195 #ifdef USE_ICONV
 196         // prepare for the string conversion
 197         if (LDAPNativeCharset[0]!='\0') {
 198                 ldapiconv = iconv_open( LDAPNativeCharset, "UTF-8" );
 199                 if (ldapiconv==(iconv_t)-1) {
 200                         debuga(_("iconv cannot convert from UTF-8 to %s: %s\n"),LDAPNativeCharset,strerror(errno));
 201                         exit(EXIT_FAILURE);
 202                 }
 203         }
 204         ldapconvbuffer=NULL;
 205         ldapconvbuffersize=0;
 206 #endif
 207
 208         /* Initializing cache */
 209
 210         init_cache();
 211 }
 212
 213 const char * charset_convert( const char * str_in, const char * charset_to )
 214 {
 215 #ifdef USE_ICONV
 216         size_t return_value;
 217         const char * str_in_orig;
 218         char * str_out;
 219         size_t str_in_len;
 220         size_t str_out_len;
 221
 222         str_in_len = strlen( str_in ) + 1;//process the terminating NUL too
 223         str_out_len = ( 2 * str_in_len );
 224         if (ldapconvbuffer==NULL || ldapconvbuffersize<str_out_len) {
 225                 ldapconvbuffersize=str_out_len;
 226                 str_out = realloc(ldapconvbuffer,ldapconvbuffersize);
 227                 if (!str_out) {
 228                         debuga(_("Not enough memory to convert a LDAP returned string: %lu bytes required\n"),(unsigned long int)str_out_len);
 229                         exit(EXIT_FAILURE);
 230                 }
 231                 ldapconvbuffer = str_out;
 232         } else {
 233                 str_out = ldapconvbuffer;
 234                 str_out_len = ldapconvbuffersize;
 235         }
 236         str_in_orig = str_in;
 237         return_value = iconv(ldapiconv, (ICONV_CONST char **)&str_in, &str_in_len, &str_out, &str_out_len );
 238         if ( return_value == ( size_t ) -1 ) {
 239                 debuga(_("iconv failed in string \"%s\":\n"),str_in_orig);
 240                 switch ( errno ) {
 241                         /* See "man 3 iconv" for an explanation. */
 242                         case EILSEQ:
 243                                 debuga(_("Invalid multibyte sequence.\n"));
 244                                 break;
 245                         case EINVAL:
 246                                 debuga(_("Incomplete multibyte sequence.\n"));
 247                                 break;
 248                         case E2BIG:
 249                                 debuga(_("No more room.\n"));
 250                                 break;
 251                         default:
 252                                 debuga(_("Error: %s.\n"),strerror( errno ));
 253                 }
 254                 exit(EXIT_FAILURE);
 255         }
 256         return(ldapconvbuffer);
 257 #else //USE_ICONV
 258         return(str_in);
 259 #endif //USE_ICONV
 260 }
 261
 262 static void get_ldap_name(const char *userlogin,char *mappedname,int namelen)
 263 {
 264         /* Start searching username in cache */
 265         // According to rfc2254 section 4, only *()\ and NUL must be escaped. This list is rather conservative !
 266         const char strictchars[] = " ~!@^&(){}|<>?:;\"\'\\[]`,\r\n\0";
 267         char filtersearch[256], *searched_in_cache;
 268         char searchloginname[3*MAX_USER_LEN];
 269         char *attr, **vals;
 270         const char *attr_out;
 271         const char *ptr;
 272         LDAPMessage *result, *e;
 273         BerElement *ber;
 274         int i;
 275         int slen;
 276         int rc;
 277         char *attrs[2];
 278
 279         searched_in_cache = search_in_cache(userlogin);
 280         if (searched_in_cache!=NULL) {
 281                 safe_strcpy(mappedname, searched_in_cache,namelen);
 282                 return;
 283         }
 284
 285         // escape characters according to rfc2254 section 4
 286         for (slen=0 , ptr=userlogin ; slen<sizeof(searchloginname)-1 && *ptr ; ptr++) {
 287                 if (strchr(strictchars,*ptr)) {
 288                         if (slen+3>=sizeof(searchloginname)-1) break;
 289                         slen+=sprintf(searchloginname+slen,"\\%02X",*ptr);
 290                 } else {
 291                         searchloginname[slen++]=*ptr;
 292                 }
 293         }
 294         searchloginname[slen]='\0';
 295
 296         i=0;
 297         ptr=LDAPFilterSearch;
 298         while (i<sizeof(filtersearch)-1 && *ptr) {
 299                 if (ptr[0]=='%' && ptr[1]=='s') {
 300                         if (i+slen>=sizeof(filtersearch)) break;
 301                         memcpy(filtersearch+i,searchloginname,slen);
 302                         i+=slen;
 303                         ptr+=2;
 304                 } else {
 305                         filtersearch[i++]=*ptr++;
 306                 }
 307         }
 308         filtersearch[i]='\0';
 309
 310         /* Search record(s) in LDAP base */
 311         attrs[0]=LDAPTargetAttr;
 312         attrs[1]=NULL;
 313         rc= ldap_search_ext_s(ldap_handle, LDAPBaseSearch, LDAP_SCOPE_SUBTREE, filtersearch, attrs, 0, NULL, NULL, NULL, -1, &result);
 314         if (rc != LDAP_SUCCESS) {
 315                 debuga(_("LDAP search failed: %s\n"), ldap_err2string(rc));
 316                 debuga(_("looking for \"%s\" at or below \"%s\"\n"),filtersearch,LDAPBaseSearch);
 317                 safe_strcpy(mappedname,userlogin,namelen);
 318                 return;
 319         }
 320
 321         if (!(e = ldap_first_entry(ldap_handle, result))) {
 322                 insert_to_cache(userlogin, userlogin);
 323                 safe_strcpy(mappedname, userlogin,namelen);
 324                 return;
 325         }
 326
 327         for (attr = ldap_first_attribute(ldap_handle, e, &ber); attr != NULL; attr = ldap_next_attribute(ldap_handle, e, ber)) {
 328                 if (!strcasecmp(attr, LDAPTargetAttr)) {
 329                         if ((vals = (char **)ldap_get_values(ldap_handle, e, attr))!=NULL) {
 330                                 attr_out = charset_convert( vals[0], LDAPNativeCharset );
 331                                 insert_to_cache(userlogin, attr_out);
 332                                 safe_strcpy(mappedname, attr_out, namelen);
 333                                 ldap_memfree(vals);
 334                         }
 335                         ldap_memfree(attr);
 336                         break;
 337                 }
 338                 ldap_memfree(attr);
 339         }
 340         ldap_msgfree(result);
 341 }
 342 #endif //HAVE_LDAP_H
 343
 344 void init_usertab(const char *UserTabFile)
 345 {
 346         if (strcmp(UserTabFile, "ldap") == 0) {
 347                 if(debug)
 348                         debuga(_("Loading User table: %s\n"),UserTabFile);
 349 #ifdef HAVE_LDAP_H
 350                 which_usertab=UTT_Ldap;
 351                 init_ldap_usertab();
 352 #else
 353                 debuga(_("LDAP module not compiled in sarg\n"));
 354                 exit(EXIT_FAILURE);
 355 #endif //HAVE_LDAP_H
 356         } else if (UserTabFile[0] != '\0') {
 357                 if(debug)
 358                         debuga(_("Loading User table: %s\n"),UserTabFile);
 359                 which_usertab=UTT_File;
 360                 init_file_usertab(UserTabFile);
 361         } else {
 362                 which_usertab=UTT_None;
 363         }
 364 }
 365
 366 void user_find(char *mappedname, int namelen, const char *userlogin)
 367 {
 368         if (which_usertab==UTT_File) {
 369                 get_usertab_name(userlogin,mappedname,namelen);
 370         }
 371 #ifdef HAVE_LDAP_H
 372         else if (which_usertab==UTT_Ldap) {
 373                 get_ldap_name(userlogin,mappedname,namelen);
 374         }
 375 #endif //HAVE_LDAP_H
 376         else {
 377                 safe_strcpy(mappedname,userlogin,namelen);
 378         }
 379 }
 380
 381 void close_usertab(void)
 382 {
 383 #ifdef HAVE_LDAP_H
 384         if (ldap_handle) {
 385                 destroy_cache();
 386                 ldap_unbind(ldap_handle);
 387                 ldap_handle=NULL;
 388         }
 389 #endif //HAVE_LDAP_H
 390 #ifdef USE_ICONV
 391         if (ldapiconv!=(iconv_t)-1) {
 392                 iconv_close (ldapiconv);
 393                 ldapiconv=(iconv_t)-1;
 394         }
 395         if (ldapconvbuffer) {
 396                 free(ldapconvbuffer);
 397                 ldapconvbuffer=NULL;
 398         }
 399 #endif // USE_ICONV
 400         if(userfile) {
 401                 free(userfile);
 402                 userfile=NULL;
 403         }
 404 }
 405