Changeset 253

Timestamp:

04/05/2005 10:41:05 AM (3 years ago)

Author:

jan

Message:

added starttls patch for auth-ldap (Dick Davies)

Location:

trunk

Files:

• doc/authentification.txt (modified) (6 diffs)
• src/http_auth.c (modified) (1 diff)
• src/http_auth.h (modified) (1 diff)
• src/mod_auth.c (modified) (7 diffs)

trunk/doc/authentification.txt

@@ -40 +40 @@
 
 The Digest method only transfers a hashed value over the 
-network which is performes a lot of work to harden the 
+network which performs a lot of work to harden the 
 authentification process in insecure networks.
 
@@ -113 +113 @@
 ````
 
-the ldap backend is basicly performing the following steps 
+the ldap backend is basically performing the following steps 
 to authenticate a user
   
@@ -121 +121 @@
 4. disconnect
    
-if step 4 is performs without any error the user is 
+if all 4 steps are performed without any error the user is 
 authenticated
 
@@ -153 +153 @@
   auth.backend.ldap.base-dn  = "dc=my-domain,dc=com"
   auth.backend.ldap.filter   = "(uid=$)"
+  # if enabled, startTLS needs a valid (base64-encoded) CA 
+  # certificate
+  auth.backend.ldap.starttls   = "enable"
+  auth.backend.ldap.cafile   = "/etc/CAcertificate.pem"
 
   ## restrictions
@@ -163 +167 @@
   # )
   #
-  # <realm> is a string that is should be display in the dialog 
+  # <realm> is a string to display in the dialog 
   #         presented to the user and is also used for the 
   #         digest-algorithm and has to match the realm in the 
@@ -183 +187 @@
                  )
 
-Limitiations
+Limitations
 ============
 
 - The implementation of digest method is currently not 
-  completely conforming to the standard as it is still allowing 
+  completely compliant with the standard as it still allows
   a replay attack.
 

trunk/src/http_auth.c

@@ -570 +570 @@
                 }
                 
+                if (p->conf.auth_ldap_starttls == 1) {
+                        if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(ldap, NULL,  NULL))) {
+                                log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
+                
+                                ldap_unbind_s(ldap);
+                                
+                                return -1;
+                        }
+                }
+
                 
                 if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(ldap, dn, pw))) {

trunk/src/http_auth.h

@@ -29 +29 @@
         buffer *auth_ldap_basedn;
         buffer *auth_ldap_filter;
+        buffer *auth_ldap_cafile;
+        unsigned short auth_ldap_starttls;
         
         unsigned short auth_debug;

trunk/src/mod_auth.c

@@ -71 +71 @@
                         buffer_free(s->auth_ldap_basedn);
                         buffer_free(s->auth_ldap_filter);
+                        buffer_free(s->auth_ldap_cafile);
                         
 #ifdef USE_LDAP
@@ -134 +135 @@
                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.filter"))) {
                                 PATCH(auth_ldap_filter);
+                        } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.ca-file"))) {
+                                PATCH(auth_ldap_cafile);
+                        } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.starttls"))) {
+                                PATCH(auth_ldap_starttls);
                         }
                 }
@@ -156 +161 @@
         PATCH(auth_ldap_basedn);
         PATCH(auth_ldap_filter);
+        PATCH(auth_ldap_cafile);
+        PATCH(auth_ldap_starttls);
 #ifdef USE_LDAP
         PATCH(ldap);
@@ -300 +307 @@
                 { "auth.backend.ldap.base-dn",      NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
                 { "auth.backend.ldap.filter",       NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
+                { "auth.backend.ldap.ca-file",       NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
+                { "auth.backend.ldap.starttls",     NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },
                 { "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
                 { "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
-                { "auth.debug",                     NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION }, /* 9 */
+                { "auth.debug",                     NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION }, /* 11 */
                 { NULL,                             NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
         };
@@ -324 +333 @@
                 s->auth_ldap_basedn = buffer_init();
                 s->auth_ldap_filter = buffer_init();
+                s->auth_ldap_cafile = buffer_init();
+                s->auth_ldap_starttls = 0;
                 s->auth_debug = 0;
                 
@@ -341 +352 @@
                 cv[5].destination = s->auth_ldap_basedn;
                 cv[6].destination = s->auth_ldap_filter;
-                cv[7].destination = s->auth_htdigest_userfile;
-                cv[8].destination = s->auth_htpasswd_userfile;
-                cv[9].destination = &(s->auth_debug);
+                cv[7].destination = s->auth_ldap_cafile;
+                cv[8].destination = &(s->auth_ldap_starttls);
+                cv[9].destination = s->auth_htdigest_userfile;
+                cv[10].destination = s->auth_htpasswd_userfile;
+                cv[11].destination = &(s->auth_debug);
                 
                 p->config_storage[i] = s;
@@ -535 +548 @@
                                 if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(s->ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
                                         log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
-                                        
-                                        return HANDLER_ERROR;
+                                
+                                        return HANDLER_ERROR;
+                                }
+                        
+                                if (s->auth_ldap_starttls && !buffer_is_empty(s->auth_ldap_cafile) ) {
+                                        if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, s->auth_ldap_cafile->ptr))) {
+                                                log_error_write(srv, __FILE__, __LINE__, "ss", "Loading CA certificate failed:", ldap_err2string(ret));
+                                                
+                                                return HANDLER_ERROR;
+                                        }
+        
+                                        if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(s->ldap, NULL,  NULL))) {
+                                                log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
+                                                
+                                                return HANDLER_ERROR;
+                                        }
                                 }