diff options
| -rw-r--r-- | client.c | 30 | ||||
| -rw-r--r-- | client.h | 2 | ||||
| -rw-r--r-- | helper.c | 12 | ||||
| -rw-r--r-- | helper.h | 1 | ||||
| -rw-r--r-- | ldadp.c | 14 | ||||
| -rw-r--r-- | proxy.c | 98 | ||||
| -rw-r--r-- | proxy.h | 4 | ||||
| -rw-r--r-- | server.c | 99 | ||||
| -rw-r--r-- | server.h | 6 | ||||
| -rw-r--r-- | types.h | 12 |
10 files changed, 162 insertions, 116 deletions
@@ -15,7 +15,7 @@ static void client_haveIn(epoll_client_t *client); static void client_haveOut(epoll_client_t *client); -static void client_free(epoll_client_t *client) +void client_free(epoll_client_t *client) { proxy_removeClient(client); if (client->sendBuffer != NULL) free(client->sendBuffer); @@ -31,7 +31,7 @@ void client_callback(void *data, int haveIn, int haveOut, int doCleanup) { epoll_client_t *client = (epoll_client_t*)data; if (doCleanup || client->kill) { - printf("Client gone (1).\n"); + //printf("Client gone (1).\n"); client_free(client); return; } @@ -40,7 +40,7 @@ void client_callback(void *data, int haveIn, int haveOut, int doCleanup) if (haveIn) client_haveIn(client); if (haveOut) client_haveOut(client); if (client->kill) { - printf("Client gone (2).\n"); + //printf("Client gone (2).\n"); client_free(client); } return; @@ -49,7 +49,7 @@ void client_callback(void *data, int haveIn, int haveOut, int doCleanup) if (!client->sslAccepted) { // Still SSL-Connecting if (!ssl_acceptClient(client)) { - printf("SSL Client accept failed.\n"); + printf("[Proxy] SSL Client accept failed.\n"); client_free(client); return; } @@ -59,7 +59,7 @@ void client_callback(void *data, int haveIn, int haveOut, int doCleanup) client_haveIn(client); client_haveOut(client); if (client->kill) { - printf("Client gone (3).\n"); + //printf("Client gone (3).\n"); client_free(client); } } @@ -68,7 +68,7 @@ static void client_haveIn(epoll_client_t *client) { for (;;) { if (client->rbPos >= REQLEN) { - printf("[C->Proxy] Read buffer overflow. Disconnecting.\n"); + printf("[Proxy] Buffer overflow reading from client. Disconnecting.\n"); client->kill = TRUE; return; } @@ -80,7 +80,7 @@ static void client_haveIn(epoll_client_t *client) if (ret < 0 && errno == EINTR) continue; if (ret < 0 && errno == EAGAIN) break; if (ret <= 0) { - printf("Client gone while reading.\n"); + printf("[Proxy] Client gone while reading (ret=%d, errno=%d).\n", (int)ret, errno); client->kill = TRUE; return; } @@ -90,7 +90,7 @@ static void client_haveIn(epoll_client_t *client) if (ret <= 0) { int err = SSL_get_error(client->ssl, ret); if (SSL_BLOCKED(err)) break; - printf("Client gone while reading (%d, %d).\n", (int)ret, err); + printf("[Proxy] SSL client gone while reading (ret=%d, err=%d).\n", (int)ret, err); client->kill = TRUE; return; } @@ -104,9 +104,8 @@ static void client_haveIn(epoll_client_t *client) if (consumed == 0) break; // Length-Header not complete len += consumed; if (len > client->rbPos) break; // Body not complete yet - printf("Received complete requrest...\n"); if (!proxy_fromClient(client, len)) { - printf("Error parsing request from client.\n"); + printf("[Proxy] Error parsing request from client.\n"); client->kill = TRUE; return; } @@ -134,7 +133,7 @@ static void client_haveOut(epoll_client_t *client) if (ret < 0 && errno == EINTR) continue; if (ret < 0 && errno == EAGAIN) return; if (ret <= 0) { - printf("Cannot send to client (ret: %d, errno: %d)\n", (int)ret, errno); + printf("[Proxy] Cannot send to client (ret=%d, errno=%d)\n", (int)ret, errno); client->kill = TRUE; return; } @@ -147,7 +146,7 @@ static void client_haveOut(epoll_client_t *client) client->writeBlocked = TRUE; return; // Blocking } - printf("SSL client gone while sending (%d)\n", err); + printf("[Proxy] SSL cannot send to client (ret=%d, err=%d)\n", (int)ret, err); ERR_print_errors_fp(stdout); client->kill = TRUE; return; // Closed @@ -173,7 +172,7 @@ BOOL client_send(epoll_client_t *client, const char *buffer, size_t len, const B // Nothing in send buffer, fire away const int ret = write(client->fd, buffer, len); if (ret == 0 || (ret < 0 && errno != EINTR && errno != EAGAIN)) { - printf("Client gone when trying to send.\n"); + printf("[Proxy] Client gone when trying to send.\n"); client->kill = TRUE; return FALSE; } @@ -187,7 +186,7 @@ BOOL client_send(epoll_client_t *client, const char *buffer, size_t len, const B // Buffer... if (client->sbLen - client->sbFill < len) { // Buffer too small? if (client->writeBlocked) { - printf("SSL Write blocked and buffer to small (%d)\n", (int)client->sbLen); + printf("[Proxy] SSL write to client blocked and buffer to small (%d bytes)\n", (int)client->sbLen); client->kill = TRUE; return FALSE; } @@ -198,7 +197,7 @@ BOOL client_send(epoll_client_t *client, const char *buffer, size_t len, const B } // Sanity if (client->sbFill + len > MAX_SEND_BUFFER) { - printf("Dropping client as the send buffer would exceed %d bytes.\n", (int)MAX_SEND_BUFFER); + printf("[Proxy] Dropping client as the send buffer would exceed %d bytes.\n", (int)MAX_SEND_BUFFER); client->kill = TRUE; return FALSE; } @@ -207,7 +206,6 @@ BOOL client_send(epoll_client_t *client, const char *buffer, size_t len, const B client->kill = TRUE; return FALSE; } - printf("Send Buffer now %d\n", (int)client->sbLen); } } // Finally append to buffer @@ -3,6 +3,8 @@ #include "types.h" +void client_free(epoll_client_t *client); + void client_callback(void *data, int haveIn, int haveOut, int doCleanup); BOOL client_send(epoll_client_t *client, const char *buffer, size_t len, const BOOL cork); @@ -111,6 +111,18 @@ void helper_printal(struct AttributeDescriptionList* a) putchar('\n'); } +void helper_printpal(struct PartialAttributeList *pal) +{ + printf("-- PAL --\n"); + while (pal) { + printf("entry ("); + if (pal->type.l && pal->type.s) printf("%.*s", (int)pal->type.l, pal->type.s); + printf("): "); + helper_printal(pal->values); + pal = pal->next; + } +} + static void helper_printfilterInt(struct Filter* f) { if (f == NULL) { @@ -11,6 +11,7 @@ void helper_nonblock(const int fd); void helper_printava(struct AttributeValueAssertion* a,const char* rel); void helper_printal(struct AttributeDescriptionList* a); +void helper_printpal(struct PartialAttributeList *pal); void helper_printfilter(struct Filter* f); static inline int min(const int a, const int b) @@ -27,6 +27,7 @@ int main(int argc, char **argv) printf("Nö\n"); exit(1); } + setbuf(stdout, NULL); signal(SIGPIPE, SIG_IGN); if (strcmp(argv[1], "-n") == 0 && argc > 2) { isdaemon = FALSE; @@ -77,11 +78,10 @@ static void listen_callback(void *data, int haveIn, int haveOut, int doCleanup) uint16 port; int sock = socket_accept4(listen->fd, remote, &port); if (sock < 0) { - printf("Error accepting new connection.\n"); + printf("[Proxy] Error accepting new connection.\n"); return; } helper_nonblock(sock); - printf("Accepted connection.\n"); SSL *ssl = NULL; if (listen->sslContext != NULL) { ssl = ssl_new(sock, listen->sslContext); @@ -95,7 +95,7 @@ static void listen_callback(void *data, int haveIn, int haveOut, int doCleanup) client->callback = &client_callback; client->ssl = ssl; if (ssl != NULL && !ssl_acceptClient(client)) { - printf("SSL-Accepting client failed.\n"); + printf("[Proxy] SSL-Accepting client failed.\n"); SSL_free(ssl); close(sock); free(client); @@ -123,10 +123,10 @@ static int loadConfig_handler(void *stuff, const char *section, const char *key, server_setPassword(section, value); } else if (strcmp(key, "base") == 0) { server_setBase(section, value); - } else if (strcmp(key, "home") == 0 && *value != '\0') { - server_setHomeTemplate(section, value); - } else if (strcmp(key, "fingerprint") == 0 && *value != '\0') { - server_setFingerprint(section, value); + } else if (strcmp(key, "home") == 0) { + if (value[0] != '\0') server_setHomeTemplate(section, value); + } else if (strcmp(key, "fingerprint") == 0) { + if (value[0] != '\0') server_setFingerprint(section, value); } else if (strcmp(key, "port") == 0) { server_setPort(section, value); } else { @@ -9,6 +9,7 @@ #include <ctype.h> #include <stdlib.h> #include <stdarg.h> +#include <sys/socket.h> #define MAXPENDING 200 #define MAX(a,b) ((a) > (b) ? (a) : (b)) @@ -36,12 +37,6 @@ typedef struct attr_t attr; } pending_t; -typedef struct -{ - const char *search; - struct string replace; -} replace_t; - static pending_t _pendingRequest[MAXPENDING]; static int _pendingCount = 0; @@ -148,7 +143,7 @@ BOOL proxy_fromClient(epoll_client_t *client, const size_t maxLen) size_t len; const size_t res = scan_ldapmessage(client->readBuffer, client->readBuffer + maxLen, &messageId, &op, &len); if (res == 0) return FALSE; - printf("[C] scan_ldapmessage: Consumed %d, remaining length %d, id %lu, op %lu\n", (int)res, (int)len, messageId, op); + //printf("[C] scan_ldapmessage: Consumed %d, remaining length %d, id %lu, op %lu\n", (int)res, (int)len, messageId, op); // TODO: Caching switch (op) { case BindRequest: @@ -161,7 +156,7 @@ BOOL proxy_fromClient(epoll_client_t *client, const size_t maxLen) return TRUE; } -void proxy_removeClient(const epoll_client_t *client) +void proxy_removeClient(epoll_client_t * const client) { int i, lastValid = -1; for (i = 0; i < _pendingCount; ++i) { @@ -169,6 +164,20 @@ void proxy_removeClient(const epoll_client_t *client) else if (_pendingRequest[i].client != NULL) lastValid = i; } _pendingCount = lastValid + 1; + if (client->fixedServer != NULL) { + client->fixedServer->kill = TRUE; + shutdown(client->fixedServer->fd, SHUT_RDWR); + client->fixedServer->fixedClient = NULL; + } +} + +void proxy_removeServer(epoll_server_t * const server) +{ + if (server->fixedClient != NULL) { + server->fixedClient->kill = TRUE; + if (server->fixedClient->sbFill == 0) shutdown(server->fixedClient->fd, SHUT_RDWR); + server->fixedClient->fixedServer = NULL; + } } BOOL proxy_fromServer(epoll_server_t *server, const size_t maxLen) @@ -179,7 +188,7 @@ BOOL proxy_fromServer(epoll_server_t *server, const size_t maxLen) if (res == 0) { return FALSE; } - printf("[AD] scan_ldapmessage: Consumed %d, remaining length %d, id %lu, op %lu\n", (int)res, (int)len, messageId, op); + //printf("[AD] scan_ldapmessage: Consumed %d, remaining length %d, id %lu, op %lu\n", (int)res, (int)len, messageId, op); switch (op) { case BindResponse: return proxy_serverBindResponse(server, messageId, res, maxLen); @@ -496,8 +505,8 @@ static void response_replacePal(server_t *server, struct PartialAttributeList ** ADDATTR(homeDirectory, "/home/%s", user); ADDATTR(gecos, "%s,,,", user); ADDATTR(cn, "%s", user); + if (wasNumeric) user++; // From here on, user is the real AD username, no leading 's' if (attr->homeMount && server->homeTemplate[0] != '\0') { - if (wasNumeric) user++; ADDATTR(homeMount, server->homeTemplate, user, user, user, user, user, user); } // Do this here so user++ will have been executed @@ -596,20 +605,22 @@ static BOOL proxy_clientSearchRequest(epoll_client_t *client, const unsigned lon } server_t *server = server_getFromBase(&req.baseObject); if (server == NULL) { - printf("scan_ldapsearchrequest: baseObj '%.*s' unknown (scope %d).\n", (int)req.baseObject.l, req.baseObject.s, (int)req.scope); + printf("[Client] Invalid search request: baseObj '%.*s' unknown (scope %d).\n", (int)req.baseObject.l, req.baseObject.s, (int)req.scope); return FALSE; } - printf("scan_ldapsearchrequest: baseObj: %.*s, scope: %d, derefAliases: %d\n", (int)req.baseObject.l, req.baseObject.s, req.scope, req.derefAliases); + //printf("scan_ldapsearchrequest: baseObj: %.*s, scope: %d, derefAliases: %d\n", (int)req.baseObject.l, req.baseObject.s, req.scope, req.derefAliases); // Try to figure out if this is a lookup for a user/multiple users, or something else (eg. group) if (!request_isUserFilter(req.filter)) { // Handle locally - printf("Handling local:\n"); + printf("[Client] Search request (handling local): "); helper_printfilter(req.filter); const BOOL ret = proxy_localSearchRequest(client, messageId, &req); free_ldapsearchrequest(&req); return ret; } // Forward + printf("[Client] Search request (forwarding): "); + helper_printfilter(req.filter); if (req.sizeLimit == 0 || req.sizeLimit > 20) req.sizeLimit = 20; // TODO: Magic value pending_t *pending = proxy_getFreePendingSlot(client); if (pending == NULL) { @@ -622,15 +633,15 @@ static BOOL proxy_clientSearchRequest(epoll_client_t *client, const unsigned lon } else { request_replaceAdl(server, &req.attributes, &pending->attr); } - helper_printfilter(req.filter); request_replaceFilter(server, &req.filter); - helper_printfilter(req.filter); - helper_printal(req.attributes); - //printf("Attrs: "); - //for (size_t i = 0; i < sizeof(attr_t); ++i) putchar(((char*)&pending->attr)[i] == 0 ? '0' : '1'); - //putchar('\n'); + //helper_printfilter(req.filter); + //helper_printal(req.attributes); pending->clientMessageId = messageId; - pending->serverMessageId = server_searchRequest(server, &req); + if (client->fixedServer == NULL) { + pending->serverMessageId = server_searchRequest(server, &req); + } else { + pending->serverMessageId = server_searchRequestOnConnection(client->fixedServer, &req); + } if (pending->serverMessageId == 0) { // Failed to forward.. TODO: Fail client printf("Failed to forward search request.\n"); @@ -648,10 +659,9 @@ static BOOL proxy_serverSearchResult(epoll_server_t *server, const unsigned long if (bodyBuffer == NULL) bodyBuffer = malloc(MAXMSGLEN); pending_t *pending = proxy_getPendingFromServer(messageId); if (pending == NULL) { - printf("No client matching server message id %lu\n", messageId); + printf("[AD] Received message with unknown messageId %lu, ignoring\n", messageId); return TRUE; } - printf("ServerID %lu -> ClientID %lu\n", messageId, pending->clientMessageId); const char *body; size_t bodyLen; if (type == SearchResultDone) { @@ -700,36 +710,43 @@ static BOOL proxy_clientBindRequest(epoll_client_t *client, const unsigned long if (res == 0) return FALSE; // Parsing request failed if (method != 0) { // Other than simple bind - currently not supported - printf("Unsupported bind method: %lu\n", method); + printf("[Client] Unsupported bind method: %lu\n", method); bodyLen = fmt_ldapbindresponse(bufoff, authMethodNotSupported, "", "SIMPLE only", ""); } else { // Simple bind :-) - const size_t res2 = scan_ldapstring(client->readBuffer + offset + res, client->readBuffer + maxLen, &password); - printf("scan_ldapbindrequest: Consumed %d, version %lu, method %lu, name '%.*s'\n", (int)(res + res2), version, method, (int)name.l, name.s); + password.l = 0; + scan_ldapstring(client->readBuffer + offset + res, client->readBuffer + maxLen, &password); + //printf("scan_ldapbindrequest: Consumed %d, version %lu, method %lu, name '%.*s'\n", (int)(res + res2), version, method, (int)name.l, name.s); if (name.l == 0 && password.l == 0) { // Anonymous bind used for "normal" lookups - printf("Anonymous bind ok\n"); + printf("[Client] Anonymous bind accepted\n"); bodyLen = fmt_ldapbindresponse(bufoff, success, "", "main screen turn on", ""); } else { + BOOL incorrect; server_t *server = server_getFromBase(&name); - if (server == NULL || strncmp(password.s, "\x08\x0a\x0d\x7fINCORRECT", 13) == 0 || isInt(&name, 0)) { - // The INCORRECT part is some weird thing I saw pam_ldap do - save the round trip to AD and deny - printf("Password INCORRECT or binddn unknown or numeric username\n"); + if (server == NULL || (incorrect = (strncmp(password.s, "\x08\x0a\x0d\x7fINCORRECT", 13) == 0)) || isInt(&name, 0)) { + // The INCORRECT part is some weird thing I saw pam_ldap do - probably to identify misconfigured + // LDAP servers/accounts that will accept any password - save the round trip to AD and deny + if (!incorrect) printf("[Client] Numeric account or invalid binddn for %.*s\n", (int)name.l, name.s); bodyLen = fmt_ldapbindresponse(bufoff, invalidCredentials, "", "invalid credentials", ""); } else { - // Seems to be an actual bind - forward to AD - TODO: SASL (DIGEST-MD5?) + // Seems to be an actual bind - forward to AD - TODO: SASL (DIGEST-MD5? Something?) fixUnNumeric(&name); pending_t *pending = proxy_getFreePendingSlot(client); - const unsigned long smid = server_tryUserBind(server, &name, &password); + epoll_server_t *con; + const unsigned long smid = server_tryUserBind(server, &name, &password, &con); if (pending == NULL || smid == 0) { // Busy if (pending != NULL) pending->client = NULL; - printf("Too many pending requests, or cannot connect to AD\n"); + printf("[Client] Too many pending requests, or cannot connect to AD for bind\n"); bodyLen = fmt_ldapbindresponse(bufoff, busy, "", "can't handle it", ""); } else { // Request queued, client needs to wait + printf("[Client] Forwarding bind to AD for user %.*s\n", (int)name.l, name.s); pending->clientMessageId = messageId; pending->serverMessageId = smid; + con->fixedClient = client; + client->fixedServer = con; return TRUE; } } @@ -747,8 +764,13 @@ static BOOL proxy_serverBindResponse(epoll_server_t *server, const unsigned long struct string binddn, error, refer; const size_t res = scan_ldapbindresponse(server->readBuffer + offset, server->readBuffer + maxLen, &result, &binddn, &error, &refer); if (res == 0) return FALSE; // Parsing request failed - printf("scan_ldapbindresponse: Consumed %d, result: %lu, binddn: %.*s, error: %.*s, referral: %.*s\n", (int)res, result, (int)binddn.l, binddn.s, (int)error.l, error.s, (int)refer.l, refer.s); - if (result == success) server->bound = TRUE; + //printf("scan_ldapbindresponse: Consumed %d, result: %lu, binddn: %.*s, error: %.*s, referral: %.*s\n", (int)res, result, (int)binddn.l, binddn.s, (int)error.l, error.s, (int)refer.l, refer.s); + server->bound = (result == success); + if (server->bound) { + printf("[AD] Accepted credentials (#%lu)\n", messageId); + } else { + printf("[AD] Wrong credentials (#%lu)\n", messageId); + } if (messageId <= 1) return TRUE; // Was a forwarded auth pending_t *pending = proxy_getPendingFromServer(messageId); @@ -759,7 +781,7 @@ static BOOL proxy_serverBindResponse(epoll_server_t *server, const unsigned long client_send(pending->client, buffer, headerLen, TRUE); client_send(pending->client, server->readBuffer + offset, res, FALSE); pending->client = NULL; - return FALSE; // Return FALSE here so server.c will kill off this server connection + return server->bound; // Return FALSE here so server.c will kill off this server connection } // ---- Local handling ---- @@ -778,7 +800,7 @@ static void prependPal(struct SearchResultEntry *dest, struct PartialAttributeLi static BOOL proxy_localFeatureReply(epoll_client_t *client, const unsigned long messageId) { - printf("Sending fake feature request reply\n"); + printf("[Proxy] Sending static feature request reply to client\n"); struct SearchResultEntry sre; struct PartialAttributeList vers; struct AttributeDescriptionList versVal; @@ -818,7 +840,7 @@ static BOOL proxy_localSearchRequest(epoll_client_t *client, const unsigned long } if (number == 1001 || name.l != 0) { // At least one of them was set - printf("Sending fake group membership\n"); + printf("[Proxy] Sending static group membership to client\n"); struct SearchResultEntry sre; struct PartialAttributeList gidNumber, cn, objectClass; struct AttributeDescriptionList gidNumberVal, cnVal, objectClassVal; @@ -835,7 +857,7 @@ static BOOL proxy_localSearchRequest(epoll_client_t *client, const unsigned long fmt_ldapsearchresultentry(buffer + headerLen, &sre); client_send(client, buffer, headerLen + bodyLen, TRUE); } else { - printf("Sending empty posixGroup search result.\n"); + printf("[Proxy] Sending empty posixGroup search result to client.\n"); } const size_t doneLen = fmt_ldapsearchresultdone(NULL, success, "", "", ""); const size_t doneHeaderLen = fmt_ldapmessage(NULL, messageId, SearchResultDone, doneLen); @@ -7,7 +7,9 @@ void proxy_init(); BOOL proxy_fromClient(epoll_client_t *client, const size_t maxLen); -void proxy_removeClient(const epoll_client_t *client); +void proxy_removeClient(epoll_client_t * const client); + +void proxy_removeServer(epoll_server_t * const server); BOOL proxy_fromServer(epoll_server_t *server, const size_t maxLen); @@ -22,7 +22,6 @@ static int serverCount = 0; static void server_init(); static server_t *server_create(const char *server); -static void server_free(epoll_server_t *server); static void server_callback(void *data, int haveIn, int haveOut, int doCleanup); static void server_haveIn(epoll_server_t *server); static void server_haveOut(epoll_server_t * const server); @@ -171,6 +170,12 @@ server_t *server_getFromBase(struct string *in) uint32_t server_searchRequest(server_t *server, struct SearchRequest *req) { if (!server_ensureConnected(server)) return 0; + epoll_server_t * const s = &server->con; + return server_searchRequestOnConnection(s, req); +} + +uint32_t server_searchRequestOnConnection(epoll_server_t *server, struct SearchRequest *req) +{ const uint32_t msgid = msgId(); const size_t bodyLen = fmt_ldapsearchrequest(NULL, req); const size_t headerLen = fmt_ldapmessage(NULL, msgid, SearchRequest, bodyLen); @@ -178,36 +183,35 @@ uint32_t server_searchRequest(server_t *server, struct SearchRequest *req) char *bufoff = buffer + 50; fmt_ldapsearchrequest(bufoff, req); fmt_ldapmessage(bufoff - headerLen, msgid, SearchRequest, bodyLen); - epoll_server_t * const s = &server->con; - server_send(s, bufoff - headerLen, headerLen + bodyLen, FALSE); + server_send(server, bufoff - headerLen, headerLen + bodyLen, FALSE); return msgid; } -uint32_t server_tryUserBind(server_t *server, struct string *binddn, struct string *password) +uint32_t server_tryUserBind(server_t *server, struct string *binddn, struct string *password, epoll_server_t **newcon) { epoll_server_t *con = calloc(1, sizeof(epoll_server_t)); con->serverData = server; con->fd = -1; con->bound = FALSE; con->dynamic = TRUE; - printf("Connecting to AD '%s' for %.*ss bind...\n", server->addr, (int)binddn->l, binddn->s); con->sbPos = con->sbFill = 0; int sock = server_connectInternal(server); if (sock == -1) { + printf("[Proxy] Could not connect to AD for user bind.\n"); server_free(con); return 0; } - printf("[ADB] Connected, binding....\n"); helper_nonblock(sock); con->fd = sock; con->callback = &server_callback; if (ePoll_add(EPOLLIN | EPOLLOUT | EPOLLET, (epoll_item_t*)con) == -1) { - printf("[ADB] epoll_add failed for ad server %s\n", server->addr); + printf("[Proxy] epoll_add failed for AD server %s on user bind\n", server->addr); server_free(con); return 0; } // SSL if (!server_connectSsl(con)) { + printf("[Proxy] SSL handshake failed for AD server %s on user bind\n", server->addr); server_free(con); return 0; } @@ -218,13 +222,14 @@ uint32_t server_tryUserBind(server_t *server, struct string *binddn, struct stri char buffer[bodyLen + 50]; char *bufoff = buffer + 50; if (headerLen >= 50) { - printf("[ADB] bind too long for %s\n", server->addr); + printf("[Proxy] User bind too long for %s\n", server->addr); server_free(con); return 0; } fmt_ldapbindrequeststring(bufoff, 3, binddn, password); fmt_ldapmessage(bufoff - headerLen, id, BindRequest, bodyLen); server_send(con, bufoff - headerLen, bodyLen + headerLen, FALSE); + *newcon = con; return id; } @@ -254,8 +259,9 @@ static server_t *server_create(const char *server) return &servers[serverCount++]; } -static void server_free(epoll_server_t *server) +void server_free(epoll_server_t *server) { + proxy_removeServer(server); server->bound = FALSE; if (server->ssl != NULL) { SSL_free(server->ssl); @@ -267,7 +273,7 @@ static void server_free(epoll_server_t *server) } server->sbPos = server->sbFill = 0; if (server->dynamic) { - printf("Freeing Bind-AD-Connection\n"); + //printf("Freeing Bind-AD-Connection\n"); free(server->sendBuffer); free(server); } @@ -276,38 +282,37 @@ static void server_free(epoll_server_t *server) static void server_callback(void *data, int haveIn, int haveOut, int doCleanup) { epoll_server_t *server = (epoll_server_t *)data; - if (doCleanup || server->kill) { - server_free(server); - return; - } if (server->ssl == NULL) { // Plain connection if (haveIn) server_haveIn(server); if (haveOut) server_haveOut(server); - if (server->kill) server_free(server); - return; - } - // SSL - if (!server->sslConnected) { - // Still SSL-Connecting - if (!ssl_connectServer(server)) { - printf("SSL Server connect failed!\n"); - server_free(server); - return; + } else { + // SSL + if (!server->sslConnected) { + // Still SSL-Connecting + if (!ssl_connectServer(server)) { + printf("[Proxy] SSL handshake for AD server %s failed.\n", server->serverData->addr); + server_free(server); + return; + } + } + // The connect above might have succeeded, so check again and start sending/receiving if so + if (server->sslConnected) { + // Since we don't know if the incoming data is just wrapped application data or ssl protocol stuff, we always call both + server_haveIn(server); + server_haveOut(server); } - if (!server->sslConnected) return; } - // Since we don't know if the incoming data is just wrapped application data or ssl protocol stuff, we always call both - server_haveIn(server); - server_haveOut(server); - if (server->kill) server_free(server); + if (doCleanup || server->kill) { + server_free(server); + } } static void server_haveIn(epoll_server_t *server) { for (;;) { if (server->rbPos >= MAXMSGLEN) { - printf("[AD->Proxy] Read buffer overflow. Disconnecting.\n"); + printf("[Proxy] Buffer overflow while reading from AD server. Disconnecting.\n"); server->kill = TRUE; return; } @@ -316,11 +321,10 @@ static void server_haveIn(epoll_server_t *server) if (server->ssl == NULL) { // Plain ret = read(server->fd, server->readBuffer + server->rbPos, buflen); - printf("AD read %d (err %d)\n", (int)ret, errno); if (ret < 0 && errno == EINTR) continue; if (ret < 0 && errno == EAGAIN) break; + if (ret < 0) printf("[Proxy] AD Server %s gone while reading (ret=%d, errno=%d).\n", server->serverData->addr, (int)ret, errno); if (ret <= 0) { - printf("AD Server gone while reading.\n"); server->kill = TRUE; return; } @@ -330,7 +334,7 @@ static void server_haveIn(epoll_server_t *server) if (ret <= 0) { int err = SSL_get_error(server->ssl, ret); if (SSL_BLOCKED(err)) break; - printf("AD Server gone while reading (%d, %d).\n", (int)ret, err); + if (err != 0) printf("[Proxy] AD Server %s gone while reading (ret=%d, err=%d).\n", server->serverData->addr, (int)ret, err); server->kill = TRUE; return; } @@ -343,13 +347,13 @@ static void server_haveIn(epoll_server_t *server) if (consumed == 0) break; // Length-Header not complete len += consumed; if (len > server->rbPos) break; // Body not complete - printf("[AD] Received complete reply (need %d, have %d)...\n", (int)len, (int)server->rbPos); + //printf("[AD] Received complete reply (need %d, have %d)...\n", (int)len, (int)server->rbPos); if (!proxy_fromServer(server, len)) { if (server->dynamic) { server->kill = TRUE; return; } - printf("Error parsing reply from AD.\n"); + printf("[Proxy] Error parsing message from AD.\n"); // Let's try to go on with the next message.... } // Shift remaining buffer contents @@ -370,14 +374,13 @@ BOOL server_send(epoll_server_t *server, const char *buffer, size_t len, const B // Nothing in send buffer, fire away const int ret = write(server->fd, buffer, len); if (ret == 0 || (ret < 0 && errno != EINTR && errno != EAGAIN)) { - printf("Server gone when trying to send.\n"); + printf("[Proxy] AD Server %s gone when trying to send.\n", server->serverData->addr); return FALSE; } server->lastActive = time(NULL); if (ret == (int)len) return TRUE; // Couldn't send everything, continue with buffering logic below if (ret > 0) { - printf("[AD] Partial send (%d of %d)\n", ret, (int)len); buffer += ret; len -= (size_t)ret; } @@ -405,7 +408,7 @@ static void server_haveOut(epoll_server_t * const server) if (ret < 0 && errno == EINTR) continue; if (ret < 0 && errno == EAGAIN) return; if (ret <= 0) { - printf("Connection to AD Server failed while flushing (ret: %d, errno: %d)\n", (int)ret, errno); + printf("[Proxy] AD Server %s gone while flushing send buffer (ret=%d, errno=%d)\n", server->serverData->addr, (int)ret, errno); return; } } else { @@ -419,7 +422,7 @@ static void server_haveOut(epoll_server_t * const server) } else if (err == SSL_ERROR_SSL) { ssl_printErrors(NULL); } - printf("SSL server gone while sending (%d)\n", err); + printf("[Proxy] AD Server %s gone while flushing send buffer (ret=%d, err=%d)\n", server->serverData->addr, (int)ret, err); ERR_print_errors_fp(stdout); server->kill = TRUE; return; // Closed @@ -443,16 +446,14 @@ static BOOL server_ensureConnected(server_t *server) if (con->fd != -1 && con->lastActive + 120 > time(NULL)) return TRUE; if (con->fd != -1) close(con->fd); con->bound = FALSE; - printf("Connecting to AD '%s'...\n", server->addr); con->sbPos = con->sbFill = 0; int sock = server_connectInternal(server); if (sock == -1) return FALSE; - printf("Connected, binding....\n"); helper_nonblock(sock); con->fd = sock; con->callback = &server_callback; if (ePoll_add(EPOLLIN | EPOLLOUT | EPOLLET, (epoll_item_t*)con) == -1) { - printf("epoll_add failed for ad server %s\n", server->addr); + printf("[Proxy] epoll_add failed for ad server %s\n", server->addr); close(con->fd); con->fd = -1; return FALSE; @@ -469,7 +470,7 @@ static BOOL server_ensureConnected(server_t *server) char buffer[bodyLen + 50]; char *bufoff = buffer + 50; if (headerLen >= 50) { - printf("[AD] bind too long for %s\n", server->addr); + printf("[Proxy] bind too long for %s\n", server->addr); close(con->fd); con->fd = -1; return FALSE; @@ -488,7 +489,7 @@ static BOOL server_ensureSendBuffer(epoll_server_t * const s, const size_t len) } if (s->sbLen - s->sbFill < len) { if (s->writeBlocked) { - printf("SSL Write blocked and buffer to small (%d)\n", (int)s->sbLen); + printf("[Proxy] SSL write to AD server blocked and buffer to small (%d bytes)\n", (int)s->sbLen); return FALSE; } if (s->sbPos != 0) { @@ -512,17 +513,17 @@ static int server_connectInternal(server_t *server) if (server->lastLookup + 300 < time(NULL)) { sock = helper_connect4(server->addr, port, server->ip); if (sock == -1) { - printf("Could not resolve/connect to AD server %s\n", server->addr); + printf("[Proxy] Could not resolve hostname or connect to AD server %s\n", server->addr); return -1; } } else { sock = socket_tcp4b(); if (sock == -1) { - printf("Could not allocate socket for connection to AD\n"); + printf("[Proxy] Could not allocate socket for connection to AD server %s\n", server->addr); return -1; } if (socket_connect4(sock, server->ip, port) == -1) { - printf("Could not connect to cached IP of %s\n", server->addr); + printf("[Proxy] Could not connect to cached IP (%s) of %s\n", server->ip, server->addr); server->lastLookup = 0; close(sock); return -1; @@ -537,11 +538,11 @@ static BOOL server_connectSsl(epoll_server_t *server) server->sslConnected = FALSE; server->ssl = ssl_new(server->fd, server->serverData->sslContext); if (server->ssl == NULL) { - printf("Could not get SSL client from context\n"); + printf("[Proxy] Could not get SSL client from context\n"); return FALSE; } if (!ssl_connectServer(server)) { - printf("SSL connect failed.\n"); + printf("[Proxy] SSL connect to AD server %s failed.\n", server->serverData->addr); SSL_free(server->ssl); server->ssl = NULL; return FALSE; @@ -20,13 +20,17 @@ void server_setFingerprint(const char *server, const char *fingerprint); BOOL server_initServers(); +void server_free(epoll_server_t *server); + BOOL server_send(epoll_server_t *server, const char *buffer, size_t len, const BOOL cork); server_t *server_getFromBase(struct string *in); uint32_t server_searchRequest(server_t *server, struct SearchRequest *req); -uint32_t server_tryUserBind(server_t *server, struct string *binddn, struct string *password); +uint32_t server_searchRequestOnConnection(epoll_server_t *con, struct SearchRequest *req); + +uint32_t server_tryUserBind(server_t *server, struct string *binddn, struct string *password, epoll_server_t **newcon); #endif @@ -22,6 +22,8 @@ #define FALSE (0) typedef struct _server_t_ server_t; +typedef struct _epoll_client_t_ epoll_client_t; +typedef struct _epoll_server_t_ epoll_server_t; /** * General epoll struct, to be implemented by every epoll struct. @@ -44,7 +46,7 @@ typedef struct { /** * epoll struct for a client we're serving. */ -typedef struct { +struct _epoll_client_t_ { void (*callback)(void *data, int haveIn, int haveOut, int doCleanup); int fd; // @@ -56,15 +58,16 @@ typedef struct { size_t sbPos, sbFill, sbLen; SSL *ssl; // NULL if not encrypted char *sendBuffer; // Dynamically allocated, might or might not get huge + epoll_server_t *fixedServer; // If client performed explicit bind, tie to server connection // Recv buffer (client's request) size_t rbPos; char readBuffer[REQLEN]; // Static, queries > 4000 bytes simply not supported -} epoll_client_t; +}; /** * epoll struct for a connection to AD. */ -typedef struct { +struct _epoll_server_t_ { void (*callback)(void *data, int haveIn, int haveOut, int doCleanup); int fd; // @@ -72,6 +75,7 @@ typedef struct { size_t sbPos, sbFill, sbLen; SSL *ssl; // NULL if not encrypted char *sendBuffer; // Dynamically allocated, might or might not get huge + epoll_client_t *fixedClient; // If client performed explicit bind, this is the client belonging to this connection // Recv buffer (server's response) size_t rbPos; char readBuffer[MAXMSGLEN]; @@ -82,7 +86,7 @@ typedef struct { BOOL writeBlocked; // An SSL_write returned WANT_*, so we must not reallocate the current send buffer time_t lastActive; server_t *serverData; -} epoll_server_t; +}; /** * Configuration data for an ADS we're proxying. |