summaryrefslogtreecommitdiff
path: root/src/modules
diff options
context:
space:
mode:
authorPierre Carrier <pierre@spotify.com>2011-09-14 15:24:55 +0200
committerPierre Carrier <pierre@spotify.com>2012-04-10 22:36:05 +0200
commit16cbb628161960eb87d5b2e8bdd62842b8eb0723 (patch)
tree4d0c3757d071c33d10c121c8ce7e1b38d4b37f79 /src/modules
parent418b77dd9d87600cefa74cac38f4becc4c98a026 (diff)
extras/m_ldapauth: CIDR-based whitelisting
Offer host-based whitelisting in the ldap module. Used to trust clients from internal networks, whilst requiring authentication from "outsiders".
Diffstat (limited to 'src/modules')
-rw-r--r--src/modules/extra/m_ldapauth.cpp21
1 files changed, 21 insertions, 0 deletions
diff --git a/src/modules/extra/m_ldapauth.cpp b/src/modules/extra/m_ldapauth.cpp
index 4fae7a2e7..a3d80b8f3 100644
--- a/src/modules/extra/m_ldapauth.cpp
+++ b/src/modules/extra/m_ldapauth.cpp
@@ -46,6 +46,7 @@ class ModuleLDAPAuth : public Module
std::string killreason;
std::string username;
std::string password;
+ std::vector<std::string> whitelistedcidrs;
int searchscope;
bool verbose;
bool useusername;
@@ -73,6 +74,7 @@ public:
void OnRehash(User* user)
{
ConfigReader Conf;
+ whitelistedcidrs.clear();
base = Conf.ReadValue("ldapauth", "baserdn", 0);
attribute = Conf.ReadValue("ldapauth", "attribute", 0);
@@ -85,6 +87,16 @@ public:
verbose = Conf.ReadFlag("ldapauth", "verbose", 0); /* Set to true if failed connects should be reported to operators */
useusername = Conf.ReadFlag("ldapauth", "userfield", 0);
+ ConfigTagList whitelisttags = ServerInstance->Config->ConfTags("ldapwhitelist");
+
+ for (ConfigIter i = whitelisttags.first; i != whitelisttags.second; ++i)
+ {
+ std::string cidr = i->second->getString("cidr");
+ if (!cidr.empty()) {
+ whitelistedcidrs.push_back(cidr);
+ }
+ }
+
if (scope == "base")
searchscope = LDAP_SCOPE_BASE;
else if (scope == "onelevel")
@@ -128,6 +140,15 @@ public:
return MOD_RES_PASSTHRU;
}
+ for (std::vector<std::string>::iterator i = whitelistedcidrs.begin(); i != whitelistedcidrs.end(); i++)
+ {
+ if (InspIRCd::MatchCIDR(user->GetIPString(), *i, ascii_case_insensitive_map))
+ {
+ ldapAuthed.set(user,1);
+ return MOD_RES_PASSTHRU;
+ }
+ }
+
if (!CheckCredentials(user))
{
ServerInstance->Users->QuitUser(user, killreason);