extras/m_ldapauth: CIDR-based whitelisting

Offer host-based whitelisting in the ldap module.

Used to trust clients from internal networks,
whilst requiring authentication from "outsiders".

1 files changed, 19 insertions, 0 deletions

diff --git a/src/modules/extra/m_ldapauth.cpp b/src/modules/extra/m_ldapauth.cpp
index ae96b0693..0b31498ef 100644
--- a/src/modules/extra/m_ldapauth.cpp
+++ b/src/modules/extra/m_ldapauth.cpp
@@ -39,6 +39,7 @@ class ModuleLDAPAuth : public Module
 	std::string killreason;
 	std::string username;
 	std::string password;
+	std::vector<std::string> whitelistedcidrs;
 	int searchscope;
 	bool verbose;
 	bool useusername;
@@ -66,6 +67,7 @@ public:
 
 	void ReadConfig(ConfigReadStatus&)
 	{
+		whitelistedcidrs.clear();
 
 		base 			= ServerInstance->Config->GetTag("ldapauth")->getString("baserdn");
 		attribute		= ServerInstance->Config->GetTag("ldapauth")->getString("attribute");
@@ -78,6 +80,14 @@ public:
 		verbose			= ServerInstance->Config->GetTag("ldapauth")->getBool("verbose");		/* Set to true if failed connects should be reported to operators */
 		useusername		= ServerInstance->Config->GetTag("ldapauth")->getBool("userfield");
 		setaccount		= ServerInstance->Config->GetTag("ldapauth")->getBool("setaccount");
+		ConfigTagList whitelisttags	= ServerInstance->Config->GetTags("ldapwhitelist");
+
+		for (ConfigIter i = whitelisttags.first; i != whitelisttags.second; ++i)
+		{
+			std::string cidr = i->second->getString("cidr");
+			if (!cidr.empty())
+				whitelistedcidrs.push_back(cidr);
+		}
 
 		if (scope == "base")
 			searchscope = LDAP_SCOPE_BASE;
@@ -122,6 +132,15 @@ public:
 			return;
 		}
 
+		for (std::vector<std::string>::iterator i = whitelistedcidrs.begin(); i != whitelistedcidrs.end(); i++)
+		{
+			if (InspIRCd::MatchCIDR(user->GetIPString(), *i, ascii_case_insensitive_map))
+			{
+				ldapAuthed.set(user,1);
+				return;
+			}
+		}
+
 		if (!CheckCredentials(user))
 		{
 			ServerInstance->Users->QuitUser(user, killreason);