diff options
| author |  Pierre Carrier | 2011-09-14 15:24:55 +0200 |
|---|---|---|
| committer | Pierre Carrier | 2012-04-10 22:30:08 +0200 |
| commit | 2d3411818abc77e4e66dd832507a68434f28ab98 (patch) | |
| tree | 7f68c935d11615bcef077446717d490ff21bc8a7 /src/modules | |
| parent | Add note about hidewhois and idle times (diff) | |
extras/m_ldapauth: CIDR-based whitelisting
Offer host-based whitelisting in the ldap module.
Used to trust clients from internal networks,
whilst requiring authentication from "outsiders".
Diffstat (limited to 'src/modules')
| -rw-r--r-- | src/modules/extra/m_ldapauth.cpp | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/src/modules/extra/m_ldapauth.cpp b/src/modules/extra/m_ldapauth.cpp index ae96b0693..0b31498ef 100644 --- a/src/modules/extra/m_ldapauth.cpp +++ b/src/modules/extra/m_ldapauth.cpp @@ -39,6 +39,7 @@ class ModuleLDAPAuth : public Module std::string killreason; std::string username; std::string password; + std::vector<std::string> whitelistedcidrs; int searchscope; bool verbose; bool useusername; @@ -66,6 +67,7 @@ public: void ReadConfig(ConfigReadStatus&) { + whitelistedcidrs.clear(); base = ServerInstance->Config->GetTag("ldapauth")->getString("baserdn"); attribute = ServerInstance->Config->GetTag("ldapauth")->getString("attribute"); @@ -78,6 +80,14 @@ public: verbose = ServerInstance->Config->GetTag("ldapauth")->getBool("verbose"); /* Set to true if failed connects should be reported to operators */ useusername = ServerInstance->Config->GetTag("ldapauth")->getBool("userfield"); setaccount = ServerInstance->Config->GetTag("ldapauth")->getBool("setaccount"); + ConfigTagList whitelisttags = ServerInstance->Config->GetTags("ldapwhitelist"); + + for (ConfigIter i = whitelisttags.first; i != whitelisttags.second; ++i) + { + std::string cidr = i->second->getString("cidr"); + if (!cidr.empty()) + whitelistedcidrs.push_back(cidr); + } if (scope == "base") searchscope = LDAP_SCOPE_BASE; @@ -122,6 +132,15 @@ public: return; } + for (std::vector<std::string>::iterator i = whitelistedcidrs.begin(); i != whitelistedcidrs.end(); i++) + { + if (InspIRCd::MatchCIDR(user->GetIPString(), *i, ascii_case_insensitive_map)) + { + ldapAuthed.set(user,1); + return; + } + } + if (!CheckCredentials(user)) { ServerInstance->Users->QuitUser(user, killreason); |