#include <config.h>
#include <stdio.h>
#include <assert.h>
#include <stdlib.h>
#include <string.h>
#include "sasl.h"
#include "saslutil.h"
#include "saslplug.h"
#include <ctype.h>
#include "plugin_common.h"
#define sql_max(a, b) ((a) > (b) ? (a) : (b))
#define sql_len(input) ((input) ? strlen(input) : 0)
#define sql_exists(input) ((input) && (*input))
typedef struct sql_engine {
const char *name;
void *(*sql_open)(char *host, char *port, int usessl,
const char *user, const char *password,
const char *database, const sasl_utils_t *utils);
int (*sql_escape_str)(char *to, const char *from);
int (*sql_begin_txn)(void *conn, const sasl_utils_t *utils);
int (*sql_commit_txn)(void *conn, const sasl_utils_t *utils);
int (*sql_rollback_txn)(void *conn, const sasl_utils_t *utils);
int (*sql_exec)(void *conn, const char *cmd, char *value, size_t size,
size_t *value_len, const sasl_utils_t *utils);
void (*sql_close)(void *conn);
} sql_engine_t;
typedef struct sql_settings {
const sql_engine_t *sql_engine;
const char *sql_user;
const char *sql_passwd;
const char *sql_hostnames;
const char *sql_database;
const char *sql_select;
const char *sql_insert;
const char *sql_update;
int sql_usessl;
} sql_settings_t;
static const char * SQL_BLANK_STRING = "";
static const char * SQL_WILDCARD = "*";
static const char * SQL_NULL_VALUE = "NULL";
#ifdef HAVE_MYSQL
#include <mysql.h>
static void *_mysql_open(char *host, char *port, int usessl,
const char *user, const char *password,
const char *database, const sasl_utils_t *utils)
{
MYSQL *mysql;
if (!(mysql = mysql_init(NULL))) {
utils->log(NULL, SASL_LOG_ERR,
"sql plugin: could not execute mysql_init()");
return NULL;
}
return mysql_real_connect(mysql, host, user, password, database,
port ? strtoul(port, NULL, 10) : 0, NULL,
usessl ? CLIENT_SSL : 0);
}
static int _mysql_escape_str(char *to, const char *from)
{
return mysql_escape_string(to, from, strlen(from));
}
static int _mysql_exec(void *conn, const char *cmd, char *value, size_t size,
size_t *value_len, const sasl_utils_t *utils)
{
MYSQL_RES *result;
MYSQL_ROW row;
int row_count, len;
len = strlen(cmd);
if (cmd[len-1] == ';') len--;
if ((mysql_real_query(conn, cmd, len) < 0)) {
return -1;
}
if (!mysql_field_count(conn)) {
return 0;
}
result = mysql_store_result(conn);
if (!result) {
return -1;
}
row_count = mysql_num_rows(result);
if (!row_count) {
mysql_free_result(result);
return -1;
}
if (row_count > 1) {
utils->log(NULL, SASL_LOG_WARN,
"sql plugin: found duplicate row for query %s", cmd);
}
row = mysql_fetch_row(result);
if (!row || !row[0]) {
mysql_free_result(result);
return -1;
}
if (value) {
strncpy(value, row[0], size-2);
value[size-1] = '\0';
if (value_len) *value_len = strlen(value);
}
mysql_free_result(result);
return 0;
}
static int _mysql_begin_txn(void *conn, const sasl_utils_t *utils)
{
return _mysql_exec(conn,
#if MYSQL_VERSION_ID >= 40011
"START TRANSACTION",
#else
"BEGIN",
#endif
NULL, 0, NULL, utils);
}
static int _mysql_commit_txn(void *conn, const sasl_utils_t *utils)
{
return _mysql_exec(conn, "COMMIT", NULL, 0, NULL, utils);
}
static int _mysql_rollback_txn(void *conn, const sasl_utils_t *utils)
{
return _mysql_exec(conn, "ROLLBACK", NULL, 0, NULL, utils);
}
static void _mysql_close(void *conn)
{
mysql_close(conn);
}
#endif
#ifdef HAVE_PGSQL
#include <libpq-fe.h>
static void *_pgsql_open(char *host, char *port, int usessl,
const char *user, const char *password,
const char *database, const sasl_utils_t *utils)
{
PGconn *conn = NULL;
char *conninfo, *sep;
conninfo = utils->malloc(64 + sql_len(host) + sql_len(port)
+ sql_len(user) + sql_len(password)
+ sql_len(database));
if (!conninfo) {
MEMERROR(utils);
return NULL;
}
conninfo[0] = '\0';
sep = "";
if (sql_exists(host)) {
strcat(conninfo, sep);
strcat(conninfo, "host='");
strcat(conninfo, host);
strcat(conninfo, "'");
sep = " ";
}
if (sql_exists(port)) {
strcat(conninfo, sep);
strcat(conninfo, "port='");
strcat(conninfo, port);
strcat(conninfo, "'");
sep = " ";
}
if (sql_exists(user)) {
strcat(conninfo, sep);
strcat(conninfo, "user='");
strcat(conninfo, user);
strcat(conninfo, "'");
sep = " ";
}
if (sql_exists(password)) {
strcat(conninfo, sep);
strcat(conninfo, "password='");
strcat(conninfo, password);
strcat(conninfo, "'");
sep = " ";
}
if (sql_exists(database)) {
strcat(conninfo, sep);
strcat(conninfo, "dbname='");
strcat(conninfo, database);
strcat(conninfo, "'");
sep = " ";
}
if (usessl) {
strcat(conninfo, sep);
strcat(conninfo, "requiressl='1'");
}
conn = PQconnectdb(conninfo);
free(conninfo);
if ((PQstatus(conn) != CONNECTION_OK)) {
utils->log(NULL, SASL_LOG_ERR, "sql plugin: %s", PQerrorMessage(conn));
return NULL;
}
return conn;
}
static int _pgsql_escape_str(char *to, const char *from)
{
return PQescapeString(to, from, strlen(from));
}
static int _pgsql_exec(void *conn, const char *cmd, char *value, size_t size,
size_t *value_len, const sasl_utils_t *utils)
{
PGresult *result;
int row_count;
ExecStatusType status;
result = PQexec(conn, cmd);
status = PQresultStatus(result);
if (status == PGRES_COMMAND_OK) {
PQclear(result);
return 0;
}
else if (status != PGRES_TUPLES_OK) {
utils->log(NULL, SASL_LOG_DEBUG, "sql plugin: %s ",
PQresStatus(status));
PQclear(result);
return -1;
}
row_count = PQntuples(result);
if (!row_count) {
PQclear(result);
return -1;
}
if (row_count > 1) {
utils->log(NULL, SASL_LOG_WARN,
"sql plugin: found duplicate row for query %s", cmd);
}
if (value) {
strncpy(value, PQgetvalue(result,0,0), size-2);
value[size-1] = '\0';
if (value_len) *value_len = strlen(value);
}
PQclear(result);
return 0;
}
static int _pgsql_begin_txn(void *conn, const sasl_utils_t *utils)
{
return _pgsql_exec(conn, "BEGIN;", NULL, 0, NULL, utils);
}
static int _pgsql_commit_txn(void *conn, const sasl_utils_t *utils)
{
return _pgsql_exec(conn, "COMMIT;", NULL, 0, NULL, utils);
}
static int _pgsql_rollback_txn(void *conn, const sasl_utils_t *utils)
{
return _pgsql_exec(conn, "ROLLBACK;", NULL, 0, NULL, utils);
}
static void _pgsql_close(void *conn)
{
PQfinish(conn);
}
#endif
static const sql_engine_t sql_engines[] = {
#ifdef HAVE_MYSQL
{ "mysql", &_mysql_open, &_mysql_escape_str,
&_mysql_begin_txn, &_mysql_commit_txn, &_mysql_rollback_txn,
&_mysql_exec, &_mysql_close },
#endif
#ifdef HAVE_PGSQL
{ "pgsql", &_pgsql_open, &_pgsql_escape_str,
&_pgsql_begin_txn, &_pgsql_commit_txn, &_pgsql_rollback_txn,
&_pgsql_exec, &_pgsql_close },
#endif
{ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }
};
static char *sql_create_statement(const char *statement, const char *prop,
const char *user, const char *realm,
const char *value,
const sasl_utils_t *utils)
{
const char *ptr, *line_ptr;
char *buf, *buf_ptr;
int filtersize;
int ulen, plen, rlen, vlen;
int numpercents=0;
int biggest;
size_t i;
ulen = strlen(user);
rlen = strlen(realm);
plen = strlen(prop);
vlen = sql_len(value);
for (i = 0; i < strlen(statement); i++) {
if (statement[i] == '%') {
numpercents++;
}
}
biggest = sql_max(sql_max(ulen, rlen), sql_max(plen, vlen));
filtersize = strlen(statement) + 1 + (numpercents*biggest)+1;
buf = (char *) utils->malloc(filtersize);
if (!buf) {
MEMERROR(utils);
return NULL;
}
buf_ptr = buf;
line_ptr = statement;
while ( (ptr = strchr(line_ptr, '%')) ) {
memcpy(buf_ptr, line_ptr, ptr - line_ptr);
buf_ptr += ptr - line_ptr;
ptr++;
switch (ptr[0]) {
case '%':
buf_ptr[0] = '%';
buf_ptr++;
break;
case 'u':
memcpy(buf_ptr, user, ulen);
buf_ptr += ulen;
break;
case 'r':
memcpy(buf_ptr, realm, rlen);
buf_ptr += rlen;
break;
case 'p':
memcpy(buf_ptr, prop, plen);
buf_ptr += plen;
break;
case 'v':
if (value != NULL) {
memcpy(buf_ptr, value, vlen);
buf_ptr += vlen;
}
else {
utils->log(NULL, SASL_LOG_ERR,
"'%%v' shouldn't be in a SELECT or DELETE");
}
break;
default:
buf_ptr[0] = '%';
buf_ptr[1] = ptr[0];
buf_ptr += 2;
break;
}
ptr++;
line_ptr = ptr;
}
memcpy(buf_ptr, line_ptr, strlen(line_ptr)+1);
if (buf_ptr[strlen(buf_ptr-1)] != ';') {
strcat(buf_ptr, ";");
}
return (buf);
}
static void sql_get_settings(const sasl_utils_t *utils, void *glob_context)
{
sql_settings_t *settings;
int r;
const char *usessl, *engine_name;
const sql_engine_t *e;
settings = (sql_settings_t *) glob_context;
r = utils->getopt(utils->getopt_context,"SQL", "sql_engine",
&engine_name, NULL);
if (r || !engine_name) {
engine_name = "mysql";
}
e = sql_engines;
while (e->name) {
if (!strcasecmp(engine_name, e->name)) break;
e++;
}
if (!e->name) {
utils->log(NULL, SASL_LOG_ERR, "SQL engine '%s' not supported",
engine_name);
}
settings->sql_engine = e;
r = utils->getopt(utils->getopt_context,"SQL","sql_user",
&settings->sql_user, NULL);
if ( r || !settings->sql_user ) {
settings->sql_user = SQL_BLANK_STRING;
}
r = utils->getopt(utils->getopt_context,"SQL", "sql_passwd",
&settings->sql_passwd, NULL);
if (r || !settings->sql_passwd ) {
settings->sql_passwd = SQL_BLANK_STRING;
}
r = utils->getopt(utils->getopt_context,"SQL", "sql_hostnames",
&settings->sql_hostnames, NULL);
if (r || !settings->sql_hostnames ) {
settings->sql_hostnames = SQL_BLANK_STRING;
}
r = utils->getopt(utils->getopt_context,"SQL", "sql_database",
&settings->sql_database, NULL);
if (r || !settings->sql_database ) {
settings->sql_database = SQL_BLANK_STRING;
}
r = utils->getopt(utils->getopt_context,"SQL", "sql_select",
&settings->sql_select, NULL);
if (r || !settings->sql_select ) {
r = utils->getopt(utils->getopt_context,"SQL", "sql_statement",
&settings->sql_select, NULL);
if (r || !settings->sql_select) {
settings->sql_select = SQL_BLANK_STRING;
}
}
r = utils->getopt(utils->getopt_context, "SQL", "sql_insert",
&settings->sql_insert, NULL);
if (r || !settings->sql_insert) {
settings->sql_insert = SQL_BLANK_STRING;
}
r = utils->getopt(utils->getopt_context, "SQL", "sql_update",
&settings->sql_update, NULL);
if (r || !settings->sql_update) {
settings->sql_update = SQL_BLANK_STRING;
}
r = utils->getopt(utils->getopt_context, "SQL", "sql_usessl",
&usessl, NULL);
if (r || !usessl) usessl = "no";
if (*usessl == '1' || *usessl == 'y' || *usessl == 't' ||
(*usessl == 'o' && usessl[1] == 'n')) {
settings->sql_usessl = 1;
} else {
settings->sql_usessl = 0;
}
}
static void *sql_connect(sql_settings_t *settings, const sasl_utils_t *utils)
{
void *conn = NULL;
char *db_host_ptr = NULL;
char *db_host = NULL;
char *cur_host, *cur_port;
utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin try and connect to a host\n");
_plug_strdup(utils, settings->sql_hostnames, &db_host_ptr, NULL);
db_host = db_host_ptr;
cur_host = db_host;
while (cur_host != NULL) {
db_host = strchr(db_host,',');
if (db_host != NULL) {
db_host[0] = '\0';
while (!isalnum(db_host[0])) db_host++;
}
utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin trying to open db '%s' on host '%s'%s\n",
settings->sql_database, cur_host,
settings->sql_usessl ? " using SSL" : "");
if ((cur_port = strchr(cur_host, ':'))) *cur_port++ = '\0';
conn = settings->sql_engine->sql_open(cur_host, cur_port,
settings->sql_usessl,
settings->sql_user,
settings->sql_passwd,
settings->sql_database,
utils);
if (conn) break;
utils->log(NULL, SASL_LOG_ERR,
"sql plugin could not connect to host %s", cur_host);
cur_host = db_host;
}
if (db_host_ptr) utils->free(db_host_ptr);
return conn;
}
static void sql_auxprop_lookup(void *glob_context,
sasl_server_params_t *sparams,
unsigned flags,
const char *user,
unsigned ulen)
{
char *userid = NULL;
char *realm = NULL;
const char *user_realm = NULL;
const struct propval *to_fetch, *cur;
char value[8192];
size_t value_len;
char *user_buf;
char *query = NULL;
char *escap_userid = NULL;
char *escap_realm = NULL;
sql_settings_t *settings;
void *conn = NULL;
int do_txn = 0;
if (!glob_context || !sparams || !user) return;
settings = (sql_settings_t *) glob_context;
sparams->utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin Parse the username %s\n", user);
user_buf = sparams->utils->malloc(ulen + 1);
if (!user_buf) goto done;
memcpy(user_buf, user, ulen);
user_buf[ulen] = '\0';
if(sparams->user_realm) {
user_realm = sparams->user_realm;
} else {
user_realm = sparams->serverFQDN;
}
if (_plug_parseuser(sparams->utils, &userid, &realm, user_realm,
sparams->serverFQDN, user_buf) != SASL_OK )
goto done;
escap_userid = (char *)sparams->utils->malloc(strlen(userid)*2+1);
escap_realm = (char *)sparams->utils->malloc(strlen(realm)*2+1);
if (!escap_userid || !escap_realm) {
MEMERROR(sparams->utils);
goto done;
}
to_fetch = sparams->utils->prop_get(sparams->propctx);
if (!to_fetch) goto done;
conn = sql_connect(settings, sparams->utils);
if (!conn) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"sql plugin couldn't connect to any host\n");
goto done;
}
settings->sql_engine->sql_escape_str(escap_userid, userid);
settings->sql_engine->sql_escape_str(escap_realm, realm);
for (cur = to_fetch; cur->name; cur++) {
char *realname = (char *) cur->name;
if (cur->name[0] == '*'
&& (flags & SASL_AUXPROP_AUTHZID))
continue;
if (!(flags & SASL_AUXPROP_AUTHZID)) {
if(cur->name[0] != '*')
continue;
else
realname = (char*)cur->name + 1;
}
if (cur->values && !(flags & SASL_AUXPROP_OVERRIDE))
continue;
else if (cur->values)
sparams->utils->prop_erase(sparams->propctx, cur->name);
if (!do_txn) {
do_txn = 1;
sparams->utils->log(NULL, SASL_LOG_DEBUG, "begin transaction");
if (settings->sql_engine->sql_begin_txn(conn, sparams->utils)) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"Unable to begin transaction\n");
}
}
sparams->utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin create statement from %s %s %s\n",
realname, escap_userid, escap_realm);
query = sql_create_statement(settings->sql_select,
realname,escap_userid,
escap_realm, NULL,
sparams->utils);
sparams->utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin doing query %s\n", query);
if (!settings->sql_engine->sql_exec(conn, query, value, sizeof(value),
&value_len, sparams->utils)) {
sparams->utils->prop_set(sparams->propctx, cur->name,
value, value_len);
}
sparams->utils->free(query);
}
if (do_txn) {
sparams->utils->log(NULL, SASL_LOG_DEBUG, "commit transaction");
if (settings->sql_engine->sql_commit_txn(conn, sparams->utils)) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"Unable to commit transaction\n");
}
}
done:
if (escap_userid) sparams->utils->free(escap_userid);
if (escap_realm) sparams->utils->free(escap_realm);
if (conn) settings->sql_engine->sql_close(conn);
if (userid) sparams->utils->free(userid);
if (realm) sparams->utils->free(realm);
if (user_buf) sparams->utils->free(user_buf);
}
static int sql_auxprop_store(void *glob_context,
sasl_server_params_t *sparams,
struct propctx *ctx,
const char *user,
unsigned ulen)
{
char *userid = NULL;
char *realm = NULL;
const char *user_realm = NULL;
int ret = SASL_FAIL;
const struct propval *to_store, *cur;
char *user_buf;
char *statement = NULL;
char *escap_userid = NULL;
char *escap_realm = NULL;
const char *cmd;
sql_settings_t *settings;
void *conn = NULL;
settings = (sql_settings_t *) glob_context;
if (!ctx &&
sql_exists(settings->sql_insert) &&
sql_exists(settings->sql_update)) return SASL_OK;
if (!glob_context || !sparams || !user) return SASL_BADPARAM;
sparams->utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin Parse the username %s\n", user);
user_buf = sparams->utils->malloc(ulen + 1);
if (!user_buf) {
ret = SASL_NOMEM;
goto done;
}
memcpy(user_buf, user, ulen);
user_buf[ulen] = '\0';
if (sparams->user_realm) {
user_realm = sparams->user_realm;
}
else {
user_realm = sparams->serverFQDN;
}
ret = _plug_parseuser(sparams->utils, &userid, &realm, user_realm,
sparams->serverFQDN, user_buf);
if (ret != SASL_OK) goto done;
escap_userid = (char *) sparams->utils->malloc(strlen(userid)*2+1);
escap_realm = (char *) sparams->utils->malloc(strlen(realm)*2+1);
if (!escap_userid || !escap_realm) {
MEMERROR(sparams->utils);
goto done;
}
to_store = sparams->utils->prop_get(ctx);
if (!to_store) {
ret = SASL_BADPARAM;
goto done;
}
conn = sql_connect(settings, sparams->utils);
if (!conn) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"sql plugin couldn't connect to any host\n");
goto done;
}
settings->sql_engine->sql_escape_str(escap_userid, userid);
settings->sql_engine->sql_escape_str(escap_realm, realm);
if (settings->sql_engine->sql_begin_txn(conn, sparams->utils)) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"Unable to begin transaction\n");
}
for (cur = to_store; ret == SASL_OK && cur->name; cur++) {
statement = sql_create_statement(settings->sql_select,
SQL_WILDCARD, escap_userid,
escap_realm, NULL,
sparams->utils);
if (!settings->sql_engine->sql_exec(conn, statement, NULL, 0, NULL,
sparams->utils)) {
cmd = settings->sql_update;
} else {
cmd = settings->sql_insert;
}
sparams->utils->free(statement);
statement = sql_create_statement(cmd, cur->name, escap_userid,
escap_realm,
cur->values && cur->values[0] ?
cur->values[0] : SQL_NULL_VALUE,
sparams->utils);
{
char *log_statement =
sql_create_statement(cmd, cur->name,
escap_userid,
escap_realm,
cur->values && cur->values[0] ?
"<omitted>" : SQL_NULL_VALUE,
sparams->utils);
sparams->utils->log(NULL, SASL_LOG_DEBUG,
"sql plugin doing statement %s\n",
log_statement);
sparams->utils->free(log_statement);
}
if (settings->sql_engine->sql_exec(conn, statement, NULL, 0, NULL,
sparams->utils)) {
ret = SASL_FAIL;
}
sparams->utils->free(statement);
}
if (ret != SASL_OK) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"Failed to store auxprop; aborting transaction\n");
if (settings->sql_engine->sql_rollback_txn(conn, sparams->utils)) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"Unable to rollback transaction\n");
}
}
else if (settings->sql_engine->sql_commit_txn(conn, sparams->utils)) {
sparams->utils->log(NULL, SASL_LOG_ERR,
"Unable to commit transaction\n");
}
done:
if (escap_userid) sparams->utils->free(escap_userid);
if (escap_realm) sparams->utils->free(escap_realm);
if (conn) settings->sql_engine->sql_close(conn);
if (userid) sparams->utils->free(userid);
if (realm) sparams->utils->free(realm);
if (user_buf) sparams->utils->free(user_buf);
return ret;
}
static void sql_auxprop_free(void *glob_context, const sasl_utils_t *utils)
{
sql_settings_t *settings;
settings = (sql_settings_t *)glob_context;
if (!settings) return;
utils->log(NULL, SASL_LOG_DEBUG, "sql freeing memory\n");
utils->free(settings);
}
static sasl_auxprop_plug_t sql_auxprop_plugin = {
0,
0,
NULL,
sql_auxprop_free,
sql_auxprop_lookup,
"sql",
sql_auxprop_store
};
int sql_auxprop_plug_init(const sasl_utils_t *utils,
int max_version,
int *out_version,
sasl_auxprop_plug_t **plug,
const char *plugname __attribute__((unused)))
{
sql_settings_t *settings;
if (!out_version || !plug) return SASL_BADPARAM;
if (max_version < SASL_AUXPROP_PLUG_VERSION) return SASL_BADVERS;
*out_version = SASL_AUXPROP_PLUG_VERSION;
*plug = &sql_auxprop_plugin;
settings = (sql_settings_t *) utils->malloc(sizeof(sql_settings_t));
if (!settings) {
MEMERROR(utils);
return SASL_NOMEM;
}
memset(settings, 0, sizeof(sql_settings_t));
sql_get_settings(utils, settings);
if (!settings->sql_engine->name) return SASL_NOMECH;
if (!sql_exists(settings->sql_select)) {
utils->log(NULL, SASL_LOG_ERR, "sql_select option missing");
return SASL_NOMECH;
}
utils->log(NULL, SASL_LOG_DEBUG,
"sql auxprop plugin using %s engine\n",
settings->sql_engine->name);
sql_auxprop_plugin.glob_context = settings;
return SASL_OK;
}