From 366d0323a932d58db0dda927544dc675d77927eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ermal=20Lu=E7i?= <eri@pfsense.org>
Date: Tue, 2 Mar 2010 00:12:06 +0000
Subject: [PATCH] Allow the authentication scripts to detect configuration
 changes. Allow multiple OUs to be specified on basedn.

---
 etc/inc/openvpn.auth-ldap.php   | 88 +++++++++++++++++++++++++++++++--
 etc/inc/openvpn.auth-radius.php | 11 ++++-
 etc/inc/openvpn.inc             | 22 +--------
 3 files changed, 93 insertions(+), 28 deletions(-)

diff --git a/etc/inc/openvpn.auth-ldap.php b/etc/inc/openvpn.auth-ldap.php
index 71559726b1..e84bfdcc84 100755
--- a/etc/inc/openvpn.auth-ldap.php
+++ b/etc/inc/openvpn.auth-ldap.php
@@ -32,6 +32,8 @@
 	pfSense_BUILDER_BINARIES:	
 	pfSense_MODULE:	openvpn
 */
+require_once("config.inc");
+require_once("system.inc");
 
 /* setup syslog logging */
 openlog("openvpn", LOG_ODELAY, LOG_AUTH);
@@ -48,9 +50,39 @@ if (empty($username) || empty($password)) {
 /* Replaced by a sed with propper variables used below(ldap parameters). */
 //<template>
 
-$usernamedn = $username;
-if (!strstr($username, "@") && !strstr($username, "\\"))
-	$usernamedn .= $ldapbasedn;
+$authcfg = system_get_authserver($authmode);
+$basednsplit = explode(",", $authcfg['ldap_basedn']);
+$ldapbasedn = "";
+foreach ($basednsplit as $basedn) {
+	$dn = explode("=", $basedn);
+	if (strtoupper($dn[0]) == "DC") {
+		if ($first > 0)
+			$ldapbasedn .= ".";
+		$first = 1;
+		$ldapbasedn .= $dn[1];
+	}
+}
+$ldapcfgou="{$authcfg['ldap_basedn']}";
+$ldapport="{$authcfg['ldap_port']}";
+if (strstr($authcfg['ldap_urltype'], "Standard"))
+	$ldapproto = "ldap";
+else
+	$ldapproto = "ldaps";
+$ldaphost="{$ldapproto}://{$authcfg['host']}";
+if (!empty($ldapbasedn))
+	$ldapbasedn="@{$ldapbasedn}";
+else
+	$ldapbasedn="{$ldapbasedn}";
+$ldapver="{$authcfg['ldap_protver']}";
+$ldapnameattr=strtolower($authcfg['ldap_attr_user']);
+$ldapfilter="({$ldapnameattr}={$username})";
+if (!$authcfg['ldap_binddn'] || !$authcfg['ldap_bindpw'])
+	$ldapanon=true;
+else {
+	$ldapanon=false;
+	$ldapusername="{$authcfg['ldap_binddn']}";
+	$ldappassword="{$authcfg['ldap_bindpw']}";
+}
 
 /* Make sure we can connect to LDAP */
 putenv('LDAPTLS_REQCERT=never');
@@ -63,13 +95,59 @@ ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
 ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, (int)$ldapver);
 
 /* ok, its up.  now, lets bind as the bind user so we can search it */
-if (!($res = @ldap_bind($ldap, $username, $password)) && !($res = @ldap_bind($ldap, $usernamedn, $password))) {
-	syslog(LOG_WARNING, "user {$username} could not authenticate\n");
+if ($ldapanon == true) {
+	if (!($res = @ldap_bind($ldap))) {
+		syslog(LOG_WARNING, "user {$username} could not bind anonymously\n");
+		ldap_close($ldap);
+		exit(-3);
+	}
+} else if (!($res = @ldap_bind($ldap, $ldapusername, $ldappassword))) {
+	syslog(LOG_WARNING, "user {$username} could not authenticate with bind credentials\n");
 	ldap_close($ldap);
 	exit(-3);
 }
 
+$ldapous = explode(";", $ldapcfgou);
+$founddn = false;
+foreach ($ldapous as $ldapou) {
+	if (!($search = ldap_search($ldap, $ldapou, $ldapfilter))) {
+		syslog(LOG_WARNING, "Could not search the {$ldapou} in directory for user: {$username}");
+		continue;
+	}
+
+	$userinfo = ldap_get_entries($ldap, $search);
+	if ($userinfo['count'] < 1) {
+		syslog(LOG_WARNING, "{$username} does not exist in {$ldapou}.");
+		continue;
+	} else if ($userinfo['count'] > 1) {
+		syslog(LOG_WARNING, "{$username} matches more than one entry in {$ldapou}.");
+		ldap_unbind($ldap);
+		exit(-5);
+	}
+	$founddn = true;
+	break;
+}
+
+if ($founddn == false) {
+	syslog(LOG_WARNING, "{$username} could not authenticate.");
+	ldap_unbind($ldap);
+	exit(-4);
+}
+
+$usernamedn = $username;
+if (!strstr($username, "@") && !strstr($username, "\\"))
+	$usernamedn .= $ldapbasedn;
+
+if (!($res = @ldap_bind($ldap, $username, $password)) && 
+    !($res = @ldap_bind($ldap, $usernamedn, $password)) &&
+    !($res = @ldap_bind($ldap, "{$ldapnameattr}={$username},{$ldapou}", $password))) {
+	syslog(LOG_WARNING, "{$username} could not authenticate in {$ldapou}.");
+	ldap_unbind($ldap);
+	exit(-6);
+}
+
 syslog(LOG_WARNING, "user {$username} authenticated\n");
+
 ldap_unbind($ldap);
 
 exit(0);
diff --git a/etc/inc/openvpn.auth-radius.php b/etc/inc/openvpn.auth-radius.php
index ea750de3d5..77f45daf30 100755
--- a/etc/inc/openvpn.auth-radius.php
+++ b/etc/inc/openvpn.auth-radius.php
@@ -33,6 +33,8 @@
 	pfSense_MODULE:	openvpn
 */
 
+require_once("config.inc");
+require_once("system.inc");
 require_once("radius.inc");
 
 /* setup syslog logging */
@@ -50,19 +52,24 @@ if (empty($username) || empty($password)) {
 /* Replaced by a sed with propper variables used below(server parameters). */
 //<template>
 
+$authcfg = system_get_authserver($authmode);
+$radsrv="{$authcfg['host']}";
+$radport="{$authcfg['radius_auth_port']}";
+$radsecret="{$authcfg['radius_secret']}";
+
 $rauth = new Auth_RADIUS_PAP($username, $password);
 /* Add server to our instance */
 $rauth->addServer($radsrv, $radport, $radsecret);
 
 if (!$rauth->start()) {
-	syslog(LOG_ERROR, "ERROR! . $rauth->getError());
+	syslog(LOG_ERROR, "ERROR! " . $rauth->getError());
 	exit(-2);
 }
 
 /* Send request */
 $result = $rauth->send();
 if (PEAR::isError($result)) {
-	syslog(LOG_WARNING, "Something went wrong trying to authenticate {$username}. " . $result->getMessage() . " \n");
+	syslog(LOG_WARNING, "Something went wrong trying to authenticate {$username}: " . $result->getMessage() . " \n");
 	exit(-1);
 } else if ($result === true) {
 	syslog(LOG_WARNING, "user {$username} authenticated\n");
diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index 09f9056cbf..a62e01ae67 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -384,27 +384,7 @@ function openvpn_reconfigure($mode,& $settings) {
 				else {
 					$authcfg = system_get_authserver($settings['authmode']);
 					if ($authcfg) {
-						switch ($authcfg['type']) {
-						case 'ldap':
-							$basednrplc = array("dc=", "DC=");
-							$ldapbasedn = str_replace($basednrplc, "", $authcfg['ldap_basedn']);
-							$ldapbasedn = str_replace(",", ".", $ldapbasedn);
-							$sed = "\$ldapport=\"{$authcfg['ldap_port']}\";";
-							if (strstr($authcfg['ldap_urltype'], "Standard"))
-								$ldapproto = "ldap";
-							else
-								$ldapproto = "ldaps";
-							$sed .= "\$ldaphost=\"{$ldapproto}:\/\/{$authcfg['host']}\";";
-							$sed .= "\$ldapbasedn=\"@{$ldapbasedn}\";";
-							$sed .= "\$ldapver={$authcfg['ldap_protver']};";
-							break;
-						case 'radius':
-							$sed = "\$radsrv=\"{$authcfg['host']}\";";
-							$sed .= "\$radport=\"{$authcfg['radius_auth_port']}\";";
-							$sed .= "\$radsecret=\"{$authcfg['radius_secret']}\";";
-							break;
-						}
-						mwexec("/bin/cat /etc/inc/openvpn.auth-{$authcfg['type']}.php | /usr/bin/sed 's/\/\/<template>/{$sed}/g' >  {$g['varetc_path']}/openvpn/{$mode_id}.php");
+						mwexec("/bin/cat /etc/inc/openvpn.auth-{$authcfg['type']}.php | /usr/bin/sed 's/\/\/<template>/\$authmode=\"{$authcfg['name']}\";/g' >  {$g['varetc_path']}/openvpn/{$mode_id}.php");
 						mwexec("/bin/chmod a+x {$g['varetc_path']}/openvpn/{$mode_id}.php");
 						$conf .= "auth-user-pass-verify {$g['varetc_path']}/openvpn/{$mode_id}.php via-env\n";
 					}