sr-dev

sr-dev@lists.kamailio.org

16 participants
45399 discussions

git:janakj/ldap: - new items added to the todo list
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: fd792300495f0de47885926ea4e0a6cb65710959 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=fd79230… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jul 10 12:54:55 2008 +0000 - new items added to the todo list --- modules/db_ldap/todo.txt | 38 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 38 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index da94661..ce9c672 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -104,3 +104,41 @@ X Support for Older LDAP Libraries * Check that we escape strings properly according to RFC4514 +* Support for server-side compare operation (could be used for authentication + where the client would send the digest credentials and the server replies + whether or not they are valid, similar to RADIUS digest authentication) + +* Support for alias-dereferencing + + Aliases represent links to other entries or partitions of the namespace. + When the distinguished name of an alias is used, the entry accessed is + the entry to which the alias refers. + Alias dereferencing specifies if aliases are dereferenced-- that is, if + the alias entry itself or the entry it points to is used. Aliases can be + dereferenced or not when locating the base object and/or when searching + under the base object. + +* Support for handling of NULL Values in configuration parameters + + When an optional attribute is missing and also when the attribute is + present but has no value; e.g. DN=NULL for anonymous authentication. + +* Support for asynchronous notifications + The only standardized async. notification seems to be "notice of disconnection" + so all that we can do is just log incoming asynchronous notifications from the + server + +* Support for subscribing to notifications of changes in the DIT (optional) + This could be useful for updating data that is cached in SER, such as the list + of supported domains. This is a "nice to have" type of feature, so no time + estimation for implementation. + +* Support for automatic reconnects (check if we do it and if we do it properly). + +* Implement support for referrals (in the ldap module, not in the libldap library). + Including loop detection. + +* Support for time limited search operations + +* Support for size limited search operations +

1 0

git:janakj/ldap: - ticket numbers added
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 0d7657b850b13160ad7ae2f46a09d9d539fe4977 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=0d7657b… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jul 10 14:14:02 2008 +0000 - ticket numbers added --- modules/db_ldap/todo.txt | 134 ++++++++++++++++++++++++---------------------- 1 files changed, 70 insertions(+), 64 deletions(-) diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index ce9c672..3849dee 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -1,35 +1,35 @@ X Simple Authentication - Implement support for simple LDAP authentication with username and - password. This will take a change in the URI parser because the one provided - by libldap (which we use to parse the URI right now) does not support - embedded usernames and passwords in the URI. + Implement support for simple LDAP authentication with username and password. + This will take a change in the URI parser because the one provided by + libldap (which we use to parse the URI right now) does not support embedded + usernames and passwords in the URI. -* SASL Authentication Support +* SASL Authentication Support (SER-392) The driver supports no authentication method at the moment, we should include support for simple authentication at least, but better SASL. -* TLS/SSL Support +* TLS/SSL Support (SER-394) The driver should support encrypted connections to LDAP servers and some level of certificate validation. Currently there are no options or parameters to configure SSL/TLS certificates and keys to use. -* Copy Data from Config Data Structure +* Copy Data from Config Data Structure (SER-395) - The driver maintains an internal data structure that gets initialized - from the supplied configuration file. The structure contains things like - search filters and field mapping tables. The LDAP specific extension - structures make a shallow copy of strings from the configuration - data structure, they should rather copy the whole string so that they - do not depend on the config structure. + The driver maintains an internal data structure that gets initialized from + the supplied configuration file. The structure contains things like search + filters and field mapping tables. The LDAP specific extension structures + make a shallow copy of strings from the configuration data structure, they + should rather copy the whole string so that they do not depend on the config + structure. X Implement Support For < And > Operators - The LDAP search filter syntax (RFC4515) does not support < and > - operators, only <= and >=. Currently the ldap driver simply uses <= instead - of < and >= instead of >. We need a better implementation of this. + The LDAP search filter syntax (RFC4515) does not support < and > operators, + only <= and >=. Currently the ldap driver simply uses <= instead of < and >= + instead of >. We need a better implementation of this. X Implement Support For Other Than str Parameters @@ -37,36 +37,36 @@ X Escape Values of Parameters Injected Into the Search Filter see RFC4515 for description of escaping. -* Proper handling of NULL Values in Parameter. +* Proper handling of NULL Values in Parameter (SER-396). - Is it correct that parameters with NULL values are represented as - paramName= in the filter? + Is it correct that parameters with NULL values are represented as paramName= + in the filter? -* Use Asynchronous API Functions Instead of Synchronous +* Use Asynchronous API Functions Instead of Synchronous (SER-397) - This would be useful when we have support for multiple database drivers + This would be useful when we have support for multiple database drivers within one database context, then we could initiate multiple searches simultaneously without being blocked waiting for the result. -* Support For Multi-Value Attributes +* Support For Multi-Value Attributes (SER-398) The module should support multi-value attributes. Objects containing - attributes with multi-values should be returned as multiple records, - each record containing one value of the multi-value attribute. Currently - the module will report an error if it encounters a multi-value attribute. + attributes with multi-values should be returned as multiple records, each + record containing one value of the multi-value attribute. Currently the + module will report an error if it encounters a multi-value attribute. -* Support For Time Zones in Generalized Times +* Support For Time Zones in Generalized Times (SER-399) The time conversion functions ignore time zones in GeneralizedTime attributes, this should be fixed. -* Handle Fractions of Seconds in Generalized Time +* Handle Fractions of Seconds in Generalized Time (SER-400) There is no need to account fractions of seconds because we store time - internally as time_t, but the parses should be able to skip fractions - of seconds gracefully. + internally as time_t, but the parses should be able to skip fractions of + seconds gracefully. -* Eliminate Use of All libldap Functions Marked as Deprecated +* Eliminate Use of All libldap Functions Marked as Deprecated (SER-401) We should eliminate the use of all functions that are marked as deprecated in the header field and remove LDAP_DEPRECATED define from all files. @@ -83,62 +83,68 @@ X Support for Syntax Specification in the Config File attributes in the configuration file so that the module knows how to convert DB API fields into attribute values in command parameters. -* Support DB_NEQ Operator in Integer Attributes +* Support DB_NEQ Operator in Integer Attributes (SER-402) fld!=10 could be converted to the search filter as: (|(fld<=9)(fld>=11)) -* Indicate Underflow/Overflow in Integer Attributes +* Indicate Underflow/Overflow in Integer Attributes (SER-403) The operators < and > cannot be used in LDAP search filter, RFC4515 only - supports <= and >= so we create the search filter like this: - fld<10 -> (fld<=9) - fld>10 -> (fld>=11) - The module should issue an warning when the incremented/decremented field - value overflows/underflows. + supports <= and >= so we create the search filter like this: fld<10 -> + (fld<=9) fld>10 -> (fld>=11) The module should issue an warning when the + incremented/decremented field value overflows/underflows. X Support for Older LDAP Libraries - Older versions of the openldap client library might not contain + Older versions of the openldap client library might not contain LDAP_SCOPE_CHILDREN. We need to handle this case in a graceful manner and make sure that the module compiles. -* Check that we escape strings properly according to RFC4514 +* Check that we escape strings properly according to RFC4514 (SER-404) -* Support for server-side compare operation (could be used for authentication +* Support for server side comparison (SER-405) + + Support for server-side compare operation (could be used for authentication where the client would send the digest credentials and the server replies whether or not they are valid, similar to RADIUS digest authentication) -* Support for alias-dereferencing +* Support for alias-dereferencing (SER-406) - Aliases represent links to other entries or partitions of the namespace. - When the distinguished name of an alias is used, the entry accessed is - the entry to which the alias refers. - Alias dereferencing specifies if aliases are dereferenced-- that is, if - the alias entry itself or the entry it points to is used. Aliases can be - dereferenced or not when locating the base object and/or when searching - under the base object. + Aliases represent links to other entries or partitions of the namespace. + When the distinguished name of an alias is used, the entry accessed is the + entry to which the alias refers. Alias dereferencing specifies if aliases + are dereferenced-- that is, if the alias entry itself or the entry it points + to is used. Aliases can be dereferenced or not when locating the base object + and/or when searching under the base object. + +* Support for handling of NULL Values in configuration parameters (SER-407) + + When an optional attribute is missing and also when the attribute is present + but has no value; e.g. DN=NULL for anonymous authentication. -* Support for handling of NULL Values in configuration parameters +* Support for unsolicited notifications (SER-408) - When an optional attribute is missing and also when the attribute is - present but has no value; e.g. DN=NULL for anonymous authentication. + The only standardized unsolicited notification seems to be "notice of + disconnection" so all that we can do is just log incoming asynchronous + notifications from the server -* Support for asynchronous notifications - The only standardized async. notification seems to be "notice of disconnection" - so all that we can do is just log incoming asynchronous notifications from the - server +* Support for asynchronous notifications (SER-409) -* Support for subscribing to notifications of changes in the DIT (optional) - This could be useful for updating data that is cached in SER, such as the list - of supported domains. This is a "nice to have" type of feature, so no time - estimation for implementation. + Support for subscribing to notifications of changes in the DIT (optional) + This could be useful for updating data that is cached in SER, such as the + list of supported domains. This is a "nice to have" type of feature, so no + time estimation for implementation. + +* Support for automatic reconnects (SER-410) + + (check if we do it and if we do it properly). -* Support for automatic reconnects (check if we do it and if we do it properly). +* Support for referrals (SER-411) -* Implement support for referrals (in the ldap module, not in the libldap library). - Including loop detection. + Implement support for referrals (in the ldap module, not in the libldap + library). Including loop detection. -* Support for time limited search operations +* Support for time limited search operations (SER-412) -* Support for size limited search operations +* Support for size limited search operations (SER-413)

1 0

git:janakj/ldap: - added an alias for generalized time syntax
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: e66572b0dddbc460bbc1536afeb60620673c554e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=e66572b… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Thu Jul 10 15:14:45 2008 +0000 - added an alias for generalized time syntax --- modules/db_ldap/ser.schema | 17 +++++++++-------- 1 files changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/db_ldap/ser.schema b/modules/db_ldap/ser.schema index 2c25c6d..6493d8f 100644 --- a/modules/db_ldap/ser.schema +++ b/modules/db_ldap/ser.schema @@ -31,14 +31,15 @@ objectIdentifier serObjectClass serLDAP:1 # # Convenience macros for commonly used syntax OIDs # -objectIdentifier ldapSyntax ldap3OID:115.121.1 -objectIdentifier stringSyntax ldapSyntax:15 -objectIdentifier octetStringSyntax ldapSyntax:40 -objectIdentifier bitStringSyntax ldapSyntax:6 -objectIdentifier intSyntax ldapSyntax:27 -objectIdentifier numericStringSyntax ldapSyntax:36 -objectIdentifier binarySyntax ldapSyntax:5 -objectIdentifier boolSyntax ldapSyntax:7 +objectIdentifier ldapSyntax ldap3OID:115.121.1 +objectIdentifier stringSyntax ldapSyntax:15 +objectIdentifier octetStringSyntax ldapSyntax:40 +objectIdentifier bitStringSyntax ldapSyntax:6 +objectIdentifier intSyntax ldapSyntax:27 +objectIdentifier numericStringSyntax ldapSyntax:36 +objectIdentifier binarySyntax ldapSyntax:5 +objectIdentifier boolSyntax ldapSyntax:7 +objectIdentifier genTimeSyntax ldapSyntax:24 # # This is the parent attribute type for various UID attributes of SER, such

1 0

git:janakj/ldap: tls encryption support added
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 110dd250960f81d1aa3238255234f228604db7ff URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=110dd25… Author: Gergely Kovacs <gergo(a)iptel.org> Committer: Gergely Kovacs <gergo(a)iptel.org> Date: Fri Jul 18 10:02:49 2008 +0000 tls encryption support added --- modules/db_ldap/Makefile | 2 ++ modules/db_ldap/ld_cfg.c | 18 +++++++++++++----- modules/db_ldap/ld_cfg.h | 3 +++ modules/db_ldap/ld_con.c | 33 ++++++++++++++++++++++++++++++++- modules/db_ldap/ld_uri.c | 23 +++++++++++++++++++++++ modules/db_ldap/ld_uri.h | 3 +++ modules/db_ldap/ldap.cfg | 12 ++++++++++++ 7 files changed, 88 insertions(+), 6 deletions(-) diff --git a/modules/db_ldap/Makefile b/modules/db_ldap/Makefile index f7b0507..e9309e2 100644 --- a/modules/db_ldap/Makefile +++ b/modules/db_ldap/Makefile @@ -8,6 +8,8 @@ NAME=ldap.so #DEFS += -DLD_TEST +DEFS += -Wall -DOPENLDAP23 + # Uncomment this if you have a recent version of libldap with # LD_SCOPE_CHILDREN defined #DEFS += -DHAVE_SCOPE_CHILDREN diff --git a/modules/db_ldap/ld_cfg.c b/modules/db_ldap/ld_cfg.c index 642c0b3..d3758ab 100644 --- a/modules/db_ldap/ld_cfg.c +++ b/modules/db_ldap/ld_cfg.c @@ -268,11 +268,14 @@ static cfg_option_t auth_values[] = { static cfg_option_t ldap_con_options[] = { - {"host", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"port", .f = cfg_parse_int_opt}, - {"username", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"password", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, - {"authtype", .param = auth_values, .f = cfg_parse_enum_opt}, + {"host", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"port", .f = cfg_parse_int_opt}, + {"username", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"password", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"authtype", .param = auth_values, .f = cfg_parse_enum_opt}, + {"tls", .param = cfg_bool_values, .f = cfg_parse_enum_opt}, + {"ca_list", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, + {"require_certificate", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM}, {0} }; @@ -342,6 +345,11 @@ static int parse_section(void* param, cfg_parser_t* st, unsigned int flags) for(i = 0; auth_values[i].name; i++) { auth_values[i].param = &con->authmech; } + for(i = 0; cfg_bool_values[i].name; i++) { + cfg_bool_values[i].param = &con->tls; + } + ldap_con_options[6].param = &con->ca_list; + ldap_con_options[7].param = &con->req_cert; } else { BUG("%s:%d:%d: Unsupported section type %c\n", st->file, t.start.line, t.start.col, t.type); diff --git a/modules/db_ldap/ld_cfg.h b/modules/db_ldap/ld_cfg.h index 1a36ee4..43abca0 100644 --- a/modules/db_ldap/ld_cfg.h +++ b/modules/db_ldap/ld_cfg.h @@ -49,6 +49,9 @@ struct ld_con_info { str username; str password; int authmech; + int tls; /**< TLS encryption enabled */ + str ca_list; /**< Path of the file that contains certificates of the CAs */ + str req_cert; /**< LDAP level of certificate request behaviour */ struct ld_con_info* next; }; diff --git a/modules/db_ldap/ld_con.c b/modules/db_ldap/ld_con.c index 103f1bb..b08a62b 100644 --- a/modules/db_ldap/ld_con.c +++ b/modules/db_ldap/ld_con.c @@ -42,7 +42,6 @@ #include <ldap.h> #include <stdlib.h> #include <string.h> - #include <sasl/sasl.h> /** Free all memory allocated for a ld_con structure. @@ -176,6 +175,7 @@ int ld_con_connect(db_con_t* con) struct ld_con* lcon; struct ld_uri* luri; int ret, version = 3; + char* err_str = NULL; lcon = DB_GET_PAYLOAD(con); luri = DB_GET_PAYLOAD(con->uri); @@ -193,6 +193,19 @@ int ld_con_connect(db_con_t* con) } } + /* we pass the TLS_REQCERT and TLS_REQCERT attributes over environment + variables to ldap library */ + if (luri->tls) { + if (setenv("LDAPTLS_CACERT", luri->ca_list, 1)) { + ERR("ldap: Can't set environment variable 'LDAPTLS_CACERT'\n"); + goto error; + } + if (setenv("LDAPTLS_REQCERT", luri->req_cert, 1)) { + ERR("ldap: Can't set environment variable 'LDAPTLS_REQCERT'\n"); + goto error; + } + } + ret = ldap_initialize(&lcon->con, luri->uri); if (lcon->con == NULL) { ERR("ldap: Error while initializing new LDAP connection to %s\n", @@ -207,6 +220,24 @@ int ld_con_connect(db_con_t* con) goto error; } + if (luri->tls) { + ret = ldap_start_tls_s(lcon->con, NULL, NULL); + if (ret != LDAP_SUCCESS) { + /* get addition info of this error */ +#ifdef OPENLDAP23 + ldap_get_option(lcon->con, LDAP_OPT_ERROR_STRING, &err_str); +#elif OPENLDAP24 + ldap_get_option(lcon->con, LDAP_OPT_DIAGNOSTIC_MESSAGE, &err_str); +#endif + ERR("ldap: Error while starting TLS: %s\n", ldap_err2string(ret)); + if (err_str) { + ERR("ldap: %s\n", err_str); + ldap_memfree(err_str); + } + goto error; + } + } + switch (luri->authmech) { case LDAP_AUTHMECH_NONE: ret = ldap_simple_bind_s(lcon->con, NULL, NULL); diff --git a/modules/db_ldap/ld_uri.c b/modules/db_ldap/ld_uri.c index 5476e51..1b18879 100644 --- a/modules/db_ldap/ld_uri.c +++ b/modules/db_ldap/ld_uri.c @@ -285,6 +285,19 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri) } res->authmech = cfg_conn_info->authmech; + res->tls = cfg_conn_info->tls; + if (cfg_conn_info->ca_list.s) { + if (!(res->ca_list = pkgstrdup(&cfg_conn_info->ca_list))) { + ERR("ldap: No memory left\n"); + goto err; + } + } + if (cfg_conn_info->req_cert.s) { + if (!(res->req_cert = pkgstrdup(&cfg_conn_info->req_cert))) { + ERR("ldap: No memory left\n"); + goto err; + } + } break; default: @@ -304,6 +317,14 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri) pkg_free(res->password); res->password = NULL; } + if (res->ca_list) { + pkg_free(res->ca_list); + res->ca_list = NULL; + } + if (res->req_cert) { + pkg_free(res->req_cert); + res->req_cert = NULL; + } return -1; } @@ -314,6 +335,8 @@ static void ld_uri_free(db_uri_t* uri, struct ld_uri* payload) if (payload->uri) pkg_free(payload->uri); if (payload->username) pkg_free(payload->username); if (payload->password) pkg_free(payload->password); + if (payload->ca_list) pkg_free(payload->ca_list); + if (payload->req_cert) pkg_free(payload->req_cert); db_drv_free(&payload->drv); pkg_free(payload); } diff --git a/modules/db_ldap/ld_uri.h b/modules/db_ldap/ld_uri.h index 27bfa15..43155f3 100644 --- a/modules/db_ldap/ld_uri.h +++ b/modules/db_ldap/ld_uri.h @@ -61,6 +61,9 @@ struct ld_uri { char* password; char* uri; /**< The whole URI, including scheme */ int authmech; + int tls; /**< TLS encryption enabled */ + char* ca_list; /**< Path of the file that contains certificates of the CAs */ + char* req_cert; /**< LDAP level of certificate request behaviour */ LDAPURLDesc* ldap_url; /**< URI parsed by the ldap client library */ }; diff --git a/modules/db_ldap/ldap.cfg b/modules/db_ldap/ldap.cfg index c21da52..d113bfb 100644 --- a/modules/db_ldap/ldap.cfg +++ b/modules/db_ldap/ldap.cfg @@ -24,6 +24,18 @@ password=heslo # Allowed values: none (default), simple, digest-md5, external authtype=simple +# tls encryption +tls=off + +# Specifies the file that contains certificates for all of the Certificate +# Authorities the ldap module will recognize. +ca_list=/home/kg/work/openssl/demoCA/cacert.pem + +# Specifies what checks to perform on server certificates in a TLS session +# allowed values are never/allow/try/demand +# see the TLS_REQCERT tls option part of ldap.conf(8) man page for more details +require_certificate=demand + # # Table credentials contains SIP digest authentication credentials. #

1 0

git:janakj/ldap: - domain_attrs table mapping added
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 06ebc89d3302a11654e42fa75bccf9404e1d3188 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=06ebc89… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Tue May 13 09:11:45 2008 +0000 - domain_attrs table mapping added --- modules/db_ldap/ldap.cfg | 37 +++++++++++++++++++++++++++++++++++++ 1 files changed, 37 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/ldap.cfg b/modules/db_ldap/ldap.cfg index 6e69119..f8ef551 100644 --- a/modules/db_ldap/ldap.cfg +++ b/modules/db_ldap/ldap.cfg @@ -6,7 +6,9 @@ # LDAP attribute names and vice versa. # +# # Table credentials contains SIP digest authentication credentials. +# [credentials] # In our LDAP directory we store SIP digest credentials under @@ -29,3 +31,38 @@ field_map = realm : digestRealm field_map = auth_username : digestUsername field_map = uid : serUID field_map = flags : serFlags + +# +# Domain table stores information about virtual domains +# +[domain] + +# Objects mapping domain IDs to domain names and vice versa are stored +# in the subtree with the following root: +base = "ou=Domains,dc=iptel,dc=org" + +scope = children + +# We are only interested in serDomain objects when looking up information +# about virtual domains. +filter = "(objectClass=serDomain)" + +field_map = did : serDID +field_map = domain : serDomain +field_map = flags : serFlags + +# +# Table domain_attrs contains domain attributes, domain attributes store +# extra information about virtual domains. +# +[domain_attrs] +base = "ou=Domains, dc=iptel,dc=org" +scope = children + +filter = "(objectClass=serDomainAttr)" + +field_map = did : serDID +field_map = name : serAttrName +field_map = type : serAttrType +field_map = value : serAttrValue +field_map = flags : serFlags

1 0

git:janakj/ldap: - Support for generalized time attributes
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 5055f48ce7f0a00ed9a5ecdb63732b84fb9a3457 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5055f48… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Mon May 12 16:13:10 2008 +0000 - Support for generalized time attributes - Support for double/float fields - Support for bitmap fields - todo list items augmented with more info --- modules/db_ldap/ld_fld.c | 113 ++++++++++++++++++++++++++++++++++++----- modules/db_ldap/standards.txt | 2 + modules/db_ldap/todo.txt | 77 ++++++++++++++++++++++++---- 3 files changed, 168 insertions(+), 24 deletions(-) diff --git a/modules/db_ldap/ld_fld.c b/modules/db_ldap/ld_fld.c index b886d85..f9d2c95 100644 --- a/modules/db_ldap/ld_fld.c +++ b/modules/db_ldap/ld_fld.c @@ -36,6 +36,10 @@ #define LDAP_DEPRECATED 1 +#define _XOPEN_SOURCE 4 /* bsd */ +#define _XOPEN_SOURCE_EXTENDED 1 /* solaris */ +#define _SVID_SOURCE 1 /* timegm */ + #include "ld_fld.h" #include "../../db/db_drv.h" @@ -43,8 +47,12 @@ #include "../../dprint.h" #include "../../ut.h" +#include <stdlib.h> +#include <strings.h> #include <stdint.h> #include <string.h> +#include <time.h> /* strptime, XOPEN issue must be >= 4 */ + /** Frees memory used by a ld_fld structure. * This function frees all memory used by a ld_fld structure @@ -127,11 +135,63 @@ static inline int ldap_bit2db_int(int* dst, str* src) } +/* Convert time_t structure to Generalized Time */ +static inline int db_datetime2ldap_gentime(str* dst, time_t src) +{ + /* + struct tm* t; + + t = gmtime(&_time); + return strftime(result, res_len, "%Y%m%d%H%M%S", t); + */ + return -1; +} + + +static inline int ldap_gentime2db_datetime(time_t* dst, str* src) +{ + struct tm time; + + if (src->len < 12) return -1; + + /* It is necessary to zero tm structure first */ + memset(&time, '\0', sizeof(struct tm)); + strptime(src->s, "%Y%m%d%H%M%S", &time); + + /* Daylight saving information got lost in the database + * so let timegm to guess it. This eliminates the bug when + * contacts reloaded from the database have different time + * of expiration by one hour when daylight saving is used + */ + time.tm_isdst = -1; +#ifdef HAVE_TIMEGM + *dst = timegm(&time); +#else + *dst = _timegm(&time); +#endif /* HAVE_TIMEGM */ + return 0; +} + + +static inline int ldap_str2db_double(double* dst, char* src) +{ + *dst = atof(src); + return 0; +} + + +static inline int ldap_str2db_float(float* dst, char* src) +{ + *dst = (float)atof(src); + return 0; +} + + int ld_ldap2fld(db_fld_t* fld, LDAP* ldap, LDAPMessage* msg) { int i; struct ld_fld* lfld; - str tmp; + str v; if (fld == NULL || msg == NULL) return 0; for(i = 0; !DB_FLD_EMPTY(fld) && !DB_FLD_LAST(fld[i]); i++) { @@ -151,32 +211,57 @@ int ld_ldap2fld(db_fld_t* fld, LDAP* ldap, LDAPMessage* msg) return -1; } + v.s = lfld->values[0]->bv_val; + v.len = lfld->values[0]->bv_len; + switch(fld[i].type) { case DB_CSTR: - fld[i].v.cstr = lfld->values[0]->bv_val; + fld[i].v.cstr = v.s; break; case DB_STR: case DB_BLOB: - fld[i].v.lstr.s = lfld->values[0]->bv_val; - fld[i].v.lstr.len = lfld->values[0]->bv_len; + fld[i].v.lstr.s = v.s; + fld[i].v.lstr.len = v.len; break; case DB_INT: case DB_BITMAP: - tmp.s = lfld->values[0]->bv_val; - tmp.len = lfld->values[0]->bv_len; + if (v.s[0] == '\'' && + v.s[v.len - 1] == 'B' && + v.s[v.len - 2] == '\'') { + + v.s++; + v.len -= 3; + return ldap_bit2db_int(&fld[i].v.int4, &v); + } else { + return ldap_int2db_int(&fld[i].v.int4, &v); + } + break; + case DB_DATETIME: + if (ldap_gentime2db_datetime(&fld[i].v.time, &v) != 0) { + ERR("ldap: Error while converting LDAP time value '%.*s'\n", + v.len, ZSW(v.s)); + return -1; + } + break; - if (tmp.s[0] == '\'' && - tmp.s[tmp.len - 1] == 'B' && - tmp.s[tmp.len - 2] == '\'') { + case DB_FLOAT: + /* We know that the ldap library zero-terminated v.s */ + if (ldap_str2db_float(&fld[i].v.flt, v.s) != 0) { + ERR("ldap: Error while converting '%.*s' to float\n", + v.len, ZSW(v.s)); + return -1; + } + break; - tmp.s++; - tmp.len -= 3; - return ldap_bit2db_int(&fld[i].v.int4, &tmp); - } else { - return ldap_int2db_int(&fld[i].v.int4, &tmp); + case DB_DOUBLE: + /* We know that the ldap library zero-terminated v.s */ + if (ldap_str2db_double(&fld[i].v.dbl, v.s) != 0) { + ERR("ldap: Error while converting '%.*s' to double\n", + v.len, ZSW(v.s)); + return -1; } break; diff --git a/modules/db_ldap/standards.txt b/modules/db_ldap/standards.txt index 77d9d2c..e24244d 100644 --- a/modules/db_ldap/standards.txt +++ b/modules/db_ldap/standards.txt @@ -23,3 +23,5 @@ RFC4530: LDAP entryUUID Operational Attribute directory. Such identifiers can be used to identify the object even when the dn of the object changes. Unfortunately the entryUUID attribute cannot by modified by the user and thus it is not directly usable for us. + +RFC2252 LDAPv3: Attribute Syntax Definitions diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index 7e9c544..14fb139 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -1,11 +1,68 @@ -* Support for authentication -* Support for SSL -* Copy all data from the configuration structures into db api structures - (right now we only store pointers) -* Implement < and > operators properly -* Implement support for other than str parameters -* Escape values of parameters injected into the search filter -* Proper handling of NULL values -* use the asynchronous functions of the api instead of synchronous -* Support for multi-value attributes (they should be broken up into rows) +* Authentication Support + + The driver supports no authentication method at the moment, we should + include support for simple authentication at least, but better SASL. + This will take a change in the URI parser because the one provided + by libldap (which we use to parse the URI right now) does not support + embedded usernames and passwords in the URI. +* TLS/SSL Support + + The driver should support encrypted connections to LDAP servers and some + level of certificate validation. Currently there are no options or + parameters to configure SSL/TLS certificates and keys to use. + +* Copy Data from Config Data Structure + + The driver maintains an internal data structure that gets initialized + from the supplied configuration file. The structure contains things like + search filters and field mapping tables. The LDAP specific extension + structures make a shallow copy of strings from the configuration + data structure, they should rather copy the whole string so that they + do not depend on the config structure. + +* Implement Support For < And > Operators + + The LDAP search filter syntax (RFC4515) does not support < and > + operators, only <= and >=. Currently the ldap driver simply uses <= instead + of < and >= instead of >. We need a better implementation of this. + +* Implement Support For Other Than str Parameters + +* Escape Values of Parameters Injected Into the Search Filter + + see RFC4515 for description of escaping. + +* Proper handling of NULL Values in Parameter. + + Is it correct that parameters with NULL values are represented as + paramName= in the filter? + +* Use Asynchronous API Functions Instead of Synchronous + + This would be useful when we have support for multiple database drivers + within one database context, then we could initiate multiple searches + simultaneously without being blocked waiting for the result. + +* Support For Multi-Value Attributes + + The module should support multi-value attributes. Objects containing + attributes with multi-values should be returned as multiple records, + each record containing one value of the multi-value attribute. Currently + the module will report an error if it encounters a multi-value attribute. + +* Support For Time Zones in Generalized Times + + The time conversion functions ignore time zones in GeneralizedTime + attributes, this should be fixed. + +* Handle Fractions of Seconds in Generalized Time + + There is no need to account fractions of seconds because we store time + internally as time_t, but the parses should be able to skip fractions + of seconds gracefully. + +* Eliminate Use of All libldap Functions Marked as Deprecated + + We should eliminate the use of all functions that are marked as deprecated + in the header field and remove LDAP_DEPRECATED define from all files.

1 0

git:janakj/ldap: - syntax added where necessary in field maps
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 6e68733f114b94c51fb265048448ab881677696a URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=6e68733… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Tue May 13 12:31:34 2008 +0000 - syntax added where necessary in field maps --- modules/db_ldap/ldap.cfg | 26 ++++++++++++++++++-------- 1 files changed, 18 insertions(+), 8 deletions(-) diff --git a/modules/db_ldap/ldap.cfg b/modules/db_ldap/ldap.cfg index f8ef551..16fe984 100644 --- a/modules/db_ldap/ldap.cfg +++ b/modules/db_ldap/ldap.cfg @@ -5,6 +5,15 @@ # configure the LDAP search filter and maps database field names to # LDAP attribute names and vice versa. # +# Supported Attribute Type Names: +# * GeneralizedTime +# * Integer +# * BitString +# * Boolean +# * String +# * Binary +# * Float +# # # Table credentials contains SIP digest authentication credentials. @@ -25,12 +34,13 @@ filter = "(objectClass=digestAuthCredentials)" # Mapping of field names to LDAP attribute names and vice versa. Names are # delimited using ':', the first name is database field name as used in SER -# modules, the second name (after :) is corresponding LDAP attribute name. -field_map = password : digestPassword +# modules, the second name (after :) is corresponding LDAP attribute name, +# optionally preceeded with LDAP attribute syntax name in parentheses. +field_map = password : (Binary) digestPassword field_map = realm : digestRealm field_map = auth_username : digestUsername field_map = uid : serUID -field_map = flags : serFlags +field_map = flags : (BitString) serFlags # # Domain table stores information about virtual domains @@ -47,9 +57,9 @@ scope = children # about virtual domains. filter = "(objectClass=serDomain)" -field_map = did : serDID -field_map = domain : serDomain -field_map = flags : serFlags +field_map = did : (String) serDID +field_map = domain : (String) serDomain +field_map = flags : (BitString) serFlags # # Table domain_attrs contains domain attributes, domain attributes store @@ -63,6 +73,6 @@ filter = "(objectClass=serDomainAttr)" field_map = did : serDID field_map = name : serAttrName -field_map = type : serAttrType +field_map = type : (Integer) serAttrType field_map = value : serAttrValue -field_map = flags : serFlags +field_map = flags : (BitString) serFlags

1 0

git:janakj/ldap: - todo list updated
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 0d793e63a790508e71854d00a4e861c9366d6337 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=0d793e6… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Tue May 13 12:35:12 2008 +0000 - todo list updated --- modules/db_ldap/todo.txt | 14 +++++++++++++- 1 files changed, 13 insertions(+), 1 deletions(-) diff --git a/modules/db_ldap/todo.txt b/modules/db_ldap/todo.txt index 14fb139..7f78010 100644 --- a/modules/db_ldap/todo.txt +++ b/modules/db_ldap/todo.txt @@ -27,7 +27,7 @@ operators, only <= and >=. Currently the ldap driver simply uses <= instead of < and >= instead of >. We need a better implementation of this. -* Implement Support For Other Than str Parameters +X Implement Support For Other Than str Parameters * Escape Values of Parameters Injected Into the Search Filter @@ -66,3 +66,15 @@ We should eliminate the use of all functions that are marked as deprecated in the header field and remove LDAP_DEPRECATED define from all files. + +X Support for Bool Attribute Types + + The module should be able to convert boolean attributes from the LDAP result + into int fields. + +X Support for Syntax Specification in the Config File + + There is no easy or portable way of retrieving syntaxes of attributes from + the LDAP server, so it might be necessary to specify the syntax of + attributes in the configuration file so that the module knows how to convert + DB API fields into attribute values in command parameters.

1 0

git:janakj/ldap: - added support for boolean attributes in result
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: b5695d3fc766ade1a6cb9254541b3167496689ae URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=b5695d3… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Tue May 13 12:31:10 2008 +0000 - added support for boolean attributes in result - added support for attribute syntaxes in the config file - the code converting integers rearranged --- modules/db_ldap/ld_config.c | 100 +++++++++++++++++++++++++++++++++++++------ modules/db_ldap/ld_config.h | 18 ++++++- modules/db_ldap/ld_fld.c | 33 +++++++++++--- modules/db_ldap/ld_fld.h | 4 +- 4 files changed, 129 insertions(+), 26 deletions(-) diff --git a/modules/db_ldap/ld_config.c b/modules/db_ldap/ld_config.c index a813c1a..57bcee1 100644 --- a/modules/db_ldap/ld_config.c +++ b/modules/db_ldap/ld_config.c @@ -91,6 +91,7 @@ struct parser_tab { static struct parser_tab token_scope[]; static struct parser_tab option_name[]; +static struct parser_tab token_syntax[]; /* @@ -581,6 +582,7 @@ static int parse_field_map(token_t* token) int ret; token_t t; void* ptr; + struct parser_tab* r; ret = lex(&t, 0); if (ret < 0) return -1; @@ -596,24 +598,33 @@ static int parse_field_map(token_t* token) return -1; } - ptr = pkg_realloc(pstate.cfg->fields, sizeof(char*) * (pstate.cfg->n + 1)); + ptr = pkg_realloc(pstate.cfg->field, sizeof(char*) * (pstate.cfg->n + 1)); if (ptr == NULL) { ERR("ldap:%s:%d: Out of memory\n", pstate.file, token->start.line); return -1; } - pstate.cfg->fields = (char**)ptr; - pstate.cfg->fields[pstate.cfg->n] = NULL; + pstate.cfg->field = (char**)ptr; + pstate.cfg->field[pstate.cfg->n] = NULL; - ptr = pkg_realloc(pstate.cfg->attrs, sizeof(char*) * (pstate.cfg->n + 1)); + ptr = pkg_realloc(pstate.cfg->attr, sizeof(char*) * (pstate.cfg->n + 1)); if (ptr == NULL) { ERR("ldap:%s:%d: Out of memory\n", pstate.file, token->start.line); return -1; } - pstate.cfg->attrs = (char**)ptr; - pstate.cfg->attrs[pstate.cfg->n] = NULL; + pstate.cfg->attr = (char**)ptr; + pstate.cfg->attr[pstate.cfg->n] = NULL; + ptr = pkg_realloc(pstate.cfg->syntax, sizeof(enum ld_syntax) * (pstate.cfg->n + 1)); + if (ptr == NULL) { + ERR("ldap:%s:%d: Out of memory\n", + pstate.file, token->start.line); + return -1; + } + pstate.cfg->syntax = (enum ld_syntax*)ptr; + pstate.cfg->syntax[pstate.cfg->n] = LD_SYNTAX_STRING; + pstate.cfg->n++; ret = lex(&t, 0); @@ -631,8 +642,8 @@ static int parse_field_map(token_t* token) return -1; } - pstate.cfg->fields[pstate.cfg->n - 1] = as_asciiz(&t.val); - if (pstate.cfg->fields[pstate.cfg->n - 1] == NULL) { + pstate.cfg->field[pstate.cfg->n - 1] = as_asciiz(&t.val); + if (pstate.cfg->field[pstate.cfg->n - 1] == NULL) { ERR("ldap:%s:%d: Out of memory\n", pstate.file, token->start.line); return -1; @@ -654,11 +665,58 @@ static int parse_field_map(token_t* token) ret = lex(&t, 0); if (ret < 0) return -1; if (ret == 0) { - ERR("ldap:%s:%d:%d: LDAP Attribute name expected\n", + ERR("ldap:%s:%d:%d: LDAP Attribute syntax or name expected\n", pstate.file, token->start.line, token->start.col); return -1; } + if (t.type == '(') { + ret = lex(&t, 0); + if (ret < 0) return -1; + if (ret == 0) { + ERR("ldap:%s:%d:%d: LDAP Attribute Syntax expected\n", + pstate.file, token->start.line, token->start.col); + return -1; + } + if (t.type != TOKEN_ALPHA) { + ERR("ldap:%s:%d:%d: Invalid LDAP attribute syntax format %d:'%.*s'\n", + pstate.file, t.start.line, t.start.col, + t.type, t.val.len, ZSW(t.val.s)); + return -1; + } + + r = lookup_token(token_syntax, &t.val); + if (!r) { + ERR("ldap:%s:%d:%d: Invalid syntaxt value '%.*s'\n", + pstate.file, t.start.line, t.start.col, + t.val.len, ZSW(t.val.s)); + return -1; + } + pstate.cfg->syntax[pstate.cfg->n - 1] = r->u.ival; + + ret = lex(&t, 0); + if (ret < 0) return -1; + if (ret == 0) { + ERR("ldap:%s:%d:%d: Closing ')' missing in attribute syntax\n", + pstate.file, token->start.line, token->start.col); + return -1; + } + + if (t.type != ')') { + ERR("ldap:%s:%d:%d: Syntax error, ')' expected\n", + pstate.file, t.start.line, t.start.col); + return -1; + } + + ret = lex(&t, 0); + if (ret < 0) return -1; + if (ret == 0) { + ERR("ldap:%s:%d:%d: LDAP Attribute name expected\n", + pstate.file, token->start.line, token->start.col); + return -1; + } + } + if (t.type != TOKEN_ALPHA) { ERR("ldap:%s:%d:%d: Invalid LDAP attribute name format %d:'%.*s'\n", pstate.file, t.start.line, t.start.col, @@ -666,8 +724,8 @@ static int parse_field_map(token_t* token) return -1; } - pstate.cfg->attrs[pstate.cfg->n - 1] = as_asciiz(&t.val); - if (pstate.cfg->attrs[pstate.cfg->n - 1] == NULL) { + pstate.cfg->attr[pstate.cfg->n - 1] = as_asciiz(&t.val); + if (pstate.cfg->attr[pstate.cfg->n - 1] == NULL) { ERR("ldap:%s:%d: Out of memory\n", pstate.file, token->start.line); return -1; @@ -846,13 +904,15 @@ struct ld_config* ld_find_config(str* table) } -char* ld_find_attr_name(struct ld_config* cfg, char* fld_name) +char* ld_find_attr_name(enum ld_syntax* syntax, struct ld_config* cfg, char* fld_name) { int i; for(i = 0; i < cfg->n; i++) { - if (!strcmp(fld_name, cfg->fields[i])) - return cfg->attrs[i]; + if (!strcmp(fld_name, cfg->field[i])) { + *syntax = cfg->syntax[i]; + return cfg->attr[i]; + } } return NULL; } @@ -867,6 +927,18 @@ static struct parser_tab token_scope[] = { }; +static struct parser_tab token_syntax[] = { + {STR_STATIC_INIT("GeneralizedTime"), {.ival = LD_SYNTAX_GENTIME}}, + {STR_STATIC_INIT("Integer"), {.ival = LD_SYNTAX_INT}}, + {STR_STATIC_INIT("BitString"), {.ival = LD_SYNTAX_BIT}}, + {STR_STATIC_INIT("Boolean"), {.ival = LD_SYNTAX_BOOL}}, + {STR_STATIC_INIT("String"), {.ival = LD_SYNTAX_STRING}}, + {STR_STATIC_INIT("Binary"), {.ival = LD_SYNTAX_BIN}}, + {STR_STATIC_INIT("Float"), {.ival = LD_SYNTAX_FLOAT}}, + {STR_NULL} +}; + + static struct parser_tab option_name[] = { {STR_STATIC_INIT("base"), {.fval = parse_search_base}}, {STR_STATIC_INIT("scope"), {.fval = parse_search_scope}}, diff --git a/modules/db_ldap/ld_config.h b/modules/db_ldap/ld_config.h index 980c5fc..640d856 100644 --- a/modules/db_ldap/ld_config.h +++ b/modules/db_ldap/ld_config.h @@ -34,13 +34,25 @@ #include "../../str.h" +enum ld_syntax { + LD_SYNTAX_STRING = 0, + LD_SYNTAX_GENTIME, + LD_SYNTAX_INT, + LD_SYNTAX_BIT, + LD_SYNTAX_BOOL, + LD_SYNTAX_BIN, + LD_SYNTAX_FLOAT +}; + + struct ld_config { str table; /**< Name of the db api table */ char* base; /**< The search base to be used with the table */ int scope; /**< LDAP scope */ char* filter; /**< The search filter */ - char** fields; /**< An array of DB API fields */ - char** attrs; /**< An array of LDAP attribute names */ + char** field; /**< An array of DB API fields */ + char** attr; /**< An array of LDAP attribute names */ + enum ld_syntax* syntax; /**< An array of configured LDAP syntaxes */ int n; /**< Number of fields in the arrays */ struct ld_config* next; /**< The next table in the list */ }; @@ -49,7 +61,7 @@ extern struct ld_config* ld_cfg_root; struct ld_config* ld_find_config(str* table); -char* ld_find_attr_name(struct ld_config* cfg, char* fld_name); +char* ld_find_attr_name(enum ld_syntax* syntax, struct ld_config* cfg, char* fld_name); int ld_load_config(str* filename); diff --git a/modules/db_ldap/ld_fld.c b/modules/db_ldap/ld_fld.c index f9d2c95..c8cfb6c 100644 --- a/modules/db_ldap/ld_fld.c +++ b/modules/db_ldap/ld_fld.c @@ -98,7 +98,7 @@ int ld_resolve_fld(db_fld_t* fld, struct ld_config* cfg) for(i = 0; !DB_FLD_EMPTY(fld) && !DB_FLD_LAST(fld[i]); i++) { lfld = DB_GET_PAYLOAD(fld + i); - lfld->attr.s = ld_find_attr_name(cfg, fld[i].name); + lfld->attr.s = ld_find_attr_name(&lfld->syntax, cfg, fld[i].name); if (lfld->attr.s == NULL) lfld->attr.s = fld[i].name; if (lfld->attr.s) lfld->attr.len = strlen(lfld->attr.s); } @@ -227,18 +227,35 @@ int ld_ldap2fld(db_fld_t* fld, LDAP* ldap, LDAPMessage* msg) case DB_INT: case DB_BITMAP: - if (v.s[0] == '\'' && - v.s[v.len - 1] == 'B' && + if (v.s[0] == '\'' && v.s[v.len - 1] == 'B' && v.s[v.len - 2] == '\'') { - v.s++; v.len -= 3; - return ldap_bit2db_int(&fld[i].v.int4, &v); - } else { - return ldap_int2db_int(&fld[i].v.int4, &v); + if (ldap_bit2db_int(&fld[i].v.int4, &v) != 0) { + ERR("ldap: Error while converting bit string '%.*s'\n", + v.len, ZSW(v.s)); + return -1; + } + break; + } + + if (v.len == 4 && !strncasecmp("TRUE", v.s, v.len)) { + fld[i].v.int4 = 1; + break; + } + + if (v.len == 5 && !strncasecmp("FALSE", v.s, v.len)) { + fld[i].v.int4 = 0; + break; } - break; + if (ldap_int2db_int(&fld[i].v.int4, &v) != 0) { + ERR("ldap: Error while converting %.*s to integer\n", + v.len, ZSW(v.s)); + return -1; + } + break; + case DB_DATETIME: if (ldap_gentime2db_datetime(&fld[i].v.time, &v) != 0) { ERR("ldap: Error while converting LDAP time value '%.*s'\n", diff --git a/modules/db_ldap/ld_fld.h b/modules/db_ldap/ld_fld.h index 6994ace..c50535e 100644 --- a/modules/db_ldap/ld_fld.h +++ b/modules/db_ldap/ld_fld.h @@ -45,9 +45,11 @@ #include <ldap.h> + struct ld_fld { db_drv_t gen; - str attr; /**< Name of corresponding LDAP attribute */ + str attr; /**< Name of corresponding LDAP attribute */ + enum ld_syntax syntax; /**< LDAP attribute syntax */ struct berval** values; /**< Values retrieved from the LDAP result */ };

1 0

git:janakj/ldap: - example SER LDAP schema
by Jan Janak 12 Feb '09

12 Feb '09

Module: sip-router Branch: janakj/ldap Commit: 5cede19dc92e67081f6d0ecbc7629c940f5f6915 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5cede19… Author: Jan Janak <jan(a)iptel.org> Committer: Jan Janak <jan(a)iptel.org> Date: Tue May 13 14:35:59 2008 +0000 - example SER LDAP schema --- modules/db_ldap/ser.schema | 259 ++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 259 insertions(+), 0 deletions(-) diff --git a/modules/db_ldap/ser.schema b/modules/db_ldap/ser.schema new file mode 100644 index 0000000..2c25c6d --- /dev/null +++ b/modules/db_ldap/ser.schema @@ -0,0 +1,259 @@ +# +# $Id$ +# +# This is the default LDAP schema of SER for OpenLDAP. +# Written by Jan Janak <jan(a)iptel.org>. +# + +# +# The root OID of IANA private enterprise numbers +# +objectIdentifier ianaPrivate 1.3.6.1.4.1 + +# +# The root OID of many LDAPv3 attributes +# +objectIdentifier ldap3OID ianaPrivate:1466 + +# +# The root OID assigned by the IANA to iptel.org +# +objectIdentifier iptelorg ianaPrivate:24960 + +# +# SER related objects and attributes +# +objectIdentifier ser iptelorg:0 +objectIdentifier serLDAP ser:1 +objectIdentifier serAttributeType serLDAP:0 +objectIdentifier serObjectClass serLDAP:1 + +# +# Convenience macros for commonly used syntax OIDs +# +objectIdentifier ldapSyntax ldap3OID:115.121.1 +objectIdentifier stringSyntax ldapSyntax:15 +objectIdentifier octetStringSyntax ldapSyntax:40 +objectIdentifier bitStringSyntax ldapSyntax:6 +objectIdentifier intSyntax ldapSyntax:27 +objectIdentifier numericStringSyntax ldapSyntax:36 +objectIdentifier binarySyntax ldapSyntax:5 +objectIdentifier boolSyntax ldapSyntax:7 + +# +# This is the parent attribute type for various UID attributes of SER, such +# as serUID and serDID. +# +attributeType ( serAttributeType:0 + NAME 'serUUID' + DESC 'SER Universally Unique Identifier' + SYNTAX stringSyntax + SINGLE-VALUE + ) + +# +# serUID attribute stores universally unique identifiers of SER users, the +# identifier is an opaque string by default. +# +attributeType ( serAttributeType:1 NAME 'serUID' + DESC 'SER User Identifier' + SUP serUUID + ) + +# +# serDID attributes contain universally unique identifiers of virtual SER +# domains. They are used to group a bunch of domain names together in a +# single virtual domain. +# +attributeType ( serAttributeType:2 NAME 'serDID' + DESC 'SER Domain Identifier' + SUP serUUID + ) + +# +# digesetUsername attribute contains the value of username field from +# digest authentication credentials as specified in RFC2617. This attribute, +# together with digestRealm, is used by SER during digest authentication to +# lookup credentaials of a particular user. +# +attributeType ( serAttributeType:3 NAME 'digestUsername' + DESC 'SIP Digest Authentication username' + SYNTAX stringSyntax + EQUALITY caseIgnoreMatch + SINGLE-VALUE + ) + +# +# digestRealm attribute contains the value of realm field from digest +# authentication credentials as specified in RFC2617. This attribute, +# together with digestUsername, is used by SER during digest authentication +# to lookup credentials of a particular user. +# +attributeType ( serAttributeType:4 NAME 'digestRealm' + DESC 'SIP Digest Authentication realm attribute' + SYNTAX stringSyntax + EQUALITY caseIgnoreMatch + SINGLE-VALUE + ) + +# +# digestPassword attribute contains the plain-text password for digest +# authentication (see RFC2617) +# +attributeType ( serAttributeType:5 NAME 'digestPassword' + DESC 'SIP Digest Authentication password' + SYNTAX octetStringSyntax + EQUALITY octetStringMatch + SINGLE-VALUE + ) + +# +# The attribute serFlags contains various SER and SERWeb related flags, +# the flags are used to mark entries as deleted or disabled, they are +# used to mark entries that are exclusively for SER or SERWeb, and so on. +# The maximum length of the bit string fields is 32 bits, the most +# significant bits of values longer than 32 will be ignored. +# +attributeType ( serAttributeType:6 NAME 'serFlags' + DESC 'SER flags' + SYNTAX bitStringSyntax + EQUALITY bitStringMatch + SINGLE-VALUE + ) + +# +# This attribute contains the HA1 string as defined in RFC2617. The +# string is an MD5 hash of digest username, realm, and password. +# See RFC2617 for more details. SER is using either HA1 or plain-text +# password (depending on configuration) when verifying digest credentials. +# +attributeType ( serAttributeType:7 NAME 'digestHA1' + DESC 'Digest Authentication HA1 String' + SYNTAX octetStringSyntax + EQUALITY octetStringMatch + SINGLE-VALUE + ) + +# +# This attribute contains the HA1 string as defined in RFC2617. This is +# similar to digestHA1 attribute, except that the MD5 hash in digestHA1b +# also includes a domain part in username, so the username is of form +# user@domain. This is sometimes needed when authenticating user agents +# that put user@domain into the digest username field. +# +attributeType ( serAttributeType:8 NAME 'digestHA1b' + DESC 'Digest Authentication HA1 String (includes domain in username)' + SYNTAX octetStringSyntax + EQUALITY octetStringMatch + SINGLE-VALUE + ) + +# +# This attribute stores a domain name within a virtual domain handled +# by a SER server. SER users this value to determine whether the SIP +# requests are to/from one of its virtual domains. +# +attributeType ( serAttributeType:9 NAME 'serDomain' + DESC 'Domain Name' + SYNTAX stringSyntax + EQUALITY caseIgnoreMatch + SINGLE-VALUE + ) + +# +# SER attributes is a generic mechanism for storing configuration data. +# This attribute contains the name of an SER attribute. +# +attributeType ( serAttributeType:10 NAME 'serAttrName' + DESC 'SER Attribute Name' + SYNTAX stringSyntax + EQUALITY caseExactMatch + SINGLE-VALUE + ) + +# +# SER attributes is a generic mechanism for storing configuration data. +# This attribute contains SER attribute type. There are two types of +# SER attributes: integer and string. +# +attributeType ( serAttributeType:11 NAME 'serAttrType' + DESC 'SER Attribute Type' + SYNTAX intSyntax + SINGLE-VALUE + ) + +# +# SER attributes is a generic mechanism for storing configuration data. +# This attribute contains the value (as string) of a SER attribute. +# +attributeType ( serAttributeType:12 NAME 'serAttrValue' + DESC 'SER Attribute Value' + SYNTAX stringSyntax + EQUALITY caseExactMatch + SINGLE-VALUE + ) + +# +# digestAuthCredentials objects are used by SER to perform digest +# authentication as defined in RFC3261 and RFC2617. Every object must +# contain a username, a realm, and a UID of the user who owns the +# credentials. In addition to that the object can contains either +# password in plain-text format, or the HA1 string, or both. Which of +# them will be used by SER depends on the configuration. +# +# This is an analogy to 'credentials' table found in SER relational +# database schema. +# +objectClass ( serObjectClass:0 NAME 'digestAuthCredentials' + DESC 'Credentials for SIP Digest Authentication' + MUST ( digestUsername $ digestRealm $ serUID $ serFlags ) + MAY ( serDID $ digestPassword $ digestHA1 $ digestHA1b ) + ) + +# +# serDomain objects are used to store the information about virtual +# domains supported by a SER server. The purpose of the object is +# to map domain names (which appear in SIP messages) to universally +# unique domain identifiers and vice versa. +# +# This is an analogy to 'domain' table found in SER relational database +# schema. +# +objectClass ( serObjectClass:1 NAME 'serDomain' + DESC 'SER Virtual Domains' + MUST ( serDID $ serDomain $ serFlags ) + ) + +# +# This is an abstract class that can be used as a base for other classes +# storing SER uri/user/domain/global attributes. An object storing SER +# attributes must contain serAttrName, serAttrType, serAttrValue, and +# serFlags attributes. +# +objectClass ( serObjectClass:2 NAME 'serAttrAbstract' + ABSTRACT + MUST ( serAttrName $ serAttrType $ serAttrValue $ serFlags ) + ) + +# +# An auxiliary class that can be used to extend other objects in an LDAP +# directory with the possibility to store SER attributes. +# +objectClass ( serObjectClass:3 NAME 'serAttr' + AUXILIARY + SUP serAttrAbstract + ) + +# +# This class is used to store domain level attributes. Domain level +# attributes are attributes used to store configuration information related +# to a virtual domain (i.e. common configuration for all users/URIs within +# that virtual domain), such as digest authentication realm or default +# language. +# +objectClass ( serObjectClass:4 NAME 'serDomainAttr' + DESC 'SER Domain Attributes' + SUP serAttrAbstract + MUST ( serDID ) + ) +

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev