Added support for TCP_WRAPPERS (ldapd code not tested, don't have isode here).

Cleaned up LDAP_CRYPT support.

diff --git a/Make-common b/Make-common
index 22d2ed4b852e56ce11555f2ae646883f2ea04360..567d9f3bf882313f821836fae45febf79d1373e9 100644 (file)
--- a/Make-common
+++ b/Make-common
@@ -198,10 +198,14 @@ LDAP_DEBUG=-DLDAP_DEBUG
 # uncomment this line to enable support for LDAP referrals in libldap
 LDAP_REFERRALS=-DLDAP_REFERRALS
 
-# uncomment this line to enable support for CRYPT passwords in LDBM.
-# Requires UNIX crypt(3), you may have to add -lcrypt (or whatever)
-# to your PLATFORMLIBS  (build/platform/your-platform)
+# uncomment these lines to enable support for CRYPT passwords in LDBM.
 #LDAP_CRYPT=-DLDAP_CRYPT
+#LDAP_CRYPT_LIB=-lcrypt
+
+# uncomment these lines to enable support fro tcp_wrappers in servers.
+# Requires tcp_wrappers.
+#LDAP_TCP_WRAPPERS=-DTCP_WRAPPERS -I/usr/local/include
+#LDAP_TCP_WRAPPERS_LIB=-L/usr/local/lib -lwrap
 
 # uncomment this line to use soundex for approximate matches in slapd.
 # the default is to use the metaphone algorithm.

diff --git a/build/Make-append b/build/Make-append
index 32c3d1cc9cc3b05f0f6574c83257dea1f0625d8f..67a2f29bb05ed286bbce22a89c0354552081bf69 100644 (file)
--- a/build/Make-append
+++ b/build/Make-append
@@ -21,7 +21,7 @@
 # DEFS are included in CFLAGS
 DEFS   = $(PLATFORMCFLAGS) $(LDAP_DEBUG) $(KERBEROS) $(AFSKERBEROS) \
                $(UOFM) $(UOFA) $(NO_USERINTERFACE) $(CLDAP) $(NO_CACHE) \
-               $(LDAP_REFERRALS) $(LDAP_CRYPT) $(LDAP_DNS) $(STR_TRANSLATION) \
+               $(LDAP_REFERRALS) $(LDAP_DNS) $(STR_TRANSLATION) \
                $(LIBLDAP_CHARSETS) $(LIBLDAP_DEF_CHARSET) \
                $(SLAPD_BACKENDS) $(LDBMBACKEND) $(LDBMINCLUDE) $(PHONETIC)
 

diff --git a/build/platforms/freebsd-gcc/Make-platform b/build/platforms/freebsd-gcc/Make-platform
index 1d78ed72c2472297ee0cca361bbae7e50cace0ab..1b8dae7517215296a076f1e60474488b05eb75a1 100644 (file)
--- a/build/platforms/freebsd-gcc/Make-platform
+++ b/build/platforms/freebsd-gcc/Make-platform
@@ -15,5 +15,3 @@ CC    = cc
 
 PLATFORMCFLAGS=        -Dfreebsd
 
-# uncomment this line if using for LDAP_CRYPT
-#PLATFORMLIBS= -lcrypt

diff --git a/build/platforms/linux-gcc/Make-platform b/build/platforms/linux-gcc/Make-platform
index 5e2a39fc44379b1f7949df7956b9606150df5a4a..2699aac6f12fc5a5ae4d6a262f51c4df8b1ee2fe 100644 (file)
--- a/build/platforms/linux-gcc/Make-platform
+++ b/build/platforms/linux-gcc/Make-platform
@@ -16,5 +16,3 @@ RANLIB        = "ranlib"
 
 PLATFORMCFLAGS=        -Dlinux
 
-# uncomment this if -DLDAP_CRYPT is defined
-#PLATFORMLIBS= -lcrypt

diff --git a/servers/ldapd/main.c b/servers/ldapd/main.c
index 5626a34c4fd2bc97435d864e05e86a974719f31c..9edd4b532ea503d9886f9f7e84ed3577fb0111e4 100644 (file)
--- a/servers/ldapd/main.c
+++ b/servers/ldapd/main.c
@@ -42,6 +42,13 @@
 #include <unistd.h>
 #endif /* USE_SYSCONF */
 
+#ifdef TCP_WRAPPERS
+#include <tcpd.h>
+
+int allow_severity = LOG_INFO;
+int deny_severity = LOG_NOTICE;
+#endif /* TCP_WRAPPERS */
+
 void log_and_exit();
 static set_socket();
 static do_queries();
@@ -393,10 +400,31 @@ char      **argv;
 
                hp = gethostbyaddr( (char *) &(from.sin_addr.s_addr),
                    sizeof(from.sin_addr.s_addr), AF_INET );
+
+#ifdef TCP_WRAPPERS
+               if ( !hosts_ctl("ldapd", (hp == NULL) ? "unknown" : hp->h_name,
+                       inet_ntoa( from.sin_addr ), STRING_UNKNOWN ) {
+
+                       Debug( LDAP_DEBUG_ARGS, "connection from %s (%s) denied.\n",
+                               (hp == NULL) ? "unknown" : hp->h_name,
+                               inet_ntoa( from.sin_addr ), 0 );
+
+                       if ( dosyslog ) {
+                               syslog( LOG_NOTICE, "connection from %s (%s) denied.",
+                                   (hp == NULL) ? "unknown" : hp->h_name,
+                                   inet_ntoa( from.sin_addr ) );
+                       }
+
+                       close(ns);
+                       continue;
+               }
+#endif /* TCP_WRAPPERS */
+
                Debug( LDAP_DEBUG_ARGS, "connection from %s (%s)\n",
                    (hp == NULL) ? "unknown" : hp->h_name,
                    inet_ntoa( from.sin_addr ), 0 );
 
+
                if ( dosyslog ) {
                        syslog( LOG_INFO, "connection from %s (%s)",
                            (hp == NULL) ? "unknown" : hp->h_name,

diff --git a/servers/slapd/Make-template b/servers/slapd/Make-template
index bdeb881c70d3c98a370a28a6124e8228e809122e..48ceaf1deaa1b0fcf2fde523fa132ece146c21c4 100644 (file)
--- a/servers/slapd/Make-template
+++ b/servers/slapd/Make-template
@@ -33,11 +33,11 @@ OBJS        = main.o daemon.o connection.o search.o filter.o add.o charray.o \
                schema.o schemaparse.o monitor.o configinfo.o
 
 INCLUDES= -I. -I$(HDIR) $(KRBINCLUDEFLAG)
-DEFINES = $(DEFS) $(SERVERDEFS)
+DEFINES = $(DEFS) $(LDAP_CRYPT) $(LDAP_TCP_WRAPPERS) $(SERVERDEFS)
 CFLAGS = $(INCLUDES) $(THREADSINCLUDE) $(DEFINES) $(ACFLAGS) $(THREADS)
 LDFLAGS        = -L$(LDIR) $(KRBLIBFLAG)
 LIBS   = $(KRBLIBS) -llber -lldbm -lavl -llthread -lldif $(THREADSLIB) \
-               $(LDBMLIB) $(ALIBS)
+               $(LDBMLIB) $(LDAP_CRYPT_LIB) $(LDAP_TCP_WRAPPERS_LIB) $(ALIBS)
 
 all: FORCE
        @if [ -z "$(MAKESLAPD)" ]; then \

diff --git a/servers/slapd/back-ldbm/Make-template b/servers/slapd/back-ldbm/Make-template
index bc46d3a58997e5918f554994210c8b4a4d0873a3..52a36db245dd49b6bd86258399b6a958c0c97c5f 100644 (file)
--- a/servers/slapd/back-ldbm/Make-template
+++ b/servers/slapd/back-ldbm/Make-template
@@ -27,9 +27,9 @@ OBJS  = idl.o add.o search.o cache.o dbcache.o dn2id.o id2entry.o \
                filterindex.o unbind.o kerberos.o close.o
 
 INCLUDES= -I. -I.. -I$(HDIR) $(KRBINCLUDEFLAG)
-DEFINES = $(DEFS) $(THREADS)
+DEFINES = $(DEFS) $(LDAP_CRYPT) $(THREADS)
 CFLAGS = $(INCLUDES) $(THREADSINCLUDE) $(DEFINES) $(ACFLAGS)
-LDFLAGS        = -L$(LDIR) $(KRBLIBFLAG)
+LDFLAGS        = -L$(LDIR) $(KRBLIBFLAG) $(LDAP_CRYPT_LIB)
 
 all:   FORCE
        -@echo "$(SLAPD_BACKENDS)" | grep LDAP_LDBM 2>&1 > /dev/null; \

diff --git a/servers/slapd/daemon.c b/servers/slapd/daemon.c
index 7dbfa2abf78c3b152adf75a101e3341c0718bd49..38062d9b2b47e1ea77a756f2d99e824963922f78 100644 (file)
--- a/servers/slapd/daemon.c
+++ b/servers/slapd/daemon.c
@@ -30,6 +30,13 @@
 #include <unistd.h>
 #endif /* USE_SYSCONF */
 
+#ifdef TCP_WRAPPERS
+#include <tcpd.h>
+
+int allow_severity = LOG_INFO;
+int deny_severity = LOG_NOTICE;
+#endif /* TCP_WRAPPERS */
+
 extern Operation       *op_add();
 
 #ifndef SYSERRLIST_IN_STDIO
@@ -177,6 +184,9 @@ slapd_daemon(
                struct timeval          *tvp;
                int                     len, pid;
 
+               char    *client_name;
+               char    *client_addr;
+
                FD_ZERO( &writefds );
                FD_ZERO( &readfds );
                FD_SET( tcps, &readfds );
@@ -251,6 +261,7 @@ slapd_daemon(
                                Debug( LDAP_DEBUG_ANY,
                                    "FIONBIO ioctl on %d failed\n", ns, 0, 0 );
                        }
+
                        c[ns].c_sb.sb_sd = ns;
                        Debug( LDAP_DEBUG_CONNS, "new connection on %d\n", ns,
                            0, 0 );
@@ -258,43 +269,76 @@ slapd_daemon(
                        pthread_mutex_lock( &ops_mutex );
                        c[ns].c_connid = num_conns++;
                        pthread_mutex_unlock( &ops_mutex );
+
                        len = sizeof(from);
+
                        if ( getpeername( ns, (struct sockaddr *) &from, &len )
                            == 0 ) {
-                               char    *s;
-#ifdef REVERSE_LOOKUP
+                               char *s;
+                               client_addr = inet_ntoa( from.sin_addr );
+
+#if defined(REVERSE_LOOKUP) || defined(TCP_WRAPPERS)
                                hp = gethostbyaddr( (char *)
                                    &(from.sin_addr.s_addr),
                                    sizeof(from.sin_addr.s_addr), AF_INET );
-#else
-                               hp = NULL;
-#endif
 
-                               Statslog( LDAP_DEBUG_STATS,
-                                   "conn=%d fd=%d connection from %s (%s)\n",
-                                   c[ns].c_connid, ns, hp == NULL ? "unknown"
-                                   : hp->h_name, inet_ntoa( from.sin_addr ),
-                                   0 );
+                               if(hp) {
+                                       client_name = hp->h_name;
 
-                               if ( c[ns].c_addr != NULL ) {
-                                       free( c[ns].c_addr );
-                               }
-                               c[ns].c_addr = strdup( inet_ntoa(
-                                   from.sin_addr ) );
-                               if ( c[ns].c_domain != NULL ) {
-                                       free( c[ns].c_domain );
-                               }
-                               c[ns].c_domain = strdup( hp == NULL ? "" :
-                                   hp->h_name );
-                               /* normalize the domain */
-                               for ( s = c[ns].c_domain; *s; s++ ) {
-                                       *s = TOLOWER( *s );
+                                       /* normalize the domain */
+                                       for ( s = client_name; *s; s++ ) {
+                                               *s = TOLOWER( *s );
+                                       }
+
+                               } else {
+                                       client_name = NULL;
                                }
+#else
+                               client_name = NULL;
+#endif
+
                        } else {
+                               client_name = NULL;;
+                               client_addr = NULL;
+                       }
+
+#ifdef TCP_WRAPPERS
+                       if(!hosts_ctl("slapd", client_name, client_addr,
+                               STRING_UNKNOWN))
+                       {
+                               /* DENY ACCESS */
                                Statslog( LDAP_DEBUG_STATS,
-                                   "conn=%d fd=%d connection from unknown\n",
-                                   c[ns].c_connid, ns, 0, 0, 0 );
+                                "conn=%d fd=%d connection from %s (%s) denied.\n",
+                                       c[ns].c_connid, ns,
+                                               client_name == NULL ? "unknown" : client_name,
+                                               client_addr == NULL ? "unknown" : client_addr,
+                                 0 );
+
+                               close(ns);
+                               pthread_mutex_unlock( &new_conn_mutex );
+                               continue;
                        }
+#endif /* TCP_WRAPPERS */
+
+                       Statslog( LDAP_DEBUG_STATS,
+                           "conn=%d fd=%d connection from %s (%s) accepted.\n",
+                               c[ns].c_connid, ns,
+                                       client_name == NULL ? "unknown" : client_name,
+                                       client_addr == NULL ? "unknown" : client_addr,
+                            0 );
+
+                       if ( c[ns].c_addr != NULL ) {
+                               free( c[ns].c_addr );
+                       }
+                       c[ns].c_addr = strdup( client_addr );
+
+                       if ( c[ns].c_domain != NULL ) {
+                               free( c[ns].c_domain );
+                       }
+
+                       c[ns].c_domain = strdup( client_name == NULL
+                               ? "" : client_name );
+
                        pthread_mutex_lock( &c[ns].c_dnmutex );
                        if ( c[ns].c_dn != NULL ) {
                                free( c[ns].c_dn );

diff --git a/servers/slapd/tools/Make-template b/servers/slapd/tools/Make-template
index 14b013ad308ec777f163f1e566024800450d72e5..e815fd8cf2e70ac847cb113196ebee6820d45fb7 100644 (file)
--- a/servers/slapd/tools/Make-template
+++ b/servers/slapd/tools/Make-template
@@ -27,12 +27,12 @@ OBJS2       = ../config.o ../ch_malloc.o ../backend.o ../charray.o \
                ../schemaparse.o ../regex.o ../strdup.o
 
 INCLUDES= -I. -I$(HDIR) $(EXINCLUDES)
-DEFINES = $(DEFS) $(SERVERDEFS) $(THREADS)
+DEFINES = $(DEFS) $(LDAP_CRYPT) $(SERVERDEFS) $(THREADS)
 CFLAGS = $(INCLUDES) $(DEFINES) $(ACFLAGS)
 LDFLAGS        = -L$(LDIR) $(EXLDFLAGS)
 LIBS   = -lldif -lldap -llber -lldbm -lavl $(LDBMLIB) $(EXLIBS) $(ALIBS)
 LIBS2  = -lldif -lldbm -lavl $(LDBMLIB) -llber $(KRBLIBFLAG) $(KRBLIBS) \
-               -llthread $(THREADSLIB) $(ALIBS)
+               -llthread $(THREADSLIB) $(ALIBS) $(LDAP_CRYPT_LIB)
 
 all:   build-edb2ldif ldif2index ldif2ldbm ldbmcat ldif2id2entry \
                ldif2id2children centipede ldbmtest ldif