summaryrefslogtreecommitdiff
path: root/src/mod_authn_ldap.c
Commit message (Collapse)AuthorAgeFilesLines
* [build] _WIN32 __declspec(dllexport) *_plugin_initGlenn Strauss2023-05-031-0/+1
| | | | _WIN32 __declspec(dllexport) on mod_*_plugin_init()
* [multiple] employ ck_calloc, ck_malloc shared codeGlenn Strauss2022-12-101-3/+2
| | | | | employ ck_calloc(), ck_malloc() shared code to slightly reduce code size (centralize the ck_assert() to check that memory allocation succeeded)
* [multiple] mark mod_*_plugin_init() funcs coldGlenn Strauss2022-12-071-0/+2
|
* [multiple] use buffer_append_char()Glenn Strauss2022-05-111-8/+8
|
* [multiple] reduce redundant NULL buffer checksGlenn Strauss2021-08-271-11/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit is a large set of code changes and results in removal of hundreds, perhaps thousands, of CPU instructions, a portion of which are on hot code paths. Most (buffer *) used by lighttpd are not NULL, especially since buffers were inlined into numerous larger structs such as request_st and chunk. In the small number of instances where that is not the case, a NULL check is often performed earlier in a function where that buffer is later used with a buffer_* func. In the handful of cases that remained, a NULL check was added, e.g. with r->http_host and r->conf.server_tag. - check for empty strings at config time and set value to NULL if blank string will be ignored at runtime; at runtime, simple pointer check for NULL can be used to check for a value that has been set and is not blank ("") - use buffer_is_blank() instead of buffer_string_is_empty(), and use buffer_is_unset() instead of buffer_is_empty(), where buffer is known not to be NULL so that NULL check can be skipped - use buffer_clen() instead of buffer_string_length() when buffer is known not to be NULL (to avoid NULL check at runtime) - use buffer_truncate() instead of buffer_string_set_length() to truncate string, and use buffer_extend() to extend Examples where buffer known not to be NULL: - cpv->v.b from config_plugin_values_init is not NULL if T_CONFIG_BOOL (though we might set it to NULL if buffer_is_blank(cpv->v.b)) - address of buffer is arg (&foo) (compiler optimizer detects this in most, but not all, cases) - buffer is checked for NULL earlier in func - buffer is accessed in same scope without a NULL check (e.g. b->ptr) internal behavior change: callers must not pass a NULL buffer to some funcs. - buffer_init_buffer() requires non-null args - buffer_copy_buffer() requires non-null args - buffer_append_string_buffer() requires non-null args - buffer_string_space() requires non-null arg
* [mod_auth*] rename http_auth.* -> mod_auth_api.*Glenn Strauss2021-08-271-4/+4
| | | | rename http_auth.[ch] -> mod_auth_api.[ch]
* [multiple] optimize primitives, buffer_extend()Glenn Strauss2021-03-261-6/+2
| | | | | | | | | | | | | | | | | | | | | | | optimize buffer_* primitives Other than buffer_string_set_length(), reallocate with one power-2 step in size (or use the requested size, if larger). This replaces the fixed BUFFER_PIECE_SIZE round-up of only 64 bytes extension each reallocation, which could lead to excessive reallocations in some scenarios. buffer_extend() convenience routine to prep for batch append (combines buffer_string_prepare_append() and buffer_commit()) mod_fastcgi, mod_scgi, mod_proxy and others now leverage buffer_extend() mod_scgi directly performs little-endian encoding of short ints http_response_write_header() optimizes writing response header, leveraging buffer_extend() modify mod_proxy to append line ends similar to how it is done in http_response_write_header() (removes one call to buffer_append_string_len())
* [mod_authn_ldap, mod_vhostdb_ldap] default cafileGlenn Strauss2020-12-161-2/+21
| | | | set default cafile at startup if cafile configured in global scope
* [mod_authn_ldap] fix crash (fixes #3048)Glenn Strauss2020-12-161-1/+1
| | | | | | | | | | (thx mgottinger) fix crash due to uninitialized memory during config parsing x-ref: "Broken LDAP authentication on lighttpd 1.4.56" https://redmine.lighttpd.net/issues/3048
* [mod_authn_ldap,mod_vhostdb_ldap] add timeout opt (#2805)Glenn Strauss2020-07-131-0/+24
| | | | | | | | | | | | | | | | auth.backend.ldap.timeout = "2000000" # quoted-string; microseconds vhostdb.ldap += ("timeout" => "2000000") # quoted-string; microseconds Default is 2000000 microseconds (2 secs) These values are converted to struct timeval and passed to ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, ); ldap_set_option(ld, LDAP_OPT_TIMEOUT, ...); if those LDAP_OPT_* values are available (both are OpenLDAP-specific). x-ref: "mod_auth caching" https://redmine.lighttpd.net/issues/2805
* [multiple] add summaries to top of some modulesGlenn Strauss2020-07-081-0/+7
|
* [multiple] correct misspellings in commentsGlenn Strauss2020-07-081-1/+1
| | | | | | x-ref: "Script for fixing spelling errors with codespell" https://redmine.lighttpd.net/boards/3/topics/8947
* [multiple] split con, request (very large change)Glenn Strauss2020-07-081-6/+6
| | | | | | | | | | | | | | | | NB: r->tmp_buf == srv->tmp_buf (pointer is copied for quicker access) NB: request read and write chunkqueues currently point to connection chunkqueues; per-request and per-connection chunkqueues are not distinct from one another con->read_queue == r->read_queue con->write_queue == r->write_queue NB: in the future, a separate connection config may be needed for connection-level module hooks. Similarly, might need to have per-request chunkqueues separate from per-connection chunkqueues. Should probably also have a request_reset() which is distinct from connection_reset().
* [multiple] store srv->tmp_buf in tb varGlenn Strauss2020-07-081-7/+7
| | | | rather than using srv->tmp_buf directly in code modifying temp buf (tb)
* [multiple] prefer (connection *) to (srv *)Glenn Strauss2020-07-081-38/+38
| | | | | | | | convert all log_error_write() to log_error() and pass (log_error_st *) use con->errh in preference to srv->errh (even though currently same) avoid passing (server *) when previously used only for logging (errh)
* [mod_auth] inline arrays in http_auth_require_tGlenn Strauss2020-07-081-2/+2
| | | | also, keep ptr to const buffer *realm rather than copy
* [multiple] plugin.c handles common FREE_FUNC codeGlenn Strauss2020-07-081-12/+2
| | | | (simpler for modules; less boilerplate to cut-n-paste)
* [mod_auth*] use config_plugin_values_init()Glenn Strauss2020-07-081-211/+304
|
* [core] const char *name in struct pluginGlenn Strauss2020-05-231-3/+1
| | | | | | | | put void *data (always used) as first member of struct plugin add int nconfig member to PLUGIN_DATA calloc() inits p->data to NULL
* [core] simpler config_check_cond()Glenn Strauss2020-05-231-3/+2
| | | | | | | optimize for common case where condition has been evaluated for the request and a cached result exists (also: begin isolating data_config)
* [core] inline buffer key for *_patch_connection()Glenn Strauss2020-02-241-9/+9
| | | | | handle buffer key as part of DATA_UNSET in *_patch_connection() (instead of key being (buffer *))
* [core] inline buffer as part of DATA_UNSET keyGlenn Strauss2020-02-241-1/+1
| | | | (instead of key being (buffer *))
* [core] use buffer_eq_icase_ssn funcGlenn Strauss2019-06-061-1/+1
| | | | | | | | | specialized buffer_eq_icase_ssn func replace strncasecmp() in cases where string lengths are not known to be at least as large as the len being compared case-insensitively. (Separate commit in case any future changes modify the implementation to be unsafe for shorter strings, where strncasecmp() would stop at '\0' in either string)
* [mod_authn_ldap] ldap_set_option LDAP_OPT_RESTART (fixes #2940)Glenn Strauss2019-05-271-0/+3
| | | | | | | | | | ldap_set_option LDAP_OPT_RESTART to handle EINTR on SIGCHLD from CGI (ldap uses poll(), which is not restartable with sigaction SA_RESTART) x-ref: "mod_authn_ldap/mod_cgi race condition, "Can't contact LDAP server"" https://redmine.lighttpd.net/issues/2940
* [multiple] cleaner calloc use in SETDEFAULTS_FUNCMohammed Sadiq2019-04-201-1/+1
| | | | | | | | github: closes #99 x-ref: "cleaner calloc use in SETDEFAULTS_FUNC" https://github.com/lighttpd/lighttpd1.4/pull/99
* [core] perf: simple, quick buffer_clear()Glenn Strauss2018-11-231-2/+2
| | | | | | | | | quickly clear buffer instead of buffer_string_set_length(b, 0) or buffer_reset(b). Avoids free() of large buffers about to be reused, or buffers that are module-scoped, persistent, and reused. (buffer_reset() should still be used with buffers in connection *con when the data in the buffers is supplied by external, untrusted source)
* [core] some header cleanupGlenn Strauss2018-04-081-1/+2
| | | | | | | | | provide standard types in first.h instead of base.h provide lighttpd types in base_decls.h instead of settings.h reduce headers exposed by headers for core data structures do not expose <pcre.h> or <stdlib.h> in headers move stat_cache_entry to stat_cache.h reduce use of "server.h" and "base.h" in headers
* [mod_authn_ldap] auth with ldap referrals (fixes #2846)Glenn Strauss2018-01-071-6/+29
| | | | | | | | | use ldap_set_rebind_proc() to provide auth when rebinding following ldap referrals (instead of rebinding anonymously for ldap referrals) x-ref: "LDAP authentication vs. AD: problems with referrals" https://redmine.lighttpd.net/issues/2846
* [mod_authn_ldap] fix mem leak when ldap auth fails (fixes #2849)Glenn Strauss2017-12-211-5/+5
| | | | | | | | thx, codehero x-ref: "Linux OOM kills lighttpd when using mod_authn_ldap" https://redmine.lighttpd.net/issues/2849
* [mod_authn_ldap] replace use of deprecated funcsGlenn Strauss2017-11-051-12/+38
| | | | | | [mod_authn_ldap,mod_vhostdb_ldap] replace use of deprecated funcs remove -DLDAP_DEPRECATED
* [core] remove some unused header includesGlenn Strauss2017-03-281-1/+0
| | | | remove exposure of stdio.h in buffer.h for print_backtrace(), now static
* [mod_auth] have LDAP template replace '?'Glenn Strauss2017-01-311-6/+9
| | | | | | For consistency with other databases, which use '?' for placeholders, have LDAP template replace '?' with username, in addition to the (mod_auth historic) '$' char.
* [mod_auth] LDAP escape username in DN and filtersGlenn Strauss2017-01-311-30/+134
| | | | (replaces restriction on characters allowed in username)
* [mod_auth] support LDAP groups for HTTP auth (fixes #1817)Glenn Strauss2017-01-311-3/+54
| | | | | | x-ref: "LDAP-Group support for HTTP-Authentication" https://redmine.lighttpd.net/issues/1817
* [autobuild] rm module stub code for missing depsGlenn Strauss2016-10-171-14/+1
| | | | | remove module stub code since the build system(s) no longer build any module when the dependencies for a given module are not present.
* [mod_auth] permit specifying ldap DN; skip search (fixes #1248)Glenn Strauss2016-10-041-21/+36
| | | | | | | | | | | If auth.backend.ldap.filter begins with ',', then concatenate uid=<username> with the 'filter' value to form the DN instead of using ldap_search to query LDAP for the DN for the username, applying the provided filter. x-ref: "Allow User-DN to be supplied in the configuration rather than searching" https://redmine.lighttpd.net/issues/1248
* [mod_auth] ldap filter subst user for multiple '$' (fixes #1508)Glenn Strauss2016-09-281-23/+13
| | | | | | | | ldap filter supports substitution of multiple '$', each with username x-ref: "auth.backend.ldap.filter: only one/first "$" replaced with Username" https://redmine.lighttpd.net/issues/1508
* [mod_auth] HTTP Basic auth backends also do authz (#1817)Glenn Strauss2016-09-281-4/+5
| | | | | | | | | | HTTP Basic auth backends now do both authn and authz in order to allow provide a means to extend backends to optionally support group authz x-ref: "LDAP-Group support for HTTP-Authentication" https://redmine.lighttpd.net/issues/1817
* [mod_auth] refactor LDAP code into smaller funcsGlenn Strauss2016-09-281-158/+204
| | | | | better handling and freeing of resources replace deprecated LDAP routines
* [mod_auth] extensible interface for auth backendsGlenn Strauss2016-08-201-0/+448
create new, extensible interface for (additional) auth backends attempt to handle HANDLER_WAIT_FOR_EVENT returned by auth backends to allow for async auth backends (e.g. to mysql database) separate auth backends from mod_auth and http_auth mod_authn_file.c htdigest, htpasswd, plain auth backends mod_authn_ldap.c ldap auth backend add http_auth.c to common_sources for auth backend registration (mod_authn_file could be three separate modules, but no need for now)
View Lorry Controller Status