Added ldap_pvt_sasl_bind() prototype to ldap_pvt.h. This

[openldap] / libraries / libldap / open.c

diff --git a/libraries/libldap/open.c b/libraries/libldap/open.c
index fb2a140d5dc6624620d1dc2ef7912ed33d062664..2ed9021b00fd13fe5465b9b362570ead821220f3 100644 (file)
--- a/libraries/libldap/open.c
+++ b/libraries/libldap/open.c
@@ -227,12 +227,53 @@ ldap_initialize( LDAP **ldp, LDAP_CONST char *url )
        return LDAP_SUCCESS;
 }
 
+int
+ldap_start_tls ( LDAP *ld,
+                               LDAPControl **serverctrls,
+                               LDAPControl **clientctrls )
+{
+#ifdef HAVE_TLS
+       LDAPConn *lc;
+       int rc;
+       char *rspoid = NULL;
+       struct berval *rspdata = NULL;
+
+       if (ld->ld_conns == NULL) {
+               rc = ldap_open_defconn( ld );
+               if (rc != LDAP_SUCCESS)
+                       return(rc);
+       }
+
+       for (lc = ld->ld_conns; lc != NULL; lc = lc->lconn_next) {
+               if (ldap_pvt_tls_inplace(lc->lconn_sb) != 0)
+                       return LDAP_OPERATIONS_ERROR;
+               rc = ldap_extended_operation_s(ld, LDAP_EXOP_START_TLS,
+                                                       NULL, serverctrls, clientctrls, &rspoid, &rspdata);
+               if (rc != LDAP_SUCCESS)
+                       return rc;
+               if (rspoid != NULL)
+                       LDAP_FREE(rspoid);
+               if (rspdata != NULL)
+                       ber_bvfree(rspdata);
+               rc = ldap_pvt_tls_start( lc->lconn_sb, ld->ld_options.ldo_tls_ctx );
+               if (rc != LDAP_SUCCESS)
+                       return rc;
+       }
+       return LDAP_SUCCESS;
+#else
+       return LDAP_NOT_SUPPORTED;
+#endif
+}
+
 int
 open_ldap_connection( LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv,
        char **krbinstancep, int async )
 {
-       int                     rc = -1;
+       int rc = -1;
        int port;
+#ifdef HAVE_TLS
+       int tls;
+#endif
        long addr;
 
        Debug( LDAP_DEBUG_TRACE, "open_ldap_connection\n", 0, 0, 0 );
@@ -243,10 +284,24 @@ open_ldap_connection( LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv,
        port = htons( (short) port );
 
        addr = 0;
-       if ( srv->lud_host == NULL )
+       if ( srv->lud_host == NULL || *srv->lud_host == 0 )
                addr = htonl( INADDR_LOOPBACK );
 
-       rc = ldap_connect_to_host( ld, sb, srv->lud_host, addr, port, async );
+       switch ( srv->lud_protocol ) {
+               case LDAP_PROTO_TCP:
+               case LDAP_PROTO_UDP:
+                       rc = ldap_connect_to_host( ld, sb, srv->lud_host, addr, port, async );
+                       break;
+#ifdef LDAP_PF_LOCAL
+               case LDAP_PROTO_LOCAL:
+                       rc = ldap_connect_to_path( ld, sb, srv->lud_host, async );
+                       break;
+#endif /* LDAP_PF_LOCAL */
+               default:
+                       rc = -1;
+                       break;
+       }
+
        if ( rc == -1 ) {
                return( rc );
        }
@@ -254,21 +309,17 @@ open_ldap_connection( LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv,
        ber_pvt_sb_set_io( sb, &ber_pvt_sb_io_tcp, NULL );
 
 #ifdef HAVE_TLS
-       if ( ld->ld_options.ldo_tls_mode == LDAP_OPT_X_TLS_HARD 
-               || srv->lud_ldaps != 0 )
-       {
-               /*
-                * Fortunately, the lib uses blocking io...
-                */
-               if ( ldap_pvt_tls_connect( sb, ld->ld_options.ldo_tls_ctx ) < 
-                    0 ) {
-                       return -1;
-               }
-               /* FIXME: hostname of server must be compared with name in
-                * certificate....
-                */
+       tls = (srv->lud_properties & LDAP_URL_USE_SSL);
+       if (tls == 0)
+               tls = (srv->lud_properties & LDAP_URL_USE_SSL_UNSPECIFIED);
+
+       if ( tls != 0 ) {
+               rc = ldap_pvt_tls_start( sb, ld->ld_options.ldo_tls_ctx );
+               if (rc != LDAP_SUCCESS)
+                       return rc;
        }
 #endif
+
        if ( krbinstancep != NULL ) {
 #ifdef HAVE_KERBEROS
                char *c;
@@ -277,7 +328,7 @@ open_ldap_connection( LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv,
                        *c = '\0';
                }
 #else /* HAVE_KERBEROS */
-               krbinstancep = NULL;
+               *krbinstancep = NULL;
 #endif /* HAVE_KERBEROS */
        }