Merge remote-tracking branch 'origin/mdb.RE/0.9'

[openldap] / libraries / libldap / tls_o.c

diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
index ba936fa09cb186c318ae96c275b8cb1162556fa8..5d2367c6c1cc1e45707dbd070dadf88a556f8d74 100644 (file)
--- a/libraries/libldap/tls_o.c
+++ b/libraries/libldap/tls_o.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2008-2013 The OpenLDAP Foundation.
+ * Copyright 2008-2015 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -321,8 +321,12 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
                DH_free( dh );
        }
 
-#ifdef SSL_OP_SINGLE_ECDH_USE
        if ( is_server && lo->ldo_tls_ecname ) {
+#ifdef OPENSSL_NO_EC
+               Debug( LDAP_DEBUG_ANY,
+                       "TLS: Elliptic Curves not supported.\n", 0,0,0 );
+               return -1;
+#else
                EC_KEY *ecdh;
 
                int nid = OBJ_sn2nid( lt->lt_ecname );
@@ -344,8 +348,8 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
                SSL_CTX_set_tmp_ecdh( ctx, ecdh );
                SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE );
                EC_KEY_free( ecdh );
-       }
 #endif
+       }
 
        if ( tlso_opt_trace ) {
                SSL_CTX_set_info_callback( ctx, tlso_info_cb );
@@ -703,6 +707,35 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server)
        return buf->bv_len;
 }
 
+static const char *
+tlso_session_version( tls_session *sess )
+{
+       tlso_session *s = (tlso_session *)sess;
+       return SSL_get_version(s);
+}
+
+static const char *
+tlso_session_cipher( tls_session *sess )
+{
+       tlso_session *s = (tlso_session *)sess;
+       return SSL_CIPHER_get_name(SSL_get_current_cipher(s));
+}
+
+static int
+tlso_session_peercert( tls_session *sess, struct berval *der )
+{
+       tlso_session *s = (tlso_session *)sess;
+       unsigned char *ptr;
+       X509 *x = SSL_get_peer_certificate(s);
+       der->bv_len = i2d_X509(x, NULL);
+       der->bv_val = LDAP_MALLOC(der->bv_len);
+       if ( !der->bv_val )
+               return -1;
+       ptr = der->bv_val;
+       i2d_X509(x, &ptr);
+       return 0;
+}
+
 /*
  * TLS support for LBER Sockbufs
  */
@@ -1209,6 +1242,9 @@ tls_impl ldap_int_tls_impl = {
        tlso_session_chkhost,
        tlso_session_strength,
        tlso_session_unique,
+       tlso_session_version,
+       tlso_session_cipher,
+       tlso_session_peercert,
 
        &tlso_sbio,