Use recursive mutex to avoid deadlocks

[openldap] / servers / slapd / config.c

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index 2598291bc5ab157f48c2e1d71a7f583b00a54dbe..34ebb1d25cd4df9f5d2a1b2f604439814aeca354 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -45,6 +45,10 @@
 #include "lutil.h"
 #include "config.h"
 
+#ifdef HAVE_TLS
+#include <openssl/ssl.h>
+#endif
+
 #define ARGS_STEP      512
 
 /*
@@ -1034,6 +1038,17 @@ static slap_cf_aux_table bindkey[] = {
        { BER_BVC("realm="), offsetof(slap_bindconf, sb_realm), 'b', 0, NULL },
        { BER_BVC("authcID="), offsetof(slap_bindconf, sb_authcId), 'b', 0, NULL },
        { BER_BVC("authzID="), offsetof(slap_bindconf, sb_authzId), 'b', 1, NULL },
+#ifdef HAVE_TLS
+       { BER_BVC("tls_cert="), offsetof(slap_bindconf, sb_tls_cert), 's', 1, NULL },
+       { BER_BVC("tls_key="), offsetof(slap_bindconf, sb_tls_key), 's', 1, NULL },
+       { BER_BVC("tls_cacert="), offsetof(slap_bindconf, sb_tls_cacert), 's', 1, NULL },
+       { BER_BVC("tls_cacertdir="), offsetof(slap_bindconf, sb_tls_cacertdir), 's', 1, NULL },
+       { BER_BVC("tls_reqcert="), offsetof(slap_bindconf, sb_tls_reqcert), 's', 1, NULL },
+       { BER_BVC("tls_cipher_suite="), offsetof(slap_bindconf, sb_tls_cipher_suite), 's', 1, NULL },
+#ifdef HAVE_OPENSSL_CRL
+       { BER_BVC("tls_crlcheck="), offsetof(slap_bindconf, sb_tls_crlcheck), 's', 1, NULL },
+#endif
+#endif
        { BER_BVNULL, 0, 0, 0, NULL }
 };
 
@@ -1243,8 +1258,112 @@ void bindconf_free( slap_bindconf *bc ) {
                ch_free( bc->sb_authzId.bv_val );
                BER_BVZERO( &bc->sb_authzId );
        }
+#ifdef HAVE_TLS
+       if ( bc->sb_tls_ctx ) {
+               SSL_CTX_free( bc->sb_tls_ctx );
+               bc->sb_tls_ctx = NULL;
+       }
+       if ( bc->sb_tls_cert ) {
+               ch_free( bc->sb_tls_cert );
+               bc->sb_tls_cert = NULL;
+       }
+       if ( bc->sb_tls_key ) {
+               ch_free( bc->sb_tls_key );
+               bc->sb_tls_key = NULL;
+       }
+       if ( bc->sb_tls_cacert ) {
+               ch_free( bc->sb_tls_cacert );
+               bc->sb_tls_cacert = NULL;
+       }
+       if ( bc->sb_tls_cacertdir ) {
+               ch_free( bc->sb_tls_cacertdir );
+               bc->sb_tls_cacertdir = NULL;
+       }
+       if ( bc->sb_tls_reqcert ) {
+               ch_free( bc->sb_tls_reqcert );
+               bc->sb_tls_reqcert = NULL;
+       }
+       if ( bc->sb_tls_cipher_suite ) {
+               ch_free( bc->sb_tls_cipher_suite );
+               bc->sb_tls_cipher_suite = NULL;
+       }
+#ifdef HAVE_OPENSSL_CRL
+       if ( bc->sb_tls_crlcheck ) {
+               ch_free( bc->sb_tls_crlcheck );
+               bc->sb_tls_crlcheck = NULL;
+       }
+#endif
+#endif
 }
 
+#ifdef HAVE_TLS
+static struct {
+       const char *key;
+       size_t offset;
+       int opt;
+} bindtlsopts[] = {
+       { "tls_cert", offsetof(slap_bindconf, sb_tls_cert), LDAP_OPT_X_TLS_CERTFILE },
+       { "tls_key", offsetof(slap_bindconf, sb_tls_key), LDAP_OPT_X_TLS_KEYFILE },
+       { "tls_cacert", offsetof(slap_bindconf, sb_tls_cacert), LDAP_OPT_X_TLS_CACERTFILE },
+       { "tls_cacertdir", offsetof(slap_bindconf, sb_tls_cacertdir), LDAP_OPT_X_TLS_CACERTDIR },
+       { "tls_cipher_suite", offsetof(slap_bindconf, sb_tls_cipher_suite), LDAP_OPT_X_TLS_CIPHER_SUITE },
+       {0, 0}
+};
+
+int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
+{
+       int i, rc, newctx = 0, res = 0;
+       char *ptr = (char *)bc, **word;
+
+       for (i=0; bindtlsopts[i].opt; i++) {
+               word = (char **)(ptr + bindtlsopts[i].offset);
+               if ( *word ) {
+                       rc = ldap_set_option( ld, bindtlsopts[i].opt, *word );
+                       if ( rc ) {
+                               Debug( LDAP_DEBUG_ANY,
+                                       "bindconf_tls_set: failed to set %s to %s\n",
+                                               bindtlsopts[i].key, *word, 0 );
+                               res = -1;
+                       } else
+                               newctx = 1;
+               }
+       }
+       if ( bc->sb_tls_reqcert ) {
+               rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_REQUIRE_CERT,
+                       bc->sb_tls_reqcert );
+               if ( rc ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "bindconf_tls_set: failed to set tls_reqcert to %s\n",
+                                       bc->sb_tls_reqcert, 0, 0 );
+                       res = -1;
+               } else
+                       newctx = 1;
+       }
+#ifdef HAVE_OPENSSL_CRL
+       if ( bc->sb_tls_crlcheck ) {
+               rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_CRLCHECK,
+                       bc->sb_tls_crlcheck );
+               if ( rc ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "bindconf_tls_set: failed to set tls_crlcheck to %s\n",
+                                       bc->sb_tls_crlcheck, 0, 0 );
+                       res = -1;
+               } else
+                       newctx = 1;
+       }
+#endif
+       if ( newctx ) {
+               int opt = 0;
+               rc = ldap_set_option( ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
+               if ( rc )
+                       res = rc;
+               else
+                       ldap_get_option( ld, LDAP_OPT_X_TLS_CTX, &bc->sb_tls_ctx );
+       }
+       
+       return res;
+}
+#endif
 
 /* -------------------------------------- */