Use recursive mutex to avoid deadlocks

[openldap] / servers / slapd / config.c

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index 8e8558c053b72ea06e576859d2f3cc1757409e48..34ebb1d25cd4df9f5d2a1b2f604439814aeca354 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -45,6 +45,10 @@
 #include "lutil.h"
 #include "config.h"
 
+#ifdef HAVE_TLS
+#include <openssl/ssl.h>
+#endif
+
 #define ARGS_STEP      512
 
 /*
@@ -552,7 +556,7 @@ strtok_quote_ldif( char **line )
        if ( !ptr || !*ptr )
                return NULL;
 
-       while( isspace( *ptr )) ptr++;
+       while( isspace( (unsigned char) *ptr )) ptr++;
 
        if ( *ptr == '"' ) {
                inquote = 1;
@@ -563,7 +567,7 @@ strtok_quote_ldif( char **line )
 
        for (;*ptr;ptr++) {
                if ( *ptr == '"' ) {
-                       if ( inquote && ( !ptr[1] || isspace(ptr[1]))) {
+                       if ( inquote && ( !ptr[1] || isspace((unsigned char) ptr[1]))) {
                                *ptr++ = '\0';
                                break;
                        }
@@ -573,7 +577,7 @@ strtok_quote_ldif( char **line )
                }
                if ( inquote )
                        continue;
-               if ( isspace( *ptr )) {
+               if ( isspace( (unsigned char) *ptr )) {
                        *ptr++ = '\0';
                        break;
                }
@@ -587,7 +591,7 @@ strtok_quote_ldif( char **line )
        if ( !*ptr ) {
                *line = NULL;
        } else {
-               while ( isspace( *ptr )) ptr++;
+               while ( isspace( (unsigned char) *ptr )) ptr++;
                *line = ptr;
        }
        return beg;
@@ -1034,6 +1038,17 @@ static slap_cf_aux_table bindkey[] = {
        { BER_BVC("realm="), offsetof(slap_bindconf, sb_realm), 'b', 0, NULL },
        { BER_BVC("authcID="), offsetof(slap_bindconf, sb_authcId), 'b', 0, NULL },
        { BER_BVC("authzID="), offsetof(slap_bindconf, sb_authzId), 'b', 1, NULL },
+#ifdef HAVE_TLS
+       { BER_BVC("tls_cert="), offsetof(slap_bindconf, sb_tls_cert), 's', 1, NULL },
+       { BER_BVC("tls_key="), offsetof(slap_bindconf, sb_tls_key), 's', 1, NULL },
+       { BER_BVC("tls_cacert="), offsetof(slap_bindconf, sb_tls_cacert), 's', 1, NULL },
+       { BER_BVC("tls_cacertdir="), offsetof(slap_bindconf, sb_tls_cacertdir), 's', 1, NULL },
+       { BER_BVC("tls_reqcert="), offsetof(slap_bindconf, sb_tls_reqcert), 's', 1, NULL },
+       { BER_BVC("tls_cipher_suite="), offsetof(slap_bindconf, sb_tls_cipher_suite), 's', 1, NULL },
+#ifdef HAVE_OPENSSL_CRL
+       { BER_BVC("tls_crlcheck="), offsetof(slap_bindconf, sb_tls_crlcheck), 's', 1, NULL },
+#endif
+#endif
        { BER_BVNULL, 0, 0, 0, NULL }
 };
 
@@ -1243,8 +1258,112 @@ void bindconf_free( slap_bindconf *bc ) {
                ch_free( bc->sb_authzId.bv_val );
                BER_BVZERO( &bc->sb_authzId );
        }
+#ifdef HAVE_TLS
+       if ( bc->sb_tls_ctx ) {
+               SSL_CTX_free( bc->sb_tls_ctx );
+               bc->sb_tls_ctx = NULL;
+       }
+       if ( bc->sb_tls_cert ) {
+               ch_free( bc->sb_tls_cert );
+               bc->sb_tls_cert = NULL;
+       }
+       if ( bc->sb_tls_key ) {
+               ch_free( bc->sb_tls_key );
+               bc->sb_tls_key = NULL;
+       }
+       if ( bc->sb_tls_cacert ) {
+               ch_free( bc->sb_tls_cacert );
+               bc->sb_tls_cacert = NULL;
+       }
+       if ( bc->sb_tls_cacertdir ) {
+               ch_free( bc->sb_tls_cacertdir );
+               bc->sb_tls_cacertdir = NULL;
+       }
+       if ( bc->sb_tls_reqcert ) {
+               ch_free( bc->sb_tls_reqcert );
+               bc->sb_tls_reqcert = NULL;
+       }
+       if ( bc->sb_tls_cipher_suite ) {
+               ch_free( bc->sb_tls_cipher_suite );
+               bc->sb_tls_cipher_suite = NULL;
+       }
+#ifdef HAVE_OPENSSL_CRL
+       if ( bc->sb_tls_crlcheck ) {
+               ch_free( bc->sb_tls_crlcheck );
+               bc->sb_tls_crlcheck = NULL;
+       }
+#endif
+#endif
 }
 
+#ifdef HAVE_TLS
+static struct {
+       const char *key;
+       size_t offset;
+       int opt;
+} bindtlsopts[] = {
+       { "tls_cert", offsetof(slap_bindconf, sb_tls_cert), LDAP_OPT_X_TLS_CERTFILE },
+       { "tls_key", offsetof(slap_bindconf, sb_tls_key), LDAP_OPT_X_TLS_KEYFILE },
+       { "tls_cacert", offsetof(slap_bindconf, sb_tls_cacert), LDAP_OPT_X_TLS_CACERTFILE },
+       { "tls_cacertdir", offsetof(slap_bindconf, sb_tls_cacertdir), LDAP_OPT_X_TLS_CACERTDIR },
+       { "tls_cipher_suite", offsetof(slap_bindconf, sb_tls_cipher_suite), LDAP_OPT_X_TLS_CIPHER_SUITE },
+       {0, 0}
+};
+
+int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
+{
+       int i, rc, newctx = 0, res = 0;
+       char *ptr = (char *)bc, **word;
+
+       for (i=0; bindtlsopts[i].opt; i++) {
+               word = (char **)(ptr + bindtlsopts[i].offset);
+               if ( *word ) {
+                       rc = ldap_set_option( ld, bindtlsopts[i].opt, *word );
+                       if ( rc ) {
+                               Debug( LDAP_DEBUG_ANY,
+                                       "bindconf_tls_set: failed to set %s to %s\n",
+                                               bindtlsopts[i].key, *word, 0 );
+                               res = -1;
+                       } else
+                               newctx = 1;
+               }
+       }
+       if ( bc->sb_tls_reqcert ) {
+               rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_REQUIRE_CERT,
+                       bc->sb_tls_reqcert );
+               if ( rc ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "bindconf_tls_set: failed to set tls_reqcert to %s\n",
+                                       bc->sb_tls_reqcert, 0, 0 );
+                       res = -1;
+               } else
+                       newctx = 1;
+       }
+#ifdef HAVE_OPENSSL_CRL
+       if ( bc->sb_tls_crlcheck ) {
+               rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_CRLCHECK,
+                       bc->sb_tls_crlcheck );
+               if ( rc ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "bindconf_tls_set: failed to set tls_crlcheck to %s\n",
+                                       bc->sb_tls_crlcheck, 0, 0 );
+                       res = -1;
+               } else
+                       newctx = 1;
+       }
+#endif
+       if ( newctx ) {
+               int opt = 0;
+               rc = ldap_set_option( ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
+               if ( rc )
+                       res = rc;
+               else
+                       ldap_get_option( ld, LDAP_OPT_X_TLS_CTX, &bc->sb_tls_ctx );
+       }
+       
+       return res;
+}
+#endif
 
 /* -------------------------------------- */