Fix prev commit, cleanup fakeroot entry before freeing

[openldap] / servers / slapd / config.c

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index 9302308da71d6c092d55a56871915969d8121706..54dcf2d571eb86deeb9a8709c9d3cb26dff9ebde 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2007 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -68,7 +68,6 @@ int           global_gentlehup = 0;
 int            global_idletimeout = 0;
 char   *global_host = NULL;
 char   *global_realm = NULL;
-char           *ldap_srvtab = "";
 char           **default_passwd_hash = NULL;
 struct berval default_search_base = BER_BVNULL;
 struct berval default_search_nbase = BER_BVNULL;
@@ -998,6 +997,21 @@ static slap_verbmasks tlskey[] = {
        { BER_BVC("critical"),  SB_TLS_CRITICAL },
        { BER_BVNULL, 0 }
 };
+
+static slap_verbmasks crlkeys[] = {
+               { BER_BVC("none"),      LDAP_OPT_X_TLS_CRL_NONE },
+               { BER_BVC("peer"),      LDAP_OPT_X_TLS_CRL_PEER },
+               { BER_BVC("all"),       LDAP_OPT_X_TLS_CRL_ALL },
+               { BER_BVNULL, 0 }
+       };
+
+static slap_verbmasks vfykeys[] = {
+               { BER_BVC("never"),     LDAP_OPT_X_TLS_NEVER },
+               { BER_BVC("demand"),    LDAP_OPT_X_TLS_DEMAND },
+               { BER_BVC("try"),       LDAP_OPT_X_TLS_TRY },
+               { BER_BVC("hard"),      LDAP_OPT_X_TLS_HARD },
+               { BER_BVNULL, 0 }
+       };
 #endif
 
 static slap_verbmasks methkey[] = {
@@ -1019,6 +1033,8 @@ static slap_cf_aux_table bindkey[] = {
        { BER_BVC("uri="), offsetof(slap_bindconf, sb_uri), 'b', 1, NULL },
        { BER_BVC("version="), offsetof(slap_bindconf, sb_version), 'i', 0, versionkey },
        { BER_BVC("bindmethod="), offsetof(slap_bindconf, sb_method), 'i', 0, methkey },
+       { BER_BVC("timeout="), offsetof(slap_bindconf, sb_timeout_api), 'i', 0, NULL },
+       { BER_BVC("network-timeout="), offsetof(slap_bindconf, sb_timeout_net), 'i', 0, NULL },
        { BER_BVC("binddn="), offsetof(slap_bindconf, sb_binddn), 'b', 1, (slap_verbmasks *)dnNormalize },
        { BER_BVC("credentials="), offsetof(slap_bindconf, sb_cred), 'b', 1, NULL },
        { BER_BVC("saslmech="), offsetof(slap_bindconf, sb_saslmech), 'b', 0, NULL },
@@ -1029,9 +1045,9 @@ static slap_cf_aux_table bindkey[] = {
 #ifdef HAVE_TLS
        { BER_BVC("starttls="), offsetof(slap_bindconf, sb_tls), 'i', 0, tlskey },
 
-       /* NOTE: replace "11" with the actual index
+       /* NOTE: replace "13" with the actual index
         * of the first TLS-related line */
-#define aux_TLS (bindkey+11)   /* beginning of TLS keywords */
+#define aux_TLS (bindkey+13)   /* beginning of TLS keywords */
 
        { BER_BVC("tls_cert="), offsetof(slap_bindconf, sb_tls_cert), 's', 1, NULL },
        { BER_BVC("tls_key="), offsetof(slap_bindconf, sb_tls_key), 's', 1, NULL },
@@ -1233,14 +1249,63 @@ slap_cf_aux_table_unparse( void *src, struct berval *bv, slap_cf_aux_table *tab0
 }
 
 int
-bindconf_parse( const char *word, slap_bindconf *bc )
+slap_tls_get_config( LDAP *ld, int opt, char **val )
+{
+       slap_verbmasks *keys;
+       int i, ival;
+
+       *val = NULL;
+       switch( opt ) {
+#ifdef HAVE_TLS
+       case LDAP_OPT_X_TLS_CRLCHECK:
+               keys = crlkeys;
+               break;
+       case LDAP_OPT_X_TLS_REQUIRE_CERT:
+               keys = vfykeys;
+               break;
+#endif
+       default:
+               return -1;
+       }
+       ldap_pvt_tls_get_option( ld, opt, &ival );
+       for (i=0; !BER_BVISNULL(&keys[i].word); i++) {
+               if (keys[i].mask == ival) {
+                       *val = ch_strdup( keys[i].word.bv_val );
+                       return 0;
+               }
+       }
+       return -1;
+}
+
+int
+bindconf_tls_parse( const char *word, slap_bindconf *bc )
 {
 #ifdef HAVE_TLS
-       /* Detect TLS config changes explicitly */
        if ( slap_cf_aux_table_parse( word, bc, aux_TLS, "tls config" ) == 0 ) {
                bc->sb_tls_do_init = 1;
                return 0;
        }
+#endif
+       return -1;
+}
+
+int
+bindconf_tls_unparse( slap_bindconf *bc, struct berval *bv )
+{
+#ifdef HAVE_TLS
+       return slap_cf_aux_table_unparse( bc, bv, aux_TLS );
+#endif
+       return -1;
+}
+
+int
+bindconf_parse( const char *word, slap_bindconf *bc )
+{
+#ifdef HAVE_TLS
+       /* Detect TLS config changes explicitly */
+       if ( bindconf_tls_parse( word, bc ) == 0 ) {
+               return 0;
+       }
 #endif
        return slap_cf_aux_table_parse( word, bc, bindkey, "bind config" );
 }
@@ -1324,6 +1389,37 @@ void bindconf_free( slap_bindconf *bc ) {
 #endif
 }
 
+void
+bindconf_tls_defaults( slap_bindconf *bc )
+{
+#ifdef HAVE_TLS
+       if ( bc->sb_tls_do_init ) {
+               if ( !bc->sb_tls_cacert )
+                       ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CACERTFILE,
+                               &bc->sb_tls_cacert );
+               if ( !bc->sb_tls_cacertdir )
+                       ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CACERTDIR,
+                               &bc->sb_tls_cacertdir );
+               if ( !bc->sb_tls_cert )
+                       ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CERTFILE,
+                               &bc->sb_tls_cert );
+               if ( !bc->sb_tls_key )
+                       ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_KEYFILE,
+                               &bc->sb_tls_key );
+               if ( !bc->sb_tls_cipher_suite )
+                       ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CIPHER_SUITE,
+                               &bc->sb_tls_cipher_suite );
+               if ( !bc->sb_tls_reqcert )
+                       bc->sb_tls_reqcert = ch_strdup("demand");
+#ifdef HAVE_OPENSSL_CRL
+               if ( !bc->sb_tls_crlcheck )
+                       slap_tls_get_config( slap_tls_ld, LDAP_OPT_X_TLS_CRLCHECK,
+                               &bc->sb_tls_crlcheck );
+#endif
+       }
+#endif
+}
+
 #ifdef HAVE_TLS
 static struct {
        const char *key;
@@ -1409,6 +1505,7 @@ slap_client_connect( LDAP **ldp, slap_bindconf *sb )
 {
        LDAP            *ld = NULL;
        int             rc;
+       struct timeval tv;
 
        /* Init connection to master */
        rc = ldap_initialize( &ld, sb->sb_uri.bv_val );
@@ -1425,6 +1522,18 @@ slap_client_connect( LDAP **ldp, slap_bindconf *sb )
                        (const void *)&sb->sb_version );
        }
 
+       if ( sb->sb_timeout_api ) {
+               tv.tv_sec = sb->sb_timeout_api;
+               tv.tv_usec = 0;
+               ldap_set_option( ld, LDAP_OPT_TIMEOUT, &tv );
+       }
+
+       if ( sb->sb_timeout_net ) {
+               tv.tv_sec = sb->sb_timeout_net;
+               tv.tv_usec = 0;
+               ldap_set_option( ld, LDAP_OPT_NETWORK_TIMEOUT, &tv );
+       }
+
 #ifdef HAVE_TLS
        if ( sb->sb_tls_do_init ) {
                rc = bindconf_tls_set( sb, ld );