Detect TLS config changes

[openldap] / servers / slapd / config.c

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index de523df14285ad8bd6696339b2dcd51751ffba2a..8f8e92ac61c48a01e7c1ab538bdf6757002799ee 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -45,6 +45,10 @@
 #include "lutil.h"
 #include "config.h"
 
+#ifdef HAVE_TLS
+#include <openssl/ssl.h>
+#endif
+
 #define ARGS_STEP      512
 
 /*
@@ -1035,6 +1039,9 @@ static slap_cf_aux_table bindkey[] = {
        { BER_BVC("authcID="), offsetof(slap_bindconf, sb_authcId), 'b', 0, NULL },
        { BER_BVC("authzID="), offsetof(slap_bindconf, sb_authzId), 'b', 1, NULL },
 #ifdef HAVE_TLS
+
+#define aux_TLS (bindkey+10)   /* beginning of TLS keywords */
+
        { BER_BVC("tls_cert="), offsetof(slap_bindconf, sb_tls_cert), 's', 1, NULL },
        { BER_BVC("tls_key="), offsetof(slap_bindconf, sb_tls_key), 's', 1, NULL },
        { BER_BVC("tls_cacert="), offsetof(slap_bindconf, sb_tls_cacert), 's', 1, NULL },
@@ -1051,7 +1058,7 @@ static slap_cf_aux_table bindkey[] = {
 int
 slap_cf_aux_table_parse( const char *word, void *dst, slap_cf_aux_table *tab0, LDAP_CONST char *tabmsg )
 {
-       int rc = 0;
+       int rc = SLAP_CONF_UNKNOWN;
        slap_cf_aux_table *tab;
 
        for (tab = tab0; !BER_BVISNULL(&tab->key); tab++ ) {
@@ -1068,11 +1075,13 @@ slap_cf_aux_table_parse( const char *word, void *dst, slap_cf_aux_table *tab0, L
                        case 's':
                                cptr = (char **)((char *)dst + tab->off);
                                *cptr = ch_strdup( val );
+                               rc = 0;
                                break;
 
                        case 'b':
                                bptr = (struct berval *)((char *)dst + tab->off);
                                ber_str2bv( val, 0, 1, bptr );
+                               rc = 0;
                                break;
 
                        case 'd':
@@ -1212,6 +1221,13 @@ slap_cf_aux_table_unparse( void *src, struct berval *bv, slap_cf_aux_table *tab0
 int
 bindconf_parse( const char *word, slap_bindconf *bc )
 {
+#ifdef HAVE_TLS
+       /* Detect TLS config changes explicitly */
+       if ( slap_cf_aux_table_parse( word, bc, aux_TLS, "tls config" ) == 0 ) {
+               bc->sb_tls_do_init = 1;
+               return 0;
+       }
+#endif
        return slap_cf_aux_table_parse( word, bc, bindkey, "bind config" );
 }
 
@@ -1255,6 +1271,10 @@ void bindconf_free( slap_bindconf *bc ) {
                BER_BVZERO( &bc->sb_authzId );
        }
 #ifdef HAVE_TLS
+       if ( bc->sb_tls_ctx ) {
+               SSL_CTX_free( bc->sb_tls_ctx );
+               bc->sb_tls_ctx = NULL;
+       }
        if ( bc->sb_tls_cert ) {
                ch_free( bc->sb_tls_cert );
                bc->sb_tls_cert = NULL;
@@ -1288,6 +1308,81 @@ void bindconf_free( slap_bindconf *bc ) {
 #endif
 }
 
+#ifdef HAVE_TLS
+static struct {
+       const char *key;
+       size_t offset;
+       int opt;
+} bindtlsopts[] = {
+       { "tls_cert", offsetof(slap_bindconf, sb_tls_cert), LDAP_OPT_X_TLS_CERTFILE },
+       { "tls_key", offsetof(slap_bindconf, sb_tls_key), LDAP_OPT_X_TLS_KEYFILE },
+       { "tls_cacert", offsetof(slap_bindconf, sb_tls_cacert), LDAP_OPT_X_TLS_CACERTFILE },
+       { "tls_cacertdir", offsetof(slap_bindconf, sb_tls_cacertdir), LDAP_OPT_X_TLS_CACERTDIR },
+       { "tls_cipher_suite", offsetof(slap_bindconf, sb_tls_cipher_suite), LDAP_OPT_X_TLS_CIPHER_SUITE },
+       {0, 0}
+};
+
+int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
+{
+       int i, rc, newctx = 0, res = 0;
+       char *ptr = (char *)bc, **word;
+
+       bc->sb_tls_do_init = 0;
+
+       for (i=0; bindtlsopts[i].opt; i++) {
+               word = (char **)(ptr + bindtlsopts[i].offset);
+               if ( *word ) {
+                       rc = ldap_set_option( ld, bindtlsopts[i].opt, *word );
+                       if ( rc ) {
+                               Debug( LDAP_DEBUG_ANY,
+                                       "bindconf_tls_set: failed to set %s to %s\n",
+                                               bindtlsopts[i].key, *word, 0 );
+                               res = -1;
+                       } else
+                               newctx = 1;
+               }
+       }
+       if ( bc->sb_tls_reqcert ) {
+               rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_REQUIRE_CERT,
+                       bc->sb_tls_reqcert );
+               if ( rc ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "bindconf_tls_set: failed to set tls_reqcert to %s\n",
+                                       bc->sb_tls_reqcert, 0, 0 );
+                       res = -1;
+               } else
+                       newctx = 1;
+       }
+#ifdef HAVE_OPENSSL_CRL
+       if ( bc->sb_tls_crlcheck ) {
+               rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_CRLCHECK,
+                       bc->sb_tls_crlcheck );
+               if ( rc ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "bindconf_tls_set: failed to set tls_crlcheck to %s\n",
+                                       bc->sb_tls_crlcheck, 0, 0 );
+                       res = -1;
+               } else
+                       newctx = 1;
+       }
+#endif
+       if ( newctx ) {
+               int opt = 0;
+
+               if ( bc->sb_tls_ctx ) {
+                       SSL_CTX_free( bc->sb_tls_ctx );
+                       bc->sb_tls_ctx = NULL;
+               }
+               rc = ldap_set_option( ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
+               if ( rc )
+                       res = rc;
+               else
+                       ldap_get_option( ld, LDAP_OPT_X_TLS_CTX, &bc->sb_tls_ctx );
+       }
+       
+       return res;
+}
+#endif
 
 /* -------------------------------------- */