X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=sidebyside;f=libraries%2Flibldap%2Ftls.c;h=8cff2aa20750124957def387736a41ca2146a654;hb=d67a2f20449b82c8a7b1a3b43e011ad7c0c750b6;hp=dfbace08f7d4032b1ee567cecd71b8a7d855ecd4;hpb=d611a4b49a00238ed32ae84c68f27c6a0ef2273a;p=openldap diff --git a/libraries/libldap/tls.c b/libraries/libldap/tls.c index dfbace08f7..8cff2aa207 100644 --- a/libraries/libldap/tls.c +++ b/libraries/libldap/tls.c @@ -2,7 +2,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 1998-2004 The OpenLDAP Foundation. + * Copyright 1998-2005 The OpenLDAP Foundation. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -50,9 +50,13 @@ static int tls_opt_trace = 1; static char *tls_opt_certfile = NULL; static char *tls_opt_keyfile = NULL; +static char *tls_opt_dhfile = NULL; static char *tls_opt_cacertfile = NULL; static char *tls_opt_cacertdir = NULL; static int tls_opt_require_cert = LDAP_OPT_X_TLS_DEMAND; +#ifdef HAVE_OPENSSL_CRL +static int tls_opt_crlcheck = LDAP_OPT_X_TLS_CRL_NONE; +#endif static char *tls_opt_ciphersuite = NULL; static char *tls_opt_randfile = NULL; @@ -67,12 +71,18 @@ static int tls_verify_ok( int ok, X509_STORE_CTX *ctx ); static RSA * tls_tmp_rsa_cb( SSL *ssl, int is_export, int key_length ); static STACK_OF(X509_NAME) * get_ca_list( char * bundle, char * dir ); -#if 0 /* Currently this is not used by anyone */ static DH * tls_tmp_dh_cb( SSL *ssl, int is_export, int key_length ); -#endif static SSL_CTX *tls_def_ctx = NULL; +typedef struct dhplist { + struct dhplist *next; + int keylength; + DH *param; +} dhplist; + +static dhplist *dhparams; + static int tls_seed_PRNG( const char *randfile ); #ifdef LDAP_R_COMPILE @@ -131,6 +141,10 @@ ldap_pvt_tls_destroy( void ) LDAP_FREE( tls_opt_keyfile ); tls_opt_keyfile = NULL; } + if ( tls_opt_dhfile ) { + LDAP_FREE( tls_opt_dhfile ); + tls_opt_dhfile = NULL; + } if ( tls_opt_cacertfile ) { LDAP_FREE( tls_opt_cacertfile ); tls_opt_cacertfile = NULL; @@ -195,6 +209,19 @@ ldap_pvt_tls_init_def_ctx( void ) char *cacertdir = tls_opt_cacertdir; char *certfile = tls_opt_certfile; char *keyfile = tls_opt_keyfile; + char *dhfile = tls_opt_dhfile; + +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_lock( &tls_def_ctx_mutex ); +#endif + + if ( !certfile && !keyfile && !cacertfile && !cacertdir ) { + /* minimum configuration not provided */ +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); +#endif + return LDAP_NOT_SUPPORTED; + } #ifdef HAVE_EBCDIC /* This ASCII/EBCDIC handling is a real pain! */ @@ -218,10 +245,10 @@ ldap_pvt_tls_init_def_ctx( void ) keyfile = LDAP_STRDUP( keyfile ); __atoe( keyfile ); } -#endif - -#ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_lock( &tls_def_ctx_mutex ); + if ( dhfile ) { + dhfile = LDAP_STRDUP( dhfile ); + __atoe( dhfile ); + } #endif if ( tls_def_ctx == NULL ) { int i; @@ -313,6 +340,31 @@ ldap_pvt_tls_init_def_ctx( void ) goto error_exit; } + if ( tls_opt_dhfile ) { + DH *dh = NULL; + BIO *bio; + dhplist *p; + + if (( bio=BIO_new_file( dhfile,"r" )) == NULL ) { + Debug( LDAP_DEBUG_ANY, + "TLS: could not use DH parameters file `%s'.\n", + tls_opt_dhfile,0,0); + tls_report_error(); + rc = -1; + goto error_exit; + } + while (( dh=PEM_read_bio_DHparams( bio, NULL, NULL, NULL ))) { + p = LDAP_MALLOC( sizeof(dhplist) ); + if ( p != NULL ) { + p->keylength = DH_size( dh ) * 8; + p->param = dh; + p->next = dhparams; + dhparams = p; + } + } + BIO_free( bio ); + } + if ( tls_opt_trace ) { SSL_CTX_set_info_callback( tls_def_ctx, tls_info_cb ); } @@ -330,7 +382,18 @@ ldap_pvt_tls_init_def_ctx( void ) tls_opt_require_cert == LDAP_OPT_X_TLS_ALLOW ? tls_verify_ok : tls_verify_cb ); SSL_CTX_set_tmp_rsa_callback( tls_def_ctx, tls_tmp_rsa_cb ); - /* SSL_CTX_set_tmp_dh_callback( tls_def_ctx, tls_tmp_dh_cb ); */ + SSL_CTX_set_tmp_dh_callback( tls_def_ctx, tls_tmp_dh_cb ); +#ifdef HAVE_OPENSSL_CRL + if ( tls_opt_crlcheck ) { + X509_STORE *x509_s = SSL_CTX_get_cert_store( tls_def_ctx ); + if ( tls_opt_crlcheck == LDAP_OPT_X_TLS_CRL_PEER ) { + X509_STORE_set_flags( x509_s, X509_V_FLAG_CRL_CHECK ); + } else if ( tls_opt_crlcheck == LDAP_OPT_X_TLS_CRL_ALL ) { + X509_STORE_set_flags( x509_s, + X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL ); + } + } +#endif } error_exit: if ( rc == -1 && tls_def_ctx != NULL ) { @@ -343,6 +406,7 @@ error_exit: LDAP_FREE( cacertdir ); LDAP_FREE( certfile ); LDAP_FREE( keyfile ); + LDAP_FREE( dhfile ); #endif #ifdef LDAP_R_COMPILE ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); @@ -699,8 +763,11 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); } else { - void *ctx = ld->ld_defconn - ? ld->ld_defconn->lconn_tls_ctx : NULL; + struct ldapoptions *lo; + void *ctx; + + lo = &ld->ld_options; + ctx = lo->ldo_tls_ctx; ssl = alloc_handle( ctx ); @@ -714,8 +781,14 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) LBER_SBIOD_LEVEL_TRANSPORT, (void *)ssl ); if( ctx == NULL ) { - conn->lconn_tls_ctx = tls_def_ctx; + ctx = tls_def_ctx; + lo->ldo_tls_ctx = ctx; } + if ( lo->ldo_tls_connect_cb ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + lo = LDAP_INT_GLOBAL_OPT(); + if ( lo && lo->ldo_tls_connect_cb ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); } err = SSL_connect( ssl ); @@ -731,6 +804,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) if ((err = ERR_peek_error())) { char buf[256]; + + if ( ld->ld_error ) { + LDAP_FREE( ld->ld_error ); + } ld->ld_error = LDAP_STRDUP(ERR_error_string(err, buf)); #ifdef HAVE_EBCDIC if ( ld->ld_error ) __etoa(ld->ld_error); @@ -805,6 +882,24 @@ ldap_pvt_tls_inplace ( Sockbuf *sb ) return HAS_TLS( sb ) ? 1 : 0; } +int +ldap_tls_inplace( LDAP *ld ) +{ + Sockbuf *sb = NULL; + + if ( ld->ld_defconn && ld->ld_defconn->lconn_sb ) { + sb = ld->ld_defconn->lconn_sb; + + } else if ( ld->ld_sb ) { + sb = ld->ld_sb; + + } else { + return 0; + } + + return ldap_pvt_tls_inplace( sb ); +} + static X509 * tls_get_cert( SSL *s ) { @@ -996,7 +1091,10 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) Debug( LDAP_DEBUG_ANY, "TLS: unable to get common name from peer certificate.\n", 0, 0, 0 ); - ret = LDAP_CONNECT_ERROR; + ret = LDAP_CONNECT_ERROR; + if ( ld->ld_error ) { + LDAP_FREE( ld->ld_error ); + } ld->ld_error = LDAP_STRDUP( _("TLS: unable to get CN from peer certificate")); @@ -1021,12 +1119,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) } if( ret == LDAP_LOCAL_ERROR ) { - Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " - "common name in certificate (%s).\n", - name, buf, 0 ); - ret = LDAP_CONNECT_ERROR; - ld->ld_error = LDAP_STRDUP( - _("TLS: hostname does not match CN in peer certificate")); + Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " + "common name in certificate (%s).\n", + name, buf, 0 ); + ret = LDAP_CONNECT_ERROR; + if ( ld->ld_error ) { + LDAP_FREE( ld->ld_error ); + } + ld->ld_error = LDAP_STRDUP( + _("TLS: hostname does not match CN in peer certificate")); } } X509_free(x); @@ -1065,6 +1166,8 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) case LDAP_OPT_X_TLS_CERTFILE: case LDAP_OPT_X_TLS_KEYFILE: case LDAP_OPT_X_TLS_RANDOM_FILE: + case LDAP_OPT_X_TLS_CIPHER_SUITE: + case LDAP_OPT_X_TLS_DHFILE: return ldap_pvt_tls_set_option( ld, option, (void *) arg ); case LDAP_OPT_X_TLS_REQUIRE_CERT: @@ -1094,8 +1197,22 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) return ldap_pvt_tls_set_option( ld, option, &i ); } return -1; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + i = -1; + if ( strcasecmp( arg, "none" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_NONE ; + } else if ( strcasecmp( arg, "peer" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_PEER ; + } else if ( strcasecmp( arg, "all" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_ALL ; + } + if (i >= 0) { + return ldap_pvt_tls_set_option( ld, option, &i ); + } + return -1; +#endif } - return -1; } @@ -1129,7 +1246,7 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) if ( ld == NULL ) { *(void **)arg = (void *) tls_def_ctx; } else { - *(void **)arg = ld->ld_defconn->lconn_tls_ctx; + *(void **)arg = lo->ldo_tls_ctx; } break; case LDAP_OPT_X_TLS_CACERTFILE: @@ -1148,9 +1265,18 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) *(char **)arg = tls_opt_keyfile ? LDAP_STRDUP( tls_opt_keyfile ) : NULL; break; + case LDAP_OPT_X_TLS_DHFILE: + *(char **)arg = tls_opt_dhfile ? + LDAP_STRDUP( tls_opt_dhfile ) : NULL; + break; case LDAP_OPT_X_TLS_REQUIRE_CERT: *(int *)arg = tls_opt_require_cert; break; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + *(int *)arg = tls_opt_crlcheck; + break; +#endif case LDAP_OPT_X_TLS_RANDOM_FILE: *(char **)arg = tls_opt_randfile ? LDAP_STRDUP( tls_opt_randfile ) : NULL; @@ -1167,6 +1293,12 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) *(void **)arg = retval; break; } + case LDAP_OPT_X_TLS_CONNECT_CB: + *(LDAP_TLS_CONNECT_CB **)arg = lo->ldo_tls_connect_cb; + break; + case LDAP_OPT_X_TLS_CONNECT_ARG: + *(void **)arg = lo->ldo_tls_connect_arg; + break; default: return -1; } @@ -1216,9 +1348,15 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) tls_def_ctx = (SSL_CTX *) arg; } else { - ld->ld_defconn->lconn_tls_ctx = arg; + lo->ldo_tls_ctx = arg; } return 0; + case LDAP_OPT_X_TLS_CONNECT_CB: + lo->ldo_tls_connect_cb = (LDAP_TLS_CONNECT_CB *)arg; + return 0; + case LDAP_OPT_X_TLS_CONNECT_ARG: + lo->ldo_tls_connect_arg = arg; + return 0; } if ( ld != NULL ) { @@ -1242,6 +1380,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) if ( tls_opt_keyfile ) LDAP_FREE( tls_opt_keyfile ); tls_opt_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; break; + case LDAP_OPT_X_TLS_DHFILE: + if ( tls_opt_dhfile ) LDAP_FREE( tls_opt_dhfile ); + tls_opt_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + break; case LDAP_OPT_X_TLS_REQUIRE_CERT: switch( *(int *) arg ) { case LDAP_OPT_X_TLS_NEVER: @@ -1253,6 +1395,17 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) return 0; } return -1; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + switch( *(int *) arg ) { + case LDAP_OPT_X_TLS_CRL_NONE: + case LDAP_OPT_X_TLS_CRL_PEER: + case LDAP_OPT_X_TLS_CRL_ALL: + tls_opt_crlcheck = * (int *) arg; + return 0; + } + return -1; +#endif case LDAP_OPT_X_TLS_CIPHER_SUITE: if ( tls_opt_ciphersuite ) LDAP_FREE( tls_opt_ciphersuite ); tls_opt_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL; @@ -1528,13 +1681,114 @@ tls_seed_PRNG( const char *randfile ) return 0; } -#if 0 +struct dhinfo { + int keylength; + const char *pem; + size_t size; +}; + + +/* From the OpenSSL 0.9.7 distro */ +static const char dhpem512[] = +"-----BEGIN DH PARAMETERS-----\n\ +MEYCQQDaWDwW2YUiidDkr3VvTMqS3UvlM7gE+w/tlO+cikQD7VdGUNNpmdsp13Yn\n\ +a6LT1BLiGPTdHghM9tgAPnxHdOgzAgEC\n\ +-----END DH PARAMETERS-----\n"; + +static const char dhpem1024[] = +"-----BEGIN DH PARAMETERS-----\n\ +MIGHAoGBAJf2QmHKtQXdKCjhPx1ottPb0PMTBH9A6FbaWMsTuKG/K3g6TG1Z1fkq\n\ +/Gz/PWk/eLI9TzFgqVAuPvr3q14a1aZeVUMTgo2oO5/y2UHe6VaJ+trqCTat3xlx\n\ +/mNbIK9HA2RgPC3gWfVLZQrY+gz3ASHHR5nXWHEyvpuZm7m3h+irAgEC\n\ +-----END DH PARAMETERS-----\n"; + +static const char dhpem2048[] = +"-----BEGIN DH PARAMETERS-----\n\ +MIIBCAKCAQEA7ZKJNYJFVcs7+6J2WmkEYb8h86tT0s0h2v94GRFS8Q7B4lW9aG9o\n\ +AFO5Imov5Jo0H2XMWTKKvbHbSe3fpxJmw/0hBHAY8H/W91hRGXKCeyKpNBgdL8sh\n\ +z22SrkO2qCnHJ6PLAMXy5fsKpFmFor2tRfCzrfnggTXu2YOzzK7q62bmqVdmufEo\n\ +pT8igNcLpvZxk5uBDvhakObMym9mX3rAEBoe8PwttggMYiiw7NuJKO4MqD1llGkW\n\ +aVM8U2ATsCun1IKHrRxynkE1/MJ86VHeYYX8GZt2YA8z+GuzylIOKcMH6JAWzMwA\n\ +Gbatw6QwizOhr9iMjZ0B26TE3X8LvW84wwIBAg==\n\ +-----END DH PARAMETERS-----\n"; + +static const char dhpem4096[] = +"-----BEGIN DH PARAMETERS-----\n\ +MIICCAKCAgEA/urRnb6vkPYc/KEGXWnbCIOaKitq7ySIq9dTH7s+Ri59zs77zty7\n\ +vfVlSe6VFTBWgYjD2XKUFmtqq6CqXMhVX5ElUDoYDpAyTH85xqNFLzFC7nKrff/H\n\ +TFKNttp22cZE9V0IPpzedPfnQkE7aUdmF9JnDyv21Z/818O93u1B4r0szdnmEvEF\n\ +bKuIxEHX+bp0ZR7RqE1AeifXGJX3d6tsd2PMAObxwwsv55RGkn50vHO4QxtTARr1\n\ +rRUV5j3B3oPMgC7Offxx+98Xn45B1/G0Prp11anDsR1PGwtaCYipqsvMwQUSJtyE\n\ +EOQWk+yFkeMe4vWv367eEi0Sd/wnC+TSXBE3pYvpYerJ8n1MceI5GQTdarJ77OW9\n\ +bGTHmxRsLSCM1jpLdPja5jjb4siAa6EHc4qN9c/iFKS3PQPJEnX7pXKBRs5f7AF3\n\ +W3RIGt+G9IVNZfXaS7Z/iCpgzgvKCs0VeqN38QsJGtC1aIkwOeyjPNy2G6jJ4yqH\n\ +ovXYt/0mc00vCWeSNS1wren0pR2EiLxX0ypjjgsU1mk/Z3b/+zVf7fZSIB+nDLjb\n\ +NPtUlJCVGnAeBK1J1nG3TQicqowOXoM6ISkdaXj5GPJdXHab2+S7cqhKGv5qC7rR\n\ +jT6sx7RUr0CNTxzLI7muV2/a4tGmj0PSdXQdsZ7tw7gbXlaWT1+MM2MCAQI=\n\ +-----END DH PARAMETERS-----\n"; + +static const struct dhinfo dhpem[] = { + { 512, dhpem512, sizeof(dhpem512) }, + { 1024, dhpem1024, sizeof(dhpem1024) }, + { 2048, dhpem2048, sizeof(dhpem2048) }, + { 4096, dhpem4096, sizeof(dhpem4096) }, + { 0, NULL, 0 } +}; + static DH * tls_tmp_dh_cb( SSL *ssl, int is_export, int key_length ) { - return NULL; -} + struct dhplist *p = NULL; + BIO *b = NULL; + DH *dh = NULL; + int i; + + /* Do we have params of this length already? */ +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_lock( &tls_def_ctx_mutex ); #endif + for ( p = dhparams; p; p=p->next ) { + if ( p->keylength == key_length ) { +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); +#endif + return p->param; + } + } + + /* No - check for hardcoded params */ + + for (i=0; dhpem[i].keylength; i++) { + if ( dhpem[i].keylength == key_length ) { + b = BIO_new_mem_buf( (char *)dhpem[i].pem, dhpem[i].size ); + break; + } + } + + if ( b ) { + dh = PEM_read_bio_DHparams( b, NULL, NULL, NULL ); + BIO_free( b ); + } + + /* Generating on the fly is expensive/slow... */ + if ( !dh ) { + dh = DH_generate_parameters( key_length, DH_GENERATOR_2, NULL, NULL ); + } + if ( dh ) { + p = LDAP_MALLOC( sizeof(struct dhplist) ); + if ( p != NULL ) { + p->keylength = key_length; + p->param = dh; + p->next = dhparams; + dhparams = p; + } + } +done: +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); +#endif + return dh; +} #endif void * @@ -1586,20 +1840,45 @@ ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, #endif } +int +ldap_start_tls( LDAP *ld, + LDAPControl **serverctrls, + LDAPControl **clientctrls, + int *msgidp ) +{ + return ldap_extended_operation( ld, LDAP_EXOP_START_TLS, + NULL, serverctrls, clientctrls, msgidp ); +} + +int +ldap_install_tls( LDAP *ld ) +{ +#ifndef HAVE_TLS + return LDAP_NOT_SUPPORTED; +#else + if ( ldap_tls_inplace( ld ) ) { + return LDAP_LOCAL_ERROR; + } + + return ldap_int_tls_start( ld, ld->ld_defconn, NULL ); +#endif +} + int ldap_start_tls_s ( LDAP *ld, LDAPControl **serverctrls, LDAPControl **clientctrls ) { +#ifndef HAVE_TLS + return LDAP_NOT_SUPPORTED; +#else int rc; - -#ifdef HAVE_TLS char *rspoid = NULL; struct berval *rspdata = NULL; /* XXYYZ: this initiates operation only on default connection! */ - if ( ld->ld_sb != NULL && ldap_pvt_tls_inplace( ld->ld_sb ) != 0 ) { + if ( ldap_tls_inplace( ld ) ) { return LDAP_LOCAL_ERROR; } @@ -1618,9 +1897,7 @@ ldap_start_tls_s ( LDAP *ld, rc = ldap_int_tls_start( ld, ld->ld_defconn, NULL ); } -#else - rc = LDAP_NOT_SUPPORTED; -#endif return rc; +#endif }