X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=libraries%2Flibldap%2Ftls.c;h=5e43f8aeb6ae26c1267b066588b04e6a9518d041;hb=refs%2Fheads%2FOPENLDAP_AC;hp=237708ab0d7be2e1de11b9b48fb5a17b26ee8c02;hpb=553d80cedd34fd6f97c0c6e486400862a44ee7f2;p=openldap diff --git a/libraries/libldap/tls.c b/libraries/libldap/tls.c index 237708ab0d..5e43f8aeb6 100644 --- a/libraries/libldap/tls.c +++ b/libraries/libldap/tls.c @@ -1,12 +1,21 @@ +/* tls.c - Handle tls/ssl using SSLeay or OpenSSL. */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2005 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. * - * tls.c - Handle tls/ssl using SSLeay or OpenSSL. + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . */ #include "portable.h" +#include "ldap_config.h" #include @@ -14,9 +23,11 @@ #include #include #include +#include #include #include #include +#include #include "ldap-int.h" @@ -31,6 +42,7 @@ #include #include #include +#include #elif defined( HAVE_SSL_H ) #include #endif @@ -40,17 +52,21 @@ static char *tls_opt_certfile = NULL; static char *tls_opt_keyfile = NULL; static char *tls_opt_cacertfile = NULL; static char *tls_opt_cacertdir = NULL; -static int tls_opt_require_cert = 0; +static int tls_opt_require_cert = LDAP_OPT_X_TLS_DEMAND; +#ifdef HAVE_OPENSSL_CRL +static int tls_opt_crlcheck = LDAP_OPT_X_TLS_CRL_NONE; +#endif static char *tls_opt_ciphersuite = NULL; static char *tls_opt_randfile = NULL; #define HAS_TLS( sb ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \ - (void *)&ldap_pvt_sockbuf_io_tls ) + (void *)&sb_tls_sbio ) static void tls_report_error( void ); -static void tls_info_cb( SSL *ssl, int where, int ret ); +static void tls_info_cb( const SSL *ssl, int where, int ret ); static int tls_verify_cb( int ok, X509_STORE_CTX *ctx ); +static int tls_verify_ok( int ok, X509_STORE_CTX *ctx ); static RSA * tls_tmp_rsa_cb( SSL *ssl, int is_export, int key_length ); static STACK_OF(X509_NAME) * get_ca_list( char * bundle, char * dir ); @@ -97,6 +113,45 @@ static void tls_init_threads( void ) } #endif /* LDAP_R_COMPILE */ +/* + * Tear down the TLS subsystem. Should only be called once. + */ +void +ldap_pvt_tls_destroy( void ) +{ + SSL_CTX_free(tls_def_ctx); + tls_def_ctx = NULL; + + EVP_cleanup(); + ERR_remove_state(0); + ERR_free_strings(); + + if ( tls_opt_certfile ) { + LDAP_FREE( tls_opt_certfile ); + tls_opt_certfile = NULL; + } + if ( tls_opt_keyfile ) { + LDAP_FREE( tls_opt_keyfile ); + tls_opt_keyfile = NULL; + } + if ( tls_opt_cacertfile ) { + LDAP_FREE( tls_opt_cacertfile ); + tls_opt_cacertfile = NULL; + } + if ( tls_opt_cacertdir ) { + LDAP_FREE( tls_opt_cacertdir ); + tls_opt_cacertdir = NULL; + } + if ( tls_opt_ciphersuite ) { + LDAP_FREE( tls_opt_ciphersuite ); + tls_opt_ciphersuite = NULL; + } + if ( tls_opt_randfile ) { + LDAP_FREE( tls_opt_randfile ); + tls_opt_randfile = NULL; + } +} + /* * Initialize TLS subsystem. Should be called only once. */ @@ -105,10 +160,18 @@ ldap_pvt_tls_init( void ) { static int tls_initialized = 0; - if ( tls_initialized ) return 0; - tls_initialized = 1; + if ( tls_initialized++ ) return 0; +#ifdef HAVE_EBCDIC + { + char *file = LDAP_STRDUP( tls_opt_randfile ); + if ( file ) __atoe( file ); + (void) tls_seed_PRNG( file ); + LDAP_FREE( file ); + } +#else (void) tls_seed_PRNG( tls_opt_randfile ); +#endif #ifdef LDAP_R_COMPILE tls_init_threads(); @@ -129,101 +192,176 @@ int ldap_pvt_tls_init_def_ctx( void ) { STACK_OF(X509_NAME) *calist; + int rc = 0; + char *ciphersuite = tls_opt_ciphersuite; + char *cacertfile = tls_opt_cacertfile; + char *cacertdir = tls_opt_cacertdir; + char *certfile = tls_opt_certfile; + char *keyfile = tls_opt_keyfile; + +#ifdef HAVE_EBCDIC + /* This ASCII/EBCDIC handling is a real pain! */ + if ( ciphersuite ) { + ciphersuite = LDAP_STRDUP( ciphersuite ); + __atoe( ciphersuite ); + } + if ( cacertfile ) { + cacertfile = LDAP_STRDUP( cacertfile ); + __atoe( cacertfile ); + } + if ( cacertdir ) { + cacertdir = LDAP_STRDUP( cacertdir ); + __atoe( cacertdir ); + } + if ( certfile ) { + certfile = LDAP_STRDUP( certfile ); + __atoe( certfile ); + } + if ( keyfile ) { + keyfile = LDAP_STRDUP( keyfile ); + __atoe( keyfile ); + } +#endif #ifdef LDAP_R_COMPILE ldap_pvt_thread_mutex_lock( &tls_def_ctx_mutex ); #endif if ( tls_def_ctx == NULL ) { + int i; tls_def_ctx = SSL_CTX_new( SSLv23_method() ); if ( tls_def_ctx == NULL ) { Debug( LDAP_DEBUG_ANY, - "TLS: could not allocate default ctx (%d).\n", + "TLS: could not allocate default ctx (%lu).\n", ERR_peek_error(),0,0); + rc = -1; goto error_exit; } + + SSL_CTX_set_session_id_context( tls_def_ctx, + (const unsigned char *) "OpenLDAP", sizeof("OpenLDAP")-1 ); + if ( tls_opt_ciphersuite && - !SSL_CTX_set_cipher_list( tls_def_ctx, - tls_opt_ciphersuite ) ) { + !SSL_CTX_set_cipher_list( tls_def_ctx, ciphersuite ) ) + { Debug( LDAP_DEBUG_ANY, - "TLS: could not set cipher list %s.\n", - tls_opt_ciphersuite, 0, 0 ); + "TLS: could not set cipher list %s.\n", + tls_opt_ciphersuite, 0, 0 ); tls_report_error(); + rc = -1; goto error_exit; } + if (tls_opt_cacertfile != NULL || tls_opt_cacertdir != NULL) { if ( !SSL_CTX_load_verify_locations( tls_def_ctx, - tls_opt_cacertfile, - tls_opt_cacertdir ) - || !SSL_CTX_set_default_verify_paths( tls_def_ctx ) ) + cacertfile, cacertdir ) || + !SSL_CTX_set_default_verify_paths( tls_def_ctx ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not load verify locations (file:`%s',dir:`%s').\n", - tls_opt_cacertfile,tls_opt_cacertdir,0); + Debug( LDAP_DEBUG_ANY, "TLS: " + "could not load verify locations (file:`%s',dir:`%s').\n", + tls_opt_cacertfile ? tls_opt_cacertfile : "", + tls_opt_cacertdir ? tls_opt_cacertdir : "", + 0 ); tls_report_error(); + rc = -1; goto error_exit; } - calist = get_ca_list( tls_opt_cacertfile, tls_opt_cacertdir ); + + calist = get_ca_list( cacertfile, cacertdir ); if ( !calist ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not load client CA list (file:`%s',dir:`%s').\n", - tls_opt_cacertfile,tls_opt_cacertdir,0); + Debug( LDAP_DEBUG_ANY, "TLS: " + "could not load client CA list (file:`%s',dir:`%s').\n", + tls_opt_cacertfile ? tls_opt_cacertfile : "", + tls_opt_cacertdir ? tls_opt_cacertdir : "", + 0 ); tls_report_error(); + rc = -1; goto error_exit; } + SSL_CTX_set_client_CA_list( tls_def_ctx, calist ); } + if ( tls_opt_keyfile && - !SSL_CTX_use_PrivateKey_file( tls_def_ctx, - tls_opt_keyfile, - SSL_FILETYPE_PEM ) ) { + !SSL_CTX_use_PrivateKey_file( tls_def_ctx, + keyfile, SSL_FILETYPE_PEM ) ) + { Debug( LDAP_DEBUG_ANY, - "TLS: could not use key file `%s'.\n", - tls_opt_keyfile,0,0); + "TLS: could not use key file `%s'.\n", + tls_opt_keyfile,0,0); tls_report_error(); + rc = -1; goto error_exit; } + if ( tls_opt_certfile && - !SSL_CTX_use_certificate_file( tls_def_ctx, - tls_opt_certfile, - SSL_FILETYPE_PEM ) ) { + !SSL_CTX_use_certificate_file( tls_def_ctx, + certfile, SSL_FILETYPE_PEM ) ) + { Debug( LDAP_DEBUG_ANY, - "TLS: could not use certificate `%s'.\n", - tls_opt_certfile,0,0); + "TLS: could not use certificate `%s'.\n", + tls_opt_certfile,0,0); tls_report_error(); + rc = -1; goto error_exit; } + if ( ( tls_opt_certfile || tls_opt_keyfile ) && - !SSL_CTX_check_private_key( tls_def_ctx ) ) { + !SSL_CTX_check_private_key( tls_def_ctx ) ) + { Debug( LDAP_DEBUG_ANY, - "TLS: private key mismatch.\n", - 0,0,0); + "TLS: private key mismatch.\n", + 0,0,0); tls_report_error(); + rc = -1; goto error_exit; } + if ( tls_opt_trace ) { SSL_CTX_set_info_callback( tls_def_ctx, tls_info_cb ); } - SSL_CTX_set_verify( tls_def_ctx, - tls_opt_require_cert ? - (SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT) : - SSL_VERIFY_NONE, - tls_verify_cb ); + + i = SSL_VERIFY_NONE; + if ( tls_opt_require_cert ) { + i = SSL_VERIFY_PEER; + if ( tls_opt_require_cert == LDAP_OPT_X_TLS_DEMAND || + tls_opt_require_cert == LDAP_OPT_X_TLS_HARD ) { + i |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; + } + } + + SSL_CTX_set_verify( tls_def_ctx, i, + tls_opt_require_cert == LDAP_OPT_X_TLS_ALLOW ? + tls_verify_ok : tls_verify_cb ); SSL_CTX_set_tmp_rsa_callback( tls_def_ctx, tls_tmp_rsa_cb ); /* SSL_CTX_set_tmp_dh_callback( tls_def_ctx, tls_tmp_dh_cb ); */ - } -#ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); +#ifdef HAVE_OPENSSL_CRL + if ( tls_opt_crlcheck ) { + X509_STORE *x509_s = SSL_CTX_get_cert_store( tls_def_ctx ); + if ( tls_opt_crlcheck == LDAP_OPT_X_TLS_CRL_PEER ) { + X509_STORE_set_flags( x509_s, X509_V_FLAG_CRL_CHECK ); + } else if ( tls_opt_crlcheck == LDAP_OPT_X_TLS_CRL_ALL ) { + X509_STORE_set_flags( x509_s, + X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL ); + } + } #endif - return 0; + } error_exit: - if ( tls_def_ctx != NULL ) { + if ( rc == -1 && tls_def_ctx != NULL ) { SSL_CTX_free( tls_def_ctx ); tls_def_ctx = NULL; } +#ifdef HAVE_EBCDIC + LDAP_FREE( ciphersuite ); + LDAP_FREE( cacertfile ); + LDAP_FREE( cacertdir ); + LDAP_FREE( certfile ); + LDAP_FREE( keyfile ); +#endif #ifdef LDAP_R_COMPILE ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); #endif - return -1; + return rc; } static STACK_OF(X509_NAME) * @@ -234,10 +372,21 @@ get_ca_list( char * bundle, char * dir ) if ( bundle ) { ca_list = SSL_load_client_CA_file( bundle ); } - /* - * FIXME: We have now to go over all files in dir, load them - * and add every certificate there to ca_list. - */ +#if defined(HAVE_DIRENT_H) || defined(dirent) + if ( dir ) { + int freeit = 0; + + if ( !ca_list ) { + ca_list = sk_X509_NAME_new_null(); + freeit = 1; + } + if ( !SSL_add_dir_cert_subjects_to_stack( ca_list, dir ) && + freeit ) { + sk_X509_NAME_free( ca_list ); + ca_list = NULL; + } + } +#endif return ca_list; } @@ -269,17 +418,17 @@ update_flags( Sockbuf *sb, SSL * ssl, int rc ) sb->sb_trans_needs_read = 0; sb->sb_trans_needs_write = 0; - if (err == SSL_ERROR_WANT_READ) - { - sb->sb_trans_needs_read = 1; - return 1; - } else if (err == SSL_ERROR_WANT_WRITE) - { - sb->sb_trans_needs_write = 1; - return 1; - } else if (err == SSL_ERROR_WANT_CONNECT) - { - return 1; + + if (err == SSL_ERROR_WANT_READ) { + sb->sb_trans_needs_read = 1; + return 1; + + } else if (err == SSL_ERROR_WANT_WRITE) { + sb->sb_trans_needs_write = 1; + return 1; + + } else if (err == SSL_ERROR_WANT_CONNECT) { + return 1; } return 0; } @@ -293,7 +442,7 @@ struct tls_data { Sockbuf_IO_Desc *sbiod; }; -extern BIO_METHOD ldap_pvt_sb_bio_method; +static BIO_METHOD sb_tls_bio_method; static int sb_tls_setup( Sockbuf_IO_Desc *sbiod, void *arg ) @@ -304,12 +453,13 @@ sb_tls_setup( Sockbuf_IO_Desc *sbiod, void *arg ) assert( sbiod != NULL ); p = LBER_MALLOC( sizeof( *p ) ); - if ( p == NULL ) + if ( p == NULL ) { return -1; + } p->ssl = (SSL *)arg; p->sbiod = sbiod; - bio = BIO_new( &ldap_pvt_sb_bio_method ); + bio = BIO_new( &sb_tls_bio_method ); bio->ptr = (void *)p; SSL_set_bio( p->ssl, bio, bio ); sbiod->sbiod_pvt = p; @@ -386,9 +536,7 @@ sb_tls_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len) err = SSL_get_error( p->ssl, ret ); if (err == SSL_ERROR_WANT_READ ) { sbiod->sbiod_sb->sb_trans_needs_read = 1; -#ifdef WIN32 errno = EWOULDBLOCK; -#endif } else sbiod->sbiod_sb->sb_trans_needs_read = 0; @@ -414,16 +562,15 @@ sb_tls_write( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len) err = SSL_get_error( p->ssl, ret ); if (err == SSL_ERROR_WANT_WRITE ) { sbiod->sbiod_sb->sb_trans_needs_write = 1; -#ifdef WIN32 errno = EWOULDBLOCK; -#endif - } - else + + } else { sbiod->sbiod_sb->sb_trans_needs_write = 0; + } return ret; } -Sockbuf_IO ldap_pvt_sockbuf_io_tls = +static Sockbuf_IO sb_tls_sbio = { sb_tls_setup, /* sbi_setup */ sb_tls_remove, /* sbi_remove */ @@ -445,8 +592,7 @@ sb_tls_bio_create( BIO *b ) { static int sb_tls_bio_destroy( BIO *b ) { - if ( b == NULL ) - return 0; + if ( b == NULL ) return 0; b->ptr = NULL; /* sb_tls_remove() will free it */ b->init = 0; @@ -460,48 +606,56 @@ sb_tls_bio_read( BIO *b, char *buf, int len ) struct tls_data *p; int ret; - if ( buf == NULL || len <= 0 ) - return 0; + if ( buf == NULL || len <= 0 ) return 0; p = (struct tls_data *)b->ptr; - if ( p == NULL || p->sbiod == NULL ) + if ( p == NULL || p->sbiod == NULL ) { return 0; + } ret = LBER_SBIOD_READ_NEXT( p->sbiod, buf, len ); BIO_clear_retry_flags( b ); - if ( ret < 0 && errno == EWOULDBLOCK ) - BIO_set_retry_read( b ); + if ( ret < 0 ) { + int err = errno; + if ( err == EAGAIN || err == EWOULDBLOCK ) { + BIO_set_retry_read( b ); + } + } return ret; } static int -sb_tls_bio_write( BIO *b, char *buf, int len ) +sb_tls_bio_write( BIO *b, const char *buf, int len ) { struct tls_data *p; int ret; - if ( buf == NULL || len <= 0 ) - return 0; + if ( buf == NULL || len <= 0 ) return 0; p = (struct tls_data *)b->ptr; - if ( p == NULL || p->sbiod == NULL ) + if ( p == NULL || p->sbiod == NULL ) { return 0; + } - ret = LBER_SBIOD_WRITE_NEXT( p->sbiod, buf, len ); + ret = LBER_SBIOD_WRITE_NEXT( p->sbiod, (char *)buf, len ); BIO_clear_retry_flags( b ); - if ( ret < 0 && errno == EWOULDBLOCK ) - BIO_set_retry_write( b ); + if ( ret < 0 ) { + int err = errno; + if ( err == EAGAIN || err == EWOULDBLOCK ) { + BIO_set_retry_write( b ); + } + } return ret; } static long -sb_tls_bio_ctrl( BIO *b, int cmd, long num, char *ptr ) +sb_tls_bio_ctrl( BIO *b, int cmd, long num, void *ptr ) { if ( cmd == BIO_CTRL_FLUSH ) { /* The OpenSSL library needs this */ @@ -517,12 +671,12 @@ sb_tls_bio_gets( BIO *b, char *buf, int len ) } static int -sb_tls_bio_puts( BIO *b, char *str ) +sb_tls_bio_puts( BIO *b, const char *str ) { return sb_tls_bio_write( b, str, strlen( str ) ); } -BIO_METHOD ldap_pvt_sb_bio_method = +static BIO_METHOD sb_tls_bio_method = { ( 100 | 0x400 ), /* it's a source/sink BIO */ "sockbuf glue", @@ -559,6 +713,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); } else { + struct ldapoptions *lo; void *ctx = ld->ld_defconn ? ld->ld_defconn->lconn_tls_ctx : NULL; @@ -570,12 +725,19 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) ber_sockbuf_add_io( sb, &ber_sockbuf_io_debug, LBER_SBIOD_LEVEL_TRANSPORT, (void *)"tls_" ); #endif - ber_sockbuf_add_io( sb, &ldap_pvt_sockbuf_io_tls, + ber_sockbuf_add_io( sb, &sb_tls_sbio, LBER_SBIOD_LEVEL_TRANSPORT, (void *)ssl ); if( ctx == NULL ) { + ctx = tls_def_ctx; conn->lconn_tls_ctx = tls_def_ctx; } + lo = &ld->ld_options; + if ( lo->ldo_tls_connect_cb ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + lo = LDAP_INT_GLOBAL_OPT(); + if ( lo && lo->ldo_tls_connect_cb ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); } err = SSL_connect( ssl ); @@ -583,16 +745,23 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) #ifdef HAVE_WINSOCK errno = WSAGetLastError(); #endif + if ( err <= 0 ) { if ( update_flags( sb, ssl, err )) { return 1; } + if ((err = ERR_peek_error())) { char buf[256]; ld->ld_error = LDAP_STRDUP(ERR_error_string(err, buf)); +#ifdef HAVE_EBCDIC + if ( ld->ld_error ) __etoa(ld->ld_error); +#endif } + Debug( LDAP_DEBUG_ANY,"TLS: can't connect.\n",0,0,0); - ber_sockbuf_remove_io( sb, &ldap_pvt_sockbuf_io_tls, + + ber_sockbuf_remove_io( sb, &sb_tls_sbio, LBER_SBIOD_LEVEL_TRANSPORT ); #ifdef LDAP_DEBUG ber_sockbuf_remove_io( sb, &ber_sockbuf_io_debug, @@ -616,15 +785,16 @@ ldap_pvt_tls_accept( Sockbuf *sb, void *ctx_arg ) if ( HAS_TLS( sb ) ) { ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); + } else { ssl = alloc_handle( ctx_arg ); - if ( ssl == NULL ) - return -1; + if ( ssl == NULL ) return -1; + #ifdef LDAP_DEBUG ber_sockbuf_add_io( sb, &ber_sockbuf_io_debug, LBER_SBIOD_LEVEL_TRANSPORT, (void *)"tls_" ); #endif - ber_sockbuf_add_io( sb, &ldap_pvt_sockbuf_io_tls, + ber_sockbuf_add_io( sb, &sb_tls_sbio, LBER_SBIOD_LEVEL_TRANSPORT, (void *)ssl ); } @@ -634,11 +804,12 @@ ldap_pvt_tls_accept( Sockbuf *sb, void *ctx_arg ) errno = WSAGetLastError(); #endif if ( err <= 0 ) { - if ( update_flags( sb, ssl, err )) - return 1; + if ( update_flags( sb, ssl, err )) return 1; + Debug( LDAP_DEBUG_ANY,"TLS: can't accept.\n",0,0,0 ); + tls_report_error(); - ber_sockbuf_remove_io( sb, &ldap_pvt_sockbuf_io_tls, + ber_sockbuf_remove_io( sb, &sb_tls_sbio, LBER_SBIOD_LEVEL_TRANSPORT ); #ifdef LDAP_DEBUG ber_sockbuf_remove_io( sb, &ber_sockbuf_io_debug, @@ -653,70 +824,57 @@ ldap_pvt_tls_accept( Sockbuf *sb, void *ctx_arg ) int ldap_pvt_tls_inplace ( Sockbuf *sb ) { - if ( HAS_TLS( sb ) ) - return(1); - return(0); + return HAS_TLS( sb ) ? 1 : 0; } -void * -ldap_pvt_tls_sb_ctx( Sockbuf *sb ) +int +ldap_tls_inplace( LDAP *ld ) { - void *p; - - if (HAS_TLS( sb )) { - ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&p ); - return p; - } + Sockbuf *sb = NULL; - return NULL; -} + if ( ld->ld_defconn && ld->ld_defconn->lconn_sb ) { + sb = ld->ld_defconn->lconn_sb; -int -ldap_pvt_tls_get_strength( void *s ) -{ - SSL_CIPHER *c; + } else if ( ld->ld_sb ) { + sb = ld->ld_sb; - c = SSL_get_current_cipher((SSL *)s); - return SSL_CIPHER_get_bits(c, NULL); -} + } else { + return 0; + } + return ldap_pvt_tls_inplace( sb ); +} -char * -ldap_pvt_tls_get_peer( void *s ) +static X509 * +tls_get_cert( SSL *s ) { - X509 *x; - X509_NAME *xn; - char buf[2048], *p; - - x = SSL_get_peer_certificate((SSL *)s); - - if (!x) - return NULL; - - xn = X509_get_subject_name(x); - p = LDAP_STRDUP(X509_NAME_oneline(xn, buf, sizeof(buf))); - X509_free(x); - return p; + /* If peer cert was bad, treat as if no cert was given */ + if (SSL_get_verify_result(s)) { + /* If we can send an alert, do so */ + if (SSL_version(s) != SSL2_VERSION) { + ssl3_send_alert(s,SSL3_AL_WARNING,SSL3_AD_BAD_CERTIFICATE); + } + return NULL; + } + return SSL_get_peer_certificate(s); } -char * -ldap_pvt_tls_get_peer_dn( void *s ) +int +ldap_pvt_tls_get_peer_dn( void *s, struct berval *dn, + LDAPDN_rewrite_dummy *func, unsigned flags ) { X509 *x; X509_NAME *xn; - char buf[2048], *p, *dn; + int rc; - x = SSL_get_peer_certificate((SSL *)s); + x = tls_get_cert((SSL *)s); - if (!x) return NULL; - + if (!x) return LDAP_INVALID_CREDENTIALS; + xn = X509_get_subject_name(x); - p = X509_NAME_oneline(xn, buf, sizeof(buf)); - - dn = ldap_dcedn2dn( p ); - + rc = ldap_X509dn2bv(xn, dn, (LDAPDN_rewrite_func *)func, flags); X509_free(x); - return dn; + return rc; } char * @@ -727,10 +885,8 @@ ldap_pvt_tls_get_peer_hostname( void *s ) char buf[2048], *p; int ret; - x = SSL_get_peer_certificate((SSL *)s); - - if (!x) - return NULL; + x = tls_get_cert((SSL *)s); + if (!x) return NULL; xn = X509_get_subject_name(x); @@ -745,113 +901,196 @@ ldap_pvt_tls_get_peer_hostname( void *s ) return p; } +/* what kind of hostname were we given? */ +#define IS_DNS 0 +#define IS_IP4 1 +#define IS_IP6 2 + int -ldap_pvt_tls_check_hostname( void *s, char *name ) +ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) { - int i, ret = LDAP_LOCAL_ERROR; - X509 *x; - - x = SSL_get_peer_certificate((SSL *)s); - if (!x) - { - Debug( LDAP_DEBUG_ANY, - "TLS: unable to get peer certificate.\n", - 0, 0, 0 ); - return ret; - } - - i = X509_get_ext_by_NID(x, NID_subject_alt_name, -1); - if (i >= 0) - { - X509_EXTENSION *ex; - STACK_OF(GENERAL_NAME) *alt; + int i, ret = LDAP_LOCAL_ERROR; + X509 *x; + const char *name; + char *ptr; + int ntype = IS_DNS; +#ifdef LDAP_PF_INET6 + struct in6_addr addr; +#else + struct in_addr addr; +#endif - ex = X509_get_ext(x, i); - alt = X509V3_EXT_d2i(ex); - if (alt) + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) { - int n, len1, len2; - char *domain; - GENERAL_NAME *gn; - X509V3_EXT_METHOD *method; - - len1 = strlen(name); - n = sk_GENERAL_NAME_num(alt); - domain = strchr(name, '.'); - if (domain) - len2 = len1 - (domain-name); - for (i=0; itype == GEN_DNS) - { - char *sn = ASN1_STRING_data(gn->d.ia5); - int sl = ASN1_STRING_length(gn->d.ia5); + name = ldap_int_hostname; + } else { + name = name_in; + } + + x = tls_get_cert((SSL *)s); + if (!x) { + Debug( LDAP_DEBUG_ANY, + "TLS: unable to get peer certificate.\n", + 0, 0, 0 ); + /* If this was a fatal condition, things would have + * aborted long before now. + */ + return LDAP_SUCCESS; + } - /* Is this an exact match? */ - if ((len1 == sl) && !strncasecmp(name, sn, len1)) - break; +#ifdef LDAP_PF_INET6 + if (name[0] == '[' && strchr(name, ']')) { + char *n2 = ldap_strdup(name+1); + *strchr(n2, ']') = 2; + if (inet_pton(AF_INET6, n2, &addr)) + ntype = IS_IP6; + LDAP_FREE(n2); + } else +#endif + if ((ptr = strrchr(name, '.')) && isdigit((unsigned char)ptr[1])) { + if (inet_aton(name, (struct in_addr *)&addr)) ntype = IS_IP4; + } + + i = X509_get_ext_by_NID(x, NID_subject_alt_name, -1); + if (i >= 0) { + X509_EXTENSION *ex; + STACK_OF(GENERAL_NAME) *alt; + + ex = X509_get_ext(x, i); + alt = X509V3_EXT_d2i(ex); + if (alt) { + int n, len1 = 0, len2 = 0; + char *domain = NULL; + GENERAL_NAME *gn; + + if (ntype == IS_DNS) { + len1 = strlen(name); + domain = strchr(name, '.'); + if (domain) { + len2 = len1 - (domain-name); + } + } + n = sk_GENERAL_NAME_num(alt); + for (i=0; itype == GEN_DNS) { + if (ntype != IS_DNS) continue; + + sn = (char *) ASN1_STRING_data(gn->d.ia5); + sl = ASN1_STRING_length(gn->d.ia5); + + /* ignore empty */ + if (sl == 0) continue; + + /* Is this an exact match? */ + if ((len1 == sl) && !strncasecmp(name, sn, len1)) { + break; + } + + /* Is this a wildcard match? */ + if (domain && (sn[0] == '*') && (sn[1] == '.') && + (len2 == sl-1) && !strncasecmp(domain, &sn[1], len2)) + { + break; + } + + } else if (gn->type == GEN_IPADD) { + if (ntype == IS_DNS) continue; + + sn = (char *) ASN1_STRING_data(gn->d.ia5); + sl = ASN1_STRING_length(gn->d.ia5); + +#ifdef LDAP_PF_INET6 + if (ntype == IS_IP6 && sl != sizeof(struct in6_addr)) { + continue; + } else +#endif + if (ntype == IS_IP4 && sl != sizeof(struct in_addr)) { + continue; + } + if (!memcmp(sn, &addr, sl)) { + break; + } + } + } - /* Is this a wildcard match? */ - if ((*sn == '*') && domain && (len2 == sl-1) && - !strncasecmp(domain, sn+1, len2)) - break; + GENERAL_NAMES_free(alt); + if (i < n) { /* Found a match */ + ret = LDAP_SUCCESS; + } } - } - method = X509V3_EXT_get(ex); - method->ext_free(alt); - if (i < n) /* Found a match */ - ret = LDAP_SUCCESS; } - } - if (ret != LDAP_SUCCESS) - { - X509_NAME *xn; - char buf[2048]; + if (ret != LDAP_SUCCESS) { + X509_NAME *xn; + char buf[2048]; + buf[0] = '\0'; - xn = X509_get_subject_name(x); + xn = X509_get_subject_name(x); + if( X509_NAME_get_text_by_NID( xn, NID_commonName, + buf, sizeof(buf)) == -1) + { + Debug( LDAP_DEBUG_ANY, + "TLS: unable to get common name from peer certificate.\n", + 0, 0, 0 ); + ret = LDAP_CONNECT_ERROR; + ld->ld_error = LDAP_STRDUP( + _("TLS: unable to get CN from peer certificate")); + + } else if (strcasecmp(name, buf) == 0 ) { + ret = LDAP_SUCCESS; + + } else if (( buf[0] == '*' ) && ( buf[1] == '.' )) { + char *domain = strchr(name, '.'); + if( domain ) { + size_t dlen = 0; + size_t sl; + + sl = strlen(name); + dlen = sl - (domain-name); + sl = strlen(buf); + + /* Is this a wildcard match? */ + if ((dlen == sl-1) && !strncasecmp(domain, &buf[1], dlen)) { + ret = LDAP_SUCCESS; + } + } + } - if (X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)) - == -1) - { - Debug( LDAP_DEBUG_ANY, - "TLS: unable to get common name from peer certificate.\n", - 0, 0, 0 ); - } else if (strcasecmp(name, buf)) - { - Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " - "common name in certificate (%s).\n", - name, buf, 0 ); - ret = LDAP_CONNECT_ERROR; - } else - { - ret = LDAP_SUCCESS; + if( ret == LDAP_LOCAL_ERROR ) { + Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " + "common name in certificate (%s).\n", + name, buf, 0 ); + ret = LDAP_CONNECT_ERROR; + ld->ld_error = LDAP_STRDUP( + _("TLS: hostname does not match CN in peer certificate")); + } } - } - X509_free(x); - return ret; + X509_free(x); + return ret; } const char * ldap_pvt_tls_get_peer_issuer( void *s ) { -#if 0 /* currently unused; see ldap_pvt_tls_get_peer() if needed */ - X509 *x; - X509_NAME *xn; - char buf[2048], *p; - - x = SSL_get_peer_certificate((SSL *)s); - - if (!x) - return NULL; - - xn = X509_get_issuer_name(x); - p = LDAP_STRDUP(X509_NAME_oneline(xn, buf, sizeof(buf))); - X509_free(x); - return p; +#if 0 /* currently unused; see ldap_pvt_tls_get_peer_dn() if needed */ + X509 *x; + X509_NAME *xn; + char buf[2048], *p; + + x = SSL_get_peer_certificate((SSL *)s); + + if (!x) return NULL; + + xn = X509_get_issuer_name(x); + p = LDAP_STRDUP(X509_NAME_oneline(xn, buf, sizeof(buf))); + X509_free(x); + return p; #else - return NULL; + return NULL; #endif } @@ -866,33 +1105,52 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) case LDAP_OPT_X_TLS_CERTFILE: case LDAP_OPT_X_TLS_KEYFILE: case LDAP_OPT_X_TLS_RANDOM_FILE: + case LDAP_OPT_X_TLS_CIPHER_SUITE: return ldap_pvt_tls_set_option( ld, option, (void *) arg ); case LDAP_OPT_X_TLS_REQUIRE_CERT: - i = ( ( strcasecmp( arg, "on" ) == 0 ) || - ( strcasecmp( arg, "yes" ) == 0) || - ( strcasecmp( arg, "true" ) == 0 ) ); - return ldap_pvt_tls_set_option( ld, option, (void *) &i ); - case LDAP_OPT_X_TLS: i = -1; - if ( strcasecmp( arg, "never" ) == 0 ) + if ( strcasecmp( arg, "never" ) == 0 ) { i = LDAP_OPT_X_TLS_NEVER ; - if ( strcasecmp( arg, "demand" ) == 0 ) + + } else if ( strcasecmp( arg, "demand" ) == 0 ) { i = LDAP_OPT_X_TLS_DEMAND ; - if ( strcasecmp( arg, "allow" ) == 0 ) + + } else if ( strcasecmp( arg, "allow" ) == 0 ) { i = LDAP_OPT_X_TLS_ALLOW ; - if ( strcasecmp( arg, "try" ) == 0 ) + + } else if ( strcasecmp( arg, "try" ) == 0 ) { i = LDAP_OPT_X_TLS_TRY ; - if ( strcasecmp( arg, "hard" ) == 0 ) + + } else if ( ( strcasecmp( arg, "hard" ) == 0 ) || + ( strcasecmp( arg, "on" ) == 0 ) || + ( strcasecmp( arg, "yes" ) == 0) || + ( strcasecmp( arg, "true" ) == 0 ) ) + { i = LDAP_OPT_X_TLS_HARD ; + } if (i >= 0) { return ldap_pvt_tls_set_option( ld, option, &i ); } return -1; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + i = -1; + if ( strcasecmp( arg, "none" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_NONE ; + } else if ( strcasecmp( arg, "peer" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_PEER ; + } else if ( strcasecmp( arg, "all" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_ALL ; + } + if (i >= 0) { + return ldap_pvt_tls_set_option( ld, option, &i ); + } + return -1; +#endif } - return -1; } @@ -923,10 +1181,11 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) *(int *)arg = lo->ldo_tls_mode; break; case LDAP_OPT_X_TLS_CTX: - if ( ld == NULL ) + if ( ld == NULL ) { *(void **)arg = (void *) tls_def_ctx; - else + } else { *(void **)arg = ld->ld_defconn->lconn_tls_ctx; + } break; case LDAP_OPT_X_TLS_CACERTFILE: *(char **)arg = tls_opt_cacertfile ? @@ -947,8 +1206,32 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) case LDAP_OPT_X_TLS_REQUIRE_CERT: *(int *)arg = tls_opt_require_cert; break; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + *(int *)arg = tls_opt_crlcheck; + break; +#endif case LDAP_OPT_X_TLS_RANDOM_FILE: - *(char **)arg = tls_opt_randfile; + *(char **)arg = tls_opt_randfile ? + LDAP_STRDUP( tls_opt_randfile ) : NULL; + break; + case LDAP_OPT_X_TLS_SSL_CTX: { + void *retval = 0; + if ( ld != NULL ) { + LDAPConn *conn = ld->ld_defconn; + if ( conn != NULL ) { + Sockbuf *sb = conn->lconn_sb; + retval = ldap_pvt_tls_sb_ctx( sb ); + } + } + *(void **)arg = retval; + break; + } + case LDAP_OPT_X_TLS_CONNECT_CB: + *(LDAP_TLS_CONNECT_CB **)arg = lo->ldo_tls_connect_cb; + break; + case LDAP_OPT_X_TLS_CONNECT_ARG: + *(void **)arg = lo->ldo_tls_connect_arg; break; default: return -1; @@ -1002,6 +1285,12 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) ld->ld_defconn->lconn_tls_ctx = arg; } return 0; + case LDAP_OPT_X_TLS_CONNECT_CB: + lo->ldo_tls_connect_cb = (LDAP_TLS_CONNECT_CB *)arg; + return 0; + case LDAP_OPT_X_TLS_CONNECT_ARG: + lo->ldo_tls_connect_arg = arg; + return 0; } if ( ld != NULL ) { @@ -1026,8 +1315,27 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) tls_opt_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; break; case LDAP_OPT_X_TLS_REQUIRE_CERT: - tls_opt_require_cert = * (int *) arg; - break; + switch( *(int *) arg ) { + case LDAP_OPT_X_TLS_NEVER: + case LDAP_OPT_X_TLS_DEMAND: + case LDAP_OPT_X_TLS_ALLOW: + case LDAP_OPT_X_TLS_TRY: + case LDAP_OPT_X_TLS_HARD: + tls_opt_require_cert = * (int *) arg; + return 0; + } + return -1; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + switch( *(int *) arg ) { + case LDAP_OPT_X_TLS_CRL_NONE: + case LDAP_OPT_X_TLS_CRL_PEER: + case LDAP_OPT_X_TLS_CRL_ALL: + tls_opt_crlcheck = * (int *) arg; + return 0; + } + return -1; +#endif case LDAP_OPT_X_TLS_CIPHER_SUITE: if ( tls_opt_ciphersuite ) LDAP_FREE( tls_opt_ciphersuite ); tls_opt_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL; @@ -1046,7 +1354,6 @@ int ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) { Sockbuf *sb = conn->lconn_sb; - /* void *ctx = ld->ld_defconn->lconn_tls_ctx; */ char *host; void *ssl; @@ -1056,6 +1363,11 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) host = conn->lconn_server->lud_host; } + /* avoid NULL host */ + if( host == NULL ) { + host = "localhost"; + } + (void) ldap_pvt_tls_init(); /* @@ -1066,31 +1378,17 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) return (ld->ld_errno); } - ssl = (void *) ldap_pvt_tls_sb_ctx( sb ); + ssl = ldap_pvt_tls_sb_ctx( sb ); assert( ssl != NULL ); /* - * compare host with name(s) in certificate - */ - - ld->ld_errno = ldap_pvt_tls_check_hostname( ssl, host ); - if (ld->ld_errno != LDAP_SUCCESS) - { - return ld->ld_errno; - } - - /* - * set SASL properties to TLS ssf and authid + * compare host with name(s) in certificate */ - { - const char *authid; - ber_len_t ssf; - - /* we need to let SASL know */ - ssf = ldap_pvt_tls_get_strength( ssl ); - authid = ldap_pvt_tls_get_peer( ssl ); - - (void) ldap_int_sasl_external( ld, conn, authid, ssf ); + if (tls_opt_require_cert != LDAP_OPT_X_TLS_NEVER) { + ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host ); + if (ld->ld_errno != LDAP_SUCCESS) { + return ld->ld_errno; + } } return LDAP_SUCCESS; @@ -1098,10 +1396,11 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) /* Derived from openssl/apps/s_cb.c */ static void -tls_info_cb( SSL *ssl, int where, int ret ) +tls_info_cb( const SSL *ssl, int where, int ret ) { int w; char *op; + char *state = (char *) SSL_state_string_long( (SSL *)ssl ); w = where & ~SSL_ST_MASK; if ( w & SSL_ST_CONNECT ) { @@ -1112,28 +1411,52 @@ tls_info_cb( SSL *ssl, int where, int ret ) op = "undefined"; } - if ( where & SSL_CB_LOOP ) { +#ifdef HAVE_EBCDIC + if ( state ) { + state = LDAP_STRDUP( state ); + __etoa( state ); + } +#endif + if ( where & SSL_CB_LOOP ) { Debug( LDAP_DEBUG_TRACE, - "TLS trace: %s:%s\n", - op, SSL_state_string_long( ssl ), 0 ); + "TLS trace: %s:%s\n", + op, state, 0 ); + } else if ( where & SSL_CB_ALERT ) { - op = ( where & SSL_CB_READ ) ? "read" : "write"; + char *atype = (char *) SSL_alert_type_string_long( ret ); + char *adesc = (char *) SSL_alert_desc_string_long( ret ); + op = ( where & SSL_CB_READ ) ? "read" : "write"; +#ifdef HAVE_EBCDIC + if ( atype ) { + atype = LDAP_STRDUP( atype ); + __etoa( atype ); + } + if ( adesc ) { + adesc = LDAP_STRDUP( adesc ); + __etoa( adesc ); + } +#endif Debug( LDAP_DEBUG_TRACE, - "TLS trace: SSL3 alert %s:%s:%s\n", - op, - SSL_alert_type_string_long( ret ), - SSL_alert_desc_string_long( ret) ); + "TLS trace: SSL3 alert %s:%s:%s\n", + op, atype, adesc ); +#ifdef HAVE_EBCDIC + if ( atype ) LDAP_FREE( atype ); + if ( adesc ) LDAP_FREE( adesc ); +#endif } else if ( where & SSL_CB_EXIT ) { - if ( ret == 0 ) { + if ( ret == 0 ) { Debug( LDAP_DEBUG_TRACE, - "TLS trace: %s:failed in %s\n", - op, SSL_state_string_long( ssl ), 0 ); - } else if ( ret < 0 ) { + "TLS trace: %s:failed in %s\n", + op, state, 0 ); + } else if ( ret < 0 ) { Debug( LDAP_DEBUG_TRACE, - "TLS trace: %s:error in %s\n", - op, SSL_state_string_long( ssl ), 0 ); + "TLS trace: %s:error in %s\n", + op, state, 0 ); } } +#ifdef HAVE_EBCDIC + if ( state ) LDAP_FREE( state ); +#endif } static int @@ -1146,6 +1469,7 @@ tls_verify_cb( int ok, X509_STORE_CTX *ctx ) X509_NAME *issuer; char *sname; char *iname; + char *certerr = NULL; cert = X509_STORE_CTX_get_current_cert( ctx ); errnum = X509_STORE_CTX_get_error( ctx ); @@ -1160,32 +1484,66 @@ tls_verify_cb( int ok, X509_STORE_CTX *ctx ) /* X509_NAME_oneline, if passed a NULL buf, allocate memomry */ sname = X509_NAME_oneline( subject, NULL, 0 ); iname = X509_NAME_oneline( issuer, NULL, 0 ); + if ( !ok ) certerr = (char *)X509_verify_cert_error_string( errnum ); +#ifdef HAVE_EBCDIC + if ( sname ) __etoa( sname ); + if ( iname ) __etoa( iname ); + if ( certerr ) { + certerr = LDAP_STRDUP( certerr ); + __etoa( certerr ); + } +#endif Debug( LDAP_DEBUG_TRACE, - "TLS certificate verification: depth: %d, subject: %s, issuer: %s\n", - errdepth, - sname ? sname : "-unknown-", - iname ? iname : "-unknown-" ); + "TLS certificate verification: depth: %d, err: %d, subject: %s,", + errdepth, errnum, + sname ? sname : "-unknown-" ); + Debug( LDAP_DEBUG_TRACE, " issuer: %s\n", iname ? iname : "-unknown-", 0, 0 ); + if ( !ok ) { + Debug( LDAP_DEBUG_ANY, + "TLS certificate verification: Error, %s\n", + certerr, 0, 0 ); + } if ( sname ) CRYPTO_free ( sname ); if ( iname ) CRYPTO_free ( iname ); - +#ifdef HAVE_EBCDIC + if ( certerr ) LDAP_FREE( certerr ); +#endif return ok; } +static int +tls_verify_ok( int ok, X509_STORE_CTX *ctx ) +{ + (void) tls_verify_cb( ok, ctx ); + return 1; +} + /* Inspired by ERR_print_errors in OpenSSL */ static void tls_report_error( void ) { - unsigned long l; - char buf[200]; - const char *file; - int line; - - while ( ( l = ERR_get_error_line( &file, &line ) ) != 0 ) { - Debug( LDAP_DEBUG_ANY, "TLS: %s %s:%d\n", - ERR_error_string( l, buf ), file, line ); - } + unsigned long l; + char buf[200]; + const char *file; + int line; + + while ( ( l = ERR_get_error_line( &file, &line ) ) != 0 ) { + ERR_error_string_n( l, buf, sizeof( buf ) ); +#ifdef HAVE_EBCDIC + if ( file ) { + file = LDAP_STRDUP( file ); + __etoa( (char *)file ); + } + __etoa( buf ); +#endif + Debug( LDAP_DEBUG_ANY, "TLS: %s %s:%d\n", + buf, file, line ); +#ifdef HAVE_EBCDIC + if ( file ) LDAP_FREE( (void *)file ); +#endif + } } static RSA * @@ -1217,7 +1575,7 @@ tls_seed_PRNG( const char *randfile ) if (randfile == NULL) { /* The seed file is $RANDFILE if defined, otherwise $HOME/.rnd. * If $HOME is not set or buffer too small to hold the pathname, - * an error occurs. - From RAND_file_name() man page. + * an error occurs. - From RAND_file_name() man page. * The fact is that when $HOME is NULL, .rnd is used. */ randfile = RAND_file_name( buffer, sizeof( buffer ) ); @@ -1262,28 +1620,99 @@ tls_tmp_dh_cb( SSL *ssl, int is_export, int key_length ) #endif #endif +void * +ldap_pvt_tls_sb_ctx( Sockbuf *sb ) +{ +#ifdef HAVE_TLS + void *p; + + if (HAS_TLS( sb )) { + ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&p ); + return p; + } +#endif + + return NULL; +} + +int +ldap_pvt_tls_get_strength( void *s ) +{ +#ifdef HAVE_TLS + SSL_CIPHER *c; + + c = SSL_get_current_cipher((SSL *)s); + return SSL_CIPHER_get_bits(c, NULL); +#else + return 0; +#endif +} + + +int +ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, unsigned flags ) +{ +#ifdef HAVE_TLS + X509 *x; + X509_NAME *xn; + int rc; + + x = SSL_get_certificate((SSL *)s); + + if (!x) return LDAP_INVALID_CREDENTIALS; + + xn = X509_get_subject_name(x); + rc = ldap_X509dn2bv(xn, dn, (LDAPDN_rewrite_func *)func, flags ); + return rc; +#else + return LDAP_NOT_SUPPORTED; +#endif +} + +int +ldap_start_tls( LDAP *ld, + LDAPControl **serverctrls, + LDAPControl **clientctrls, + int *msgidp ) +{ + return ldap_extended_operation( ld, LDAP_EXOP_START_TLS, + NULL, serverctrls, clientctrls, msgidp ); +} + +int +ldap_install_tls( LDAP *ld ) +{ +#ifndef HAVE_TLS + return LDAP_NOT_SUPPORTED; +#else + if ( ldap_tls_inplace( ld ) ) { + return LDAP_LOCAL_ERROR; + } + + return ldap_int_tls_start( ld, ld->ld_defconn, NULL ); +#endif +} + int ldap_start_tls_s ( LDAP *ld, LDAPControl **serverctrls, LDAPControl **clientctrls ) { +#ifndef HAVE_TLS + return LDAP_NOT_SUPPORTED; +#else int rc; - -#ifdef HAVE_TLS char *rspoid = NULL; struct berval *rspdata = NULL; /* XXYYZ: this initiates operation only on default connection! */ - if ( ldap_pvt_tls_inplace( ld->ld_sb ) != 0 ) { + if ( ldap_tls_inplace( ld ) ) { return LDAP_LOCAL_ERROR; } rc = ldap_extended_operation_s( ld, LDAP_EXOP_START_TLS, NULL, serverctrls, clientctrls, &rspoid, &rspdata ); - if ( rc != LDAP_SUCCESS ) { - return rc; - } if ( rspoid != NULL ) { LDAP_FREE(rspoid); @@ -1293,10 +1722,11 @@ ldap_start_tls_s ( LDAP *ld, ber_bvfree( rspdata ); } - rc = ldap_int_tls_start( ld, ld->ld_defconn, NULL ); -#else - rc = LDAP_NOT_SUPPORTED; -#endif + if ( rc == LDAP_SUCCESS ) { + rc = ldap_int_tls_start( ld, ld->ld_defconn, NULL ); + } + return rc; +#endif }