X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=libraries%2Flibldap%2Ftls.c;h=6774fed54d4ce76bea6e1523d828af5b4ce42880;hb=0ea43c9d7d2fbf08b2078931bebfcaf443230878;hp=19ad523acf3c45c5636b001f8ebdf8d196ceee8a;hpb=d82d018f2007222e78dced621a7647bc18ae7306;p=openldap diff --git a/libraries/libldap/tls.c b/libraries/libldap/tls.c index 19ad523acf..6774fed54d 100644 --- a/libraries/libldap/tls.c +++ b/libraries/libldap/tls.c @@ -1,12 +1,21 @@ +/* tls.c - Handle tls/ssl using SSLeay or OpenSSL. */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2005 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. * - * tls.c - Handle tls/ssl using SSLeay or OpenSSL. + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . */ #include "portable.h" +#include "ldap_config.h" #include @@ -14,9 +23,11 @@ #include #include #include +#include #include #include #include +#include #include "ldap-int.h" @@ -39,26 +50,29 @@ static int tls_opt_trace = 1; static char *tls_opt_certfile = NULL; static char *tls_opt_keyfile = NULL; +static char *tls_opt_dhparamdir = NULL; static char *tls_opt_cacertfile = NULL; static char *tls_opt_cacertdir = NULL; -static int tls_opt_require_cert = 0; +static int tls_opt_require_cert = LDAP_OPT_X_TLS_DEMAND; +#ifdef HAVE_OPENSSL_CRL +static int tls_opt_crlcheck = LDAP_OPT_X_TLS_CRL_NONE; +#endif static char *tls_opt_ciphersuite = NULL; static char *tls_opt_randfile = NULL; +static int tls_opt_dhparamdirlen; #define HAS_TLS( sb ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \ (void *)&sb_tls_sbio ) static void tls_report_error( void ); -static void tls_info_cb( SSL *ssl, int where, int ret ); +static void tls_info_cb( const SSL *ssl, int where, int ret ); static int tls_verify_cb( int ok, X509_STORE_CTX *ctx ); static int tls_verify_ok( int ok, X509_STORE_CTX *ctx ); static RSA * tls_tmp_rsa_cb( SSL *ssl, int is_export, int key_length ); static STACK_OF(X509_NAME) * get_ca_list( char * bundle, char * dir ); -#if 0 /* Currently this is not used by anyone */ static DH * tls_tmp_dh_cb( SSL *ssl, int is_export, int key_length ); -#endif static SSL_CTX *tls_def_ctx = NULL; @@ -109,6 +123,7 @@ ldap_pvt_tls_destroy( void ) tls_def_ctx = NULL; EVP_cleanup(); + ERR_remove_state(0); ERR_free_strings(); if ( tls_opt_certfile ) { @@ -119,6 +134,10 @@ ldap_pvt_tls_destroy( void ) LDAP_FREE( tls_opt_keyfile ); tls_opt_keyfile = NULL; } + if ( tls_opt_dhparamdir ) { + LDAP_FREE( tls_opt_dhparamdir ); + tls_opt_dhparamdir = NULL; + } if ( tls_opt_cacertfile ) { LDAP_FREE( tls_opt_cacertfile ); tls_opt_cacertfile = NULL; @@ -145,10 +164,18 @@ ldap_pvt_tls_init( void ) { static int tls_initialized = 0; - if ( tls_initialized ) return 0; - tls_initialized = 1; + if ( tls_initialized++ ) return 0; +#ifdef HAVE_EBCDIC + { + char *file = LDAP_STRDUP( tls_opt_randfile ); + if ( file ) __atoe( file ); + (void) tls_seed_PRNG( file ); + LDAP_FREE( file ); + } +#else (void) tls_seed_PRNG( tls_opt_randfile ); +#endif #ifdef LDAP_R_COMPILE tls_init_threads(); @@ -169,80 +196,94 @@ int ldap_pvt_tls_init_def_ctx( void ) { STACK_OF(X509_NAME) *calist; + int rc = 0; + char *ciphersuite = tls_opt_ciphersuite; + char *cacertfile = tls_opt_cacertfile; + char *cacertdir = tls_opt_cacertdir; + char *certfile = tls_opt_certfile; + char *keyfile = tls_opt_keyfile; #ifdef LDAP_R_COMPILE ldap_pvt_thread_mutex_lock( &tls_def_ctx_mutex ); #endif + + if ( !certfile && !keyfile && !cacertfile && !cacertdir ) { + /* minimum configuration not provided */ + return LDAP_NOT_SUPPORTED; + } + +#ifdef HAVE_EBCDIC + /* This ASCII/EBCDIC handling is a real pain! */ + if ( ciphersuite ) { + ciphersuite = LDAP_STRDUP( ciphersuite ); + __atoe( ciphersuite ); + } + if ( cacertfile ) { + cacertfile = LDAP_STRDUP( cacertfile ); + __atoe( cacertfile ); + } + if ( cacertdir ) { + cacertdir = LDAP_STRDUP( cacertdir ); + __atoe( cacertdir ); + } + if ( certfile ) { + certfile = LDAP_STRDUP( certfile ); + __atoe( certfile ); + } + if ( keyfile ) { + keyfile = LDAP_STRDUP( keyfile ); + __atoe( keyfile ); + } +#endif if ( tls_def_ctx == NULL ) { int i; tls_def_ctx = SSL_CTX_new( SSLv23_method() ); if ( tls_def_ctx == NULL ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_init_def_ctx: " - "TLS could not allocate default ctx (%d).\n", - ERR_peek_error() )); -#else Debug( LDAP_DEBUG_ANY, "TLS: could not allocate default ctx (%lu).\n", ERR_peek_error(),0,0); -#endif + rc = -1; goto error_exit; } + SSL_CTX_set_session_id_context( tls_def_ctx, + (const unsigned char *) "OpenLDAP", sizeof("OpenLDAP")-1 ); + if ( tls_opt_ciphersuite && - !SSL_CTX_set_cipher_list( tls_def_ctx, tls_opt_ciphersuite ) ) + !SSL_CTX_set_cipher_list( tls_def_ctx, ciphersuite ) ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_init_def_ctx: " - "TLS could not set cipher list %s.\n", - tls_opt_ciphersuite )); -#else Debug( LDAP_DEBUG_ANY, "TLS: could not set cipher list %s.\n", tls_opt_ciphersuite, 0, 0 ); -#endif tls_report_error(); + rc = -1; goto error_exit; } if (tls_opt_cacertfile != NULL || tls_opt_cacertdir != NULL) { if ( !SSL_CTX_load_verify_locations( tls_def_ctx, - tls_opt_cacertfile, tls_opt_cacertdir ) || + cacertfile, cacertdir ) || !SSL_CTX_set_default_verify_paths( tls_def_ctx ) ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, - "ldap_pvt_tls_init_def_ctx: " - "TLS could not load verify locations " - "(file:`%s',dir:`%s').\n", - tls_opt_cacertfile ? tls_opt_cacertfile : "", - tls_opt_cacertdir ? tls_opt_cacertdir : "" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: " "could not load verify locations (file:`%s',dir:`%s').\n", tls_opt_cacertfile ? tls_opt_cacertfile : "", tls_opt_cacertdir ? tls_opt_cacertdir : "", 0 ); -#endif tls_report_error(); + rc = -1; goto error_exit; } - calist = get_ca_list( tls_opt_cacertfile, tls_opt_cacertdir ); + calist = get_ca_list( cacertfile, cacertdir ); if ( !calist ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_init_def_ctx: " - "TLS could not load client CA list (file: `%s',dir:`%s')\n", - tls_opt_cacertfile ? tls_opt_cacertfile : "", - tls_opt_cacertdir ? tls_opt_cacertdir : "" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: " "could not load client CA list (file:`%s',dir:`%s').\n", tls_opt_cacertfile ? tls_opt_cacertfile : "", tls_opt_cacertdir ? tls_opt_cacertdir : "", 0 ); -#endif tls_report_error(); + rc = -1; goto error_exit; } @@ -251,48 +292,36 @@ ldap_pvt_tls_init_def_ctx( void ) if ( tls_opt_keyfile && !SSL_CTX_use_PrivateKey_file( tls_def_ctx, - tls_opt_keyfile, SSL_FILETYPE_PEM ) ) + keyfile, SSL_FILETYPE_PEM ) ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_init_def_ctx: " - "TLS could not use key file `%s'.\n", tls_opt_keyfile )); -#else Debug( LDAP_DEBUG_ANY, "TLS: could not use key file `%s'.\n", tls_opt_keyfile,0,0); -#endif tls_report_error(); + rc = -1; goto error_exit; } if ( tls_opt_certfile && !SSL_CTX_use_certificate_file( tls_def_ctx, - tls_opt_certfile, SSL_FILETYPE_PEM ) ) + certfile, SSL_FILETYPE_PEM ) ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_init_def_ctx: " - "TLS could not use certificate `%s'.\n", tls_opt_certfile )); -#else Debug( LDAP_DEBUG_ANY, "TLS: could not use certificate `%s'.\n", tls_opt_certfile,0,0); -#endif tls_report_error(); + rc = -1; goto error_exit; } if ( ( tls_opt_certfile || tls_opt_keyfile ) && !SSL_CTX_check_private_key( tls_def_ctx ) ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_init_def_ctx: " - "TLS private key mismatch.\n" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: private key mismatch.\n", 0,0,0); -#endif tls_report_error(); + rc = -1; goto error_exit; } @@ -313,22 +342,35 @@ ldap_pvt_tls_init_def_ctx( void ) tls_opt_require_cert == LDAP_OPT_X_TLS_ALLOW ? tls_verify_ok : tls_verify_cb ); SSL_CTX_set_tmp_rsa_callback( tls_def_ctx, tls_tmp_rsa_cb ); - /* SSL_CTX_set_tmp_dh_callback( tls_def_ctx, tls_tmp_dh_cb ); */ - } -#ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); + SSL_CTX_set_tmp_dh_callback( tls_def_ctx, tls_tmp_dh_cb ); +#ifdef HAVE_OPENSSL_CRL + if ( tls_opt_crlcheck ) { + X509_STORE *x509_s = SSL_CTX_get_cert_store( tls_def_ctx ); + if ( tls_opt_crlcheck == LDAP_OPT_X_TLS_CRL_PEER ) { + X509_STORE_set_flags( x509_s, X509_V_FLAG_CRL_CHECK ); + } else if ( tls_opt_crlcheck == LDAP_OPT_X_TLS_CRL_ALL ) { + X509_STORE_set_flags( x509_s, + X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL ); + } + } #endif - return 0; - + } error_exit: - if ( tls_def_ctx != NULL ) { + if ( rc == -1 && tls_def_ctx != NULL ) { SSL_CTX_free( tls_def_ctx ); tls_def_ctx = NULL; } +#ifdef HAVE_EBCDIC + LDAP_FREE( ciphersuite ); + LDAP_FREE( cacertfile ); + LDAP_FREE( cacertdir ); + LDAP_FREE( certfile ); + LDAP_FREE( keyfile ); +#endif #ifdef LDAP_R_COMPILE ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); #endif - return -1; + return rc; } static STACK_OF(X509_NAME) * @@ -339,10 +381,21 @@ get_ca_list( char * bundle, char * dir ) if ( bundle ) { ca_list = SSL_load_client_CA_file( bundle ); } - /* - * FIXME: We have now to go over all files in dir, load them - * and add every certificate there to ca_list. - */ +#if defined(HAVE_DIRENT_H) || defined(dirent) + if ( dir ) { + int freeit = 0; + + if ( !ca_list ) { + ca_list = sk_X509_NAME_new_null(); + freeit = 1; + } + if ( !SSL_add_dir_cert_subjects_to_stack( ca_list, dir ) && + freeit ) { + sk_X509_NAME_free( ca_list ); + ca_list = NULL; + } + } +#endif return ca_list; } @@ -361,12 +414,7 @@ alloc_handle( void *ctx_arg ) ssl = SSL_new( ctx ); if ( ssl == NULL ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "alloc_handle: " - "TLS can't create ssl handle.\n" )); -#else Debug( LDAP_DEBUG_ANY,"TLS: can't create ssl handle.\n",0,0,0); -#endif return NULL; } return ssl; @@ -578,8 +626,11 @@ sb_tls_bio_read( BIO *b, char *buf, int len ) ret = LBER_SBIOD_READ_NEXT( p->sbiod, buf, len ); BIO_clear_retry_flags( b ); - if ( ret < 0 && errno == EWOULDBLOCK ) { - BIO_set_retry_read( b ); + if ( ret < 0 ) { + int err = errno; + if ( err == EAGAIN || err == EWOULDBLOCK ) { + BIO_set_retry_read( b ); + } } return ret; @@ -602,8 +653,11 @@ sb_tls_bio_write( BIO *b, const char *buf, int len ) ret = LBER_SBIOD_WRITE_NEXT( p->sbiod, (char *)buf, len ); BIO_clear_retry_flags( b ); - if ( ret < 0 && errno == EWOULDBLOCK ) { - BIO_set_retry_write( b ); + if ( ret < 0 ) { + int err = errno; + if ( err == EAGAIN || err == EWOULDBLOCK ) { + BIO_set_retry_write( b ); + } } return ret; @@ -668,6 +722,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); } else { + struct ldapoptions *lo; void *ctx = ld->ld_defconn ? ld->ld_defconn->lconn_tls_ctx : NULL; @@ -683,8 +738,15 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) LBER_SBIOD_LEVEL_TRANSPORT, (void *)ssl ); if( ctx == NULL ) { + ctx = tls_def_ctx; conn->lconn_tls_ctx = tls_def_ctx; } + lo = &ld->ld_options; + if ( lo->ldo_tls_connect_cb ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + lo = LDAP_INT_GLOBAL_OPT(); + if ( lo && lo->ldo_tls_connect_cb ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); } err = SSL_connect( ssl ); @@ -700,15 +762,17 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) if ((err = ERR_peek_error())) { char buf[256]; + + if ( ld->ld_error ) { + LDAP_FREE( ld->ld_error ); + } ld->ld_error = LDAP_STRDUP(ERR_error_string(err, buf)); +#ifdef HAVE_EBCDIC + if ( ld->ld_error ) __etoa(ld->ld_error); +#endif } -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_int_tls_connect: " - "TLS can't connect.\n" )); -#else Debug( LDAP_DEBUG_ANY,"TLS: can't connect.\n",0,0,0); -#endif ber_sockbuf_remove_io( sb, &sb_tls_sbio, LBER_SBIOD_LEVEL_TRANSPORT ); @@ -755,12 +819,7 @@ ldap_pvt_tls_accept( Sockbuf *sb, void *ctx_arg ) if ( err <= 0 ) { if ( update_flags( sb, ssl, err )) return 1; -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_accept: " - "TLS can't accept.\n" )); -#else Debug( LDAP_DEBUG_ANY,"TLS: can't accept.\n",0,0,0 ); -#endif tls_report_error(); ber_sockbuf_remove_io( sb, &sb_tls_sbio, @@ -781,44 +840,22 @@ ldap_pvt_tls_inplace ( Sockbuf *sb ) return HAS_TLS( sb ) ? 1 : 0; } -void * -ldap_pvt_tls_sb_ctx( Sockbuf *sb ) -{ - void *p; - - if (HAS_TLS( sb )) { - ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&p ); - return p; - } - - return NULL; -} - int -ldap_pvt_tls_get_strength( void *s ) +ldap_tls_inplace( LDAP *ld ) { - SSL_CIPHER *c; + Sockbuf *sb = NULL; - c = SSL_get_current_cipher((SSL *)s); - return SSL_CIPHER_get_bits(c, NULL); -} + if ( ld->ld_defconn && ld->ld_defconn->lconn_sb ) { + sb = ld->ld_defconn->lconn_sb; + } else if ( ld->ld_sb ) { + sb = ld->ld_sb; -int -ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, unsigned flags ) -{ - X509 *x; - X509_NAME *xn; - int rc; - - x = SSL_get_certificate((SSL *)s); + } else { + return 0; + } - if (!x) return LDAP_INVALID_CREDENTIALS; - - xn = X509_get_subject_name(x); - rc = ldap_X509dn2bv(xn, dn, (LDAPDN_rewrite_func *)func, flags ); - X509_free(x); - return rc; + return ldap_pvt_tls_inplace( sb ); } static X509 * @@ -836,7 +873,8 @@ tls_get_cert( SSL *s ) } int -ldap_pvt_tls_get_peer_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, unsigned flags ) +ldap_pvt_tls_get_peer_dn( void *s, struct berval *dn, + LDAPDN_rewrite_dummy *func, unsigned flags ) { X509 *x; X509_NAME *xn; @@ -876,12 +914,24 @@ ldap_pvt_tls_get_peer_hostname( void *s ) return p; } +/* what kind of hostname were we given? */ +#define IS_DNS 0 +#define IS_IP4 1 +#define IS_IP6 2 + int -ldap_pvt_tls_check_hostname( void *s, const char *name_in ) +ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) { int i, ret = LDAP_LOCAL_ERROR; X509 *x; const char *name; + char *ptr; + int ntype = IS_DNS; +#ifdef LDAP_PF_INET6 + struct in6_addr addr; +#else + struct in_addr addr; +#endif if( ldap_int_hostname && ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) @@ -893,17 +943,28 @@ ldap_pvt_tls_check_hostname( void *s, const char *name_in ) x = tls_get_cert((SSL *)s); if (!x) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_check_hostname: " - "TLS unable to get peer certificate.\n" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: unable to get peer certificate.\n", 0, 0, 0 ); -#endif - return ret; + /* If this was a fatal condition, things would have + * aborted long before now. + */ + return LDAP_SUCCESS; } +#ifdef LDAP_PF_INET6 + if (name[0] == '[' && strchr(name, ']')) { + char *n2 = ldap_strdup(name+1); + *strchr(n2, ']') = 2; + if (inet_pton(AF_INET6, n2, &addr)) + ntype = IS_IP6; + LDAP_FREE(n2); + } else +#endif + if ((ptr = strrchr(name, '.')) && isdigit((unsigned char)ptr[1])) { + if (inet_aton(name, (struct in_addr *)&addr)) ntype = IS_IP4; + } + i = X509_get_ext_by_NID(x, NID_subject_alt_name, -1); if (i >= 0) { X509_EXTENSION *ex; @@ -912,22 +973,30 @@ ldap_pvt_tls_check_hostname( void *s, const char *name_in ) ex = X509_get_ext(x, i); alt = X509V3_EXT_d2i(ex); if (alt) { - int n, len1, len2 = 0; - char *domain; + int n, len1 = 0, len2 = 0; + char *domain = NULL; GENERAL_NAME *gn; - X509V3_EXT_METHOD *method; - len1 = strlen(name); - n = sk_GENERAL_NAME_num(alt); - domain = strchr(name, '.'); - if (domain) { - len2 = len1 - (domain-name); + if (ntype == IS_DNS) { + len1 = strlen(name); + domain = strchr(name, '.'); + if (domain) { + len2 = len1 - (domain-name); + } } + n = sk_GENERAL_NAME_num(alt); for (i=0; itype == GEN_DNS) { - char *sn = ASN1_STRING_data(gn->d.ia5); - int sl = ASN1_STRING_length(gn->d.ia5); + if (ntype != IS_DNS) continue; + + sn = (char *) ASN1_STRING_data(gn->d.ia5); + sl = ASN1_STRING_length(gn->d.ia5); + + /* ignore empty */ + if (sl == 0) continue; /* Is this an exact match? */ if ((len1 == sl) && !strncasecmp(name, sn, len1)) { @@ -935,25 +1004,33 @@ ldap_pvt_tls_check_hostname( void *s, const char *name_in ) } /* Is this a wildcard match? */ - if ((*sn == '*') && domain && (len2 == sl-1) && - !strncasecmp(domain, sn+1, len2)) + if (domain && (sn[0] == '*') && (sn[1] == '.') && + (len2 == sl-1) && !strncasecmp(domain, &sn[1], len2)) { break; } -#if 0 - /* Is this a RFC 2549 style wildcard match? */ - if ((*sn == '.') && domain && (len2 == sl) && - !strncasecmp(domain, sn, len2)) - { + } else if (gn->type == GEN_IPADD) { + if (ntype == IS_DNS) continue; + + sn = (char *) ASN1_STRING_data(gn->d.ia5); + sl = ASN1_STRING_length(gn->d.ia5); + +#ifdef LDAP_PF_INET6 + if (ntype == IS_IP6 && sl != sizeof(struct in6_addr)) { + continue; + } else +#endif + if (ntype == IS_IP4 && sl != sizeof(struct in_addr)) { + continue; + } + if (!memcmp(sn, &addr, sl)) { break; } -#endif } } - method = X509V3_EXT_get(ex); - method->ext_free(alt); + GENERAL_NAMES_free(alt); if (i < n) { /* Found a match */ ret = LDAP_SUCCESS; } @@ -963,35 +1040,52 @@ ldap_pvt_tls_check_hostname( void *s, const char *name_in ) if (ret != LDAP_SUCCESS) { X509_NAME *xn; char buf[2048]; + buf[0] = '\0'; xn = X509_get_subject_name(x); - if( X509_NAME_get_text_by_NID( xn, NID_commonName, buf, sizeof(buf)) == -1) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_check_hostname: " - "TLS unable to get common name from peer certificate.\n" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: unable to get common name from peer certificate.\n", 0, 0, 0 ); -#endif + ret = LDAP_CONNECT_ERROR; + if ( ld->ld_error ) { + LDAP_FREE( ld->ld_error ); + } + ld->ld_error = LDAP_STRDUP( + _("TLS: unable to get CN from peer certificate")); - } else if (strcasecmp(name, buf)) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "ldap_pvt_tls_check_hostname: " - "TLS hostname (%s) does not match " - "common name in certificate (%s).\n", name, buf )); -#else + } else if (strcasecmp(name, buf) == 0 ) { + ret = LDAP_SUCCESS; + + } else if (( buf[0] == '*' ) && ( buf[1] == '.' )) { + char *domain = strchr(name, '.'); + if( domain ) { + size_t dlen = 0; + size_t sl; + + sl = strlen(name); + dlen = sl - (domain-name); + sl = strlen(buf); + + /* Is this a wildcard match? */ + if ((dlen == sl-1) && !strncasecmp(domain, &buf[1], dlen)) { + ret = LDAP_SUCCESS; + } + } + } + + if( ret == LDAP_LOCAL_ERROR ) { Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " "common name in certificate (%s).\n", name, buf, 0 ); -#endif ret = LDAP_CONNECT_ERROR; - - } else { - ret = LDAP_SUCCESS; + if ( ld->ld_error ) { + LDAP_FREE( ld->ld_error ); + } + ld->ld_error = LDAP_STRDUP( + _("TLS: hostname does not match CN in peer certificate")); } } X509_free(x); @@ -1030,6 +1124,8 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) case LDAP_OPT_X_TLS_CERTFILE: case LDAP_OPT_X_TLS_KEYFILE: case LDAP_OPT_X_TLS_RANDOM_FILE: + case LDAP_OPT_X_TLS_CIPHER_SUITE: + case LDAP_OPT_X_TLS_DHPARAMDIR: return ldap_pvt_tls_set_option( ld, option, (void *) arg ); case LDAP_OPT_X_TLS_REQUIRE_CERT: @@ -1059,8 +1155,22 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) return ldap_pvt_tls_set_option( ld, option, &i ); } return -1; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + i = -1; + if ( strcasecmp( arg, "none" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_NONE ; + } else if ( strcasecmp( arg, "peer" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_PEER ; + } else if ( strcasecmp( arg, "all" ) == 0 ) { + i = LDAP_OPT_X_TLS_CRL_ALL ; + } + if (i >= 0) { + return ldap_pvt_tls_set_option( ld, option, &i ); + } + return -1; +#endif } - return -1; } @@ -1113,9 +1223,18 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) *(char **)arg = tls_opt_keyfile ? LDAP_STRDUP( tls_opt_keyfile ) : NULL; break; + case LDAP_OPT_X_TLS_DHPARAMDIR: + *(char **)arg = tls_opt_dhparamdir ? + LDAP_STRDUP( tls_opt_dhparamdir ) : NULL; + break; case LDAP_OPT_X_TLS_REQUIRE_CERT: *(int *)arg = tls_opt_require_cert; break; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + *(int *)arg = tls_opt_crlcheck; + break; +#endif case LDAP_OPT_X_TLS_RANDOM_FILE: *(char **)arg = tls_opt_randfile ? LDAP_STRDUP( tls_opt_randfile ) : NULL; @@ -1132,6 +1251,12 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) *(void **)arg = retval; break; } + case LDAP_OPT_X_TLS_CONNECT_CB: + *(LDAP_TLS_CONNECT_CB **)arg = lo->ldo_tls_connect_cb; + break; + case LDAP_OPT_X_TLS_CONNECT_ARG: + *(void **)arg = lo->ldo_tls_connect_arg; + break; default: return -1; } @@ -1184,6 +1309,12 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) ld->ld_defconn->lconn_tls_ctx = arg; } return 0; + case LDAP_OPT_X_TLS_CONNECT_CB: + lo->ldo_tls_connect_cb = (LDAP_TLS_CONNECT_CB *)arg; + return 0; + case LDAP_OPT_X_TLS_CONNECT_ARG: + lo->ldo_tls_connect_arg = arg; + return 0; } if ( ld != NULL ) { @@ -1207,6 +1338,12 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) if ( tls_opt_keyfile ) LDAP_FREE( tls_opt_keyfile ); tls_opt_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; break; + case LDAP_OPT_X_TLS_DHPARAMDIR: + if ( tls_opt_dhparamdir ) LDAP_FREE( tls_opt_dhparamdir ); + tls_opt_dhparamdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + if ( tls_opt_dhparamdir ) + tls_opt_dhparamdirlen = strlen( tls_opt_dhparamdir ); + break; case LDAP_OPT_X_TLS_REQUIRE_CERT: switch( *(int *) arg ) { case LDAP_OPT_X_TLS_NEVER: @@ -1218,6 +1355,17 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) return 0; } return -1; +#ifdef HAVE_OPENSSL_CRL + case LDAP_OPT_X_TLS_CRLCHECK: + switch( *(int *) arg ) { + case LDAP_OPT_X_TLS_CRL_NONE: + case LDAP_OPT_X_TLS_CRL_PEER: + case LDAP_OPT_X_TLS_CRL_ALL: + tls_opt_crlcheck = * (int *) arg; + return 0; + } + return -1; +#endif case LDAP_OPT_X_TLS_CIPHER_SUITE: if ( tls_opt_ciphersuite ) LDAP_FREE( tls_opt_ciphersuite ); tls_opt_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL; @@ -1266,25 +1414,11 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) /* * compare host with name(s) in certificate */ - ld->ld_errno = ldap_pvt_tls_check_hostname( ssl, host ); - if (ld->ld_errno != LDAP_SUCCESS) { - return ld->ld_errno; - } - - /* - * set SASL properties to TLS ssf and authid - */ - { - struct berval authid; - ber_len_t ssf; - - /* we need to let SASL know */ - ssf = ldap_pvt_tls_get_strength( ssl ); - /* failure is OK, we just can't use SASL EXTERNAL */ - (void) ldap_pvt_tls_get_my_dn( ssl, &authid, NULL, 0 ); - - (void) ldap_int_sasl_external( ld, conn, authid.bv_val, ssf ); - LDAP_FREE( authid.bv_val ); + if (tls_opt_require_cert != LDAP_OPT_X_TLS_NEVER) { + ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host ); + if (ld->ld_errno != LDAP_SUCCESS) { + return ld->ld_errno; + } } return LDAP_SUCCESS; @@ -1292,10 +1426,11 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) /* Derived from openssl/apps/s_cb.c */ static void -tls_info_cb( SSL *ssl, int where, int ret ) +tls_info_cb( const SSL *ssl, int where, int ret ) { int w; char *op; + char *state = (char *) SSL_state_string_long( (SSL *)ssl ); w = where & ~SSL_ST_MASK; if ( w & SSL_ST_CONNECT ) { @@ -1306,52 +1441,52 @@ tls_info_cb( SSL *ssl, int where, int ret ) op = "undefined"; } +#ifdef HAVE_EBCDIC + if ( state ) { + state = LDAP_STRDUP( state ); + __etoa( state ); + } +#endif if ( where & SSL_CB_LOOP ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_DETAIL1, "tls_info_cb: " - "TLS trace: %s:%s\n", op, SSL_state_string_long( ssl ) )); -#else Debug( LDAP_DEBUG_TRACE, "TLS trace: %s:%s\n", - op, SSL_state_string_long( ssl ), 0 ); -#endif + op, state, 0 ); } else if ( where & SSL_CB_ALERT ) { + char *atype = (char *) SSL_alert_type_string_long( ret ); + char *adesc = (char *) SSL_alert_desc_string_long( ret ); op = ( where & SSL_CB_READ ) ? "read" : "write"; -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_DETAIL1, "tls_info_cb: " - "TLS trace: SSL3 alert %s:%s:%s\n", op, - SSL_alert_type_string_long( ret ), - SSL_alert_desc_string_long( ret) )); -#else +#ifdef HAVE_EBCDIC + if ( atype ) { + atype = LDAP_STRDUP( atype ); + __etoa( atype ); + } + if ( adesc ) { + adesc = LDAP_STRDUP( adesc ); + __etoa( adesc ); + } +#endif Debug( LDAP_DEBUG_TRACE, "TLS trace: SSL3 alert %s:%s:%s\n", - op, - SSL_alert_type_string_long( ret ), - SSL_alert_desc_string_long( ret) ); + op, atype, adesc ); +#ifdef HAVE_EBCDIC + if ( atype ) LDAP_FREE( atype ); + if ( adesc ) LDAP_FREE( adesc ); #endif - } else if ( where & SSL_CB_EXIT ) { if ( ret == 0 ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "tls_info_cb: " - "TLS trace: %s:failed in %s\n", op, SSL_state_string_long( ssl ) )); -#else Debug( LDAP_DEBUG_TRACE, "TLS trace: %s:failed in %s\n", - op, SSL_state_string_long( ssl ), 0 ); -#endif + op, state, 0 ); } else if ( ret < 0 ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "tls_info_cb: " - "TLS trace: %s:error in %s\n", op, SSL_state_string_long( ssl ) )); -#else Debug( LDAP_DEBUG_TRACE, "TLS trace: %s:error in %s\n", - op, SSL_state_string_long( ssl ), 0 ); -#endif + op, state, 0 ); } } +#ifdef HAVE_EBCDIC + if ( state ) LDAP_FREE( state ); +#endif } static int @@ -1364,6 +1499,7 @@ tls_verify_cb( int ok, X509_STORE_CTX *ctx ) X509_NAME *issuer; char *sname; char *iname; + char *certerr = NULL; cert = X509_STORE_CTX_get_current_cert( ctx ); errnum = X509_STORE_CTX_get_error( ctx ); @@ -1378,23 +1514,32 @@ tls_verify_cb( int ok, X509_STORE_CTX *ctx ) /* X509_NAME_oneline, if passed a NULL buf, allocate memomry */ sname = X509_NAME_oneline( subject, NULL, 0 ); iname = X509_NAME_oneline( issuer, NULL, 0 ); -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, "tls_verify_cb" - "TLS certificate verification: depth: %d, err: %d: " - "subject: %s, issuer: %s\n", errdepth, errnum, - sname ? sname : "-unknown-", iname ? iname : "-unknown-" )); -#else + if ( !ok ) certerr = (char *)X509_verify_cert_error_string( errnum ); +#ifdef HAVE_EBCDIC + if ( sname ) __etoa( sname ); + if ( iname ) __etoa( iname ); + if ( certerr ) { + certerr = LDAP_STRDUP( certerr ); + __etoa( certerr ); + } +#endif Debug( LDAP_DEBUG_TRACE, "TLS certificate verification: depth: %d, err: %d, subject: %s,", errdepth, errnum, sname ? sname : "-unknown-" ); Debug( LDAP_DEBUG_TRACE, " issuer: %s\n", iname ? iname : "-unknown-", 0, 0 ); -#endif + if ( !ok ) { + Debug( LDAP_DEBUG_ANY, + "TLS certificate verification: Error, %s\n", + certerr, 0, 0 ); + } if ( sname ) CRYPTO_free ( sname ); if ( iname ) CRYPTO_free ( iname ); - +#ifdef HAVE_EBCDIC + if ( certerr ) LDAP_FREE( certerr ); +#endif return ok; } @@ -1415,13 +1560,18 @@ tls_report_error( void ) int line; while ( ( l = ERR_get_error_line( &file, &line ) ) != 0 ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, - "tls_report_error: TLS %s %s:%d\n", - ERR_error_string( l, buf ), file, line )); -#else + ERR_error_string_n( l, buf, sizeof( buf ) ); +#ifdef HAVE_EBCDIC + if ( file ) { + file = LDAP_STRDUP( file ); + __etoa( (char *)file ); + } + __etoa( buf ); +#endif Debug( LDAP_DEBUG_ANY, "TLS: %s %s:%d\n", - ERR_error_string( l, buf ), file, line ); + buf, file, line ); +#ifdef HAVE_EBCDIC + if ( file ) LDAP_FREE( (void *)file ); #endif } } @@ -1436,15 +1586,9 @@ tls_tmp_rsa_cb( SSL *ssl, int is_export, int key_length ) tmp_rsa = RSA_generate_key( key_length, RSA_F4, NULL, NULL ); if ( !tmp_rsa ) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_ERR, - "tls_tmp_rsa_cb: TLS Failed to generate temporary %d-bit %s RSA key\n", - key_length, is_export ? "export" : "domestic" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: Failed to generate temporary %d-bit %s RSA key\n", key_length, is_export ? "export" : "domestic", 0 ); -#endif return NULL; } return tmp_rsa; @@ -1472,29 +1616,18 @@ tls_seed_PRNG( const char *randfile ) } if (randfile == NULL) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_DETAIL1, - "tls_seed_PRNG: TLS Use configuration file or " - "$RANDFILE to define seed PRNG\n" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: Use configuration file or $RANDFILE to define seed PRNG\n", 0, 0, 0); -#endif return -1; } total = RAND_load_file(randfile, -1); if (RAND_status() == 0) { -#ifdef NEW_LOGGING - LDAP_LOG (( "tls", LDAP_LEVEL_DETAIL1, - "tls_seed_PRNG: TLS PRNG not been seeded with enough data\n" )); -#else Debug( LDAP_DEBUG_ANY, "TLS: PRNG not been seeded with enough data\n", 0, 0, 0); -#endif return -1; } @@ -1508,37 +1641,243 @@ tls_seed_PRNG( const char *randfile ) return 0; } -#if 0 +struct dhinfo { + int keylength; + const char *pem; + size_t size; +}; + +struct dhplist { + struct dhplist *next; + int keylength; + DH *param; +}; + +static struct dhplist *dhparams; + +/* From the OpenSSL 0.9.7 distro */ +static const char dhpem512[] = +"-----BEGIN DH PARAMETERS-----\n\ +MEYCQQDaWDwW2YUiidDkr3VvTMqS3UvlM7gE+w/tlO+cikQD7VdGUNNpmdsp13Yn\n\ +a6LT1BLiGPTdHghM9tgAPnxHdOgzAgEC\n\ +-----END DH PARAMETERS-----\n"; + +static const char dhpem1024[] = +"-----BEGIN DH PARAMETERS-----\n\ +MIGHAoGBAJf2QmHKtQXdKCjhPx1ottPb0PMTBH9A6FbaWMsTuKG/K3g6TG1Z1fkq\n\ +/Gz/PWk/eLI9TzFgqVAuPvr3q14a1aZeVUMTgo2oO5/y2UHe6VaJ+trqCTat3xlx\n\ +/mNbIK9HA2RgPC3gWfVLZQrY+gz3ASHHR5nXWHEyvpuZm7m3h+irAgEC\n\ +-----END DH PARAMETERS-----\n"; + +static const char dhpem2048[] = +"-----BEGIN DH PARAMETERS-----\n\ +MIIBCAKCAQEA7ZKJNYJFVcs7+6J2WmkEYb8h86tT0s0h2v94GRFS8Q7B4lW9aG9o\n\ +AFO5Imov5Jo0H2XMWTKKvbHbSe3fpxJmw/0hBHAY8H/W91hRGXKCeyKpNBgdL8sh\n\ +z22SrkO2qCnHJ6PLAMXy5fsKpFmFor2tRfCzrfnggTXu2YOzzK7q62bmqVdmufEo\n\ +pT8igNcLpvZxk5uBDvhakObMym9mX3rAEBoe8PwttggMYiiw7NuJKO4MqD1llGkW\n\ +aVM8U2ATsCun1IKHrRxynkE1/MJ86VHeYYX8GZt2YA8z+GuzylIOKcMH6JAWzMwA\n\ +Gbatw6QwizOhr9iMjZ0B26TE3X8LvW84wwIBAg==\n\ +-----END DH PARAMETERS-----\n"; + +static const char dhpem4096[] = +"-----BEGIN DH PARAMETERS-----\n\ +MIICCAKCAgEA/urRnb6vkPYc/KEGXWnbCIOaKitq7ySIq9dTH7s+Ri59zs77zty7\n\ +vfVlSe6VFTBWgYjD2XKUFmtqq6CqXMhVX5ElUDoYDpAyTH85xqNFLzFC7nKrff/H\n\ +TFKNttp22cZE9V0IPpzedPfnQkE7aUdmF9JnDyv21Z/818O93u1B4r0szdnmEvEF\n\ +bKuIxEHX+bp0ZR7RqE1AeifXGJX3d6tsd2PMAObxwwsv55RGkn50vHO4QxtTARr1\n\ +rRUV5j3B3oPMgC7Offxx+98Xn45B1/G0Prp11anDsR1PGwtaCYipqsvMwQUSJtyE\n\ +EOQWk+yFkeMe4vWv367eEi0Sd/wnC+TSXBE3pYvpYerJ8n1MceI5GQTdarJ77OW9\n\ +bGTHmxRsLSCM1jpLdPja5jjb4siAa6EHc4qN9c/iFKS3PQPJEnX7pXKBRs5f7AF3\n\ +W3RIGt+G9IVNZfXaS7Z/iCpgzgvKCs0VeqN38QsJGtC1aIkwOeyjPNy2G6jJ4yqH\n\ +ovXYt/0mc00vCWeSNS1wren0pR2EiLxX0ypjjgsU1mk/Z3b/+zVf7fZSIB+nDLjb\n\ +NPtUlJCVGnAeBK1J1nG3TQicqowOXoM6ISkdaXj5GPJdXHab2+S7cqhKGv5qC7rR\n\ +jT6sx7RUr0CNTxzLI7muV2/a4tGmj0PSdXQdsZ7tw7gbXlaWT1+MM2MCAQI=\n\ +-----END DH PARAMETERS-----\n"; + +static const struct dhinfo dhpem[] = { + { 512, dhpem512, sizeof(dhpem512) }, + { 1024, dhpem1024, sizeof(dhpem1024) }, + { 2048, dhpem2048, sizeof(dhpem2048) }, + { 4096, dhpem4096, sizeof(dhpem4096) }, + { 0, NULL, 0 } +}; + +#define MAXDIGITS 12 + +#define DHFILEPATTERN "dh%d.pem" + static DH * tls_tmp_dh_cb( SSL *ssl, int is_export, int key_length ) { + struct dhplist *p = NULL; + BIO *b = NULL; + FILE *f; + char *file; + DH *dh = NULL; + + /* Do we have params of this length already? */ +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_lock( &tls_def_ctx_mutex ); +#endif + for ( p = dhparams; p; p=p->next ) { + if ( p->keylength == key_length ) { +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); +#endif + return p->param; + } + } + + /* See if there's a file to load */ + if ( tls_opt_dhparamdir ) { + file = LDAP_MALLOC( tls_opt_dhparamdirlen + 1 + MAXDIGITS + + sizeof(DHFILEPATTERN) ); + if ( file == NULL ) + goto done; + sprintf( file, "%s/" DHFILEPATTERN, tls_opt_dhparamdir, key_length ); + } else { + file = LDAP_MALLOC( STRLENOF(LDAP_SYSCONFDIR) + 1 + MAXDIGITS + + sizeof(DHFILEPATTERN) ); + if ( file == NULL ) + goto done; + sprintf( file, LDAP_SYSCONFDIR "/" DHFILEPATTERN, key_length ); + } + f = fopen(file,"r"); + /* Did we get the file? */ + if ( f ) { + b = BIO_new_fp( f, BIO_CLOSE ); + if ( b == NULL ) + fclose( f ); + } else { + /* No - check for hardcoded params */ + int i; + + for (i=0; dhpem[i].keylength; i++) { + if ( dhpem[i].keylength == key_length ) { + b = BIO_new_mem_buf( (char *)dhpem[i].pem, dhpem[i].size ); + break; + } + } + } + if ( b ) { + dh = PEM_read_bio_DHparams( b, NULL, NULL, NULL ); + BIO_free( b ); + } + + /* Generating on the fly is expensive/slow... */ + if ( !dh ) { + dh = DH_generate_parameters( key_length, DH_GENERATOR_2, NULL, NULL ); + } + if ( dh ) { + p = LDAP_MALLOC( sizeof(struct dhplist) ); + if ( p != NULL ) { + p->keylength = key_length; + p->param = dh; + p->next = dhparams; + dhparams = p; + } + } +done: +#ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_unlock( &tls_def_ctx_mutex ); +#endif + return dh; +} +#endif + +void * +ldap_pvt_tls_sb_ctx( Sockbuf *sb ) +{ +#ifdef HAVE_TLS + void *p; + + if (HAS_TLS( sb )) { + ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&p ); + return p; + } +#endif + return NULL; } + +int +ldap_pvt_tls_get_strength( void *s ) +{ +#ifdef HAVE_TLS + SSL_CIPHER *c; + + c = SSL_get_current_cipher((SSL *)s); + return SSL_CIPHER_get_bits(c, NULL); +#else + return 0; +#endif +} + + +int +ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, unsigned flags ) +{ +#ifdef HAVE_TLS + X509 *x; + X509_NAME *xn; + int rc; + + x = SSL_get_certificate((SSL *)s); + + if (!x) return LDAP_INVALID_CREDENTIALS; + + xn = X509_get_subject_name(x); + rc = ldap_X509dn2bv(xn, dn, (LDAPDN_rewrite_func *)func, flags ); + return rc; +#else + return LDAP_NOT_SUPPORTED; #endif +} + +int +ldap_start_tls( LDAP *ld, + LDAPControl **serverctrls, + LDAPControl **clientctrls, + int *msgidp ) +{ + return ldap_extended_operation( ld, LDAP_EXOP_START_TLS, + NULL, serverctrls, clientctrls, msgidp ); +} + +int +ldap_install_tls( LDAP *ld ) +{ +#ifndef HAVE_TLS + return LDAP_NOT_SUPPORTED; +#else + if ( ldap_tls_inplace( ld ) ) { + return LDAP_LOCAL_ERROR; + } + + return ldap_int_tls_start( ld, ld->ld_defconn, NULL ); #endif +} int ldap_start_tls_s ( LDAP *ld, LDAPControl **serverctrls, LDAPControl **clientctrls ) { +#ifndef HAVE_TLS + return LDAP_NOT_SUPPORTED; +#else int rc; - -#ifdef HAVE_TLS char *rspoid = NULL; struct berval *rspdata = NULL; /* XXYYZ: this initiates operation only on default connection! */ - if ( ld->ld_sb != NULL && ldap_pvt_tls_inplace( ld->ld_sb ) != 0 ) { + if ( ldap_tls_inplace( ld ) ) { return LDAP_LOCAL_ERROR; } rc = ldap_extended_operation_s( ld, LDAP_EXOP_START_TLS, NULL, serverctrls, clientctrls, &rspoid, &rspdata ); - if ( rc != LDAP_SUCCESS ) { - return rc; - } if ( rspoid != NULL ) { LDAP_FREE(rspoid); @@ -1548,10 +1887,11 @@ ldap_start_tls_s ( LDAP *ld, ber_bvfree( rspdata ); } - rc = ldap_int_tls_start( ld, ld->ld_defconn, NULL ); -#else - rc = LDAP_NOT_SUPPORTED; -#endif + if ( rc == LDAP_SUCCESS ) { + rc = ldap_int_tls_start( ld, ld->ld_defconn, NULL ); + } + return rc; +#endif }