X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Foverlays%2Fautoca.c;h=73a57476174dc938cb57fa90b56a7aa21b32310f;hb=59e9ff6243465640956b58ad1756a3ede53eca7c;hp=2762a4f26ecd2ba60e0b85a2a1043a712904b9f6;hpb=268f71cb276315f18fc8a5df7ce17fa2045f963b;p=openldap

diff --git a/servers/slapd/overlays/autoca.c b/servers/slapd/overlays/autoca.c
index 2762a4f26e..73a5747617 100644
--- a/servers/slapd/overlays/autoca.c
+++ b/servers/slapd/overlays/autoca.c
@@ -2,8 +2,8 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2009-2017 The OpenLDAP Foundation.
- * Copyright 2009-2017 by Howard Chu.
+ * Copyright 2009-2018 The OpenLDAP Foundation.
+ * Copyright 2009-2018 by Howard Chu.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -21,8 +21,6 @@
 
 #include "portable.h"
 
-#define SLAPD_OVER_AUTOCA	SLAPD_MOD_DYNAMIC
-
 #ifdef SLAPD_OVER_AUTOCA
 
 #include <stdio.h>
@@ -34,8 +32,21 @@
 #include "slap.h"
 #include "config.h"
 
+#include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/evp.h>
+#include <openssl/bn.h>
+
+/* Starting with OpenSSL 1.1.0, rsa.h is no longer included in
+ * x509.h, so we need to explicitly include it for the
+ * call to EVP_PKEY_CTX_set_rsa_keygen_bits
+ */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+#include <openssl/rsa.h>
+#define X509_get_notBefore(x)	X509_getm_notBefore(x)
+#define X509_get_notAfter(x)	X509_getm_notAfter(x)
+#endif
 
 /* This overlay implements a certificate authority that can generate
  * certificates automatically for any entry in the directory.
@@ -260,17 +271,16 @@ static int autoca_gencert( Operation *op, genargs *args )
 	X509_NAME *subj_name, *issuer_name;
 	X509 *subj_cert;
 	struct berval derdn;
-	const unsigned char *p;
+	unsigned char *pp;
 	EVP_PKEY *evpk = NULL;
 	int rc;
-	unsigned char *pp;
 
 	if ((subj_cert = X509_new()) == NULL)
 		return -1;
 
 	autoca_dnbv2der( op, args->subjectDN, &derdn );
-	p = (const unsigned char *)derdn.bv_val;
-	subj_name = d2i_X509_NAME( NULL, &p, derdn.bv_len );
+	pp = (unsigned char *)derdn.bv_val;
+	subj_name = d2i_X509_NAME( NULL, (const unsigned char **)&pp, derdn.bv_len );
 	op->o_tmpfree( derdn.bv_val, op->o_tmpmemctx );
 	if ( subj_name == NULL )
 	{
@@ -293,7 +303,7 @@ fail2:
 			goto fail2;
 		args->derpkey.bv_len = i2d_PKCS8_PRIV_KEY_INFO( p8inf, NULL );
 		args->derpkey.bv_val = op->o_tmpalloc( args->derpkey.bv_len, op->o_tmpmemctx );
-		pp = args->derpkey.bv_val;
+		pp = (unsigned char *)args->derpkey.bv_val;
 		i2d_PKCS8_PRIV_KEY_INFO( p8inf, &pp );
 		PKCS8_PRIV_KEY_INFO_free( p8inf );
 	}
@@ -372,7 +382,7 @@ fail3:
 		goto fail3;
 	args->dercert.bv_len = i2d_X509( subj_cert, NULL );
 	args->dercert.bv_val = op->o_tmpalloc( args->dercert.bv_len, op->o_tmpmemctx );
-	pp = args->dercert.bv_val;
+	pp = (unsigned char *)args->dercert.bv_val;
 	i2d_X509( subj_cert, &pp );
 	args->newcert = subj_cert;
 	return 0;
@@ -457,7 +467,6 @@ autoca_setca_task( void *ctx, void *arg )
 	struct berval *cacert = arg;
 	Modifications mod;
 	struct berval bvs[2];
-	BackendInfo *bi;
 	slap_callback cb = {0};
 	SlapReply rs = {REP_RESULT};
 	const char *text;
@@ -511,11 +520,9 @@ autoca_setlocal( Operation *op, struct berval *cert, struct berval *pkey )
 {
 	Modifications mod[2];
 	struct berval bvs[4];
-	BackendInfo *bi;
 	slap_callback cb = {0};
 	SlapReply rs = {REP_RESULT};
 	const char *text;
-	static const struct berval config = BER_BVC("cn=config");
 
 	mod[0].sml_numvals = 1;
 	mod[0].sml_values = bvs;
@@ -964,6 +971,24 @@ autoca_db_open(
 	if (slapMode & SLAP_TOOL_MODE)
 		return 0;
 
+	if ( ! *aca_attr2[0].ad ) {
+		int i, code;
+		const char *text;
+
+		for ( i=0; aca_attr2[i].at; i++ ) {
+			code = slap_str2ad( aca_attr2[i].at, aca_attr2[i].ad, &text );
+			if ( code ) return code;
+		}
+
+		/* Schema may not be loaded, ignore if missing */
+		slap_str2ad( "ipHostNumber", &ad_ipaddr, &text );
+
+		for ( i=0; aca_ocs[i].ot; i++ ) {
+			code = register_oc( aca_ocs[i].ot, aca_ocs[i].oc, 0 );
+			if ( code ) return code;
+		}
+	}
+
 	thrctx = ldap_pvt_thread_pool_context();
 	connection_fake_init2( &conn, &opbuf, thrctx, 0 );
 	op = &opbuf.ob_op;
@@ -980,14 +1005,14 @@ autoca_db_open(
 			a = attr_find( e->e_attrs, ad_caPkey );
 			if ( a ) {
 				const unsigned char *pp;
-				pp = a->a_vals[0].bv_val;
+				pp = (unsigned char *)a->a_vals[0].bv_val;
 				ai->ai_pkey = d2i_AutoPrivateKey( NULL, &pp, a->a_vals[0].bv_len );
 				if ( ai->ai_pkey )
 				{
 					a = attr_find( e->e_attrs, ad_caCert );
 					if ( a )
 					{
-						pp = a->a_vals[0].bv_val;
+						pp = (unsigned char *)a->a_vals[0].bv_val;
 						ai->ai_cert = d2i_X509( NULL, &pp, a->a_vals[0].bv_len );
 						/* If TLS wasn't configured yet, set this as our CA */
 						if ( !slap_tls_ctx )
@@ -1052,7 +1077,6 @@ static slap_overinst autoca;
 
 int autoca_initialize() {
 	int i, code;
-	const char *text;
 
 	autoca.on_bi.bi_type = "autoca";
 	autoca.on_bi.bi_db_init = autoca_db_init;
@@ -1069,19 +1093,6 @@ int autoca_initialize() {
 		if ( code ) return code;
 	}
 
-	for ( i=0; aca_attr2[i].at; i++ ) {
-		code = slap_str2ad( aca_attr2[i].at, aca_attr2[i].ad, &text );
-		if ( code ) return code;
-	}
-
-	/* Schema may not be loaded, ignore if missing */
-	slap_str2ad( "ipHostNumber", &ad_ipaddr, &text );
-
-	for ( i=0; aca_ocs[i].ot; i++ ) {
-		code = register_oc( aca_ocs[i].ot, aca_ocs[i].oc, 0 );
-		if ( code ) return code;
-	}
-
 	return overlay_register( &autoca );
 }