Happy New Year

[openldap] / servers / slapd / overlays / autoca.c

diff --git a/servers/slapd/overlays/autoca.c b/servers/slapd/overlays/autoca.c
index 2762a4f26ecd2ba60e0b85a2a1043a712904b9f6..73a57476174dc938cb57fa90b56a7aa21b32310f 100644 (file)
--- a/servers/slapd/overlays/autoca.c
+++ b/servers/slapd/overlays/autoca.c
@@ -2,8 +2,8 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2009-2017 The OpenLDAP Foundation.
- * Copyright 2009-2017 by Howard Chu.
+ * Copyright 2009-2018 The OpenLDAP Foundation.
+ * Copyright 2009-2018 by Howard Chu.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -21,8 +21,6 @@
 
 #include "portable.h"
 
-#define SLAPD_OVER_AUTOCA      SLAPD_MOD_DYNAMIC
-
 #ifdef SLAPD_OVER_AUTOCA
 
 #include <stdio.h>
@@ -34,8 +32,21 @@
 #include "slap.h"
 #include "config.h"
 
+#include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/evp.h>
+#include <openssl/bn.h>
+
+/* Starting with OpenSSL 1.1.0, rsa.h is no longer included in
+ * x509.h, so we need to explicitly include it for the
+ * call to EVP_PKEY_CTX_set_rsa_keygen_bits
+ */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+#include <openssl/rsa.h>
+#define X509_get_notBefore(x)  X509_getm_notBefore(x)
+#define X509_get_notAfter(x)   X509_getm_notAfter(x)
+#endif
 
 /* This overlay implements a certificate authority that can generate
  * certificates automatically for any entry in the directory.
@@ -260,17 +271,16 @@ static int autoca_gencert( Operation *op, genargs *args )
        X509_NAME *subj_name, *issuer_name;
        X509 *subj_cert;
        struct berval derdn;
-       const unsigned char *p;
+       unsigned char *pp;
        EVP_PKEY *evpk = NULL;
        int rc;
-       unsigned char *pp;
 
        if ((subj_cert = X509_new()) == NULL)
                return -1;
 
        autoca_dnbv2der( op, args->subjectDN, &derdn );
-       p = (const unsigned char *)derdn.bv_val;
-       subj_name = d2i_X509_NAME( NULL, &p, derdn.bv_len );
+       pp = (unsigned char *)derdn.bv_val;
+       subj_name = d2i_X509_NAME( NULL, (const unsigned char **)&pp, derdn.bv_len );
        op->o_tmpfree( derdn.bv_val, op->o_tmpmemctx );
        if ( subj_name == NULL )
        {
@@ -293,7 +303,7 @@ fail2:
                        goto fail2;
                args->derpkey.bv_len = i2d_PKCS8_PRIV_KEY_INFO( p8inf, NULL );
                args->derpkey.bv_val = op->o_tmpalloc( args->derpkey.bv_len, op->o_tmpmemctx );
-               pp = args->derpkey.bv_val;
+               pp = (unsigned char *)args->derpkey.bv_val;
                i2d_PKCS8_PRIV_KEY_INFO( p8inf, &pp );
                PKCS8_PRIV_KEY_INFO_free( p8inf );
        }
@@ -372,7 +382,7 @@ fail3:
                goto fail3;
        args->dercert.bv_len = i2d_X509( subj_cert, NULL );
        args->dercert.bv_val = op->o_tmpalloc( args->dercert.bv_len, op->o_tmpmemctx );
-       pp = args->dercert.bv_val;
+       pp = (unsigned char *)args->dercert.bv_val;
        i2d_X509( subj_cert, &pp );
        args->newcert = subj_cert;
        return 0;
@@ -457,7 +467,6 @@ autoca_setca_task( void *ctx, void *arg )
        struct berval *cacert = arg;
        Modifications mod;
        struct berval bvs[2];
-       BackendInfo *bi;
        slap_callback cb = {0};
        SlapReply rs = {REP_RESULT};
        const char *text;
@@ -511,11 +520,9 @@ autoca_setlocal( Operation *op, struct berval *cert, struct berval *pkey )
 {
        Modifications mod[2];
        struct berval bvs[4];
-       BackendInfo *bi;
        slap_callback cb = {0};
        SlapReply rs = {REP_RESULT};
        const char *text;
-       static const struct berval config = BER_BVC("cn=config");
 
        mod[0].sml_numvals = 1;
        mod[0].sml_values = bvs;
@@ -964,6 +971,24 @@ autoca_db_open(
        if (slapMode & SLAP_TOOL_MODE)
                return 0;
 
+       if ( ! *aca_attr2[0].ad ) {
+               int i, code;
+               const char *text;
+
+               for ( i=0; aca_attr2[i].at; i++ ) {
+                       code = slap_str2ad( aca_attr2[i].at, aca_attr2[i].ad, &text );
+                       if ( code ) return code;
+               }
+
+               /* Schema may not be loaded, ignore if missing */
+               slap_str2ad( "ipHostNumber", &ad_ipaddr, &text );
+
+               for ( i=0; aca_ocs[i].ot; i++ ) {
+                       code = register_oc( aca_ocs[i].ot, aca_ocs[i].oc, 0 );
+                       if ( code ) return code;
+               }
+       }
+
        thrctx = ldap_pvt_thread_pool_context();
        connection_fake_init2( &conn, &opbuf, thrctx, 0 );
        op = &opbuf.ob_op;
@@ -980,14 +1005,14 @@ autoca_db_open(
                        a = attr_find( e->e_attrs, ad_caPkey );
                        if ( a ) {
                                const unsigned char *pp;
-                               pp = a->a_vals[0].bv_val;
+                               pp = (unsigned char *)a->a_vals[0].bv_val;
                                ai->ai_pkey = d2i_AutoPrivateKey( NULL, &pp, a->a_vals[0].bv_len );
                                if ( ai->ai_pkey )
                                {
                                        a = attr_find( e->e_attrs, ad_caCert );
                                        if ( a )
                                        {
-                                               pp = a->a_vals[0].bv_val;
+                                               pp = (unsigned char *)a->a_vals[0].bv_val;
                                                ai->ai_cert = d2i_X509( NULL, &pp, a->a_vals[0].bv_len );
                                                /* If TLS wasn't configured yet, set this as our CA */
                                                if ( !slap_tls_ctx )
@@ -1052,7 +1077,6 @@ static slap_overinst autoca;
 
 int autoca_initialize() {
        int i, code;
-       const char *text;
 
        autoca.on_bi.bi_type = "autoca";
        autoca.on_bi.bi_db_init = autoca_db_init;
@@ -1069,19 +1093,6 @@ int autoca_initialize() {
                if ( code ) return code;
        }
 
-       for ( i=0; aca_attr2[i].at; i++ ) {
-               code = slap_str2ad( aca_attr2[i].at, aca_attr2[i].ad, &text );
-               if ( code ) return code;
-       }
-
-       /* Schema may not be loaded, ignore if missing */
-       slap_str2ad( "ipHostNumber", &ad_ipaddr, &text );
-
-       for ( i=0; aca_ocs[i].ot; i++ ) {
-               code = register_oc( aca_ocs[i].ot, aca_ocs[i].oc, 0 );
-               if ( code ) return code;
-       }
-
        return overlay_register( &autoca );
 }