upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-12-20 22:59:34 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

ITS#7683 more for tls version/cipher info

Browse source 
Add LDAP_OPT_X_TLS_VERSION / LDAP_OPT_X_TLS_CIPHER for
retrieving from an LDAP session handle. Update ldap_get_option(3).
This commit is contained in:
Howard Chu 2013-09-09 11:41:28 -07:00
parent 057b2bab20
commit 0045e56c34
3 changed files with 64 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
doc/man/man3/ldap_get_option.3
View file

@ -608,6 +608,14 @@ must be
and its contents need to be freed by the caller using and its contents need to be freed by the caller using
.BR ldap_memfree (3). .BR ldap_memfree (3).
.TP .TP
.B LDAP_OPT_X_TLS_CIPHER
Gets the cipher being used on an established TLS session.
.BR outvalue
must be
.BR "char **" ,
and its contents need to be freed by the caller using
.BR ldap_memfree (3).
.TP
.B LDAP_OPT_X_TLS_CIPHER_SUITE .B LDAP_OPT_X_TLS_CIPHER_SUITE
Sets/gets the allowed cipher suite. Sets/gets the allowed cipher suite.
.BR invalue .BR invalue
@ -688,7 +696,21 @@ must be
.BR "char **" , .BR "char **" ,
and its contents need to be freed by the caller using and its contents need to be freed by the caller using
.BR ldap_memfree (3). .BR ldap_memfree (3).
Ignored by GnuTLS and Mozilla NSS. Ignored by Mozilla NSS.
.TP
.B LDAP_OPT_X_TLS_ECNAME
Gets/sets the name of the curve used for
elliptic curve key exchanges.
.BR invalue
must be
.BR "const char *" ;
.BR outvalue
must be
.BR "char **" ,
and its contents need to be freed by the caller using
.BR ldap_memfree (3).
Ignored by GnuTLS and Mozilla NSS. In GnuTLS a curve may be selected
in the cipher suite specification.
.TP .TP
.B LDAP_OPT_X_TLS_KEYFILE .B LDAP_OPT_X_TLS_KEYFILE
Sets/gets the full-path of the certificate key file. Sets/gets the full-path of the certificate key file.
@ -752,6 +774,14 @@ must be
When using the OpenSSL library this is an SSL*. When using other When using the OpenSSL library this is an SSL*. When using other
crypto libraries this is a pointer to an OpenLDAP private structure. crypto libraries this is a pointer to an OpenLDAP private structure.
Applications generally should not use this option. Applications generally should not use this option.
.TP
.B LDAP_OPT_X_TLS_VERSION
Gets the TLS version being used on an established TLS session.
.BR outvalue
must be
.BR "char **" ,
and its contents need to be freed by the caller using
.BR ldap_memfree (3).
.SH ERRORS .SH ERRORS
On success, the functions return On success, the functions return
.BR LDAP_OPT_SUCCESS , .BR LDAP_OPT_SUCCESS ,

2
include/ldap.h
View file

@ -159,6 +159,8 @@ LDAP_BEGIN_DECL
#define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */
#define LDAP_OPT_X_TLS_PACKAGE 0x6011 #define LDAP_OPT_X_TLS_PACKAGE 0x6011
#define LDAP_OPT_X_TLS_ECNAME 0x6012 #define LDAP_OPT_X_TLS_ECNAME 0x6012
#define LDAP_OPT_X_TLS_VERSION 0x6013 /* read-only */
#define LDAP_OPT_X_TLS_CIPHER 0x6014 /* read-only */
#define LDAP_OPT_X_TLS_NEVER 0 #define LDAP_OPT_X_TLS_NEVER 0
#define LDAP_OPT_X_TLS_HARD 1 #define LDAP_OPT_X_TLS_HARD 1

31
libraries/libldap/tls2.c
View file

@ -688,6 +688,37 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg )
case LDAP_OPT_X_TLS_CONNECT_ARG: case LDAP_OPT_X_TLS_CONNECT_ARG:
*(void **)arg = lo->ldo_tls_connect_arg; *(void **)arg = lo->ldo_tls_connect_arg;
break; break;
case LDAP_OPT_X_TLS_VERSION: {
void *sess = NULL;
const char *retval = NULL;
if ( ld != NULL ) {
LDAPConn *conn = ld->ld_defconn;
if ( conn != NULL ) {
Sockbuf *sb = conn->lconn_sb;
sess = ldap_pvt_tls_sb_ctx( sb );
if ( sess != NULL )
retval = ldap_pvt_tls_get_version( sess );
}
}
*(char **)arg = retval ? LDAP_STRDUP( retval ) : NULL;
break;
}
case LDAP_OPT_X_TLS_CIPHER: {
void *sess = NULL;
const char *retval = NULL;
if ( ld != NULL ) {
LDAPConn *conn = ld->ld_defconn;
if ( conn != NULL ) {
Sockbuf *sb = conn->lconn_sb;
sess = ldap_pvt_tls_sb_ctx( sb );
if ( sess != NULL )
retval = ldap_pvt_tls_get_cipher( sess );
}
}
*(char **)arg = retval ? LDAP_STRDUP( retval ) : NULL;
break;
}
default: default:
return -1; return -1;
} }