Preliminary GNUtls support. gnutls.c will merge back into tls.c later.

include/ldap_pvt.h

@@ -285,8 +285,7 @@ LDAP_F (int) ldap_pvt_tls_init_def_ctx LDAP_P(( int is_server ));
 LDAP_F (int) ldap_pvt_tls_accept LDAP_P(( Sockbuf *sb, void *ctx_arg ));
 LDAP_F (int) ldap_pvt_tls_inplace LDAP_P(( Sockbuf *sb ));
 LDAP_F (void *) ldap_pvt_tls_sb_ctx LDAP_P(( Sockbuf *sb ));
-
+LDAP_F (void) ldap_pvt_tls_ctx_free LDAP_P(( void * ));
-LDAP_F (int) ldap_pvt_tls_init_default_ctx LDAP_P(( void ));
 
 typedef int LDAPDN_rewrite_dummy LDAP_P (( void *dn, unsigned flags ));
 

libraries/libldap/getdn.c

@@ -3309,202 +3309,3 @@ return_results:;
 	return( rc );
 }
 
-#ifdef HAVE_TLS
-#include <openssl/x509.h>
-#include <openssl/err.h>
-
-/* Convert a structured DN from an X.509 certificate into an LDAPV3 DN.
- * x509_name must be an (X509_NAME *). If func is non-NULL, the
- * constructed DN will use numeric OIDs to identify attributeTypes,
- * and the func() will be invoked to rewrite the DN with the given
- * flags.
- *
- * Otherwise the DN will use shortNames as defined in the OpenSSL
- * library.
- *
- * It's preferable to let slapd do the OID to attributeType mapping,
- * because the OpenSSL tables are known to have many typos in versions
- * up to (at least) 0.9.6c. However, the LDAP client has no schema tables,
- * so we're forced to use OpenSSL's mapping there.
- *  -- Howard Chu 2002-04-18
- */
-
-int
-ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
-	unsigned flags )
-{
-	LDAPDN	newDN;
-	LDAPRDN	newRDN;
-	LDAPAVA *newAVA, *baseAVA;
-	X509_NAME_ENTRY *ne;
-	ASN1_OBJECT *obj;
-	ASN1_STRING *str;
-	char oids[8192], *oidptr = oids, *oidbuf = NULL;
-	void *ptrs[2048];
-	int i, j, k = 0, navas, nrdns, rc = LDAP_SUCCESS;
-	int set = -1;
-	size_t dnsize, oidrem = sizeof(oids), oidsize = 0;
-	int csize;
-
-	struct berval	Val;
-
-	assert( bv != NULL );
-	bv->bv_len = 0;
-	bv->bv_val = NULL;
-
-	/* Get the number of AVAs. This is not necessarily the same as
-	 * the number of RDNs.
-	 */
-	navas = X509_NAME_entry_count( x509_name );
-
-	/* Get the last element, to see how many RDNs there are */
-	ne = X509_NAME_get_entry( x509_name, navas - 1 );
-	nrdns = ne->set + 1;
-
-	/* Allocate the DN/RDN/AVA stuff as a single block */    
-	dnsize = sizeof(LDAPRDN) * (nrdns+1);
-	dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
-	dnsize += sizeof(LDAPAVA) * navas;
-	if (dnsize > sizeof(ptrs)) {
-		newDN = (LDAPDN)LDAP_MALLOC( dnsize );
-		if ( newDN == NULL )
-			return LDAP_NO_MEMORY;
-	} else {
-		newDN = (LDAPDN)(char *)ptrs;
-	}
-	
-	newDN[nrdns] = NULL;
-	newRDN = (LDAPRDN)(newDN + nrdns+1);
-	newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
-	baseAVA = newAVA;
-
-	/* Retrieve RDNs in reverse order; LDAP is backwards from X.500. */
-	for ( i = nrdns - 1, j = 0; i >= 0; i-- ) {
-		ne = X509_NAME_get_entry( x509_name, i );
-		obj = X509_NAME_ENTRY_get_object( ne );
-		str = X509_NAME_ENTRY_get_data( ne );
-
-		/* If set changed, move to next RDN */
-		if ( set != ne->set ) {
-			/* If this is not the first time, end the
-			 * previous RDN and advance.
-			 */
-			if ( j > 0 ) {
-				newRDN[k] = NULL;
-				newRDN += k+1;
-			}
-			newDN[j++] = newRDN;
-
-			k = 0;
-			set = ne->set;
-		}
-		newAVA->la_private = NULL;
-		newAVA->la_flags = LDAP_AVA_STRING;
-
-		if ( !func ) {
-			int n = OBJ_obj2nid( obj );
-
-			if (n == NID_undef)
-				goto get_oid;
-			newAVA->la_attr.bv_val = (char *)OBJ_nid2sn( n );
-			newAVA->la_attr.bv_len = strlen( newAVA->la_attr.bv_val );
-#ifdef HAVE_EBCDIC
-			newAVA->la_attr.bv_val = LDAP_STRDUP( newAVA->la_attr.bv_val );
-			__etoa( newAVA->la_attr.bv_val );
-			newAVA->la_flags |= LDAP_AVA_FREE_ATTR;
-#endif
-		} else {
-get_oid:		newAVA->la_attr.bv_val = oidptr;
-			newAVA->la_attr.bv_len = OBJ_obj2txt( oidptr, oidrem, obj, 1 );
-#ifdef HAVE_EBCDIC
-			__etoa( newAVA->la_attr.bv_val );
-#endif
-			oidptr += newAVA->la_attr.bv_len + 1;
-			oidrem -= newAVA->la_attr.bv_len + 1;
-
-			/* Running out of OID buffer space? */
-			if (oidrem < 128) {
-				if ( oidsize == 0 ) {
-					oidsize = sizeof(oids) * 2;
-					oidrem = oidsize;
-					oidbuf = LDAP_MALLOC( oidsize );
-					if ( oidbuf == NULL ) goto nomem;
-					oidptr = oidbuf;
-				} else {
-					char *old = oidbuf;
-					oidbuf = LDAP_REALLOC( oidbuf, oidsize*2 );
-					if ( oidbuf == NULL ) goto nomem;
-					/* Buffer moved! Fix AVA pointers */
-					if ( old != oidbuf ) {
-						LDAPAVA *a;
-						long dif = oidbuf - old;
-
-						for (a=baseAVA; a<=newAVA; a++){
-							if (a->la_attr.bv_val >= old &&
-								a->la_attr.bv_val <= (old + oidsize))
-								a->la_attr.bv_val += dif;
-						}
-					}
-					oidptr = oidbuf + oidsize - oidrem;
-					oidrem += oidsize;
-					oidsize *= 2;
-				}
-			}
-		}
-		Val.bv_val = (char *) str->data;
-		Val.bv_len = str->length;
-		switch( str->type ) {
-		case V_ASN1_UNIVERSALSTRING:
-			/* This uses 32-bit ISO 10646-1 */
-			csize = 4; goto to_utf8;
-		case V_ASN1_BMPSTRING:
-			/* This uses 16-bit ISO 10646-1 */
-			csize = 2; goto to_utf8;
-		case V_ASN1_T61STRING:
-			/* This uses 8-bit, assume ISO 8859-1 */
-			csize = 1;
-to_utf8:		rc = ldap_ucs_to_utf8s( &Val, csize, &newAVA->la_value );
-			newAVA->la_flags |= LDAP_AVA_FREE_VALUE;
-			if (rc != LDAP_SUCCESS) goto nomem;
-			newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
-			break;
-		case V_ASN1_UTF8STRING:
-			newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
-			/* This is already in UTF-8 encoding */
-		case V_ASN1_IA5STRING:
-		case V_ASN1_PRINTABLESTRING:
-			/* These are always 7-bit strings */
-			newAVA->la_value = Val;
-		default:
-			;
-		}
-		newRDN[k] = newAVA;
-		newAVA++;
-		k++;
-	}
-	newRDN[k] = NULL;
-
-	if ( func ) {
-		rc = func( newDN, flags, NULL );
-		if ( rc != LDAP_SUCCESS )
-			goto nomem;
-	}
-
-	rc = ldap_dn2bv_x( newDN, bv, LDAP_DN_FORMAT_LDAPV3, NULL );
-
-nomem:
-	for (;baseAVA < newAVA; baseAVA++) {
-		if (baseAVA->la_flags & LDAP_AVA_FREE_ATTR)
-			LDAP_FREE( baseAVA->la_attr.bv_val );
-		if (baseAVA->la_flags & LDAP_AVA_FREE_VALUE)
-			LDAP_FREE( baseAVA->la_value.bv_val );
-	}
-
-	if ( oidsize != 0 )
-		LDAP_FREE( oidbuf );
-	if ( newDN != (LDAPDN)(char *) ptrs )
-		LDAP_FREE( newDN );
-	return rc;
-}
-#endif /* HAVE_TLS */
-

libraries/libldap/tls.c

@@ -37,6 +37,11 @@
 #include <ldap_pvt_thread.h>
 #endif
 
+#ifdef HAVE_GNUTLS
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gcrypt.h>
+#else
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
@@ -46,6 +51,7 @@
 #elif defined( HAVE_SSL_H )
 #include <ssl.h>
 #endif
+#endif
 
 static int  tls_opt_trace = 1;
 static char *tls_opt_randfile = NULL;
@@ -113,11 +119,17 @@ static void tls_init_threads( void )
 }
 #endif /* LDAP_R_COMPILE */
 
+void
+ldap_pvt_tls_ctx_free ( void *c )
+{
+	SSL_CTX_free( c );
+}
+
 void
 ldap_int_tls_destroy( struct ldapoptions *lo )
 {
 	if ( lo->ldo_tls_ctx ) {
-		SSL_CTX_free( lo->ldo_tls_ctx );
+		ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
 		lo->ldo_tls_ctx = NULL;
 	}
 
@@ -394,7 +406,7 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server )
 
 error_exit:
 	if ( rc == -1 && lo->ldo_tls_ctx != NULL ) {
-		SSL_CTX_free( lo->ldo_tls_ctx );
+		ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
 		lo->ldo_tls_ctx = NULL;
 	}
 #ifdef HAVE_EBCDIC
@@ -1373,7 +1385,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 
 	case LDAP_OPT_X_TLS_CTX:
 		if ( lo->ldo_tls_ctx )
-			SSL_CTX_free( lo->ldo_tls_ctx );
+			ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
 		lo->ldo_tls_ctx = arg;
 		CRYPTO_add( &((SSL_CTX *)arg)->references, 1, CRYPTO_LOCK_SSL_CTX );
 		return 0;
@@ -1442,7 +1454,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 	case LDAP_OPT_X_TLS_NEWCTX:
 		if ( !arg ) return -1;
 		if ( lo->ldo_tls_ctx )
-			SSL_CTX_free( lo->ldo_tls_ctx );
+			ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
 		lo->ldo_tls_ctx = NULL;
 		return ldap_int_tls_init_ctx( lo, *(int *)arg );
 	default:
@@ -1932,3 +1944,199 @@ ldap_start_tls_s ( LDAP *ld,
 #endif
 }
 
+#ifdef HAVE_TLS
+/* Convert a structured DN from an X.509 certificate into an LDAPV3 DN.
+ * x509_name must be an (X509_NAME *). If func is non-NULL, the
+ * constructed DN will use numeric OIDs to identify attributeTypes,
+ * and the func() will be invoked to rewrite the DN with the given
+ * flags.
+ *
+ * Otherwise the DN will use shortNames as defined in the OpenSSL
+ * library.
+ *
+ * It's preferable to let slapd do the OID to attributeType mapping,
+ * because the OpenSSL tables are known to have many typos in versions
+ * up to (at least) 0.9.6c. However, the LDAP client has no schema tables,
+ * so we're forced to use OpenSSL's mapping there.
+ *  -- Howard Chu 2002-04-18
+ */
+
+int
+ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
+	unsigned flags )
+{
+	LDAPDN	newDN;
+	LDAPRDN	newRDN;
+	LDAPAVA *newAVA, *baseAVA;
+	X509_NAME_ENTRY *ne;
+	ASN1_OBJECT *obj;
+	ASN1_STRING *str;
+	char oids[8192], *oidptr = oids, *oidbuf = NULL;
+	void *ptrs[2048];
+	int i, j, k = 0, navas, nrdns, rc = LDAP_SUCCESS;
+	int set = -1;
+	size_t dnsize, oidrem = sizeof(oids), oidsize = 0;
+	int csize;
+
+	struct berval	Val;
+
+	assert( bv != NULL );
+	bv->bv_len = 0;
+	bv->bv_val = NULL;
+
+	/* Get the number of AVAs. This is not necessarily the same as
+	 * the number of RDNs.
+	 */
+	navas = X509_NAME_entry_count( x509_name );
+
+	/* Get the last element, to see how many RDNs there are */
+	ne = X509_NAME_get_entry( x509_name, navas - 1 );
+	nrdns = ne->set + 1;
+
+	/* Allocate the DN/RDN/AVA stuff as a single block */    
+	dnsize = sizeof(LDAPRDN) * (nrdns+1);
+	dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
+	dnsize += sizeof(LDAPAVA) * navas;
+	if (dnsize > sizeof(ptrs)) {
+		newDN = (LDAPDN)LDAP_MALLOC( dnsize );
+		if ( newDN == NULL )
+			return LDAP_NO_MEMORY;
+	} else {
+		newDN = (LDAPDN)(char *)ptrs;
+	}
+	
+	newDN[nrdns] = NULL;
+	newRDN = (LDAPRDN)(newDN + nrdns+1);
+	newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
+	baseAVA = newAVA;
+
+	/* Retrieve RDNs in reverse order; LDAP is backwards from X.500. */
+	for ( i = nrdns - 1, j = 0; i >= 0; i-- ) {
+		ne = X509_NAME_get_entry( x509_name, i );
+		obj = X509_NAME_ENTRY_get_object( ne );
+		str = X509_NAME_ENTRY_get_data( ne );
+
+		/* If set changed, move to next RDN */
+		if ( set != ne->set ) {
+			/* If this is not the first time, end the
+			 * previous RDN and advance.
+			 */
+			if ( j > 0 ) {
+				newRDN[k] = NULL;
+				newRDN += k+1;
+			}
+			newDN[j++] = newRDN;
+
+			k = 0;
+			set = ne->set;
+		}
+		newAVA->la_private = NULL;
+		newAVA->la_flags = LDAP_AVA_STRING;
+
+		if ( !func ) {
+			int n = OBJ_obj2nid( obj );
+
+			if (n == NID_undef)
+				goto get_oid;
+			newAVA->la_attr.bv_val = (char *)OBJ_nid2sn( n );
+			newAVA->la_attr.bv_len = strlen( newAVA->la_attr.bv_val );
+#ifdef HAVE_EBCDIC
+			newAVA->la_attr.bv_val = LDAP_STRDUP( newAVA->la_attr.bv_val );
+			__etoa( newAVA->la_attr.bv_val );
+			newAVA->la_flags |= LDAP_AVA_FREE_ATTR;
+#endif
+		} else {
+get_oid:		newAVA->la_attr.bv_val = oidptr;
+			newAVA->la_attr.bv_len = OBJ_obj2txt( oidptr, oidrem, obj, 1 );
+#ifdef HAVE_EBCDIC
+			__etoa( newAVA->la_attr.bv_val );
+#endif
+			oidptr += newAVA->la_attr.bv_len + 1;
+			oidrem -= newAVA->la_attr.bv_len + 1;
+
+			/* Running out of OID buffer space? */
+			if (oidrem < 128) {
+				if ( oidsize == 0 ) {
+					oidsize = sizeof(oids) * 2;
+					oidrem = oidsize;
+					oidbuf = LDAP_MALLOC( oidsize );
+					if ( oidbuf == NULL ) goto nomem;
+					oidptr = oidbuf;
+				} else {
+					char *old = oidbuf;
+					oidbuf = LDAP_REALLOC( oidbuf, oidsize*2 );
+					if ( oidbuf == NULL ) goto nomem;
+					/* Buffer moved! Fix AVA pointers */
+					if ( old != oidbuf ) {
+						LDAPAVA *a;
+						long dif = oidbuf - old;
+
+						for (a=baseAVA; a<=newAVA; a++){
+							if (a->la_attr.bv_val >= old &&
+								a->la_attr.bv_val <= (old + oidsize))
+								a->la_attr.bv_val += dif;
+						}
+					}
+					oidptr = oidbuf + oidsize - oidrem;
+					oidrem += oidsize;
+					oidsize *= 2;
+				}
+			}
+		}
+		Val.bv_val = (char *) str->data;
+		Val.bv_len = str->length;
+		switch( str->type ) {
+		case V_ASN1_UNIVERSALSTRING:
+			/* This uses 32-bit ISO 10646-1 */
+			csize = 4; goto to_utf8;
+		case V_ASN1_BMPSTRING:
+			/* This uses 16-bit ISO 10646-1 */
+			csize = 2; goto to_utf8;
+		case V_ASN1_T61STRING:
+			/* This uses 8-bit, assume ISO 8859-1 */
+			csize = 1;
+to_utf8:		rc = ldap_ucs_to_utf8s( &Val, csize, &newAVA->la_value );
+			newAVA->la_flags |= LDAP_AVA_FREE_VALUE;
+			if (rc != LDAP_SUCCESS) goto nomem;
+			newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
+			break;
+		case V_ASN1_UTF8STRING:
+			newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
+			/* This is already in UTF-8 encoding */
+		case V_ASN1_IA5STRING:
+		case V_ASN1_PRINTABLESTRING:
+			/* These are always 7-bit strings */
+			newAVA->la_value = Val;
+		default:
+			;
+		}
+		newRDN[k] = newAVA;
+		newAVA++;
+		k++;
+	}
+	newRDN[k] = NULL;
+
+	if ( func ) {
+		rc = func( newDN, flags, NULL );
+		if ( rc != LDAP_SUCCESS )
+			goto nomem;
+	}
+
+	rc = ldap_dn2bv_x( newDN, bv, LDAP_DN_FORMAT_LDAPV3, NULL );
+
+nomem:
+	for (;baseAVA < newAVA; baseAVA++) {
+		if (baseAVA->la_flags & LDAP_AVA_FREE_ATTR)
+			LDAP_FREE( baseAVA->la_attr.bv_val );
+		if (baseAVA->la_flags & LDAP_AVA_FREE_VALUE)
+			LDAP_FREE( baseAVA->la_value.bv_val );
+	}
+
+	if ( oidsize != 0 )
+		LDAP_FREE( oidbuf );
+	if ( newDN != (LDAPDN)(char *) ptrs )
+		LDAP_FREE( newDN );
+	return rc;
+}
+#endif /* HAVE_TLS */
+

servers/slapd/config.c

@@ -1351,12 +1351,6 @@ void bindconf_free( slap_bindconf *bc ) {
 		BER_BVZERO( &bc->sb_authzId );
 	}
 #ifdef HAVE_TLS
-#if 0
-	if ( bc->sb_tls_ctx ) {
-		SSL_CTX_free( bc->sb_tls_ctx );
-		bc->sb_tls_ctx = NULL;
-	}
-#endif
 	if ( bc->sb_tls_cert ) {
 		ch_free( bc->sb_tls_cert );
 		bc->sb_tls_cert = NULL;
@@ -1483,7 +1477,7 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
 		int opt = 0;
 
 		if ( bc->sb_tls_ctx ) {
-			SSL_CTX_free( bc->sb_tls_ctx );
+			ldap_pvt_tls_ctx_free( bc->sb_tls_ctx );
 			bc->sb_tls_ctx = NULL;
 		}
 		rc = ldap_set_option( ld, LDAP_OPT_X_TLS_NEWCTX, &opt );

servers/slapd/main.c

@@ -991,7 +991,7 @@ stop:
 
 #ifdef HAVE_TLS
 	if ( slap_tls_ld ) {
-		SSL_CTX_free( slap_tls_ctx );
+		ldap_pvt_tls_ctx_free( slap_tls_ctx );
 		ldap_unbind_ext( slap_tls_ld, NULL, NULL );
 	}
 	ldap_pvt_tls_destroy();