upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-12-20 22:59:34 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Preliminary GNUtls support. gnutls.c will merge back into tls.c later.

Browse source
This commit is contained in:
Howard Chu 2007-03-23 23:47:07 +00:00
parent b213588f95
commit 49d708fae3
6 changed files with 1970 additions and 213 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
include/ldap_pvt.h
View file

@ -285,8 +285,7 @@ LDAP_F (int) ldap_pvt_tls_init_def_ctx LDAP_P(( int is_server ));
LDAP_F (int) ldap_pvt_tls_accept LDAP_P(( Sockbuf *sb, void *ctx_arg ));
LDAP_F (int) ldap_pvt_tls_inplace LDAP_P(( Sockbuf *sb ));
LDAP_F (void *) ldap_pvt_tls_sb_ctx LDAP_P(( Sockbuf *sb ));
LDAP_F (int) ldap_pvt_tls_init_default_ctx LDAP_P(( void ));
LDAP_F (void) ldap_pvt_tls_ctx_free LDAP_P(( void * ));
typedef int LDAPDN_rewrite_dummy LDAP_P (( void *dn, unsigned flags ));

199
libraries/libldap/getdn.c
View file

@ -3309,202 +3309,3 @@ return_results:;
return( rc );
}
#ifdef HAVE_TLS
#include <openssl/x509.h>
#include <openssl/err.h>
/* Convert a structured DN from an X.509 certificate into an LDAPV3 DN.
* x509_name must be an (X509_NAME *). If func is non-NULL, the
* constructed DN will use numeric OIDs to identify attributeTypes,
* and the func() will be invoked to rewrite the DN with the given
* flags.
*
* Otherwise the DN will use shortNames as defined in the OpenSSL
* library.
*
* It's preferable to let slapd do the OID to attributeType mapping,
* because the OpenSSL tables are known to have many typos in versions
* up to (at least) 0.9.6c. However, the LDAP client has no schema tables,
* so we're forced to use OpenSSL's mapping there.
* -- Howard Chu 2002-04-18
*/
int
ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
unsigned flags )
{
LDAPDN newDN;
LDAPRDN newRDN;
LDAPAVA *newAVA, *baseAVA;
X509_NAME_ENTRY *ne;
ASN1_OBJECT *obj;
ASN1_STRING *str;
char oids[8192], *oidptr = oids, *oidbuf = NULL;
void *ptrs[2048];
int i, j, k = 0, navas, nrdns, rc = LDAP_SUCCESS;
int set = -1;
size_t dnsize, oidrem = sizeof(oids), oidsize = 0;
int csize;
struct berval Val;
assert( bv != NULL );
bv->bv_len = 0;
bv->bv_val = NULL;
/* Get the number of AVAs. This is not necessarily the same as
* the number of RDNs.
*/
navas = X509_NAME_entry_count( x509_name );
/* Get the last element, to see how many RDNs there are */
ne = X509_NAME_get_entry( x509_name, navas - 1 );
nrdns = ne->set + 1;
/* Allocate the DN/RDN/AVA stuff as a single block */
dnsize = sizeof(LDAPRDN) * (nrdns+1);
dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
dnsize += sizeof(LDAPAVA) * navas;
if (dnsize > sizeof(ptrs)) {
newDN = (LDAPDN)LDAP_MALLOC( dnsize );
if ( newDN == NULL )
return LDAP_NO_MEMORY;
} else {
newDN = (LDAPDN)(char *)ptrs;
}
newDN[nrdns] = NULL;
newRDN = (LDAPRDN)(newDN + nrdns+1);
newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
baseAVA = newAVA;
/* Retrieve RDNs in reverse order; LDAP is backwards from X.500. */
for ( i = nrdns - 1, j = 0; i >= 0; i-- ) {
ne = X509_NAME_get_entry( x509_name, i );
obj = X509_NAME_ENTRY_get_object( ne );
str = X509_NAME_ENTRY_get_data( ne );
/* If set changed, move to next RDN */
if ( set != ne->set ) {
/* If this is not the first time, end the
* previous RDN and advance.
*/
if ( j > 0 ) {
newRDN[k] = NULL;
newRDN += k+1;
}
newDN[j++] = newRDN;
k = 0;
set = ne->set;
}
newAVA->la_private = NULL;
newAVA->la_flags = LDAP_AVA_STRING;
if ( !func ) {
int n = OBJ_obj2nid( obj );
if (n == NID_undef)
goto get_oid;
newAVA->la_attr.bv_val = (char *)OBJ_nid2sn( n );
newAVA->la_attr.bv_len = strlen( newAVA->la_attr.bv_val );
#ifdef HAVE_EBCDIC
newAVA->la_attr.bv_val = LDAP_STRDUP( newAVA->la_attr.bv_val );
__etoa( newAVA->la_attr.bv_val );
newAVA->la_flags |= LDAP_AVA_FREE_ATTR;
#endif
} else {
get_oid: newAVA->la_attr.bv_val = oidptr;
newAVA->la_attr.bv_len = OBJ_obj2txt( oidptr, oidrem, obj, 1 );
#ifdef HAVE_EBCDIC
__etoa( newAVA->la_attr.bv_val );
#endif
oidptr += newAVA->la_attr.bv_len + 1;
oidrem -= newAVA->la_attr.bv_len + 1;
/* Running out of OID buffer space? */
if (oidrem < 128) {
if ( oidsize == 0 ) {
oidsize = sizeof(oids) * 2;
oidrem = oidsize;
oidbuf = LDAP_MALLOC( oidsize );
if ( oidbuf == NULL ) goto nomem;
oidptr = oidbuf;
} else {
char *old = oidbuf;
oidbuf = LDAP_REALLOC( oidbuf, oidsize*2 );
if ( oidbuf == NULL ) goto nomem;
/* Buffer moved! Fix AVA pointers */
if ( old != oidbuf ) {
LDAPAVA *a;
long dif = oidbuf - old;
for (a=baseAVA; a<=newAVA; a++){
if (a->la_attr.bv_val >= old &&
a->la_attr.bv_val <= (old + oidsize))
a->la_attr.bv_val += dif;
}
}
oidptr = oidbuf + oidsize - oidrem;
oidrem += oidsize;
oidsize *= 2;
}
}
}
Val.bv_val = (char *) str->data;
Val.bv_len = str->length;
switch( str->type ) {
case V_ASN1_UNIVERSALSTRING:
/* This uses 32-bit ISO 10646-1 */
csize = 4; goto to_utf8;
case V_ASN1_BMPSTRING:
/* This uses 16-bit ISO 10646-1 */
csize = 2; goto to_utf8;
case V_ASN1_T61STRING:
/* This uses 8-bit, assume ISO 8859-1 */
csize = 1;
to_utf8: rc = ldap_ucs_to_utf8s( &Val, csize, &newAVA->la_value );
newAVA->la_flags |= LDAP_AVA_FREE_VALUE;
if (rc != LDAP_SUCCESS) goto nomem;
newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
break;
case V_ASN1_UTF8STRING:
newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
/* This is already in UTF-8 encoding */
case V_ASN1_IA5STRING:
case V_ASN1_PRINTABLESTRING:
/* These are always 7-bit strings */
newAVA->la_value = Val;
default:
;
}
newRDN[k] = newAVA;
newAVA++;
k++;
}
newRDN[k] = NULL;
if ( func ) {
rc = func( newDN, flags, NULL );
if ( rc != LDAP_SUCCESS )
goto nomem;
}
rc = ldap_dn2bv_x( newDN, bv, LDAP_DN_FORMAT_LDAPV3, NULL );
nomem:
for (;baseAVA < newAVA; baseAVA++) {
if (baseAVA->la_flags & LDAP_AVA_FREE_ATTR)
LDAP_FREE( baseAVA->la_attr.bv_val );
if (baseAVA->la_flags & LDAP_AVA_FREE_VALUE)
LDAP_FREE( baseAVA->la_value.bv_val );
}
if ( oidsize != 0 )
LDAP_FREE( oidbuf );
if ( newDN != (LDAPDN)(char *) ptrs )
LDAP_FREE( newDN );
return rc;
}
#endif /* HAVE_TLS */

1755
libraries/libldap/gnutls.c Normal file
View file

File diff suppressed because it is too large Load diff

216
libraries/libldap/tls.c
View file

@ -37,6 +37,11 @@
#include <ldap_pvt_thread.h>
#endif
#ifdef HAVE_GNUTLS
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
#include <gcrypt.h>
#else
#ifdef HAVE_OPENSSL_SSL_H
#include <openssl/ssl.h>
#include <openssl/x509v3.h>
@ -46,6 +51,7 @@
#elif defined( HAVE_SSL_H )
#include <ssl.h>
#endif
#endif
static int tls_opt_trace = 1;
static char *tls_opt_randfile = NULL;
@ -113,11 +119,17 @@ static void tls_init_threads( void )
}
#endif /* LDAP_R_COMPILE */
void
ldap_pvt_tls_ctx_free ( void *c )
{
SSL_CTX_free( c );
}
void
ldap_int_tls_destroy( struct ldapoptions *lo )
{
if ( lo->ldo_tls_ctx ) {
SSL_CTX_free( lo->ldo_tls_ctx );
ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
lo->ldo_tls_ctx = NULL;
}
@ -394,7 +406,7 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server )
error_exit:
if ( rc == -1 && lo->ldo_tls_ctx != NULL ) {
SSL_CTX_free( lo->ldo_tls_ctx );
ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
lo->ldo_tls_ctx = NULL;
}
#ifdef HAVE_EBCDIC
@ -1373,7 +1385,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
case LDAP_OPT_X_TLS_CTX:
if ( lo->ldo_tls_ctx )
SSL_CTX_free( lo->ldo_tls_ctx );
ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
lo->ldo_tls_ctx = arg;
CRYPTO_add( &((SSL_CTX *)arg)->references, 1, CRYPTO_LOCK_SSL_CTX );
return 0;
@ -1442,7 +1454,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
case LDAP_OPT_X_TLS_NEWCTX:
if ( !arg ) return -1;
if ( lo->ldo_tls_ctx )
SSL_CTX_free( lo->ldo_tls_ctx );
ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
lo->ldo_tls_ctx = NULL;
return ldap_int_tls_init_ctx( lo, *(int *)arg );
default:
@ -1932,3 +1944,199 @@ ldap_start_tls_s ( LDAP *ld,
#endif
}
#ifdef HAVE_TLS
/* Convert a structured DN from an X.509 certificate into an LDAPV3 DN.
* x509_name must be an (X509_NAME *). If func is non-NULL, the
* constructed DN will use numeric OIDs to identify attributeTypes,
* and the func() will be invoked to rewrite the DN with the given
* flags.
*
* Otherwise the DN will use shortNames as defined in the OpenSSL
* library.
*
* It's preferable to let slapd do the OID to attributeType mapping,
* because the OpenSSL tables are known to have many typos in versions
* up to (at least) 0.9.6c. However, the LDAP client has no schema tables,
* so we're forced to use OpenSSL's mapping there.
* -- Howard Chu 2002-04-18
*/
int
ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
unsigned flags )
{
LDAPDN newDN;
LDAPRDN newRDN;
LDAPAVA *newAVA, *baseAVA;
X509_NAME_ENTRY *ne;
ASN1_OBJECT *obj;
ASN1_STRING *str;
char oids[8192], *oidptr = oids, *oidbuf = NULL;
void *ptrs[2048];
int i, j, k = 0, navas, nrdns, rc = LDAP_SUCCESS;
int set = -1;
size_t dnsize, oidrem = sizeof(oids), oidsize = 0;
int csize;
struct berval Val;
assert( bv != NULL );
bv->bv_len = 0;
bv->bv_val = NULL;
/* Get the number of AVAs. This is not necessarily the same as
* the number of RDNs.
*/
navas = X509_NAME_entry_count( x509_name );
/* Get the last element, to see how many RDNs there are */
ne = X509_NAME_get_entry( x509_name, navas - 1 );
nrdns = ne->set + 1;
/* Allocate the DN/RDN/AVA stuff as a single block */
dnsize = sizeof(LDAPRDN) * (nrdns+1);
dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
dnsize += sizeof(LDAPAVA) * navas;
if (dnsize > sizeof(ptrs)) {
newDN = (LDAPDN)LDAP_MALLOC( dnsize );
if ( newDN == NULL )
return LDAP_NO_MEMORY;
} else {
newDN = (LDAPDN)(char *)ptrs;
}
newDN[nrdns] = NULL;
newRDN = (LDAPRDN)(newDN + nrdns+1);
newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
baseAVA = newAVA;
/* Retrieve RDNs in reverse order; LDAP is backwards from X.500. */
for ( i = nrdns - 1, j = 0; i >= 0; i-- ) {
ne = X509_NAME_get_entry( x509_name, i );
obj = X509_NAME_ENTRY_get_object( ne );
str = X509_NAME_ENTRY_get_data( ne );
/* If set changed, move to next RDN */
if ( set != ne->set ) {
/* If this is not the first time, end the
* previous RDN and advance.
*/
if ( j > 0 ) {
newRDN[k] = NULL;
newRDN += k+1;
}
newDN[j++] = newRDN;
k = 0;
set = ne->set;
}
newAVA->la_private = NULL;
newAVA->la_flags = LDAP_AVA_STRING;
if ( !func ) {
int n = OBJ_obj2nid( obj );
if (n == NID_undef)
goto get_oid;
newAVA->la_attr.bv_val = (char *)OBJ_nid2sn( n );
newAVA->la_attr.bv_len = strlen( newAVA->la_attr.bv_val );
#ifdef HAVE_EBCDIC
newAVA->la_attr.bv_val = LDAP_STRDUP( newAVA->la_attr.bv_val );
__etoa( newAVA->la_attr.bv_val );
newAVA->la_flags |= LDAP_AVA_FREE_ATTR;
#endif
} else {
get_oid: newAVA->la_attr.bv_val = oidptr;
newAVA->la_attr.bv_len = OBJ_obj2txt( oidptr, oidrem, obj, 1 );
#ifdef HAVE_EBCDIC
__etoa( newAVA->la_attr.bv_val );
#endif
oidptr += newAVA->la_attr.bv_len + 1;
oidrem -= newAVA->la_attr.bv_len + 1;
/* Running out of OID buffer space? */
if (oidrem < 128) {
if ( oidsize == 0 ) {
oidsize = sizeof(oids) * 2;
oidrem = oidsize;
oidbuf = LDAP_MALLOC( oidsize );
if ( oidbuf == NULL ) goto nomem;
oidptr = oidbuf;
} else {
char *old = oidbuf;
oidbuf = LDAP_REALLOC( oidbuf, oidsize*2 );
if ( oidbuf == NULL ) goto nomem;
/* Buffer moved! Fix AVA pointers */
if ( old != oidbuf ) {
LDAPAVA *a;
long dif = oidbuf - old;
for (a=baseAVA; a<=newAVA; a++){
if (a->la_attr.bv_val >= old &&
a->la_attr.bv_val <= (old + oidsize))
a->la_attr.bv_val += dif;
}
}
oidptr = oidbuf + oidsize - oidrem;
oidrem += oidsize;
oidsize *= 2;
}
}
}
Val.bv_val = (char *) str->data;
Val.bv_len = str->length;
switch( str->type ) {
case V_ASN1_UNIVERSALSTRING:
/* This uses 32-bit ISO 10646-1 */
csize = 4; goto to_utf8;
case V_ASN1_BMPSTRING:
/* This uses 16-bit ISO 10646-1 */
csize = 2; goto to_utf8;
case V_ASN1_T61STRING:
/* This uses 8-bit, assume ISO 8859-1 */
csize = 1;
to_utf8: rc = ldap_ucs_to_utf8s( &Val, csize, &newAVA->la_value );
newAVA->la_flags |= LDAP_AVA_FREE_VALUE;
if (rc != LDAP_SUCCESS) goto nomem;
newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
break;
case V_ASN1_UTF8STRING:
newAVA->la_flags = LDAP_AVA_NONPRINTABLE;
/* This is already in UTF-8 encoding */
case V_ASN1_IA5STRING:
case V_ASN1_PRINTABLESTRING:
/* These are always 7-bit strings */
newAVA->la_value = Val;
default:
;
}
newRDN[k] = newAVA;
newAVA++;
k++;
}
newRDN[k] = NULL;
if ( func ) {
rc = func( newDN, flags, NULL );
if ( rc != LDAP_SUCCESS )
goto nomem;
}
rc = ldap_dn2bv_x( newDN, bv, LDAP_DN_FORMAT_LDAPV3, NULL );
nomem:
for (;baseAVA < newAVA; baseAVA++) {
if (baseAVA->la_flags & LDAP_AVA_FREE_ATTR)
LDAP_FREE( baseAVA->la_attr.bv_val );
if (baseAVA->la_flags & LDAP_AVA_FREE_VALUE)
LDAP_FREE( baseAVA->la_value.bv_val );
}
if ( oidsize != 0 )
LDAP_FREE( oidbuf );
if ( newDN != (LDAPDN)(char *) ptrs )
LDAP_FREE( newDN );
return rc;
}
#endif /* HAVE_TLS */

8
servers/slapd/config.c
View file

@ -1351,12 +1351,6 @@ void bindconf_free( slap_bindconf *bc ) {
BER_BVZERO( &bc->sb_authzId );
}
#ifdef HAVE_TLS
#if 0
if ( bc->sb_tls_ctx ) {
SSL_CTX_free( bc->sb_tls_ctx );
bc->sb_tls_ctx = NULL;
}
#endif
if ( bc->sb_tls_cert ) {
ch_free( bc->sb_tls_cert );
bc->sb_tls_cert = NULL;
@ -1483,7 +1477,7 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
int opt = 0;
if ( bc->sb_tls_ctx ) {
SSL_CTX_free( bc->sb_tls_ctx );
ldap_pvt_tls_ctx_free( bc->sb_tls_ctx );
bc->sb_tls_ctx = NULL;
}
rc = ldap_set_option( ld, LDAP_OPT_X_TLS_NEWCTX, &opt );

2
servers/slapd/main.c
View file

@ -991,7 +991,7 @@ stop:
#ifdef HAVE_TLS
if ( slap_tls_ld ) {
SSL_CTX_free( slap_tls_ctx );
ldap_pvt_tls_ctx_free( slap_tls_ctx );
ldap_unbind_ext( slap_tls_ld, NULL, NULL );
}
ldap_pvt_tls_destroy();