upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-12-24 00:29:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
24372 commits 38 branches 309 tags 68 MiB
Commit graph

2073 commits

Author SHA1 Message Date
Quanah Gibson-Mount
43a039eba4 ITS#7428 - Non-blocking TLS is not compatible with MOZNSS 2017-09-26 10:59:08 -07:00
Quanah Gibson-Mount
c1512eea58 Fix typo "errror" -> "error" 2017-09-08 12:03:02 -07:00
Howard Chu
01a5eeac1d ITS#8727 plug ber leaks 2017-09-08 16:35:32 +01:00
Howard Chu
738723866e ITS#8717 call connection delete callbacks 
When TLS fails to start
 2017-09-06 21:46:09 +01:00
Ryan Tandy
431c4af526 ITS#8648 init SASL library in global init 2017-05-07 21:29:44 +00:00
Ryan Tandy
e437b12277 ITS#8648 check result of ldap_int_initialize in ldap_{get,set}_option 2017-05-07 20:16:25 +00:00
Ryan Tandy
7b5181da8c ITS#8650 retry gnutls_handshake after GNUTLS_E_AGAIN 2017-05-06 22:50:13 +00:00
Howard Chu
9e051001d4 Add GnuTLS support for direct DER config of cacert/cert/key 
Followon to b402a2805f
 2017-04-10 00:21:08 +01:00
Howard Chu
2e011eeb67 Fixup cacert option 2017-04-09 15:39:13 +01:00
Howard Chu
83fb515555 Fixup cacert/cert/key options 
Add get_option support, allow delete by setting a NULL arg.
 2017-04-09 14:49:48 +01:00
Howard Chu
b402a2805f Add options to use DER format cert+keys directly 
Instead of loading from files.
 2017-04-09 00:13:42 +01:00
Quanah Gibson-Mount
eb8f1a7247 ITS#8353, ITS#8533 - Cleanup for libldap_r 2017-04-07 13:39:11 -07:00
Quanah Gibson-Mount
6ced84af79 ITS#8353, ITS#8533 - Fix libldap_r compilation 2017-04-06 15:12:02 -07:00
Quanah Gibson-Mount
01cbb7f4c6 ITS#8353, ITS#8533 - Ensure that the deprecated API is not used when using OpenSSL 1.1 or later 2017-04-06 11:47:06 -07:00
Howard Guo
4962dd6083 ITS#8529 Avoid hiding the error if user specified CA does not load 
The TLS configuration deliberately hid the error in case that
user specified CA locations cannot be read, by loading CAs from default
locations; and when user does not specify CA locations, the CAs from default
locations are not read at all.

This patch corrects the behaviour so that CAs from default location are used
if user does not specify a CA location, and user is informed of the error if
CAs cannot be loaded from the user specified location.
 2017-02-22 09:56:17 -08:00
Howard Chu
9773f43b11 ITS#8585 Fail ldap_result if handle is already bad 2017-02-07 13:00:05 +00:00
Howard Chu
2bf650d95e ITS#8533 OpenSSL 1.1.0c compat 2017-01-11 14:12:45 +00:00
Quanah Gibson-Mount
1df85d3427 Happy New Year! 2017-01-03 12:36:47 -08:00
Howard Chu
283f3ae171 ITS#8385 Fix use-after-free with GnuTLS 2016-03-12 11:03:29 +00:00
Howard Chu
6bb6d5e3c6 ITS#8353 more for OpenSSL 1.1 compat 
tmp_rsa callback has been removed from OpenSSL 1.1
Use new X509_NAME accessor function to retrieve DER bytes
 2016-01-31 03:29:28 +00:00
Quanah Gibson-Mount
6c4d6c880b Happy New Year! 2016-01-29 13:32:05 -06:00
Howard Chu
f3a7bf79db ITS#8353 partial fix 
Use newly added SSL_CTX_up_ref()
Still waiting for X509_NAME accessor
 2016-01-26 18:06:46 +00:00
Howard Chu
f2d0aa7d22 ITS#8353 partial fixes 
ERR_remove_state() is deprecated since OpenSSL 1.0.0
Use X509_NAME_ENTRY_get_object() instead of direct access.
 2016-01-21 18:05:42 +00:00
Howard Chu
597ce61000 ITS#8295 fix Windows microsecond timer 
Also add ldap_pvt_gettimeofday() to
emulate gettimeofday on Windows
 2015-10-28 13:49:25 +00:00
Howard Chu
28a02271f0 ITS#8273 Windows file:// URL fixup 2015-10-19 08:52:28 +01:00
Howard Chu
db3175eaba ITS#8262 more 
extended ops
 2015-10-02 05:14:53 +01:00
Howard Chu
34ccd14f3e ITS#8262 add ldap_build_*_req functions 
Basic ops except abandon and unbind; since they get no reply
it's not important for the caller to know their msgID.
 2015-10-02 05:02:15 +01:00
Howard Chu
e75fbc953f ITS#8201 LDAPSTACKGUARD feature 2015-07-16 18:58:23 +01:00
Howard Chu
4796f01209 ITS#8195 fix ITS#7027 regression, port number sign bit overflow 
Another bug from 5de85b922a
 2015-07-12 11:14:33 +01:00
Hallvard Furuseth
17853783df Silence warnings 2015-05-04 21:07:02 +02:00
Mikko Auvinen
de76b8d1ce ITS#8093 add LDAP_X_CONNECTING error string 2015-04-01 20:54:54 +01:00
Howard Chu
7aefa46b37 ITS#8090 fix for async connect 2015-04-01 20:54:12 +01:00
Quanah Gibson-Mount
1705fa7e55 Happy New Year 2015-02-11 15:36:57 -06:00
Howard Chu
79d90c3935 ITS#8050 fix ldap_get_option(LDAP_OPT_SESSION_REFCNT) 2015-02-04 03:16:20 +00:00
Howard Chu
e2b4366044 ITS#8028 fix ldap_new_connection 2015-01-21 01:02:12 +00:00
Howard Chu
fccca0ead9 Minor cleanup (coverity) 2015-01-14 16:59:54 +00:00
Howard Chu
bf4ed09c5e Plug leak (coverity) 2015-01-14 14:16:24 +00:00
Howard Chu
ae6347bac1 ITS#8022 an async connect may still succeed immediately 2015-01-12 22:27:58 +00:00
Howard Chu
234931acb0 ITS#8001 fix ldap_sync_initialize 2014-12-10 22:58:33 +00:00
Mark Reynolds
7a7d941943 ITS#7979 MozNSS fix for TLS_PROTOCOL_MIN 
Fix NSS code to check for TLS_PROCOTOL_MIN, and then set the SSL
version range(min and max). Also updated SSL version string map
table to support up to TLSv1.3
 2014-11-13 15:11:40 +00:00
Howard Chu
d06073d0d6 Fix a1e3b1cf3c 
copy/paste error
 2014-10-15 11:11:08 +01:00
Howard Chu
b36bd703d7 ITS#7967 fix abandon regression 
From ITS#7712, avoid double-free of request
 2014-10-15 11:08:29 +01:00
Kurt Zeilenga
a1e3b1cf3c Fix pointer incompatibility issue on some platforms 
Don't assume tv_sec is a time_t.
 2014-10-10 11:56:31 -07:00
Howard Chu
eef1ca007f ITS#7027 actually implement RFC 2782 shuffle 2014-07-21 22:17:21 -07:00
Howard Chu
31995b535e ITS#7027 fix bugs in prev commit 2014-07-21 22:12:22 -07:00
James M Leddy
5de85b922a ITS#7027 Implement priority/weight for DNS SRV records 
From RFC 2782:

  A client MUST attempt to contact the target host with the
  lowest-numbered priority it can reach.

This patch sorts the DNS SRV records by their priority, and
additionally gives records with a larger weight a higher probability
of appearing earlier. This way, the DNS SRV records are tried in the
order of their priority.
 2014-07-21 19:31:59 -07:00
Howard Chu
3102cbbd55 ITS#7859 more for revert 2014-07-11 12:38:16 -07:00
Howard Chu
189f312d64 ITS#7859 refix 
This was actually broken by 65e163d2, ITS#6947. Reverting both
of those changes and fixing #6947 again.
 2014-07-11 12:29:15 -07:00
Ryan Tandy
7d2f9c6277 ITS#7877 assume gnutls is at least 2.12.0 2014-06-30 20:08:38 -07:00
Ryan Tandy
0fd0f24f03 ITS#7877 assume gnutls provides cipher suites 2014-06-30 20:08:17 -07:00
Ryan Tandy
829027945f ITS#7877 use nettle instead of gcrypt 2014-06-30 20:07:41 -07:00
Howard Chu
71ff674a02 ITS#7871 fix ldif-wrap length 
Doc has been updated to note the default was actually 78.
The off-by-two error is fixed. Note that wrap=1 will still
output 2 columns, otherwise it can't output anything besides
the continuation character.
 2014-06-04 00:52:01 -07:00
Howard Chu
b22a614224 ITS#7859 fix to read 4096-character lines 2014-05-26 11:08:14 -07:00
Howard Chu
106a4b90aa More for ITS#4365 refix CR/LF handling 
Was rejecting "-\r\n" in input LDIF
 2014-02-07 00:31:23 -08:00
Kurt Zeilenga
5c878c1bf2 Happy new year (belated) 2014-01-25 05:21:25 -08:00
Howard Chu
14868fcab6 ITS#7783 workaround stupid NSPR bug 
free(NULL) is supposed to be safe. "Portable wrapper libraries"
that fail to preserve this behavior are inherently broken.
But then again, this is Mozilla code, so that's redundant.
 2014-01-12 13:51:09 -08:00
Pierangelo Masarati
2358b35c58 fix years old cut'n'paste 2013-12-28 11:12:42 +01:00
Howard Chu
79b12f2f93 ITS#7762 shortcut NULL RDNs 2013-12-11 04:41:48 -08:00
Howard Chu
80e6316d37 ITS#7759 avoid assert in parse_passwdpolicy_control 2013-12-07 08:36:14 -08:00
Howard Chu
f8efeb4278 ITS#7757 plug memleak 2013-12-03 14:16:20 -08:00
Stef Walter
743a9783d5 ITS#7694 Fix use of IPv6 with LDAP_CONNECTIONLESS 
LDAP_CONNECTIONLESS code assumed that the size of an peer address
is equal to or smaller than sizeof (struct sockaddr).

Fix to use struct sockaddr_storage instead which is intended for
this purpose. Use getnameinfo() where appropriate so we don't
assume anything about the contents of struct sockaddr
 2013-10-10 10:26:28 -07:00
Emily Backes
85003d8a54 ITS#7712 Fix lock ordering in libldap abandon 2013-09-30 15:31:27 -07:00
Quanah Gibson-Mount
1a712bf18e Enable features that were hidden behind LDAP_DEVEL 2013-09-19 09:50:52 -07:00
Howard Chu
16f8b0902c ITS#7398 add LDAP_OPT_X_TLS_PEERCERT 
retrieve peer cert for an active TLS session
 2013-09-10 04:31:39 -07:00
Howard Chu
0045e56c34 ITS#7683 more for tls version/cipher info 
Add LDAP_OPT_X_TLS_VERSION / LDAP_OPT_X_TLS_CIPHER for
retrieving from an LDAP session handle. Update ldap_get_option(3).
 2013-09-09 11:52:10 -07:00
Howard Chu
721e46fe66 ITS#7595 don't try to use EC if OpenSSL lacks it 2013-09-08 06:32:23 -07:00
Howard Chu
7d6d6944c5 ITS#7683 log tls prot/cipher info 
Note: I could not test the MozNSS patch due to the absence of
NSS PEM support on my machine. Given the review comments in
https://bugzilla.mozilla.org/show_bug.cgi?id=402712 I doubt that
trustworthy PEM support will be appearing for MozNSS any time soon.
 2013-09-07 12:22:09 -07:00
Howard Chu
e631ce808e ITS#7595 Add Elliptic Curve support for OpenSSL 2013-09-07 09:47:40 -07:00
Howard Chu
0205e83f46 ITS#7430 GnuTLS: Avoid use of deprecated function 2013-09-07 09:41:46 -07:00
Howard Chu
3e100bb54d Add GnuTLS channel binding support 2013-09-07 09:38:47 -07:00
Howard Chu
cb00bb0218 Fix double-free on ciphersuite parse failure 
GnuTLS does an implicit free on failure.
 2013-09-07 08:58:25 -07:00
Howard Chu
cfeb28412c ITS#7506 fix prev commit 
The patch unconditionally enabled DHparams, which is a significant
change of behavior. Reverting to previous behavior, which only enables
DH use if a DHparam file was configured.
 2013-09-07 06:39:53 -07:00
Ben Jencks
6f120920d3 ITS#7506 tls_o.c: Fix Diffie-Hellman parameter usage. 
If a DHParamFile or olcDHParamFile is specified, then it will be used,
otherwise a hardcoded 1024 bit parameter will be used. This allows the use of
larger parameters; previously only 512 or 1024 bit parameters would ever be
used.
 2013-09-07 06:33:39 -07:00
Howard Chu
a72d1ffe0f ITS#7506 cleanup prev commit 2013-09-07 06:31:58 -07:00
Ben Jencks
622d13a32e ITS#7506 tls_g.c: Properly support DHParamFile. 
If a DHParamFile or olcDHParamFile is specified then it will be loaded. This
allows use of DHE/EDH cipher suites which was previously impossible with
GnuTLS.
 2013-09-07 06:29:14 -07:00
Howard Chu
ca310ebff4 Add channel binding support 
Currently only implemented for OpenSSL.
Needs an option to set the criticality flag.
 2013-08-26 23:31:48 -07:00
Philip Guenther
c6cf495247 ITS#7645 more OpenSSL TLS versions 2013-07-29 07:01:15 -07:00
Stef Walter
ffe383c27b ITS#7583 Fix ldap_init_fd() for LDAP_PROTO_UDP 
ldap_init_fd() tried to handle UDP sockets but was missing
certain key pieces to make it work. Fill in the address and
set the UDP flag correctly.
 2013-05-23 12:40:09 -07:00
Howard Chu
63312f109f ITS#7582 CLDAP, avoid ref to uninit'd memory 2013-05-23 12:36:15 -07:00
Howard Chu
1e68029078 Drop ldap_int_sasl_mutex 
It was introduced for Cyrus 1.5 in 2001; we've been on 2.x since 2002 and
Cyrus does its own locking when needed.
 2013-04-24 00:52:52 -07:00
Howard Chu
461db2de1a ITS#7497 fix lineno overflow in ldif_read_record() 2013-01-23 02:19:02 +00:00
David Bender
8f52aa24d3 ITS#7476 Prevent EINTR from stopping otherwise successful connect 2013-01-09 09:11:35 -08:00
Kurt Zeilenga
0fd1bf30b8 Happy New Year 2013-01-02 10:22:57 -08:00
Howard Chu
2565e974b9 ITS#7477 check for invalid LDIF 2012-12-19 09:15:09 -08:00
Ralf Haferkamp
c728ebf586 ITS#7428 Use non-blocking IO during SSL Handshake 
If a timeout is set, perform the SSL Handshake using non-blocking IO.  This way
we can timeout if SSL Handshake gets stuck for whatever reason.

This code is currently hidden behind #ifdefs (LDAP_USE_NON_BLOCKING_TLS) and
disabled by default as there seem to be some problems using NON-blocking
I/O during the TLS Handshake when linking against NSS (either a bug in NSS
itself of in tls_m.c, see discussion on -devel)

This patch adds an additional parameter to ldap_int_poll() in order to indicate
if we're waiting in order to perform a read or write operation.
 2012-11-21 14:25:18 +01:00
Rich Megginson
a0e48e7246 ITS#7360 accept nss certname in the form of tokenname:certnickname 
There are cases where the user may want to force the use of a particular
PKCS11 device to use for a given certificate.  Allow the user to do this
with MozNSS by specifying the cert as "tokenname:certnickname" where
token name is the name of a token/slot in a PKCS11 device and certnickname
is the nickname of a certificate on that device.
 2012-08-22 14:21:23 -07:00
Howard Chu
1ebf95c31b ITS#7359 cleanup for loop 2012-08-22 14:13:10 -07:00
Jan Vcelak
6833b8717a ITS#7359 MozNSS: fix whitespaces in all my changes 
To be compliant with OpenLDAP coding standards.
 2012-08-22 14:12:01 -07:00
Jan Vcelak
46dc6c424b ITS#7359 MozNSS: prefer unlocked slot when getting private key 2012-08-21 13:32:34 -07:00
Howard Chu
68c3cf9795 ITS#7358 fix ITS#7270 patch 
commit 8bb9e88d5f breaks Visual C
(as well as our own coding rules)
 2012-08-21 13:22:19 -07:00
Jan Vcelak
f425a07d02 ITS#7331 MozNSS: ignore untrusted issuer error when verifying server cert 
Untrusted issuer error can appear with self-signed PEM certificates.
 2012-07-26 10:16:39 -07:00
Mat Booth
e6d190c7de ITS#7332 Changes required to build with Microsoft Visual Studio 2012-07-23 08:29:39 -07:00
Emily Backes
c453a236fc Update name information 2012-07-22 07:08:35 -07:00
Howard Chu
43d47c46a7 ITS#6262 fix gettime() regression 
Add a mutex in ldap_pvt_gettime(), delete the mutex comment
since it's no longer relevant (and was ignored anyway). This
could only ever affect multi-processor machines.
 2012-07-11 16:53:33 -07:00
Jan Vcelak
2db5195650 ITS#7316 MozNSS: do not retry when reading the pin from file 
Avoid infinite loop if the pin in the password file is wrong.
 2012-06-26 06:47:48 -07:00
Jan Vcelak
a171237999 ITS#7315 MozNSS: do not authenticate to a slot manually 
We cannot rely on tc_certificate->slot value, the library will choose
the correct slot itself when needed. Just provide correct pin argument.
 2012-06-26 06:46:29 -07:00
Jan Vcelak
3531c344e1 ITS#7314 MozNSS: lock whole init and clenaup process 2012-06-26 06:44:46 -07:00
Jan Vcelak
d07779e97b ITS#7313 MozNSS: store certificate object instead of nickname in in ctx 
PEM certificates should not be referenced by nicknames, because the
nicknames are derived from basename of the cerificate file and in
general are not easy-predictable.

The code of Mozilla NSS backend depends on some aspects of PEM module
and tries to guess the nicknames correctly. In some cases the guessing
is wrong.
 2012-06-26 06:43:11 -07:00
Jan Vcelak
87132b820d ITS#7312 MozNSS: context specific token description for certdb 2012-06-26 06:41:05 -07:00
Jan Vcelak
221531b31a ITS#7241 unbind: free socket prior to destroying TLS context 2012-06-25 12:53:29 -07:00
Howard Chu
450d224291 ITS#7293 make ldapava_free static 2012-06-23 05:41:39 -07:00
Howard Chu
e2b5aaf5dd ITS#7290 fix ldap_int_initialize() to set debug level 2012-06-07 05:15:04 -07:00
Jan Vcelak
00d0e16272 ITS#7291 MozNSS: read pin from file file can cause infinite loop 
The buffer allocated for reading password file has to be initialized
with zeros, or we need to append zero at the end of the file. Otherwise
we might read unitialized memory and consider it to be a password.
 2012-06-07 05:05:08 -07:00
Tim Strobell (Contractor)
4b6bd2c600 ITS#7289 MozNSS: cipher suite selection by name may be ignored 2012-06-07 05:03:15 -07:00
Jan Vcelak
dc3842fca3 ITS#7287 MozNSS: do not overwrite error in tlsm_verify_cert 2012-06-05 03:43:24 -07:00
Tim Strobell (Contractor)
2c2bb2e7ae ITS#7285 Mozilla NSS: default cipher suite always selected 2012-06-05 03:43:15 -07:00
Jan Vcelak
df1d118de8 ITS#7276 MozNSS: allow CA certdb together with PEM CA bundle file 
Prior to this patch, if TLS_CACERTDIR was set to Mozilla NSS certificate
database and TLS_CACERT was set to a PEM bundle file with CA
certificates, the PEM file content was not loaded.

With this patch and the same settings, OpenLDAP can verify certificates
which are signed by CAs stored both in certdb and PEM bundle file.
 2012-05-30 06:18:50 -07:00
Frederik Deweerdt
8bb9e88d5f ITS#7270 Protect accesses to ldap_int_hostname with a mutex. 
Not protecting the accesses to ldap_int_hostname could lead to a double
free.
 2012-05-30 05:49:53 -07:00
Howard Chu
dcf94e25f5 ITS#7207 check for ld->ld_defconn 2012-03-26 03:35:31 -07:00
Howard Chu
bb921063e0 ITS#7194 fix IPv6 URL detection 2012-03-08 19:35:44 -08:00
Howard Chu
33f6bc4fe6 ITS#7167 only poll sockets for write as needed 2012-02-20 14:51:30 -08:00
Hallvard Furuseth
ffbad797c8 Fix typo in ldap_int_client_controls() comment 2012-02-07 16:11:43 +01:00
Jan Vcelak
4e9926ca97 ITS#7136 MozNSS: store TLS params until the deferred initialization is finished 
Deferred TLS initialization is used with Mozilla NSS. The real
initialization takes place when the TLS context is needed for the first
time. If the initialization parameters were freed immediately after
tlsm_ctx_init was called, they were not available at the time of
deferred initialization which caused segmentation fault.

With this patch, initialization parameters are copied and stored until
the deferred initialization is finished. The parameters are freed
afterwards.

Red Hat Bugzilla: #783431
 2012-01-25 21:24:28 -08:00
Jan Vcelak
1107103dd7 ITS#7135 MozNSS, PEM: fix segfault when TLS certificate key is not set 
Red Hat Bugzilla: #772890
 2012-01-25 21:22:47 -08:00
Howard Chu
ce2c041671 Cleanup gssapi_flags -> ldo_gssapi_flags 2012-01-24 15:43:39 -08:00
Howard Chu
7ff18967d7 More for prev commit (270ef33acf) 2012-01-24 15:43:14 -08:00
Howard Chu
270ef33acf ITS#7118, #7133 tentative fix 
Move mutexes to end of structs, so libldap can ignore them
 2012-01-24 13:32:52 -08:00
Hallvard Furuseth
1a931a86ee Silence 'assign away const' warning 2012-01-24 01:45:51 +01:00
Kurt Zeilenga
2bbf9804b9 Happy New Year! 2012-01-01 07:10:53 -08:00
Howard Chu
277a8edd2e Android defines wctomb but doesn't provide it 2011-10-12 19:18:05 -07:00
Howard Chu
8a5d0952ad ITS#7006 fix MozNSS wildcard cert match 2011-09-30 03:27:19 -07:00
Rich Megginson
8e9af53fb6 ITS#7034 use mutex for connection handshake when using PEM nss 
PEM nss is not thread safe when establishing the initial connection
using SSL_ForceHandshake.  Create a new mutex - tlsm_pem_mutex - to
protect this function call.
The call to SSL_ConfigServerSessionIDCache() is not thread-safe - move it
to the init section and protect it with the init mutex.
 2011-09-30 03:16:57 -07:00
Howard Chu
9b082bf716 ITS#7051 fix GNUtls cert dn parse 2011-09-30 00:41:13 -07:00
Howard Chu
c7d6c0fab3 Add a few NULL checks to defend against dumb API checkers. 
Unfortunately automated checkers don't seem to read the documentation
for how APIs are expected to be used, and the C declaration syntax
isn't expressive enough to encode the documented usage.
 2011-09-08 23:41:06 -07:00
Pierangelo Masarati
568e3b7faa fix uninit'ed vars (ITS#7039) 2011-09-08 23:32:58 +02:00
Howard Chu
06ec9f1db2 ITS#7035 don't loop forever in wait4msg 2011-09-06 21:13:49 -07:00
Howard Chu
6546ecd39c ITS#7022 cleanup prev commit 2011-08-24 15:37:52 -07:00
Rich Megginson
a7aac14d2a ITS#7022 NSS_Init* functions are not thread safe 
The NSS_InitContext et. al, and their corresponding shutdown functions,
are not thread safe.  There can only be one thread at a time calling
these functions.  Protect the calls with a mutex.  Create the mutex
using a PR_CallOnce to ensure that the mutex is only created once and
not used before created.  Move the registration of the nss shutdown
callback to also use a PR_CallOnce.  Removed the call to
SSL_ClearSessionCache() because it is always called at shutdown, and we must
not call it more than once.
 2011-08-24 15:34:47 -07:00
Jan Vcelak
3dae953fd6 ITS#7014 TLS: don't check hostname if reqcert is 'allow' 
If server certificate hostname does not match the server hostname,
connection is closed even if client has set TLS_REQCERT to 'allow'. This
is wrong - the documentation says, that bad certificates are being
ignored when TLS_REQCERT is set to 'allow'.
 2011-08-24 15:27:29 -07:00
Rich Megginson
210b156ece ITS#7002 MozNSS: fix VerifyCert allow/try behavior 
If the olcTLSVerifyClient is set to a value other than "never", the server
should request that the client send a client certificate for possible use
with client cert auth (e.g. SASL/EXTERNAL).
If set to "allow", if the client sends a cert, and there are problems with
it, the server will warn about problems, but will allow the SSL session to
proceed without a client cert.
If set to "try", if the client sends a cert, and there are problems with
it, the server will warn about those problems, and shutdown the SSL session.
If set to "demand" or "hard", the client must send a cert, and the server
will shutdown the SSL session if there are problems.
I added a new member of the tlsm context structure - tc_warn_only - if this
is set, tlsm_verify_cert will only warn about errors, and only if TRACE
level debug is set.  This allows the server to warn but allow bad certs
if "allow" is set, and warn and fail if "try" is set.
 2011-07-28 14:09:55 -07:00
Rich Megginson
fb4b4f7445 ITS#7001 MozNSS: free the return of tlsm_find_and_verify_cert_key 
If tlsm_find_and_verify_cert_key finds the cert and/or key, and it fails
to verify them, it will leave them allocated for the caller to dispose of.
There were a couple of places that were not disposing of the cert and key
upon error.
 2011-07-28 14:00:15 -07:00
Jan Vcelak
e8ac17e17c ITS#6998 MozNSS: when cert not required, ignore issuer expiration 
When server certificate is not required in a TLS session (e.g.
TLS_REQCERT is set to 'never'), ignore expired issuer certificate error
and do not terminate the connection.
 2011-07-21 11:59:06 -07:00
Rich Megginson
d944920fd3 ITS#6980 free the result of SSL_PeerCertificate 
In tlsm_auth_cert_handler, we get the peer's cert from the socket using
SSL_PeerCertificate.  This value is allocated and/or cached.  We must
destroy it using CERT_DestroyCertificate.
 2011-06-29 16:56:26 -07:00
Howard Chu
7ee3dee647 ITS#6828 set ld_errno on connect failures 2011-06-27 18:43:31 -07:00
Howard Chu
052ac2f64a ITS#6828 silence warning in prev commit 2011-06-24 18:03:11 -07:00
Howard Chu
d0973003f7 ITS#6978 bail out on invalid input 2011-06-23 13:17:08 -07:00
Rich Megginson
5e467e4899 ITS#6862 MozNSS - workaround PR_SetEnv bug 2011-06-21 15:58:49 -07:00
Rich Megginson
d78cf81648 ITS#6975 MozNSS - allow cacertdir in most cases 
OpenLDAP built with OpenSSL allows most any value of cacertdir - directory
is a file, directory does not contain any CA certs, directory does not
exist - users expect if they specify TLS_REQCERT=never, no matter what
the TLS_CACERTDIR setting is, TLS/SSL will just work.
TLS_CACERT, on the other hand, is a hard error.  Even if TLS_REQCERT=never,
if TLS_CACERT is specified and is not a valid CA cert file, TLS/SSL will
fail.  This patch makes CACERT errors hard errors, and makes CACERTDIR
errors "soft" errors.  The code checks CACERT first and, even though
the function will return an error, checks CACERTDIR anyway so that if the
user sets TRACE mode they will get CACERTDIR processing messages.
 2011-06-21 15:56:55 -07:00
Jan Vcelak
65e163d268 ITS#6947 Handle missing '\n' termination in LDIF input 2011-06-20 18:18:34 -07:00
Howard Chu
9f7d119ce3 Add LDAP_OPT_X_TLS_PACKAGE 
to return the name of the underlying TLS implementation
 2011-06-10 02:11:26 -07:00
Howard Chu
33f3de77f1 ITS#6828 fix TLS setup with async connect 2011-06-08 18:27:54 -07:00
Hallvard Furuseth
fac36dcba7 ITS#6932: Clean up strange asserts & nearby code. 
Mostly found by Klocwork: Issues #213,298-300,331,342-343,374,390,410.
 2011-05-05 15:55:29 +02:00
Hallvard Furuseth
06dca7858e ITS#6931 Catch NULL ld for LDAP_OPT_SESSION_REFCNT. 
Klocwork issue#111, ldap_get_option().
 2011-05-05 14:10:32 +02:00
Hallvard Furuseth
a1cb490d0c ITS#6930 Plug ldapi://too-long-path socket leak. 
Klocwork issue#117, ldap_connect_to_path().
 2011-05-05 13:52:08 +02:00
Howard Chu
9b463b59ec ITS#6898 fix regression from ITS#6625 
compound statements need brackets, duh.
 2011-04-09 16:55:00 -07:00
Howard Chu
f8a5ce4a6e ITS#6870 move ldif.c and fetch.c from liblutil to libldap 2011-03-24 06:49:04 +00:00
Howard Chu
31a8460417 ITS#6863, fix crashes in ITS#6714 patch. From Jan Vcelak @ Red Hat 2011-03-16 18:23:26 +00:00
Howard Chu
6f1d218652 ITS#6832 #elif cleanup 2011-02-17 00:36:30 +00:00
Howard Chu
bbecfa740d ITS#6811, more for #6802 PKCS11 fork() handling from Rich Megginson @ Red Hat 2011-01-29 20:40:20 +00:00
Pierangelo Masarati
45d580e941 do not hijack loop counter (ITS#6813; blind fix) 2011-01-29 11:05:08 +00:00
Howard Chu
2d545befdd Cleanup version checking 2011-01-27 21:43:22 +00:00
Howard Chu
d27f458b37 ITS#6802 restart modules for fork() - from Rich Megginson @ Red Hat 2011-01-27 21:38:40 +00:00
Howard Chu
ba70ec8b2c ITS#6791 fix cert usage types/values - from Rich Megginson @ Red Hat 2011-01-27 21:34:35 +00:00
Howard Chu
5224536a8e ITS#6790 fix default cipher suites - from Rich Megginson @ Red Hat 2011-01-27 21:32:39 +00:00
Hallvard Furuseth
9eb5ecba15 ITS#5421 comment ldapoptions vs ldapoptions_prefix 2011-01-20 10:45:14 +00:00
Pierangelo Masarati
6d8e0d5b3e increment lconn_refcnt so connection does not get closed (ITS#6788) 2011-01-18 23:53:24 +00:00
Hallvard Furuseth
b9609cedf5 Catch ber errors in vc (Verify Credentials) 2011-01-17 13:15:27 +00:00
Hallvard Furuseth
8021cbd8f1 ITS#6738 Catch ber errors in libldap/ldap_sync.c. 
Also remove variable tag in ldap_sync_search_intermediate()
and reduce  ber_scanf("tm", &tag, foo)  to  tag=ber_scanf("m", foo).
 2011-01-17 12:20:56 +00:00
Hallvard Furuseth
dd640af54f Fix ITS#6672: Do not return LDAP_MUTEX_LOCK(). 
It has type void.
 2011-01-12 14:25:37 +00:00
Hallvard Furuseth
77f78f1d57 vc.c: ber_printf/flatten rc==LBER_ERROR -> rc<0 2011-01-12 14:23:07 +00:00
Howard Chu
6a544b7193 Silence stupid MUTEX_FIRSTCREATE warnings 2011-01-11 21:34:55 +00:00
Pierangelo Masarati
45205bdf70 don't leak reqdata 2011-01-08 12:51:43 +00:00
Kurt Zeilenga
be897b6679 Outline SASL interactive API (no meat) 2011-01-06 18:37:23 +00:00
Kurt Zeilenga
966cef8c9a Happy New Year 2011-01-05 00:42:37 +00:00
Kurt Zeilenga
390ba8c84e VC adjust controls tag 2011-01-04 16:01:07 +00:00
Pierangelo Masarati
e2440ccb00 fix previous commit 2011-01-04 01:02:12 +00:00
Pierangelo Masarati
fdafc6384e fix error handling/arg checking 2011-01-03 23:40:02 +00:00
Kurt Zeilenga
37dcb1d791 Remove authzid parameter from verify credential response. 
If client wants authzid, it can ask by adding an Authorization Identity
Request inner control.
 2011-01-03 22:05:23 +00:00
Kurt Zeilenga
7f4c7ebc1c Extend Verify Credentials encode/decode per -devel post. 
(ldapvc doesn't yet request/handle inner password policy control.
 2011-01-03 21:49:26 +00:00
Kurt Zeilenga
e6fd8bfbb0 Remove version from encoding 
(previously removed from SASL choices, but should be always absent)
 2011-01-03 19:21:03 +00:00
Howard Chu
8018924efd ITS#6741 support Bitstring in ldap_X509dn2bv() 2010-12-30 19:38:57 +00:00
Kurt Zeilenga
46f4813632 Remove dead code. 2010-12-30 17:46:26 +00:00
Pierangelo Masarati
f3dd90a553 s/0/O/ 2010-12-30 15:58:48 +00:00
Pierangelo Masarati
538b582cdc fix perror; removed extra sequence opening (is it needed; if yes, it must also be closed, see #if 0) 2010-12-30 15:51:25 +00:00
Pierangelo Masarati
7dfc54378c s/VCRequest/VCResponse/ 2010-12-30 14:12:26 +00:00
Howard Chu
f697a3ffed ITS#6742 from Rich Megginson @ Red Hat 2010-12-24 00:29:31 +00:00
Howard Chu
1bb648841b ITS#6453 cleanup on LDAP_TIMEOUT 2010-12-23 23:18:41 +00:00
Kurt Zeilenga
6119ad7294 Misc vc updates 2010-12-15 00:59:42 +00:00
Kurt Zeilenga
8a692a0034 Add comment regarding ASN.1 syntax 
rm version field
 2010-12-14 22:09:50 +00:00
Kurt Zeilenga
25aa65f693 cleanup 2010-12-14 21:14:31 +00:00
Kurt Zeilenga
d3b51f2614 LDAP "Verify Credentials" operation 
Client library implementation only
 2010-12-14 20:58:02 +00:00
Hallvard Furuseth
5feeec67d7 ITS#6747 Fix LDAP_CONNECTIONLESS Debug(), warnings 2010-12-14 15:06:32 +00:00
Howard Chu
439030a16d ITS#6714 non-blocking support from Richard Megginson @ Red Hat 2010-12-11 04:57:10 +00:00
Howard Chu
0215833bcd Cleanup prev commit 2010-12-11 04:51:21 +00:00
Howard Chu
a2053729f0 ITS#6744 - plug leak 2010-12-11 04:35:01 +00:00
Howard Chu
75bb972859 Partial fix for non-string types in cert DNs. (Need to add explicit support 
for Bitstring, maybe a few others.)
 2010-12-10 02:05:18 +00:00
Pierangelo Masarati
d5f101f836 typo in comment 2010-12-07 10:11:06 +00:00
Hallvard Furuseth
16b7df8397 ITS#6625 Remove some LDAP_R_COMPILEs 2010-12-06 11:31:58 +00:00
Hallvard Furuseth
5ecd624f50 Fix ITS#6625: mutex-protect ldap_free_connection() 2010-12-06 10:51:55 +00:00
Hallvard Furuseth
7cb9c496bf ITS#6625 concurrency patch cleanup 2010-12-06 10:41:41 +00:00
Pierangelo Masarati
603eec5758 remove #ifdef EAGAIN, EWOULDBLOCK (ITS#6603) 2010-11-24 14:47:46 +00:00
Hallvard Furuseth
7c29e2c7c5 ITS#6723: Handle EOF in test programs 2010-11-23 12:12:54 +00:00
Hallvard Furuseth
b75b769471 Fix cyrus.c rev 1.159 for --without-cyrus-sasl: 
It modified ldap_int_sasl_bind()'s prototype with but not without SASL.
 2010-11-19 12:32:05 +00:00
Howard Chu
1ed2d0a485 ITS#6706 from Rich Megginson @ Red Hat - improve diagnostic messages 2010-11-15 20:47:24 +00:00
Howard Chu
750f7f895b ITS#6705 from Rich Megginson @ Red Hat - only use .0 files in cacertdir 2010-11-15 20:45:47 +00:00
Howard Chu
4c31652ee8 ITS#6704 from Rich Megginson @ Red Hat - use both cacert and cacertdir 2010-11-15 20:44:32 +00:00
Howard Chu
208308d4dd ITS#6703 from Rich Megginson @ Red Hat - reject non-files for cert/key pem files 2010-11-15 20:43:53 +00:00
Howard Chu
f26b5b6692 ITS#6689 from Rich Megginson @ Red Hat 2010-10-29 10:30:30 +00:00
Howard Chu
0f30db1c46 ITS#6625 concurrency patch from Doug Leavitt @ Oracle .com 2010-10-22 21:45:48 +00:00
Howard Chu
abe4a5f83b ITS#6673 GnuTLS hangs if you tell it to shut the read direction. Just 
shut the write direction; it will all be irrelevant since the socket
will be closed immediately after.
 2010-10-16 12:11:11 +00:00
Howard Chu
845bf30c5b Fix prev commit 2010-10-15 13:53:12 +00:00
Howard Chu
f1a18f4e53 Cleanup prev commit 2010-10-14 03:11:26 +00:00
Howard Chu
120d2ce228 More for prev commit. What about ldap_pvt_sasl_getmechs() ? 2010-10-14 01:47:09 +00:00
Howard Chu
fca72f333b Add ldap_sasl_interactive_bind() 2010-10-14 01:29:32 +00:00
Howard Chu
0b660dc9f6 ITS#6672 mutex cleanup 2010-10-13 08:43:15 +00:00
Pierangelo Masarati
2b1b37cd4b do not use lutil_atoix() (ITS#6654) 2010-09-21 00:10:44 +00:00
Pierangelo Masarati
9d77d61314 don't use lud_host when NULL (ITS#6653, fixed differently) 2010-09-21 00:05:36 +00:00
Howard Chu
f32f1a45d4 ITS#6639 set sock err to EAGAIN on partial write 2010-09-12 10:09:45 +00:00
Pierangelo Masarati
4601107e4e fix format specifier (ITS#6644) 2010-09-09 16:05:26 +00:00
Pierangelo Masarati
6c6e187b98 do not alter ld_nextref_proc (ITS#6602) 2010-07-27 00:55:51 +00:00
Pierangelo Masarati
d27038f6b4 fix previous commit 2010-07-26 19:45:36 +00:00
Pierangelo Masarati
c2ab1778a0 check mutex ownership 2010-07-26 19:26:59 +00:00
Howard Chu
71f062afee ITS#6595 remove unneeded token init code. From Rich Megginson @ RedHat. 2010-07-21 22:57:01 +00:00
Howard Chu
e0cac8a048 ITS#6589 allow self-signed server certs, from Rich Megginson @ RedHat.com 2010-07-14 23:11:34 +00:00
Howard Chu
ce1e201343 add ifdefs for SASL_GSS_CREDS to accomodate ancient Cyrus SASL 2010-06-12 22:10:16 +00:00
Howard Chu
33bfd730a1 ITS#6569 return server's error code on Disconnect 2010-06-02 03:30:19 +00:00
Howard Chu
d3a1be4e3f ITS#6568 plug cldap memleaks 2010-06-02 03:10:39 +00:00
Howard Chu
2dd75cf206 Support option SASL_GSS_CREDS 2010-05-13 06:08:21 +00:00
Pierangelo Masarati
a94b978e9d (blind) fix off-by-one bug (ITS#6223; fixed differently) 2010-04-18 02:42:56 +00:00
Howard Chu
b8013e828c No longer used 2010-04-15 21:29:50 +00:00
Pierangelo Masarati
ee156cfd7a serial can be longer than ber_int_t (ITS#6460) 2010-04-14 20:26:24 +00:00
Kurt Zeilenga
3dadeb3efe happy belated New Year 2010-04-13 22:17:29 +00:00
Pierangelo Masarati
9331182a07 union of operation-specific data in LDIFRecord (ITS#6194, by Rich Megginson) 2010-04-13 07:37:59 +00:00
Howard Chu
68b292d869 Cleanup prev commit 2010-04-12 20:21:13 +00:00
Howard Chu
86c361cdb8 In tmp_rsa_cb, new API is in 0.9.8 inclusive, not exclusive 2010-04-12 03:21:05 +00:00
Howard Chu
1dbefa75be ITS#6432 updated MozNSS context and PEM support 2010-04-12 02:44:28 +00:00
Pierangelo Masarati
d033f680b5 (ITS#6194) Patch - Enhancement - provide LDIF support as libldif 2010-04-12 02:01:55 +00:00
Howard Chu
e5302c2431 ITS#6510 ignore referrals on Bind response 2010-04-09 18:30:29 +00:00
Kurt Zeilenga
abdb6c683f ldap_parse_result should always free result when freeit is true. 2010-03-26 14:05:47 +00:00
Kurt Zeilenga
f967ec3b4e Set res parameter to NULL upon ldap_search_ext_s entry. Likewise for friends. 
Note in manual that res parameter should be freed regardless of return value
of ldap_search_ext_s (or friends).
 2010-01-29 23:11:24 +00:00
Pierangelo Masarati
797387c4ef skip the serial, whatever its length (ITS#6460) 2010-01-24 19:16:57 +00:00
Howard Chu
127e504015 ITS#6405 in ldap_pvt_gettime, also check for microsecs going backward 2009-11-30 21:47:38 +00:00
Howard Chu
61be1d55d3 More for prev commit - only set if URL was provided. 
(should URL be mandatory?)
 2009-11-18 22:37:02 +00:00
Howard Chu
a248701ed2 ITS#6386 Must init conn->lconn_server 2009-11-18 22:23:14 +00:00
Pierangelo Masarati
a95b8cd488 honor -1 timeout (ITS#6388) 2009-11-18 14:57:52 +00:00
Howard Chu
b99fdb6506 ITS#6283 add missing env options 2009-11-15 21:48:49 +00:00
Howard Chu
9a65f35f2e partially revert prev commit 2009-11-06 02:20:40 +00:00
Howard Chu
86d9e86afd Minor cleanup in strval2str 2009-11-06 01:37:09 +00:00
Hallvard Furuseth
7b22b22202 ITS#6355: Fix uninitialiezed lso_tmp_rsa_cb() return value 2009-10-30 17:08:57 +00:00
Howard Chu
585940984c Fix prev commit, s/errno/err/g 2009-10-27 01:55:45 +00:00
Howard Chu
405c68abf9 For prev commit, check for EINTR/EAGAIN/EWOULDBLOCK 2009-10-26 23:52:55 +00:00
Howard Chu
a05d7015e0 ITS#6327, #6334 take ret=-1/EINTR into account 2009-10-26 23:36:39 +00:00
Howard Chu
30c55952d3 Cleanup prev commit 2009-10-26 19:19:20 +00:00
Howard Chu
1155f5ff20 ITS#6327 fix sb_sasl_generic_write retval for partial writes 2009-10-26 18:49:42 +00:00
Ralf Haferkamp
8fcdc29405 In case of certificate verification failures include failure reason 
into the error message (openssl only)
 2009-09-30 16:25:23 +00:00
Howard Chu
e0431681ad On OpenSSL 0.9.8 and newer, use RSA_generate_key_ex since 
RSA_generate_key is deprecated
 2009-09-25 23:31:24 +00:00
Pierangelo Masarati
4b4db7b529 keep compatibility with slapd's gmtime_mutex (ITS#6262) 2009-09-08 23:21:21 +00:00
Howard Chu
2ba0e44ad1 ITS#6278 PEM support for MozNSS from rmeggins@redhat.com, with header cleanups 2009-08-29 03:41:53 +00:00
Pierangelo Masarati
ba2bddafbd copy username, much like other string-valued options (more about ITS#6257) 2009-08-19 21:46:07 +00:00
Pierangelo Masarati
a846dad6fb cleanup previous commit 2009-08-19 13:10:30 +00:00