/* Licensed to the Apache Software Foundation (ASF) under one or more * contributor license agreements. See the NOTICE file distributed with * this work for additional information regarding copyright ownership. * The ASF licenses this file to You under the Apache License, Version 2.0 * (the "License"); you may not use this file except in compliance with * the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /* apr_ldap_option.c -- LDAP options * * The LDAP SDK allows the getting and setting of options on an LDAP * connection. * */ #include "apr.h" #include "apu.h" #include "apu_config.h" #if APU_DSO_BUILD #define APU_DSO_LDAP_BUILD #endif #include "apr_ldap.h" #include "apr_errno.h" #include "apr_pools.h" #include "apr_strings.h" #include "apr_tables.h" #if APR_HAS_LDAP static void option_set_cert(apr_pool_t *pool, LDAP *ldap, const void *invalue, apr_ldap_err_t *result); static void option_set_tls(apr_pool_t *pool, LDAP *ldap, const void *invalue, apr_ldap_err_t *result); /** * APR LDAP get option function * * This function gets option values from a given LDAP session if * one was specified. */ APU_DECLARE_LDAP(int) apr_ldap_get_option(apr_pool_t *pool, LDAP *ldap, int option, void *outvalue, apr_ldap_err_t **result_err) { apr_ldap_err_t *result; result = apr_pcalloc(pool, sizeof(apr_ldap_err_t)); *result_err = result; if (!result) { return APR_ENOMEM; } /* get the option specified using the native LDAP function */ result->rc = ldap_get_option(ldap, option, outvalue); /* handle the error case */ if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result-> rc); result->reason = apr_pstrdup(pool, "LDAP: Could not get an option"); return APR_EGENERAL; } return APR_SUCCESS; } /** * APR LDAP set option function * * This function sets option values to a given LDAP session if * one was specified. * * Where an option is not supported by an LDAP toolkit, this function * will try and apply legacy functions to achieve the same effect, * depending on the platform. */ APU_DECLARE_LDAP(int) apr_ldap_set_option(apr_pool_t *pool, LDAP *ldap, int option, const void *invalue, apr_ldap_err_t **result_err) { apr_ldap_err_t *result; result = apr_pcalloc(pool, sizeof(apr_ldap_err_t)); *result_err = result; if (!result) { return APR_ENOMEM; } switch (option) { case APR_LDAP_OPT_TLS_CERT: option_set_cert(pool, ldap, invalue, result); break; case APR_LDAP_OPT_TLS: option_set_tls(pool, ldap, invalue, result); break; case APR_LDAP_OPT_VERIFY_CERT: #if APR_HAS_NETSCAPE_LDAPSDK || APR_HAS_SOLARIS_LDAPSDK || APR_HAS_MOZILLA_LDAPSK result->reason = "LDAP: Verify certificate not yet supported by APR on the " "Netscape, Solaris or Mozilla LDAP SDKs"; result->rc = -1; return APR_EGENERAL; #endif #if APR_HAS_NOVELL_LDAPSDK if (*((int*)invalue)) { result->rc = ldapssl_set_verify_mode(LDAPSSL_VERIFY_SERVER); } else { result->rc = ldapssl_set_verify_mode(LDAPSSL_VERIFY_NONE); } #endif #if APR_HAS_OPENLDAP_LDAPSDK #ifdef LDAP_OPT_X_TLS /* This is not a per-connection setting so just pass NULL for the Ldap connection handle */ if (*((int*)invalue)) { int i = LDAP_OPT_X_TLS_DEMAND; result->rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &i); } else { int i = LDAP_OPT_X_TLS_NEVER; result->rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &i); } #else result->reason = "LDAP: SSL/TLS not yet supported by APR on this " "version of the OpenLDAP toolkit"; result->rc = -1; return APR_EGENERAL; #endif #endif /* handle the error case */ if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result->rc); result->reason = "LDAP: Could not set verify mode"; } break; case APR_LDAP_OPT_REFERRALS: /* Setting this option is supported on at least TIVOLI_SDK and OpenLDAP. Folks * who know the NOVELL, NETSCAPE, MOZILLA, and SOLARIS SDKs should note here if * the SDK at least tolerates this option being set, or add an elif to handle * special cases (i.e. different LDAP_OPT_X value). */ result->rc = ldap_set_option(ldap, LDAP_OPT_REFERRALS, (void *)invalue); if (result->rc != LDAP_SUCCESS) { result->reason = "Unable to set LDAP_OPT_REFERRALS."; return(result->rc); } break; case APR_LDAP_OPT_REFHOPLIMIT: #if !defined(LDAP_OPT_REFHOPLIMIT) || APR_HAS_NOVELL_LDAPSDK /* If the LDAP_OPT_REFHOPLIMIT symbol is missing, assume that the * particular LDAP library has a reasonable default. So far certain * versions of the OpenLDAP SDK miss this symbol (but default to 5), * and the Microsoft SDK misses the symbol (the default is not known). */ result->rc = LDAP_SUCCESS; #else /* Setting this option is supported on at least TIVOLI_SDK. Folks who know * the NOVELL, NETSCAPE, MOZILLA, and SOLARIS SDKs should note here if * the SDK at least tolerates this option being set, or add an elif to handle * special cases so an error isn't returned if there is a perfectly good * default value that just can't be changed (like openLDAP). */ result->rc = ldap_set_option(ldap, LDAP_OPT_REFHOPLIMIT, (void *)invalue); #endif if (result->rc != LDAP_SUCCESS) { result->reason = "Unable to set LDAP_OPT_REFHOPLIMIT."; return(result->rc); } break; default: /* set the option specified using the native LDAP function */ result->rc = ldap_set_option(ldap, option, (void *)invalue); /* handle the error case */ if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result->rc); result->reason = "LDAP: Could not set an option"; } break; } /* handle the error case */ if (result->rc != LDAP_SUCCESS) { return APR_EGENERAL; } return APR_SUCCESS; } /** * Handle APR_LDAP_OPT_TLS * * This function sets the type of TLS to be applied to this connection. * The options are: * APR_LDAP_NONE: no encryption * APR_LDAP_SSL: SSL encryption (ldaps://) * APR_LDAP_STARTTLS: STARTTLS encryption * APR_LDAP_STOPTLS: Stop existing TLS connecttion */ static void option_set_tls(apr_pool_t *pool, LDAP *ldap, const void *invalue, apr_ldap_err_t *result) { #if APR_HAS_LDAP_SSL /* compiled with ssl support */ int tls = * (const int *)invalue; /* Netscape/Mozilla/Solaris SDK */ #if APR_HAS_NETSCAPE_LDAPSDK || APR_HAS_SOLARIS_LDAPSDK || APR_HAS_MOZILLA_LDAPSK #if APR_HAS_LDAPSSL_INSTALL_ROUTINES if (tls == APR_LDAP_SSL) { result->rc = ldapssl_install_routines(ldap); #ifdef LDAP_OPT_SSL /* apparently Netscape and Mozilla need this too, Solaris doesn't */ if (result->rc == LDAP_SUCCESS) { result->rc = ldap_set_option(ldap, LDAP_OPT_SSL, LDAP_OPT_ON); } #endif if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result->rc); result->reason = "LDAP: Could not switch SSL on for this " "connection."; } } else if (tls == APR_LDAP_STARTTLS) { result->reason = "LDAP: STARTTLS is not supported by the " "Netscape/Mozilla/Solaris SDK"; result->rc = -1; } else if (tls == APR_LDAP_STOPTLS) { result->reason = "LDAP: STOPTLS is not supported by the " "Netscape/Mozilla/Solaris SDK"; result->rc = -1; } #else if (tls != APR_LDAP_NONE) { result->reason = "LDAP: SSL/TLS is not supported by this version " "of the Netscape/Mozilla/Solaris SDK"; result->rc = -1; } #endif #endif /* Novell SDK */ #if APR_HAS_NOVELL_LDAPSDK /* ldapssl_install_routines(ldap) * Behavior is unpredictable when other LDAP functions are called * between the ldap_init function and the ldapssl_install_routines * function. * * STARTTLS is supported by the ldap_start_tls_s() method */ if (tls == APR_LDAP_SSL) { result->rc = ldapssl_install_routines(ldap); if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result->rc); result->reason = "LDAP: Could not switch SSL on for this " "connection."; } } if (tls == APR_LDAP_STARTTLS) { result->rc = ldapssl_start_tls(ldap); if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result->rc); result->reason = "LDAP: Could not start TLS on this connection"; } } else if (tls == APR_LDAP_STOPTLS) { result->rc = ldapssl_stop_tls(ldap); if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result->rc); result->reason = "LDAP: Could not stop TLS on this connection"; } } #endif /* OpenLDAP SDK */ #if APR_HAS_OPENLDAP_LDAPSDK #ifdef LDAP_OPT_X_TLS if (tls == APR_LDAP_SSL) { int SSLmode = LDAP_OPT_X_TLS_HARD; result->rc = ldap_set_option(ldap, LDAP_OPT_X_TLS, &SSLmode); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldap_set_option failed. " "Could not set LDAP_OPT_X_TLS to " "LDAP_OPT_X_TLS_HARD"; result->msg = ldap_err2string(result->rc); } } else if (tls == APR_LDAP_STARTTLS) { result->rc = ldap_start_tls_s(ldap, NULL, NULL); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldap_start_tls_s() failed"; result->msg = ldap_err2string(result->rc); } } else if (tls == APR_LDAP_STOPTLS) { result->reason = "LDAP: STOPTLS is not supported by the " "OpenLDAP SDK"; result->rc = -1; } #else if (tls != APR_LDAP_NONE) { result->reason = "LDAP: SSL/TLS not yet supported by APR on this " "version of the OpenLDAP toolkit"; result->rc = -1; } #endif #endif /* Microsoft SDK */ #if APR_HAS_MICROSOFT_LDAPSDK if (tls == APR_LDAP_NONE) { ULONG ul = (ULONG) LDAP_OPT_OFF; result->rc = ldap_set_option(ldap, LDAP_OPT_SSL, &ul); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: an attempt to set LDAP_OPT_SSL off " "failed."; result->msg = ldap_err2string(result->rc); } } else if (tls == APR_LDAP_SSL) { ULONG ul = (ULONG) LDAP_OPT_ON; result->rc = ldap_set_option(ldap, LDAP_OPT_SSL, &ul); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: an attempt to set LDAP_OPT_SSL on " "failed."; result->msg = ldap_err2string(result->rc); } } #if APR_HAS_LDAP_START_TLS_S else if (tls == APR_LDAP_STARTTLS) { result->rc = ldap_start_tls_s(ldap, NULL, NULL, NULL, NULL); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldap_start_tls_s() failed"; result->msg = ldap_err2string(result->rc); } } else if (tls == APR_LDAP_STOPTLS) { result->rc = ldap_stop_tls_s(ldap); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldap_stop_tls_s() failed"; result->msg = ldap_err2string(result->rc); } } #endif #endif #if APR_HAS_OTHER_LDAPSDK if (tls != APR_LDAP_NONE) { result->reason = "LDAP: SSL/TLS is currently not supported by " "APR on this LDAP SDK"; result->rc = -1; } #endif #endif /* APR_HAS_LDAP_SSL */ } /** * Handle APR_LDAP_OPT_TLS_CACERTFILE * * This function sets the CA certificate for further SSL/TLS connections. * * The file provided are in different formats depending on the toolkit used: * * Netscape: cert7.db file * Novell: PEM or DER * OpenLDAP: PEM (others supported?) * Microsoft: unknown * Solaris: unknown */ static void option_set_cert(apr_pool_t *pool, LDAP *ldap, const void *invalue, apr_ldap_err_t *result) { #if APR_HAS_LDAP_SSL #if APR_HAS_LDAPSSL_CLIENT_INIT || APR_HAS_OPENLDAP_LDAPSDK apr_array_header_t *certs = (apr_array_header_t *)invalue; struct apr_ldap_opt_tls_cert_t *ents = (struct apr_ldap_opt_tls_cert_t *)certs->elts; int i = 0; #endif /* Netscape/Mozilla/Solaris SDK */ #if APR_HAS_NETSCAPE_LDAPSDK || APR_HAS_SOLARIS_LDAPSDK || APR_HAS_MOZILLA_LDAPSDK #if APR_HAS_LDAPSSL_CLIENT_INIT const char *nickname = NULL; const char *secmod = NULL; const char *key3db = NULL; const char *cert7db = NULL; const char *password = NULL; /* set up cert7.db, key3.db and secmod parameters */ for (i = 0; i < certs->nelts; i++) { switch (ents[i].type) { case APR_LDAP_CA_TYPE_CERT7_DB: cert7db = ents[i].path; break; case APR_LDAP_CA_TYPE_SECMOD: secmod = ents[i].path; break; case APR_LDAP_CERT_TYPE_KEY3_DB: key3db = ents[i].path; break; case APR_LDAP_CERT_TYPE_NICKNAME: nickname = ents[i].path; password = ents[i].password; break; default: result->rc = -1; result->reason = "LDAP: The Netscape/Mozilla LDAP SDK only " "understands the CERT7, KEY3 and SECMOD " "file types."; break; } if (result->rc != LDAP_SUCCESS) { break; } } /* actually set the certificate parameters */ if (result->rc == LDAP_SUCCESS) { if (nickname) { result->rc = ldapssl_enable_clientauth(ldap, "", (char *)password, (char *)nickname); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: could not set client certificate: " "ldapssl_enable_clientauth() failed."; result->msg = ldap_err2string(result->rc); } } else if (secmod) { result->rc = ldapssl_advclientauth_init(cert7db, NULL, key3db ? 1 : 0, key3db, NULL, 1, secmod, LDAPSSL_AUTH_CNCHECK); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldapssl_advclientauth_init() failed."; result->msg = ldap_err2string(result->rc); } } else if (key3db) { result->rc = ldapssl_clientauth_init(cert7db, NULL, 1, key3db, NULL); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldapssl_clientauth_init() failed."; result->msg = ldap_err2string(result->rc); } } else { result->rc = ldapssl_client_init(cert7db, NULL); if (result->rc != LDAP_SUCCESS) { result->reason = "LDAP: ldapssl_client_init() failed."; result->msg = ldap_err2string(result->rc); } } } #else result->reason = "LDAP: SSL/TLS ldapssl_client_init() function not " "supported by this Netscape/Mozilla/Solaris SDK. " "Certificate authority file not set"; result->rc = -1; #endif #endif /* Novell SDK */ #if APR_HAS_NOVELL_LDAPSDK #if APR_HAS_LDAPSSL_CLIENT_INIT && APR_HAS_LDAPSSL_ADD_TRUSTED_CERT && APR_HAS_LDAPSSL_CLIENT_DEINIT /* The Novell library cannot support per connection certificates. Error * out if the ldap handle is provided. */ if (ldap) { result->rc = -1; result->reason = "LDAP: The Novell LDAP SDK cannot support the setting " "of certificates or keys on a per connection basis."; } /* Novell's library needs to be initialised first */ else { result->rc = ldapssl_client_init(NULL, NULL); if (result->rc != LDAP_SUCCESS) { result->msg = ldap_err2string(result-> rc); result->reason = apr_pstrdup(pool, "LDAP: Could not " "initialize SSL"); } } /* set one or more certificates */ for (i = 0; LDAP_SUCCESS == result->rc && i < certs->nelts; i++) { /* Novell SDK supports DER or BASE64 files. */ switch (ents[i].type) { case APR_LDAP_CA_TYPE_DER: result->rc = ldapssl_add_trusted_cert((void *)ents[i].path, LDAPSSL_CERT_FILETYPE_DER); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_CA_TYPE_BASE64: result->rc = ldapssl_add_trusted_cert((void *)ents[i].path, LDAPSSL_CERT_FILETYPE_B64); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_CERT_TYPE_DER: result->rc = ldapssl_set_client_cert((void *)ents[i].path, LDAPSSL_CERT_FILETYPE_DER, (void*)ents[i].password); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_CERT_TYPE_BASE64: result->rc = ldapssl_set_client_cert((void *)ents[i].path, LDAPSSL_CERT_FILETYPE_B64, (void*)ents[i].password); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_CERT_TYPE_PFX: result->rc = ldapssl_set_client_cert((void *)ents[i].path, LDAPSSL_FILETYPE_P12, (void*)ents[i].password); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_KEY_TYPE_DER: result->rc = ldapssl_set_client_private_key((void *)ents[i].path, LDAPSSL_CERT_FILETYPE_DER, (void*)ents[i].password); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_KEY_TYPE_BASE64: result->rc = ldapssl_set_client_private_key((void *)ents[i].path, LDAPSSL_CERT_FILETYPE_B64, (void*)ents[i].password); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_KEY_TYPE_PFX: result->rc = ldapssl_set_client_private_key((void *)ents[i].path, LDAPSSL_FILETYPE_P12, (void*)ents[i].password); result->msg = ldap_err2string(result->rc); break; default: result->rc = -1; result->reason = "LDAP: The Novell LDAP SDK only understands the " "DER and PEM (BASE64) file types."; break; } if (result->rc != LDAP_SUCCESS) { break; } } #else result->reason = "LDAP: ldapssl_client_init(), " "ldapssl_add_trusted_cert() or " "ldapssl_client_deinit() functions not supported " "by this Novell SDK. Certificate authority file " "not set"; result->rc = -1; #endif #endif /* OpenLDAP SDK */ #if APR_HAS_OPENLDAP_LDAPSDK #ifdef LDAP_OPT_X_TLS_CACERTFILE /* set one or more certificates */ /* FIXME: make it support setting directories as well as files */ for (i = 0; i < certs->nelts; i++) { /* OpenLDAP SDK supports BASE64 files. */ switch (ents[i].type) { case APR_LDAP_CA_TYPE_BASE64: result->rc = ldap_set_option(ldap, LDAP_OPT_X_TLS_CACERTFILE, (void *)ents[i].path); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_CERT_TYPE_BASE64: result->rc = ldap_set_option(ldap, LDAP_OPT_X_TLS_CERTFILE, (void *)ents[i].path); result->msg = ldap_err2string(result->rc); break; case APR_LDAP_KEY_TYPE_BASE64: result->rc = ldap_set_option(ldap, LDAP_OPT_X_TLS_KEYFILE, (void *)ents[i].path); result->msg = ldap_err2string(result->rc); break; #ifdef LDAP_OPT_X_TLS_CACERTDIR case APR_LDAP_CA_TYPE_CACERTDIR_BASE64: result->rc = ldap_set_option(ldap, LDAP_OPT_X_TLS_CACERTDIR, (void *)ents[i].path); result->msg = ldap_err2string(result->rc); break; #endif default: result->rc = -1; result->reason = "LDAP: The OpenLDAP SDK only understands the " "PEM (BASE64) file type."; break; } if (result->rc != LDAP_SUCCESS) { break; } } #else result->reason = "LDAP: LDAP_OPT_X_TLS_CACERTFILE not " "defined by this OpenLDAP SDK. Certificate " "authority file not set"; result->rc = -1; #endif #endif /* Microsoft SDK */ #if APR_HAS_MICROSOFT_LDAPSDK /* Microsoft SDK use the registry certificate store - error out * here with a message explaining this. */ result->reason = "LDAP: CA certificates cannot be set using this method, " "as they are stored in the registry instead."; result->rc = -1; #endif /* SDK not recognised */ #if APR_HAS_OTHER_LDAPSDK result->reason = "LDAP: LDAP_OPT_X_TLS_CACERTFILE not " "defined by this LDAP SDK. Certificate " "authority file not set"; result->rc = -1; #endif #else /* not compiled with SSL Support */ result->reason = "LDAP: Attempt to set certificate(s) failed. " "Not built with SSL support"; result->rc = -1; #endif /* APR_HAS_LDAP_SSL */ } #endif /* APR_HAS_LDAP */
.htaccess Tutorial
Find information you are looking for on the AskApache Home Page.