tls encryption support added

modules_s/ldap/Makefile

@@ -8,6 +8,8 @@ NAME=ldap.so
 
 #DEFS += -DLD_TEST
 
+DEFS += -Wall -DOPENLDAP23
+
 # Uncomment this if you have a recent version of libldap with
 # LD_SCOPE_CHILDREN defined
 #DEFS += -DHAVE_SCOPE_CHILDREN

modules_s/ldap/ld_cfg.c

@@ -268,11 +268,14 @@ static cfg_option_t auth_values[] = {
 
 
 static cfg_option_t ldap_con_options[] = {
-	{"host",     .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
-	{"port",     .f = cfg_parse_int_opt},
-	{"username", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
-	{"password", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
-	{"authtype", .param = auth_values, .f = cfg_parse_enum_opt},
+	{"host",     		.f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
+	{"port",     		.f = cfg_parse_int_opt},
+	{"username", 		.f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
+	{"password", 		.f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
+	{"authtype", 		.param = auth_values, .f = cfg_parse_enum_opt},
+	{"tls",			.param = cfg_bool_values, .f = cfg_parse_enum_opt},
+	{"ca_list",  		.f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
+	{"require_certificate", .f = cfg_parse_str_opt, .flags = CFG_STR_PKGMEM},
 	{0}
 };
 
@@ -342,6 +345,11 @@ static int parse_section(void* param, cfg_parser_t* st, unsigned int flags)
 		for(i = 0; auth_values[i].name; i++) {
 			auth_values[i].param = &con->authmech;
 		}
+		for(i = 0; cfg_bool_values[i].name; i++) {
+			cfg_bool_values[i].param = &con->tls;
+		}
+		ldap_con_options[6].param = &con->ca_list;
+		ldap_con_options[7].param = &con->req_cert;
 	} else {
 		BUG("%s:%d:%d: Unsupported section type %c\n",
 			st->file, t.start.line, t.start.col, t.type);

modules_s/ldap/ld_cfg.h

@@ -49,6 +49,9 @@ struct ld_con_info {
 	str username;
 	str password;
 	int authmech;
+	int tls;  /**<  TLS encryption enabled */
+	str ca_list;  /**< Path of the file that contains certificates of the CAs */
+	str req_cert;  /**< LDAP level of certificate request behaviour */
 	struct ld_con_info* next;
 };
 

modules_s/ldap/ld_con.c

@@ -42,7 +42,6 @@
 #include <ldap.h>
 #include <stdlib.h>
 #include <string.h>
-
 #include <sasl/sasl.h>
 
 /** Free all memory allocated for a ld_con structure.
@@ -176,6 +175,7 @@ int ld_con_connect(db_con_t* con)
 	struct ld_con* lcon;
 	struct ld_uri* luri;
 	int ret, version = 3;
+	char* err_str = NULL;
 
 	lcon = DB_GET_PAYLOAD(con);
 	luri = DB_GET_PAYLOAD(con->uri);
@@ -193,6 +193,19 @@ int ld_con_connect(db_con_t* con)
 		}
 	}
 
+	/* we pass the TLS_REQCERT and TLS_REQCERT attributes over environment
+	   variables to ldap library */
+	if (luri->tls) {
+		if (setenv("LDAPTLS_CACERT", luri->ca_list, 1)) {
+			ERR("ldap: Can't set environment variable 'LDAPTLS_CACERT'\n");
+			goto error;
+		}
+		if (setenv("LDAPTLS_REQCERT", luri->req_cert, 1)) {
+			ERR("ldap: Can't set environment variable 'LDAPTLS_REQCERT'\n");
+			goto error;
+		}
+	}
+
 	ret = ldap_initialize(&lcon->con, luri->uri);
 	if (lcon->con == NULL) {
 		ERR("ldap: Error while initializing new LDAP connection to %s\n",
@@ -207,6 +220,24 @@ int ld_con_connect(db_con_t* con)
 		goto error;
 	}
 
+	if (luri->tls) {
+		ret = ldap_start_tls_s(lcon->con, NULL, NULL);
+		if (ret != LDAP_SUCCESS) {
+			/* get addition info of this error */
+#ifdef OPENLDAP23
+			ldap_get_option(lcon->con, LDAP_OPT_ERROR_STRING, &err_str);
+#elif OPENLDAP24
+			ldap_get_option(lcon->con, LDAP_OPT_DIAGNOSTIC_MESSAGE, &err_str);
+#endif
+			ERR("ldap: Error while starting TLS: %s\n", ldap_err2string(ret));
+			if (err_str) {
+				ERR("ldap: %s\n", err_str);
+				ldap_memfree(err_str);
+			}
+			goto error;
+		}
+	}
+
 	switch (luri->authmech) {
 		case LDAP_AUTHMECH_NONE:
 			ret = ldap_simple_bind_s(lcon->con, NULL, NULL);

modules_s/ldap/ld_uri.c

@@ -285,6 +285,19 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri)
 		}
 
 		res->authmech = cfg_conn_info->authmech;
+		res->tls = cfg_conn_info->tls;
+		if (cfg_conn_info->ca_list.s) {
+			if (!(res->ca_list = pkgstrdup(&cfg_conn_info->ca_list))) {
+					ERR("ldap: No memory left\n");
+					goto err;
+			}
+		}
+		if (cfg_conn_info->req_cert.s) {
+			if (!(res->req_cert = pkgstrdup(&cfg_conn_info->req_cert))) {
+					ERR("ldap: No memory left\n");
+					goto err;
+			}
+		}
 
 		break;
 	default:
@@ -304,6 +317,14 @@ int parse_ldap_uri(struct ld_uri* res, str* scheme, str* uri)
 		pkg_free(res->password);
 		res->password = NULL;
 	}
+	if (res->ca_list) {
+		pkg_free(res->ca_list);
+		res->ca_list = NULL;
+	}
+	if (res->req_cert) {
+		pkg_free(res->req_cert);
+		res->req_cert = NULL;
+	}
 	return -1;
 }
 
@@ -314,6 +335,8 @@ static void ld_uri_free(db_uri_t* uri, struct ld_uri* payload)
 	if (payload->uri) pkg_free(payload->uri);
     if (payload->username) pkg_free(payload->username);
     if (payload->password) pkg_free(payload->password);
+    if (payload->ca_list) pkg_free(payload->ca_list);
+    if (payload->req_cert) pkg_free(payload->req_cert);
 	db_drv_free(&payload->drv);
 	pkg_free(payload);
 }

modules_s/ldap/ld_uri.h

@@ -61,6 +61,9 @@ struct ld_uri {
 	char* password;
 	char* uri;             /**< The whole URI, including scheme */
 	int authmech;
+	int tls;  /**<  TLS encryption enabled */
+	char* ca_list;  /**< Path of the file that contains certificates of the CAs */
+	char* req_cert;  /**< LDAP level of certificate request behaviour */
 	LDAPURLDesc* ldap_url; /**< URI parsed by the ldap client library */
 };
 

modules_s/ldap/ldap.cfg

@@ -24,6 +24,18 @@ password=heslo
 # Allowed values: none (default), simple, digest-md5, external
 authtype=simple
 
+# tls encryption
+tls=off
+
+# Specifies the file that contains certificates for all of the Certificate
+# Authorities the ldap module will recognize.
+ca_list=/home/kg/work/openssl/demoCA/cacert.pem
+
+# Specifies what checks to perform on server certificates in a TLS session
+# allowed values are never/allow/try/demand
+# see the TLS_REQCERT tls option part of ldap.conf(8) man page for more details
+require_certificate=demand
+
 #
 # Table credentials contains SIP digest authentication credentials.
 #