You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by bn...@apache.org on 2005/05/12 00:34:20 UTC
svn commit: r169705 - in /httpd/httpd/trunk: include/util_ldap.h
modules/ldap/util_ldap.c
Author: bnicholes
Date: Wed May 11 15:34:18 2005
New Revision: 169705
URL: http://svn.apache.org/viewcvs?rev=169705&view=rev
Log:
Add the LDAPVerifyServerCert directive to util_ldap to force
verification of a server certificate when establishing an SSL connection
to the LDAP server
Modified:
httpd/httpd/trunk/include/util_ldap.h
httpd/httpd/trunk/modules/ldap/util_ldap.c
Modified: httpd/httpd/trunk/include/util_ldap.h
URL: http://svn.apache.org/viewcvs/httpd/httpd/trunk/include/util_ldap.h?rev=169705&r1=169704&r2=169705&view=diff
==============================================================================
--- httpd/httpd/trunk/include/util_ldap.h (original)
+++ httpd/httpd/trunk/include/util_ldap.h Wed May 11 15:34:18 2005
@@ -131,6 +131,7 @@
void *util_ldap_cache;
char *lock_file; /* filename for shm lock mutex */
long connectionTimeout;
+ int verify_svr_cert;
} util_ldap_state_t;
Modified: httpd/httpd/trunk/modules/ldap/util_ldap.c
URL: http://svn.apache.org/viewcvs/httpd/httpd/trunk/modules/ldap/util_ldap.c?rev=169705&r1=169704&r2=169705&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ldap/util_ldap.c (original)
+++ httpd/httpd/trunk/modules/ldap/util_ldap.c Wed May 11 15:34:18 2005
@@ -330,6 +330,9 @@
/* always default to LDAP V3 */
ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);
+ apr_ldap_set_option(ldc->pool, ldc->ldap,
+ APR_LDAP_OPT_VERIFY_CERT, &(st->verify_svr_cert), &(result));
+
#ifdef LDAP_OPT_NETWORK_TIMEOUT
if (st->connectionTimeout > 0) {
timeOut.tv_sec = st->connectionTimeout;
@@ -1556,7 +1559,6 @@
cert->path == NULL ? file : cert->path);
return "Invalid global certificate file path";
}
-
}
return(NULL);
@@ -1684,6 +1686,24 @@
return(NULL);
}
+static const char *util_ldap_set_verify_srv_cert(cmd_parms *cmd,
+ void *dummy,
+ int mode)
+{
+ util_ldap_state_t *st =
+ (util_ldap_state_t *)ap_get_module_config(cmd->server->module_config,
+ &ldap_module);
+
+ ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, cmd->server,
+ "LDAP: SSL verify server certificate - %s",
+ mode?"TRUE":"FALSE");
+
+ st->verify_svr_cert = mode;
+
+ return(NULL);
+}
+
+
static const char *util_ldap_set_connection_timeout(cmd_parms *cmd,
void *dummy,
const char *ttl)
@@ -1732,6 +1752,7 @@
st->secure = APR_LDAP_NONE;
st->secure_set = 0;
st->connectionTimeout = 10;
+ st->verify_svr_cert = 1;
return st;
}
@@ -2013,6 +2034,11 @@
NULL, RSRC_CONF,
"Specify the type of security that should be applied to "
"an LDAP connection. One of; NONE, SSL or STARTTLS."),
+
+ AP_INIT_FLAG("LDAPVerifyServerCert", util_ldap_set_verify_srv_cert,
+ NULL, RSRC_CONF,
+ "Set to 'ON' requires that the server certificate be verified "
+ "before a secure LDAP connection can be establish. Default 'ON'"),
AP_INIT_TAKE1("LDAPConnectionTimeout", util_ldap_set_connection_timeout,
NULL, RSRC_CONF,
Re: Reverting vs branching, WAS: Re: svn commit: r169705 - in /httpd/httpd/trunk:
include/util_ldap.h modules/ldap/util_ldap.c
Posted by Garrett Rooney <ro...@electricjellyfish.net>.
Sander Striker wrote:
>> Ideas for a solution that doesn't involve waiting for APR-Util 1.2.0?
>
>
> Yes. We could do the branch...
Heck, you don't even need to revert the commit to do that, just branch
from the revision before the change was made to trunk...
-garrett
Reverting vs branching, WAS: Re: svn commit: r169705 - in /httpd/httpd/trunk:
include/util_ldap.h modules/ldap/util_ldap.c
Posted by Sander Striker <st...@apache.org>.
Paul Querna wrote:
> bnicholes@apache.org wrote:
>
>>Author: bnicholes
>>Date: Wed May 11 15:34:18 2005
>>New Revision: 169705
>>
>>URL: http://svn.apache.org/viewcvs?rev=169705&view=rev
>>Log:
>>Add the LDAPVerifyServerCert directive to util_ldap to force
>>verification of a server certificate when establishing an SSL connection
>>to the LDAP server
>>
>>Modified:
>> httpd/httpd/trunk/include/util_ldap.h
>> httpd/httpd/trunk/modules/ldap/util_ldap.c
>
> Ack. This commit means that httpd/trunk now depends on apr-util/trunk.
> Before this you were able to run httpd/trunk using APR-Util 1.1.x.
Which is a no-go. Please revert.
> This effectively kills any httpd alphas until APR-Util 1.2.0 is released.
>
> I believe we should uphold the policy of using only released versions of
> a dependency.
+1.
> I don't see an APR-Util 1.2.0 coming very soon. The APR-DBD code could
> still use more love.
>
> This is just an example of why I wanted to branch trunk to 2.1.x. I
> have nothing against adding this specific feature -- it just happens to
> require a non-released version of APR-Util.
>
> Ideas for a solution that doesn't involve waiting for APR-Util 1.2.0?
Yes. We could do the branch...
Sander
Re: svn commit: r169705 - in /httpd/httpd/trunk:
include/util_ldap.h modules/ldap/util_ldap.c
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
At 05:52 PM 5/11/2005, Paul Querna wrote:
>I believe we should uphold the policy of using only released versions of
>a dependency.
+1, however...
>I don't see an APR-Util 1.2.0 coming very soon. The APR-DBD code could
>still use more love.
Why not? Looks like apr_dbd should simply be pushed off to
apr_util release 1.3.0 and get the other fixes and features
out the door, perhaps.
>This is just an example of why I wanted to branch trunk to 2.1.x. I
>have nothing against adding this specific feature -- it just happens to
>require a non-released version of APR-Util.
-1 for this specific purpose; I always saw httpd-2.2 as addressing
only the handful of things we never did quite finish in 2.0. Those
being the auth reorg, auth ldap, proxy and cache.
If httpd-2.2 can really be boiled down to this small subset - I would
very much like to see this work adopted. If it means creating a dbd-less
apr_util 1.2.0 then so be it. Thoughts?
Bill
Re: svn commit: r169705 - in /httpd/httpd/trunk: include/util_ldap.h
modules/ldap/util_ldap.c
Posted by Paul Querna <ch...@force-elite.com>.
bnicholes@apache.org wrote:
> Author: bnicholes
> Date: Wed May 11 15:34:18 2005
> New Revision: 169705
>
> URL: http://svn.apache.org/viewcvs?rev=169705&view=rev
> Log:
> Add the LDAPVerifyServerCert directive to util_ldap to force
> verification of a server certificate when establishing an SSL connection
> to the LDAP server
>
> Modified:
> httpd/httpd/trunk/include/util_ldap.h
> httpd/httpd/trunk/modules/ldap/util_ldap.c
>
Ack. This commit means that httpd/trunk now depends on apr-util/trunk.
Before this you were able to run httpd/trunk using APR-Util 1.1.x.
This effectively kills any httpd alphas until APR-Util 1.2.0 is released.
I believe we should uphold the policy of using only released versions of
a dependency.
I don't see an APR-Util 1.2.0 coming very soon. The APR-DBD code could
still use more love.
This is just an example of why I wanted to branch trunk to 2.1.x. I
have nothing against adding this specific feature -- it just happens to
require a non-released version of APR-Util.
Ideas for a solution that doesn't involve waiting for APR-Util 1.2.0?
Thanks,
-Paul
Re: svn commit: r169705 - in /httpd/httpd/trunk: include/util_ldap.h
modules/ldap/util_ldap.c
Posted by Paul Querna <ch...@force-elite.com>.
bnicholes@apache.org wrote:
> Author: bnicholes
> Date: Wed May 11 15:34:18 2005
> New Revision: 169705
>
> URL: http://svn.apache.org/viewcvs?rev=169705&view=rev
> Log:
> Add the LDAPVerifyServerCert directive to util_ldap to force
> verification of a server certificate when establishing an SSL connection
> to the LDAP server
>
> Modified:
> httpd/httpd/trunk/include/util_ldap.h
> httpd/httpd/trunk/modules/ldap/util_ldap.c
>
Ack. This commit means that httpd/trunk now depends on apr-util/trunk.
Before this you were able to run httpd/trunk using APR-Util 1.1.x.
This effectively kills any httpd alphas until APR-Util 1.2.0 is released.
I believe we should uphold the policy of using only released versions of
a dependency.
I don't see an APR-Util 1.2.0 coming very soon. The APR-DBD code could
still use more love.
This is just an example of why I wanted to branch trunk to 2.1.x. I
have nothing against adding this specific feature -- it just happens to
require a non-released version of APR-Util.
Ideas for a solution that doesn't involve waiting for APR-Util 1.2.0?
Thanks,
-Paul