openldap/openldap-nss-db-prefix.patch

Enhancement, support multiple cert/key databases in tha same directory with another prefix.

Upstream ITS: #6689

--- openldap.old/libraries/libldap/tls_m.c	21 Jul 2010 20:57:01 -0000	1.18
+++ openldap.new/libraries/libldap/tls_m.c	28 Oct 2010 19:55:51 -0000
@@ -1202,16 +1202,55 @@
 			return -1;
 		}
 	}
 
 	return 0;
 }
 
 /*
+ * NSS supports having multiple cert/key databases in the same
+ * directory, each one having a unique string prefix e.g.
+ * slapd-01-cert8.db - the prefix here is "slapd-01-"
+ * this function examines the given certdir - if it looks like
+ * /path/to/directory/prefix it will return the
+ * /path/to/directory part in realcertdir, and the prefix in prefix
+ */
+static void
+tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
+{
+	char sep = PR_GetDirectorySeparator();
+	char *ptr = NULL;
+	struct PRFileInfo prfi;
+	PRStatus prc;
+
+	*realcertdir = (char *)certdir; /* default is the one passed in */
+
+	/* if certdir is not given, just return */
+	if ( !certdir ) {
+		return;
+	}
+
+	prc = PR_GetFileInfo( certdir, &prfi );
+	/* if certdir exists (file or directory) then it cannot specify a prefix */
+	if ( prc == PR_SUCCESS ) {
+		return;
+	}
+
+	/* if certdir was given, and there is a '/' in certdir, see if there
+	   is anything after the last '/' - if so, assume it is the prefix */
+	if ( ( ( ptr = strrchr( certdir, sep ) ) ) && *(ptr+1) ) {
+		*realcertdir = PL_strndup( certdir, ptr-certdir );
+		*prefix = PL_strdup( ptr+1 );
+	}
+
+	return;
+}
+
+/*
  * This is the part of the init we defer until we get the
  * actual security configuration information.  This is
  * only called once, protected by a PRCallOnce
  * NOTE: This must be done before the first call to SSL_ImportFD,
  * especially the setting of the policy
  * NOTE: This must be called after fork()
  */
 static int
@@ -1223,16 +1262,17 @@
 	int ii;
 	int nn;
 	PRErrorCode errcode = 1;
 #ifdef HAVE_NSS_INITCONTEXT
 	NSSInitParameters initParams;
 	NSSInitContext *initctx = NULL;
 #endif
 	SECStatus rc;
+	int done = 0;
 
 #ifdef HAVE_NSS_INITCONTEXT
 	memset( &initParams, 0, sizeof( initParams ) );
 	initParams.length = sizeof( initParams );
 #endif /* HAVE_NSS_INITCONTEXT */
 
 #ifndef HAVE_NSS_INITCONTEXT
 	if ( !NSS_IsInitialized() ) {
@@ -1246,50 +1286,61 @@
 		  DEFAULT_MOZNSS_DIR will only be used if the code cannot
 		  find a security dir to use based on the current
 		  settings
 		*/
 		nn = 0;
 		securitydirs[nn++] = PR_GetEnv( "MOZNSS_DIR" );
 		securitydirs[nn++] = lt->lt_cacertdir;
 		securitydirs[nn++] = PR_GetEnv( "DEFAULT_MOZNSS_DIR" );
-		for ( ii = 0; ii < nn; ++ii ) {
+		for ( ii = 0; !done && ( ii < nn ); ++ii ) {
+			char *realcertdir = NULL;
+			const char *defprefix = "";
+			char *prefix = (char *)defprefix;
 			const char *securitydir = securitydirs[ii];
 			if ( NULL == securitydir ) {
 				continue;
 			}
+
+			tlsm_get_certdb_prefix( securitydir, &realcertdir, &prefix );
 #ifdef HAVE_NSS_INITCONTEXT
 #ifdef INITCONTEXT_HACK
 			if ( !NSS_IsInitialized() && ctx->tc_is_server ) {
-				rc = NSS_Initialize( securitydir, "", "", SECMOD_DB, NSS_INIT_READONLY );
+				rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY );
 			} else {
-				initctx = NSS_InitContext( securitydir, "", "", SECMOD_DB,
+				initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB,
 										   &initParams, NSS_INIT_READONLY );
 				rc = (initctx == NULL) ? SECFailure : SECSuccess;
 			}
 #else
-			initctx = NSS_InitContext( securitydir, "", "", SECMOD_DB,
+			initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB,
 									   &initParams, NSS_INIT_READONLY );
 			rc = (initctx == NULL) ? SECFailure : SECSuccess;
 #endif
 #else
-			rc = NSS_Initialize( securitydir, "", "", SECMOD_DB, NSS_INIT_READONLY );
+			rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY );
 #endif
 
 			if ( rc != SECSuccess ) {
 				errcode = PORT_GetError();
 				Debug( LDAP_DEBUG_TRACE,
-					   "TLS: could not initialize moznss using security dir %s - error %d:%s.\n",
-					   securitydir, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+					   "TLS: could not initialize moznss using security dir %s prefix %s - error %d.\n",
+					   realcertdir, prefix, errcode );
 			} else {
 				/* success */
-				Debug( LDAP_DEBUG_TRACE, "TLS: using moznss security dir %s.\n",
-					   securitydir, 0, 0 );
+				Debug( LDAP_DEBUG_TRACE, "TLS: using moznss security dir %s prefix %s.\n",
+					   realcertdir, prefix, 0 );
 				errcode = 0;
-				break;
+				done = 1;
+			}
+			if ( realcertdir != securitydir ) {
+				PL_strfree( realcertdir );
+			}
+			if ( prefix != defprefix ) {
+				PL_strfree( prefix );
 			}
 		}
 
 		if ( errcode ) { /* no moznss db found, or not using moznss db */
 #ifdef HAVE_NSS_INITCONTEXT
 			int flags = NSS_INIT_READONLY|NSS_INIT_NOCERTDB|NSS_INIT_NOMODDB;
 #ifdef INITCONTEXT_HACK
 			if ( !NSS_IsInitialized() && ctx->tc_is_server ) {
@@ -2038,19 +2089,16 @@
 
 		errno = 0;
 		rc = SSL_ForceHandshake( s );
 		if (rc == SECSuccess) {
 			rc = 0;
 			break; /* done */
 		}
 		err = PR_GetError();
-		Debug( LDAP_DEBUG_TRACE, 
-			   "TLS: error: accept - force handshake failure %d - error %d waitcounter %d\n",
-			   errno, err, waitcounter );
 		if ( errno == EAGAIN || errno == EWOULDBLOCK ) {
 			waitcounter++;
 			in_flags = PR_POLL_READ | PR_POLL_EXCEPT;
 			out_flags = 0;
 			errno = 0;
 			filesReady = tlsm_is_io_ready( s, in_flags, &out_flags );
 			if ( filesReady < 0 ) {
 				err = PR_GetError();
@@ -2155,49 +2203,49 @@
 tlsm_session_my_dn( tls_session *session, struct berval *der_dn )
 {
 	tlsm_session *s = (tlsm_session *)session;
 	CERTCertificate *cert;
 
 	cert = SSL_LocalCertificate( s );
 	if (!cert) return LDAP_INVALID_CREDENTIALS;
 
-	der_dn->bv_val = cert->derSubject.data;
+	der_dn->bv_val = (char *)cert->derSubject.data;
 	der_dn->bv_len = cert->derSubject.len;
 	CERT_DestroyCertificate( cert );
 	return 0;
 }
 
 static int
 tlsm_session_peer_dn( tls_session *session, struct berval *der_dn )
 {
 	tlsm_session *s = (tlsm_session *)session;
 	CERTCertificate *cert;
 
 	cert = SSL_PeerCertificate( s );
 	if (!cert) return LDAP_INVALID_CREDENTIALS;
 	
-	der_dn->bv_val = cert->derSubject.data;
+	der_dn->bv_val = (char *)cert->derSubject.data;
 	der_dn->bv_len = cert->derSubject.len;
 	CERT_DestroyCertificate( cert );
 	return 0;
 }
 
 /* what kind of hostname were we given? */
 #define	IS_DNS	0
 #define	IS_IP4	1
 #define	IS_IP6	2
 
 static int
 tlsm_session_chkhost( LDAP *ld, tls_session *session, const char *name_in )
 {
 	tlsm_session *s = (tlsm_session *)session;
 	CERTCertificate *cert;
 	const char *name, *domain = NULL, *ptr;
-	int i, ret, ntype = IS_DNS, nlen, dlen;
+	int ret, ntype = IS_DNS, nlen, dlen;
 #ifdef LDAP_PF_INET6
 	struct in6_addr addr;
 #else
 	struct in_addr addr;
 #endif
 	SECItem altname;
 	SECStatus rv;
 
@@ -2259,17 +2307,17 @@
 
 		do {
 			char *host;
 			int hlen;
 
 			/* ignore empty */
 			if ( !cur->name.other.len ) continue;
 
-			host = cur->name.other.data;
+			host = (char *)cur->name.other.data;
 			hlen = cur->name.other.len;
 
 			if ( cur->type == certDNSName ) {
 				if ( ntype != IS_DNS )	continue;
 
 				/* is this an exact match? */
 				if ( nlen == hlen && !strncasecmp( name, host, nlen )) {
 					ret = LDAP_SUCCESS;
@@ -2317,21 +2365,21 @@
 			while ( avas && ( ava = *avas++ )) {
 				if ( CERT_GetAVATag( ava ) == SEC_OID_AVA_COMMON_NAME )
 					lastava = ava;
 			}
 		}
 		if ( lastava ) {
 			SECItem *av = CERT_DecodeAVAValue( &lastava->value );
 			if ( av ) {
-				if ( av->len == nlen && !strncasecmp( name, av->data, nlen )) {
+				if ( av->len == nlen && !strncasecmp( name, (char *)av->data, nlen )) {
 					ret = LDAP_SUCCESS;
 				} else if ( av->data[0] == '*' && av->data[1] == '.' &&
 					domain && dlen == av->len - 1 && !strncasecmp( name,
-						av->data+1, dlen )) {
+						(char *)(av->data+1), dlen )) {
 					ret = LDAP_SUCCESS;
 				} else {
 					int len = av->len;
 					if ( len >= sizeof(buf) )
 						len = sizeof(buf)-1;
 					memcpy( buf, av->data, len );
 					buf[len] = '\0';
 				}
@@ -2479,17 +2527,16 @@
 {
 	return tlsm_PR_Send( fd, buf, len, 0, PR_INTERVAL_NO_TIMEOUT );
 }
 
 static PRStatus PR_CALLBACK
 tlsm_PR_GetPeerName(PRFileDesc *fd, PRNetAddr *addr)
 {
 	struct tls_data		*p;
-	int rc;
 	ber_socklen_t len;
 
 	p = (struct tls_data *)fd->secret;
 
 	if ( p == NULL || p->sbiod == NULL ) {
 		return PR_FAILURE;
 	}
 	len = sizeof(PRNetAddr);