tldap_tls: Move creation of tls_params out of tldap_tls_connect()

Soon we will have a tldap user which does not want to verify the
certs. Instead of passing another boolean down, hand in pre-created
tstream_tls_params.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/lib/tldap_tls_connect.c b/source3/lib/tldap_tls_connect.c
index daf33dba3401b9bd3f8a198f2b597365eef15605..7254afb79bda353eeac122b21af49e088d809144 100644 (file)
--- a/source3/lib/tldap_tls_connect.c
+++ b/source3/lib/tldap_tls_connect.c
@@ -29,20 +29,17 @@
 struct tldap_tls_connect_state {
        struct tevent_context *ev;
        struct tldap_context *ctx;
-       struct loadparm_context *lp_ctx;
-       const char *peer_name;
+       struct tstream_tls_params *tls_params;
 };
 
 static void tldap_tls_connect_starttls_done(struct tevent_req *subreq);
 static void tldap_tls_connect_crypto_start(struct tevent_req *req);
 static void tldap_tls_connect_crypto_done(struct tevent_req *subreq);
 
-struct tevent_req *tldap_tls_connect_send(
-       TALLOC_CTX *mem_ctx,
-       struct tevent_context *ev,
-       struct tldap_context *ctx,
-       struct loadparm_context *lp_ctx,
-       const char *peer_name)
+struct tevent_req *tldap_tls_connect_send(TALLOC_CTX *mem_ctx,
+                                         struct tevent_context *ev,
+                                         struct tldap_context *ctx,
+                                         struct tstream_tls_params *tls_params)
 {
        struct tevent_req *req = NULL;
        struct tldap_tls_connect_state *state = NULL;
@@ -54,8 +51,7 @@ struct tevent_req *tldap_tls_connect_send(
        }
        state->ev = ev;
        state->ctx = ctx;
-       state->lp_ctx = lp_ctx;
-       state->peer_name = peer_name;
+       state->tls_params = tls_params;
 
        if (!tldap_connection_ok(ctx)) {
                DBG_ERR("tldap_connection_ok() => false\n");
@@ -112,7 +108,8 @@ static void tldap_tls_connect_starttls_done(struct tevent_req *subreq)
        TALLOC_FREE(subreq);
        if (!TLDAP_RC_IS_SUCCESS(rc)) {
                DBG_ERR("tldap_extended_recv(STARTTLS, %s): %s\n",
-                       state->peer_name, tldap_rc2string(rc));
+                       tstream_tls_params_peer_name(state->tls_params),
+                       tldap_rc2string(rc));
                tevent_req_ldap_error(req, rc);
                return;
        }
@@ -127,9 +124,7 @@ static void tldap_tls_connect_crypto_start(struct tevent_req *req)
        struct tldap_tls_connect_state *state = tevent_req_data(
                req, struct tldap_tls_connect_state);
        struct tstream_context *plain_stream = NULL;
-       struct tstream_tls_params *tls_params = NULL;
        struct tevent_req *subreq = NULL;
-       NTSTATUS status;
 
        plain_stream = tldap_get_plain_tstream(state->ctx);
        if (plain_stream == NULL) {
@@ -138,21 +133,10 @@ static void tldap_tls_connect_crypto_start(struct tevent_req *req)
                return;
        }
 
-       status = tstream_tls_params_client_lpcfg(state,
-                                                state->lp_ctx,
-                                                state->peer_name,
-                                                &tls_params);
-       if (!NT_STATUS_IS_OK(status)) {
-               DBG_ERR("tstream_tls_params_client_lpcfg(%s): %s\n",
-                       state->peer_name, nt_errstr(status));
-               tevent_req_ldap_error(req, TLDAP_LOCAL_ERROR);
-               return;
-       }
-
        subreq = tstream_tls_connect_send(state,
                                          state->ev,
                                          plain_stream,
-                                         tls_params);
+                                         state->tls_params);
        if (tevent_req_nomem(subreq, req)) {
                return;
        }
@@ -175,7 +159,9 @@ static void tldap_tls_connect_crypto_done(struct tevent_req *subreq)
        TALLOC_FREE(subreq);
        if (ret != 0) {
                DBG_ERR("tstream_tls_connect_recv(%s): %d %d\n",
-                       state->peer_name, ret, error);
+                       tstream_tls_params_peer_name(state->tls_params),
+                       ret,
+                       error);
                tevent_req_ldap_error(req, TLDAP_CONNECT_ERROR);
                return;
        }
@@ -196,10 +182,8 @@ TLDAPRC tldap_tls_connect_recv(struct tevent_req *req)
        return TLDAP_SUCCESS;
 }
 
-TLDAPRC tldap_tls_connect(
-       struct tldap_context *ctx,
-       struct loadparm_context *lp_ctx,
-       const char *peer_name)
+TLDAPRC tldap_tls_connect(struct tldap_context *ctx,
+                         struct tstream_tls_params *tls_params)
 {
        TALLOC_CTX *frame = talloc_stackframe();
        struct tevent_context *ev;
@@ -210,11 +194,7 @@ TLDAPRC tldap_tls_connect(
        if (ev == NULL) {
                goto fail;
        }
-       req = tldap_tls_connect_send(frame,
-                                    ev,
-                                    ctx,
-                                    lp_ctx,
-                                    peer_name);
+       req = tldap_tls_connect_send(frame, ev, ctx, tls_params);
        if (req == NULL) {
                goto fail;
        }

diff --git a/source3/lib/tldap_tls_connect.h b/source3/lib/tldap_tls_connect.h
index 6225d62e5ebf78a40f63d5a84cf907fe98092ff7..42977e410fb1083d4c6b8563a598e141f9e3b5c2 100644 (file)
--- a/source3/lib/tldap_tls_connect.h
+++ b/source3/lib/tldap_tls_connect.h
@@ -23,17 +23,15 @@
 struct tevent_context;
 struct tldap_context;
 struct loadparm_context;
+struct tstream_tls_params;
 
 struct tevent_req *tldap_tls_connect_send(
        TALLOC_CTX *mem_ctx,
        struct tevent_context *ev,
        struct tldap_context *ctx,
-       struct loadparm_context *lp_ctx,
-       const char *peer_name);
+       struct tstream_tls_params *tls_params);
 TLDAPRC tldap_tls_connect_recv(struct tevent_req *req);
-TLDAPRC tldap_tls_connect(
-       struct tldap_context *ctx,
-       struct loadparm_context *lp_ctx,
-       const char *peer_name);
+TLDAPRC tldap_tls_connect(struct tldap_context *ctx,
+                         struct tstream_tls_params *tls_params);
 
 #endif

diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 36f0d99d911176954649bc5114d050e2471d27a3..87da71a311d8c8d6c7a11b2a48e93c933917af1f 100644 (file)
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -55,6 +55,7 @@
 #include "lib/util/string_wrappers.h"
 #include "source3/lib/substitute.h"
 #include "ads.h"
+#include "source4/lib/tls/tls.h"
 
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
@@ -12427,9 +12428,21 @@ static bool run_tldap(int dummy)
        }
 
        if (use_tls && !tldap_has_tls_tstream(ld)) {
+               struct tstream_tls_params *tls_params = NULL;
+
                tldap_set_starttls_needed(ld, use_starttls);
 
-               rc = tldap_tls_connect(ld, lp_ctx, host);
+               status = tstream_tls_params_client_lpcfg(talloc_tos(),
+                                                        lp_ctx,
+                                                        host,
+                                                        &tls_params);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_ERR("tstream_tls_params_client_lpcfg failed: %s\n",
+                               nt_errstr(status));
+                       return false;
+               }
+
+               rc = tldap_tls_connect(ld, tls_params);
                if (!TLDAP_RC_IS_SUCCESS(rc)) {
                        DBG_ERR("tldap_tls_connect(%s) failed: %s\n",
                                host, tldap_errstr(talloc_tos(), ld, rc));

diff --git a/source3/winbindd/idmap_ad.c b/source3/winbindd/idmap_ad.c
index 00a75a6f3ecb5a35cee1be93c26e7c9ba1e0711d..e7df090ef6fa7b18f08ccf7391a0805e5d1c6a8d 100644 (file)
--- a/source3/winbindd/idmap_ad.c
+++ b/source3/winbindd/idmap_ad.c
@@ -38,6 +38,7 @@
 #include "source3/librpc/gen_ndr/ads.h"
 #include "source3/lib/global_contexts.h"
 #include <ldb.h>
+#include "source4/lib/tls/tls.h"
 
 struct idmap_ad_schema_names;
 
@@ -428,9 +429,22 @@ static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
        }
 
        if (use_tls && !tldap_has_tls_tstream(ld)) {
+               struct tstream_tls_params *tls_params = NULL;
+
                tldap_set_starttls_needed(ld, use_starttls);
 
-               rc = tldap_tls_connect(ld, lp_ctx, dcinfo->dc_unc);
+               status = tstream_tls_params_client_lpcfg(talloc_tos(),
+                                                        lp_ctx,
+                                                        dcinfo->dc_unc,
+                                                        &tls_params);
+               if (!NT_STATUS_IS_OK(status)) {
+                      DBG_ERR("tstream_tls_params_client_lpcfg failed: %s\n",
+                              nt_errstr(status));
+                      TALLOC_FREE(dcinfo);
+                      return status;
+               }
+
+               rc = tldap_tls_connect(ld, tls_params);
                if (!TLDAP_RC_IS_SUCCESS(rc)) {
                        DBG_ERR("tldap_gensec_bind(%s) failed: %s\n",
                                dcinfo->dc_unc,