ITS#8427 Set up TLS settings on each reconnection

diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 3223f39641eeb46d4a89094076cc7a83772fb37e..323874379e68bcb342ada37119c55a50945d71f7 100644 (file)
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -729,11 +729,7 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_
                sb = &li->li_tls;
        }
 
-       if ( sb->sb_tls_do_init ) {
-               bindconf_tls_set( sb, ld );
-       } else if ( sb->sb_tls_ctx ) {
-               ldap_set_option( ld, LDAP_OPT_X_TLS_CTX, sb->sb_tls_ctx );
-       }
+       bindconf_tls_set( sb, ld );
 
        /* if required by the bindconf configuration, force TLS */
        if ( ( sb == &li->li_acl || sb == &li->li_idassert.si_bc ) &&

diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index d028b8dd40fcd18675b0c1c348e183540215daa4..22cadb7000a1d33ba471fbeeca293f0a2cb9d518 100644 (file)
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -433,11 +433,7 @@ retry_lock:;
                        sb = &mt->mt_tls;
                }
 
-               if ( sb->sb_tls_do_init ) {
-                       bindconf_tls_set( sb, msc->msc_ld );
-               } else if ( sb->sb_tls_ctx ) {
-                       ldap_set_option( msc->msc_ld, LDAP_OPT_X_TLS_CTX, sb->sb_tls_ctx );
-               }
+               bindconf_tls_set( sb, msc->msc_ld );
 
                if ( !is_ldaps ) {
                        if ( sb == &mt->mt_idassert.si_bc && sb->sb_tls_ctx ) {

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index fd633914ce656a551465290ce0eee29ec3479c3e..67c6e335192ebe75dba20197bd3e4e05bcfb1a7e 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -1864,7 +1864,7 @@ static struct {
 
 int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
 {
-       int i, rc, newctx = 0, res = 0;
+       int i, rc, res = 0;
        char *ptr = (char *)bc, **word;
 
        bc->sb_tls_do_init = 0;
@@ -1878,8 +1878,7 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
                                        "bindconf_tls_set: failed to set %s to %s\n",
                                                bindtlsopts[i].key, *word, 0 );
                                res = -1;
-                       } else
-                               newctx = 1;
+                       }
                }
        }
        if ( bc->sb_tls_reqcert ) {
@@ -1890,8 +1889,7 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
                                "bindconf_tls_set: failed to set tls_reqcert to %s\n",
                                        bc->sb_tls_reqcert, 0, 0 );
                        res = -1;
-               } else
-                       newctx = 1;
+               }
        }
        if ( bc->sb_tls_protocol_min ) {
                rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_PROTOCOL_MIN,
@@ -1901,8 +1899,7 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
                                "bindconf_tls_set: failed to set tls_protocol_min to %s\n",
                                        bc->sb_tls_protocol_min, 0, 0 );
                        res = -1;
-               } else
-                       newctx = 1;
+               }
        }
 #ifdef HAVE_OPENSSL_CRL
        if ( bc->sb_tls_crlcheck ) {
@@ -1913,17 +1910,15 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld )
                                "bindconf_tls_set: failed to set tls_crlcheck to %s\n",
                                        bc->sb_tls_crlcheck, 0, 0 );
                        res = -1;
-               } else
-                       newctx = 1;
+               }
        }
 #endif
-       if ( newctx ) {
+       if ( bc->sb_tls_ctx ) {
+               rc = ldap_set_option( ld, LDAP_OPT_X_TLS_CTX, bc->sb_tls_ctx );
+               if ( rc )
+                       res = rc;
+       } else {
                int opt = 0;
-
-               if ( bc->sb_tls_ctx ) {
-                       ldap_pvt_tls_ctx_free( bc->sb_tls_ctx );
-                       bc->sb_tls_ctx = NULL;
-               }
                rc = ldap_set_option( ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
                if ( rc )
                        res = rc;
@@ -2000,14 +1995,7 @@ slap_client_connect( LDAP **ldp, slap_bindconf *sb )
        slap_client_keepalive(ld, &sb->sb_keepalive);
 
 #ifdef HAVE_TLS
-       if ( sb->sb_tls_do_init ) {
-               rc = bindconf_tls_set( sb, ld );
-
-       } else if ( sb->sb_tls_ctx ) {
-               rc = ldap_set_option( ld, LDAP_OPT_X_TLS_CTX,
-                       sb->sb_tls_ctx );
-       }
-
+       rc = bindconf_tls_set( sb, ld );
        if ( rc ) {
                Debug( LDAP_DEBUG_ANY,
                        "slap_client_connect: "