Add ldap_tls_cacertfile and ldap_tls_depth options (EJAB-1299)

src/ejabberd_auth_ldap.erl

@@ -374,6 +374,8 @@ parse_options(Host) ->
 		   end,
     LDAPEncrypt = ejabberd_config:get_local_option({ldap_encrypt, Host}),
     LDAPTLSVerify = ejabberd_config:get_local_option({ldap_tls_verify, Host}),
+    LDAPTLSCAFile = ejabberd_config:get_local_option({ldap_tls_cacertfile, Host}),
+    LDAPTLSDepth = ejabberd_config:get_local_option({ldap_tls_depth, Host}),
     LDAPPort = case ejabberd_config:get_local_option({ldap_port, Host}) of
 		   undefined -> case LDAPEncrypt of
 				    tls -> ?LDAPS_PORT;
@@ -422,7 +424,9 @@ parse_options(Host) ->
 	   backups = LDAPBackups,
 	   port = LDAPPort,
 	   tls_options = [{encrypt, LDAPEncrypt},
-			  {tls_verify, LDAPTLSVerify}],
+			  {tls_verify, LDAPTLSVerify},
+                          {tls_cacertfile, LDAPTLSCAFile},
+                          {tls_depth, LDAPTLSDepth}],
 	   dn = RootDN,
 	   password = Password,
 	   base = LDAPBase,

src/eldap/eldap.erl

@@ -448,14 +448,29 @@ init({Hosts, Port, Rootdn, Passwd, Opts}) ->
 		       end;
 		   PT -> PT
 	       end,
-    TLSOpts = case proplists:get_value(tls_verify, Opts) of
+    CacertOpts = case proplists:get_value(tls_cacertfile, Opts) of
-		  soft ->
+                     [_|_] = Path -> [{cacertfile, Path}];
-		      [{verify, 1}];
+                     _ -> []
-		  hard ->
+                 end,
-		      [{verify, 2}];
+    DepthOpts = case proplists:get_value(tls_depth, Opts) of
-		  _ ->
+                    Depth when is_integer(Depth), Depth >= 0 ->
-		      [{verify, 0}]
+                        [{depth, Depth}];
-	      end,
+                    _ -> []
+                end,
+    Verify = proplists:get_value(tls_verify, Opts),
+    TLSOpts = if (Verify == hard orelse Verify == soft)
+                 andalso CacertOpts == [] ->
+                      ?WARNING_MSG("TLS verification is enabled "
+                                   "but no CA certfiles configured, so "
+                                   "verification is disabled.", []),
+                      [];
+                 Verify == soft ->
+                      [{verify, 1}] ++ CacertOpts ++ DepthOpts;
+                 Verify == hard ->
+                      [{verify, 2}] ++ CacertOpts ++ DepthOpts;
+                 true ->
+                      []
+              end,
     {ok, connecting, #eldap{hosts = Hosts,
 			    port = PortTemp,
 			    rootdn = Rootdn,
@@ -965,18 +980,21 @@ polish([], Res, Ref) ->
 connect_bind(S) ->
     Host = next_host(S#eldap.host, S#eldap.hosts),
     ?INFO_MSG("LDAP connection on ~s:~p", [Host, S#eldap.port]),
+    Opts = if S#eldap.tls == tls ->
+                   [{packet, asn1}, {active, true}, {keepalive, true},
+                    binary | S#eldap.tls_options];
+              true ->
+                   [{packet, asn1}, {active, true}, {keepalive, true},
+                    {send_timeout, ?SEND_TIMEOUT}, binary]
+           end,
     SocketData = case S#eldap.tls of
 		     tls ->
 			 SockMod = ssl,
-			 SslOpts = [{packet, asn1}, {active, true}, {keepalive, true},
+			 ssl:connect(Host, S#eldap.port, Opts);
-				    binary | S#eldap.tls_options],
-			 ssl:connect(Host, S#eldap.port, SslOpts);
 		     %% starttls -> %% TODO: Implement STARTTLS;
 		     _ ->
 			 SockMod = gen_tcp,
-			 TcpOpts = [{packet, asn1}, {active, true}, {keepalive, true},
+			 gen_tcp:connect(Host, S#eldap.port, Opts)
-				    {send_timeout, ?SEND_TIMEOUT}, binary],
-			 gen_tcp:connect(Host, S#eldap.port, TcpOpts)
 		 end,
     case SocketData of
 	{ok, Socket} ->
@@ -994,8 +1012,11 @@ connect_bind(S) ->
 		    {ok, connecting, NewS#eldap{host = Host}}
 	    end;
 	{error, Reason} ->
-	    ?ERROR_MSG("LDAP connection failed on ~s:~p~nReason: ~p",
+	    ?ERROR_MSG("LDAP connection failed:~n"
-		       [Host, S#eldap.port, Reason]),
+                       "** Server: ~s:~p~n"
+                       "** Reason: ~p~n"
+                       "** Socket options: ~p",
+		       [Host, S#eldap.port, Reason, Opts]),
 	    NewS = close_and_retry(S),
 	    {ok, connecting, NewS#eldap{host = Host}}
     end.

src/mod_shared_roster_ldap.erl

@@ -483,6 +483,17 @@ parse_options(Host, Opts) ->
 			    ejabberd_config:get_local_option({ldap_tls_verify, Host});
 			Verify -> Verify
 		    end,
+    LDAPTLSCAFile = case gen_mod:get_opt(ldap_tls_cacertfile, Opts, undefined) of
+                        undefined ->
+                            ejabberd_config:get_local_option({ldap_tls_cacertfile, Host});
+                        CAFile -> CAFile
+                    end,
+    LDAPTLSDepth = case gen_mod:get_opt(ldap_tls_depth, Opts, undefined) of
+                       undefined ->
+                           ejabberd_config:get_local_option({ldap_tls_depth, Host});
+                       Depth ->
+                           Depth
+                   end,
     LDAPPort = case gen_mod:get_opt(ldap_port, Opts, undefined) of
 		   undefined ->
 		       case ejabberd_config:get_local_option({ldap_port, Host}) of
@@ -654,7 +665,9 @@ parse_options(Host, Opts) ->
 	   backups = LDAPBackups,
 	   port = LDAPPort,
 	   tls_options = [{encrypt, LDAPEncrypt},
-			  {tls_verify, LDAPTLSVerify}],
+			  {tls_verify, LDAPTLSVerify},
+                          {tls_cacertfile, LDAPTLSCAFile},
+                          {tls_depth, LDAPTLSDepth}],
 	   dn = RootDN,
 	   base = LDAPBase,
 	   password = Password,

src/mod_vcard_ldap.erl

@@ -691,6 +691,17 @@ parse_options(Host, Opts) ->
 			    ejabberd_config:get_local_option({ldap_tls_verify, Host});
 			Verify -> Verify
 		    end,
+    LDAPTLSCAFile = case gen_mod:get_opt(ldap_tls_cacertfile, Opts, undefined) of
+                        undefined ->
+                            ejabberd_config:get_local_option({ldap_tls_cacertfile, Host});
+                        CAFile -> CAFile
+                    end,
+    LDAPTLSDepth = case gen_mod:get_opt(ldap_tls_depth, Opts, undefined) of
+                       undefined ->
+                           ejabberd_config:get_local_option({ldap_tls_depth, Host});
+                       Depth ->
+                           Depth
+                   end,
     LDAPPortTemp = case gen_mod:get_opt(ldap_port, Opts, undefined) of
 		       undefined ->
 			   ejabberd_config:get_local_option({ldap_port, Host});
@@ -776,7 +787,9 @@ parse_options(Host, Opts) ->
 	   backups = LDAPBackups,
 	   port = LDAPPort,
 	   tls_options = [{encrypt, LDAPEncrypt},
-			  {tls_verify, LDAPTLSVerify}],
+			  {tls_verify, LDAPTLSVerify},
+                          {tls_cacertfile, LDAPTLSCAFile},
+                          {tls_depth, LDAPTLSDepth}],
 	   dn = RootDN,
 	   base = LDAPBase,
 	   password = Password,