openldap-bugs

openldap-bugs@openldap.org

1 participants
20963 discussions

Re: (ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by rmeggins＠redhat.com 18 Dec '09

18 Dec '09

You are right, Howard. It works as you described. I'm not sure what happened in my testing. Mea culpa. This is a new patch with the SetURL changes backed out. ftp://ftp.openldap.org/incoming/openldap-2.4.20-tls_m_c-InitContext-PEM-200…

1 0

Re: (ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by hyc＠symas.com 18 Dec '09

18 Dec '09

rmeggins(a)redhat.com wrote: >>> I also had to call >>> SSL_SetURL in order to put the correct hostname in the SSL socket for cert >>> validation. >> >> I explicitly withheld the hostname to force our own cert validation function >> to be used. The NSS hostname validator's behavior is inconsistent with the >> LDAP spec. >> > That's the tlsm_session_chkhost() function? The problem is that the > chkhost function is called too late - NSS attempts to perform the > verification during the handshake process - by the time > ldap_pvt_tls_check_hostname() is called in ldap_int_tls_start(), it's > too late - NSS has failed - ldap_int_tls_connect() has returned an error. That should not happen, since tlsm_bad_cert_handler() causes the bad hostname result to be returned as Success. That gives us the chance to check it on our own. It worked in my tests before... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by rmeggins＠redhat.com 18 Dec '09

18 Dec '09

This is a new patch, which #defines HAVE_NSS_INITCONTEXT based on the NSS version. ftp://ftp.openldap.org/incoming/openldap-2.4.20-tls_m_c-InitContext-PEM-200…

1 0

Re: (ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by rmeggins＠redhat.com 18 Dec '09

18 Dec '09

> > Thanks for the patch. > > Just blindly #defining HAVE_NSS_INITCONTEXT is no good. Isn't there an NSS > version symbol we can check in the preprocessor, to make sure it's 3.12.5 or > newer? Otherwise we'll need an autoconf test for the existence of the > NSS_InitCOntext() function. > Ok. I'll change it to check for NSS version >= 3.12.5 > > This allows apps and libraries to initialize NSS from different contexts. > I've > > also cleaned up some of the code around PEM file support. I also had to > call > > SSL_SetURL in order to put the correct hostname in the SSL socket for cert > > validation. > > I explicitly withheld the hostname to force our own cert validation function > to be used. The NSS hostname validator's behavior is inconsistent with the > LDAP spec. > That's the tlsm_session_chkhost() function? The problem is that the chkhost function is called too late - NSS attempts to perform the verification during the handshake process - by the time ldap_pvt_tls_check_hostname() is called in ldap_int_tls_start(), it's too late - NSS has failed - ldap_int_tls_connect() has returned an error.

1 0

Re: (ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by hyc＠symas.com 18 Dec '09

18 Dec '09

rmeggins(a)redhat.com wrote: > Full_Name: Richard Megginson > Version: 2.4.20 > OS: Fedora 11 > URL: ftp://ftp.openldap.org/incoming/openldap-2.4.20-tls_m_c-InitContext-PEM-200… > Submission from: (NULL) (76.113.111.209) > > > This patch adds support for the new NSS_InitContext() API (new in NSS 3.12.5). Thanks for the patch. Just blindly #defining HAVE_NSS_INITCONTEXT is no good. Isn't there an NSS version symbol we can check in the preprocessor, to make sure it's 3.12.5 or newer? Otherwise we'll need an autoconf test for the existence of the NSS_InitCOntext() function. > This allows apps and libraries to initialize NSS from different contexts. I've > also cleaned up some of the code around PEM file support. I also had to call > SSL_SetURL in order to put the correct hostname in the SSL socket for cert > validation. I explicitly withheld the hostname to force our own cert validation function to be used. The NSS hostname validator's behavior is inconsistent with the LDAP spec. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by rmeggins＠redhat.com 18 Dec '09

18 Dec '09

Full_Name: Richard Megginson Version: 2.4.20 OS: Fedora 11 URL: ftp://ftp.openldap.org/incoming/openldap-2.4.20-tls_m_c-InitContext-PEM-200… Submission from: (NULL) (76.113.111.209) This patch adds support for the new NSS_InitContext() API (new in NSS 3.12.5). This allows apps and libraries to initialize NSS from different contexts. I've also cleaned up some of the code around PEM file support. I also had to call SSL_SetURL in order to put the correct hostname in the SSL socket for cert validation. This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat, Inc.. Red Hat, Inc. has not assigned rights and/or interest in this work to any party. I, Richard Megginson am authorized by Red Hat, Inc., my employer, to release this work under the following terms. Red Hat, Inc. hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#5340) REP_ENTRY_MODIFIABLE bug in dynlist
by masarati＠aero.polimi.it 17 Dec '09

17 Dec '09

> Forgot to enclose the URL. > > http://folk.uio.no/hbf/OpenLDAP/slapreply-draft2.diff At a first glance, your patch makes sense. I see your concern, this approach is definitely fragile. However, I see two points: - the code is not just modified by everyone, so we can count on paying relative attention to what is done, as soon as there are clear guidelines - we should probably produce some indications about how code needs to be used. I'm not thinking about a comprehensive programming guide, but some clear guidelines about writing safe code in critical areas like this would be of help. In cases like this, I'd really prefer to be able to exploit OOP and data abstraction as in C++. p.

1 0

Re: (ITS#6194) Patch - Enhancement - provide LDIF support as libldif
by hyc＠symas.com 16 Dec '09

16 Dec '09

rmeggins(a)redhat.com wrote: > I think this could be accomplished in one of two ways: > 1) Just have libldif return lists of struct berval* for the various data > parsed. The caller would be responsible for turning these into LDAPMod > or LDAPControl structures - the advantage is that libldif doesn't have > to know about any of these higher level structures > 2) Have libldif create LDAPMod and LDAPControl - I think this could be > accomplished by having ldif.c #include<ldap.h> to pull in the > definitions of LDAPMod and LDAPControl - would this be ok? Let's move this discussion to the openldap-devel mailing list. I'm thinking (2) is OK but I'd like to hear from other developers / potential users of this library. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6194) Patch - Enhancement - provide LDIF support as libldif
by rmeggins＠redhat.com 16 Dec '09

16 Dec '09

I think this could be accomplished in one of two ways: 1) Just have libldif return lists of struct berval* for the various data parsed. The caller would be responsible for turning these into LDAPMod or LDAPControl structures - the advantage is that libldif doesn't have to know about any of these higher level structures 2) Have libldif create LDAPMod and LDAPControl - I think this could be accomplished by having ldif.c #include <ldap.h> to pull in the definitions of LDAPMod and LDAPControl - would this be ok?

1 0

Re: (ITS#6194) Patch - Enhancement - provide LDIF support as libldif
by rmeggins＠redhat.com 16 Dec '09

16 Dec '09

The ldif code does not currently have knowledge of any of the higher level LDAP data types such as LDAPMod or LDAPControl - some of the proposals would have the ldif API return these objects - Do we really want to introduce this higher level knowledge into the relatively low level libldif, along with the dependency on libldap? I think in order to do this properly, we would have to introduce a new LDAP API e.g. ldap_mods_from_ldif(const char *ldifstr, LDAPMod***, LDAPControl***) or something like that - something that would parse the given ldif record into those higher level data types.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs