https://bugs.openldap.org/show_bug.cgi?id=10337
Issue ID: 10337 Summary: Global TLS options not inherited in context Product: OpenLDAP Version: 2.6.9 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: remi@fedoraproject.org Target Milestone: ---
During ldap_create, global options are copied
See https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_6_9/libraries/l...
/* copy the global options */ AC_MEMCPY(&ld->ld_options, gopts, sizeof(ld->ld_options));
But not the TLS string options
See https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_6_9/libraries/l...
/* We explicitly inherit the SSL_CTX, don't need the names/paths. Leave * them empty to allow new SSL_CTX's to be created from scratch. */ memset( &ld->ld_options.ldo_tls_info, 0, sizeof( ld->ld_options.ldo_tls_info )); ld->ld_options.ldo_tls_ctx = NULL;
Which create inconsistency when trying to generate a newctx
For the context
See * https://github.com/php/php-src/issues/17776 => why tls_newctx is needed * https://github.com/php/php-src/issues/18529 => regression
On PHP side a possible workaround is to do the copyu manually * https://github.com/php/php-src/pull/18547
But should probably be handled at openldap library