Full_Name: Version: 2.3.36 and earlier and I assume also later OS: Red Hat Enterprise Linux 4.5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (15.203.233.75)

This problem was previously described one the openLDAP websiste at:

http://www.openldap.org/lists/openldap-bugs/200405/msg00096.html

The described fix is not included in release 2.3.36 and I assume that it has not been included in later releases either.

The probem is with the response to the 'startTLS' command in the 'slapd' server.

Here is an excerpt from the write up at the above URL:

************************************************************** Having fixed described above we came across another issues which concerns TLS extended operation response.

As RFC2830 states:

... A Start TLS extended response MUST contain a responseName field which MUST be set to the same string as that in the responseName field present in the Start TLS extended request. ...

Unfortunately OpenLDAP server doesn't return the 'responseName' field. This defect may prevent other LDAP APIs from understanding the response of OpenLDAP servers. For instance, Microsoft LDAP API doesn't accept the response without this field. We suggest to add the responseName field to the response. This is also a trivial one:

rs->sr_rspoid = SLAP_STRDUP(LDAP_EXOP_START_TLS);

before 'rc = LDAP_SUCCESS;' in starttls_extop() function (starttls.c).

3. Patch

Unfortunately didn't manage to get access to the /incoming FTP folder despite the fact I used my email as password. So here is a patch for both problems:

============= --- orig/starttls.c 2004-01-01 21:15:32.000000000 +0200 +++ fixed/starttls.c 2004-05-27 14:14:54.000000000 +0300 @@ -94,6 +94,8 @@ op->o_conn->c_is_tls = 1; op->o_conn->c_needs_tls_accept = 1;

+ rs->sr_rspoid = SLAP_STRDUP(LDAP_EXOP_START_TLS); + rc = LDAP_SUCCESS;

done: =============

Looking forward for your comments...

Sincerely yours,

Kirill Kovalenko Softerra LLC ************************************************************

Thanks and Regards, John Clark

john.w.clark@hp.com Sr. Software Engineer Hewlett-Packard Atalla Security Products