https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #1 from Howard Chu hyc@openldap.org --- Thanks for the submission. I see you've got #ifdef'd support for older versions (2.x) as well as (3.x). For adding a new feature, I see no reason to support any older versions, particularly if they lack support for TLS1.3. I suggest stripping out all the 2.x support.

There are traces of copy/paste from tls_g.c and tls_o.c scattered around the file, these should be fixed.

I'd consider naming the source file "tls_mt.c" since we already had a "tls_m.c" for MozNSS in the past, and would prefer to avoid any possible confusion.

https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #3 from Howard Chu hyc@openldap.org --- re: 2.x, I guess we should hear some other folks' opinions. Just note that this would be a new feature, appearing in OpenLDAP 2.7 later this year. All of those platforms are already well supported by OpenSSL (with TLS 1.3 support) so we need to understand why they would choose to use a backrev mbedTLS library instead.

https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #5 from Ondřej Kuzník ondra@mistotebe.net --- On Thu, Feb 23, 2023 at 09:04:15AM +0000, openldap-its@openldap.org wrote:

I uploaded the code on gitlab, cleaning it a little bit.

https://git.openldap.org/Johan/openldap/-/tree/add/mbedtls_handle

I tried to add a CI run using the mbedtls handle but the CI runner is on debian stable which packages mbedtls-2.16.9 and is not supported by the handle(it requires functions introduced in 2.18.0).

Our use case for OpenLDAP with mbedtls handle, in the linphone project, on debian or distribution supporting openssl is to unify the code base shared on various platform. The same code is built on these platform but also on android or iOS where we rather use mbedtls.

Hi Johan, Debian Bookworm (the testing suite at this point) ship 2.28.0, so I think you can tag the job with a Debian testing image for now.

Regards,

https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #7 from Ondřej Kuzník ondra@mistotebe.net --- On Thu, Feb 23, 2023 at 12:54:37PM +0000, openldap-its@openldap.org wrote:

Hi Ondřej,

thanks for your suggestion. I could not find on gitlab any tagged runner, I see 4 of them all on agnesi.openldap.org but none seem to have any tag. Sorry Gitlab is not really my field, can you detail how I can access a debian bookworm runner?

I meant setting https://docs.gitlab.com/ee/ci/yaml/index.html#image in a job which would give you a different Docker image on the existing runners.

Regards,

https://bugs.openldap.org/show_bug.cgi?id=10014

Quanah Gibson-Mount quanah@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Keywords|needs_review | Target Milestone|--- |2.7.0

https://bugs.openldap.org/show_bug.cgi?id=10014

Quanah Gibson-Mount quanah@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |FIXED

--- Comment #10 from Quanah Gibson-Mount quanah@openldap.org --- Commits: • f7e6c71e by johan pascal at 2023-03-31T05:19:30+00:00 ITS#10014: Add TLS handle using MbedTLS

https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #11 from Ondřej Kuzník ondra@mistotebe.net --- I've just noticed that tlsmt_session_accept busy loops on non-blocking connections.

This is a problem for lloadd which wants non-blocking operation where possible, rescheduling callbacks based LBER_SB_OPT_NEEDS_WRITE/READ.

https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #13 from Quanah Gibson-Mount quanah@openldap.org --- (In reply to Johan from comment #12)

Hi Ondřej, you're right I completely missed the loop through session_upflags to manage the non blocking I/O. Just removing the loop and directly returning

mbedtls_ssl_handshake( &(s->ssl_ctx) )

in tlsmt_session_accept shall work.

I'll do a MR by the end of week

Hi Johan,

Any luck on getting this MR put together? It's almost been a year.

https://bugs.openldap.org/show_bug.cgi?id=10014

--- Comment #15 from Quanah Gibson-Mount quanah@openldap.org --- (In reply to Johan from comment #14)

(In reply to Quanah Gibson-Mount from comment #13)

...

Hi Johan,

Any luck on getting this MR put together? It's almost been a year.

Hi,

sorry for the delay, I completely forgot about it :-(

I just made a MR that should fix the problem: https://git.openldap.org/openldap/openldap/-/merge_requests/675

Johan

Thanks so much!