Full_Name: Jochen Keutel Version: 2.4.21 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (87.159.206.14)

The code for detecting LDAP servers via DNS SRV records seems to handle only ldap URLs - not ldaps URLs.

Esp.: If you access an OpenLDAP server with ldaps://host1/..., then the DNS SRV code returns a URL like ldap://host2/... . So the LDAP server chains the original ldaps request as a LDAP query without TLS.

This gets problematic when the (company / project) requirements clearly state that only ldaps has to be used ...

The problematic code seems to be in libraries/libldap/dnssrv.c, function ldap_domain2hostlist():

request = LDAP_MALLOC(strlen(domain) + sizeof("_ldap._tcp.")); ... sprintf(request, "_ldap._tcp.%s", domain);

So always "_ldap._tcp" is used (hard coded) - not "ldaps._tcp" in case of ldaps in the original query.

I'd suggest to introduce a third parameter to that function:

int ldap_domain2hostlist( LDAP_CONST char *protocol, LDAP_CONST char *domain, char **list )

protocol is either "ldap" oder "ldaps".

The code calling this function (slapd/back-dnssrv/search.c and referral.c) has to be adjusted as well.

I'm not sure whether you want me to deliver a complete patch or not ...

Thanks to my colleague Manuel Gaupp for detecting this problem.

Best regards, Jochen.