I am new to Openldap and TLS/SSL. I have two small test programs (see details below). The first uses ldap_init the second ldap_initalize. My observation is:
1) Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
2) Using ldap_init,ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (emprty ldap.conf and only TLS_REQCERT ALL in ldaprc) It does not connect on port 636 but it does on port 389
3) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
4) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf and
only TLS_REQCERT ALL in ldaprc) It does not connect on port 389 but it does on port 636
My first question is why does
val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val);
not work ?
Secondly why behaves ldap_init different to ldap_initialize ?
Thirdly what do I need to do to be able to use TLS/SSL on either port 389 or 636 ?
Thank you Markus
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ldap_debug = -1 /*LDAP_DEBUG_ANY */ ; (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug);
if (strstr(argv[1],"://") ) { hostname=strstr(argv[1],"://")+3; ssl=strstr(argv[1],"ldaps://"); host=strdup(hostname); port=389; if ((p=strchr(host,':'))) { *p='\0'; p++; port=atoi(p); } } ld = (LDAP *)ldap_init(host,port); val = LDAP_VERSION3; (void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val); (void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); ldap_start_tls_s(ld, NULL, NULL); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); . . .
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 636 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:02:11 2007
** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 ber_get_next failed. ldap_err2string ldap_test Error while setting start_tls for ldap server: Can't contact LDAPserver ldap_free_request (origid 1, msgid 1)ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_createldap_extended_operation_s ldap_extended_operation ldap_send_initial_requestldap_new_connection 1 1 0 ldap_int_open_connectionldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:00:34 2007 ** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 read1msg: ld 8065c90 msgid 1 message type extended-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 8065c90 0 new referrals read1msg: mark request completed, ld 8065c90 msgid 1 request done: ld 8065c90 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer:/DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed
With ~/.ldaprc
TLS_REQCERT ALLOW
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_createldap_extended_operation_sldap_extended_operationldap_send_initial_requestldap_new_connection 1 1 0ldap_int_o pen_connection ldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:04:26 2007
** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 read1msg: ld 8065c90 msgid 1 message type extended-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 8065c90 0 new referrals read1msg: mark request completed, ld 8065c90 msgid 1 request done: ld 8065c90 msgid 1res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificateTLS certificate verification: depth: 0, err: 27,
subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificate TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer ertificate. ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_result ld 8065c90 msgid 2 ldap_chkResponseList ld 8065c90 msgid 2 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 2 (infinite timeout) wait4msg continue ld 8065c90 msgid 2 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:04:26 2007 ** ld 8065c90 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ldap_debug = -1 /*LDAP_DEBUG_ANY */ ; (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug); ldap_initialize(ld,argv[1]); val = LDAP_VERSION3; (void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val); (void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld,LDAP_OPT_X_TLS, &val); . . .
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer:/DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Can'tcontact LDAP server
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:389) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS: can't connect. ldap_err2string Can'tcontact LDAP server
With ~/.ldaprc TLS_REQCERT ALLOW
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificateTLS certificate verification: depth: 0, err: 27,
subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificateTLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec ATLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c58 msgid 1 ldap_chkResponseList ld 8065c58 msgid 1 all 1 ldap_chkResponseList returns ld 8065c58 NULL wait4msg ld 8065c58 msgid 1 (infinite timeout) wait4msg continue ld 8065c58 msgid 1 all 1 ** ld 8065c58 Connections: * host: w2k3.windows2003.home port: 636 (default) refcnt: 2 status: Connected last used: Tue Jun 5 22:55:02 2007 ** ld 8065c58 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c58 Response Queue: Empty