Re: Mirrormode and cn=config
- First Post
- Replies
- Stats
-
Go to
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
On Wed, 25 Mar 2009 15:09:09 +0100, Peter Mogensen <apm(a)mutex.dk> wrote:
Hi,
[snip]
Second:
I have problem with SASL/EXTERNAL and TLS. The server can't seem to find
the client certificate. I'm using slapd from Debian Lenny and Ubuntu
Hardy, and it's probably due to GnuTLS problems.
I get error from slapd like:
"TLS: can't accept: A TLS packet with unexpected length was received.."
"unable to get TLS client DN, error=-4 id=0"
Are GnuTLS just completely broken on Debian Lenny or can this be made to
work?
Which version of OpenLDAP are you using ?
If using 2.4.15, the ldap "client" libs have broken SASL/EXTERNAL
implementation. These libs are also used for consumer to connect to
provider.
Patch already submitted and to be available with 2.4.16.
/Peter
Hope it can help,
Sincerely yours, Mathieu.
Mathieu MILLET wrote:
On Wed, 25 Mar 2009 15:09:09 +0100, Peter Mogensen
<apm(a)mutex.dk> wrote:
> I have problem with SASL/EXTERNAL and TLS. The server can't seem to find
> the client certificate. I'm using slapd from Debian Lenny and Ubuntu
> Hardy, and it's probably due to GnuTLS problems.
> I get error from slapd like:
> "TLS: can't accept: A TLS packet with unexpected length was received.."
Oh ... forget this one. I found the reason for this. It was my fault.
> "unable to get TLS client DN, error=-4 id=0"
> Are GnuTLS just completely broken on Debian Lenny or can this be made to
> work?
Which version of OpenLDAP are you using ?
If using 2.4.15, the ldap "client" libs have broken SASL/EXTERNAL
implementation. These libs are also used for consumer to connect to
provider.
2.4.9-0ubuntu0.8.0
I haven't checked which upstream version the patches makes it equivalent
to though.
Doing: ldapwhoami -YEXTERNAL -H ldaps://server:389/
I'm stepping through the SSL handshake with wireshark and it seems to
get all the way through to the servers ChangeChipherSpec/Finish stage
after which the client sends a TCP FIN,ACK.
slapd output is:
connection_get(10): got connid=11
connection_read(10): checking for input on id=11
connection_get(10): got connid=11
connection_read(10): checking for input on id=11
connection_get(10): got connid=11
connection_read(10): checking for input on id=11
connection_get(10): got connid=11
connection_read(10): checking for input on id=11
connection_get(10): got connid=11
connection_read(10): checking for input on id=11
connection_read(10): unable to get TLS client DN, error=-4 id=11
connection_get(10): got connid=11
connection_read(10): checking for input on id=11
ber_get_next
ber_get_next on fd 10 failed errno=0 (Success)
connection_closing: readying conn=11 sd=10 for close
connection_close: conn=11 sd=10
According to wireshark it's TLSv1.1.
I think I read somewhere that GnuTLS don't like that, but I can't figure
out how do downgrade to TLSv1.0
/Peter
5365
days inactive
5365
days old
openldap-software@openldap.org
1 comments
2 participants
tags (0)
participants (2)
-
Mathieu MILLET -
Peter Mogensen