I am new to Openldap and TLS/SSL. I have two small test programs (see details below). The first uses ldap_init the second ldap_initalize. My observation is:
1) Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
2) Using ldap_init,ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (emprty ldap.conf and only TLS_REQCERT ALL in ldaprc) It does not connect on port 636 but it does on port 389
3) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
4) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf and
only TLS_REQCERT ALL in ldaprc) It does not connect on port 389 but it does on port 636
My first question is why does
val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val);
not work ?
Secondly why behaves ldap_init different to ldap_initialize ?
Thirdly what do I need to do to be able to use TLS/SSL on either port 389 or 636 ?
Thank you Markus
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ldap_debug = -1 /*LDAP_DEBUG_ANY */ ; (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug);
if (strstr(argv[1],"://") ) { hostname=strstr(argv[1],"://")+3; ssl=strstr(argv[1],"ldaps://"); host=strdup(hostname); port=389; if ((p=strchr(host,':'))) { *p='\0'; p++; port=atoi(p); } } ld = (LDAP *)ldap_init(host,port); val = LDAP_VERSION3; (void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val); (void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); ldap_start_tls_s(ld, NULL, NULL); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); . . .
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 636 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:02:11 2007
** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 ber_get_next failed. ldap_err2string ldap_test Error while setting start_tls for ldap server: Can't contact LDAPserver ldap_free_request (origid 1, msgid 1)ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_createldap_extended_operation_s ldap_extended_operation ldap_send_initial_requestldap_new_connection 1 1 0 ldap_int_open_connectionldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:00:34 2007 ** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 read1msg: ld 8065c90 msgid 1 message type extended-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 8065c90 0 new referrals read1msg: mark request completed, ld 8065c90 msgid 1 request done: ld 8065c90 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer:/DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed
With ~/.ldaprc
TLS_REQCERT ALLOW
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_createldap_extended_operation_sldap_extended_operationldap_send_initial_requestldap_new_connection 1 1 0ldap_int_o pen_connection ldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:04:26 2007
** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 read1msg: ld 8065c90 msgid 1 message type extended-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 8065c90 0 new referrals read1msg: mark request completed, ld 8065c90 msgid 1 request done: ld 8065c90 msgid 1res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificateTLS certificate verification: depth: 0, err: 27,
subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificate TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer ertificate. ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_result ld 8065c90 msgid 2 ldap_chkResponseList ld 8065c90 msgid 2 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 2 (infinite timeout) wait4msg continue ld 8065c90 msgid 2 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:04:26 2007 ** ld 8065c90 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ldap_debug = -1 /*LDAP_DEBUG_ANY */ ; (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug); ldap_initialize(ld,argv[1]); val = LDAP_VERSION3; (void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val); (void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld,LDAP_OPT_X_TLS, &val); . . .
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer:/DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Can'tcontact LDAP server
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:389) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS: can't connect. ldap_err2string Can'tcontact LDAP server
With ~/.ldaprc TLS_REQCERT ALLOW
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificateTLS certificate verification: depth: 0, err: 27,
subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificateTLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec ATLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c58 msgid 1 ldap_chkResponseList ld 8065c58 msgid 1 all 1 ldap_chkResponseList returns ld 8065c58 NULL wait4msg ld 8065c58 msgid 1 (infinite timeout) wait4msg continue ld 8065c58 msgid 1 all 1 ** ld 8065c58 Connections: * host: w2k3.windows2003.home port: 636 (default) refcnt: 2 status: Connected last used: Tue Jun 5 22:55:02 2007 ** ld 8065c58 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c58 Response Queue: Empty
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ?
Is it a bug if it doesn't work ?
Thank you Markus ----- Original Message ----- From: Markus Moeller To: openldap-software@openldap.org Sent: Friday, June 08, 2007 11:00 PM Subject: [-SPAM-] Question about ldap_init, ldap_initialize, start_tls,LDAP_OPT_X_TLS_ALLOW and TLS/SSL
I am new to Openldap and TLS/SSL. I have two small test programs (see details below). The first uses ldap_init the second ldap_initalize. My observation is:
1) Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
2) Using ldap_init,ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (emprty ldap.conf and only TLS_REQCERT ALL in ldaprc) It does not connect on port 636 but it does on port 389
3) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
4) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf and
only TLS_REQCERT ALL in ldaprc) It does not connect on port 389 but it does on port 636
My first question is why does
val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val);
not work ?
Secondly why behaves ldap_init different to ldap_initialize ?
Thirdly what do I need to do to be able to use TLS/SSL on either port 389 or 636 ?
Thank you Markus
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ldap_debug = -1 /*LDAP_DEBUG_ANY */ ; (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug);
if (strstr(argv[1],"://") ) { hostname=strstr(argv[1],"://")+3; ssl=strstr(argv[1],"ldaps://"); host=strdup(hostname); port=389; if ((p=strchr(host,':'))) { *p='\0'; p++; port=atoi(p); } } ld = (LDAP *)ldap_init(host,port); val = LDAP_VERSION3; (void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val); (void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); ldap_start_tls_s(ld, NULL, NULL); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); . . .
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 636 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:02:11 2007
** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 ber_get_next failed. ldap_err2string ldap_test Error while setting start_tls for ldap server: Can't contact LDAPserver ldap_free_request (origid 1, msgid 1)ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_createldap_extended_operation_s ldap_extended_operation ldap_send_initial_requestldap_new_connection 1 1 0 ldap_int_open_connectionldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:00:34 2007 ** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 read1msg: ld 8065c90 msgid 1 message type extended-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 8065c90 0 new referrals read1msg: mark request completed, ld 8065c90 msgid 1 request done: ld 8065c90 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer:/DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed
With ~/.ldaprc
TLS_REQCERT ALLOW
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_createldap_extended_operation_sldap_extended_operationldap_send_initial_requestldap_new_connection 1 1 0ldap_int_o pen_connection ldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c90 msgid 1 ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 1 (infinite timeout) wait4msg continue ld 8065c90 msgid 1 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:04:26 2007
** ld 8065c90 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty ldap_chkResponseList ld 8065c90 msgid 1 all 1 ldap_chkResponseList returns ld 8065c90 NULL ldap_int_select read1msg: ld 8065c90 msgid 1 all 1 read1msg: ld 8065c90 msgid 1 message type extended-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 8065c90 0 new referrals read1msg: mark request completed, ld 8065c90 msgid 1 request done: ld 8065c90 msgid 1res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificateTLS certificate verification: depth: 0, err: 27,
subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificate TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer ertificate. ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_result ld 8065c90 msgid 2 ldap_chkResponseList ld 8065c90 msgid 2 all 1 ldap_chkResponseList returns ld 8065c90 NULL wait4msg ld 8065c90 msgid 2 (infinite timeout) wait4msg continue ld 8065c90 msgid 2 all 1 ** ld 8065c90 Connections: * host: w2k3.windows2003.home port: 389 (default) refcnt: 2 status: Connected last used: Tue Jun 5 23:04:26 2007 ** ld 8065c90 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c90 Response Queue: Empty
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ldap_debug = -1 /*LDAP_DEBUG_ANY */ ; (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug); ldap_initialize(ld,argv[1]); val = LDAP_VERSION3; (void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val); (void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld,LDAP_OPT_X_TLS, &val); . . .
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer:/DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Can'tcontact LDAP server
./ldap_test ldaps://w2k3.windows2003.home:389 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:389) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS: can't connect. ldap_err2string Can'tcontact LDAP server
With ~/.ldaprc TLS_REQCERT ALLOW
./ldap_test ldaps://w2k3.windows2003.home:636 "DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd ldap_create ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636) ldap_err2string ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3.windows2003.home:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 192.168.1.5:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificateTLS certificate verification: depth: 0, err: 27,
subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject:/CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificateTLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec ATLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. ldap_open_defconn: successful ldap_send_server_request ldap_result ld 8065c58 msgid 1 ldap_chkResponseList ld 8065c58 msgid 1 all 1 ldap_chkResponseList returns ld 8065c58 NULL wait4msg ld 8065c58 msgid 1 (infinite timeout) wait4msg continue ld 8065c58 msgid 1 all 1 ** ld 8065c58 Connections: * host: w2k3.windows2003.home port: 636 (default) refcnt: 2 status: Connected last used: Tue Jun 5 22:55:02 2007 ** ld 8065c58 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 8065c58 Response Queue: Empty
Markus Moeller wrote:
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ?
Is it a bug if it doesn't work ?
The LDAP_OPT_X_TLS option is incompatible with ldap_start_tls. You cannot use both together. In general, the LDAP_OPT_X_TLS option is deprecated and should not be used at all.
But it is allowed to be set in ldap.conf, so why can't or shouldn't I be able to set it in my client without the pain of checking all the different config files ldap.conf, .ldaprc, ldaprc ... I'd like to be able to control my client options without the use of config files.
Regards Markus
----- Original Message ----- From: "Howard Chu" hyc@symas.com To: "Markus Moeller" huaraz@moeller.plus.com Cc: openldap-software@openldap.org Sent: Tuesday, June 19, 2007 12:01 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls, LDAP_OPT_X_TLS_ALLOW and TLS/SSL
Markus Moeller wrote:
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ? Is it a bug if it doesn't work ?
The LDAP_OPT_X_TLS option is incompatible with ldap_start_tls. You cannot use both together. In general, the LDAP_OPT_X_TLS option is deprecated and should not be used at all.
-- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
Markus Moeller wrote:
But it is allowed to be set in ldap.conf,
That doesn't necessarily mean anything. Lots of things can be set in ldap.conf that don't mean anything at all, since the parser ignores any keywords it doesn't recognize.
What evidence do you have that this particular setting actually does anything? A quick scan of the source code proves that it actually does nothing.
so why can't or shouldn't I be able to set it in my client without the pain of checking all the different config files ldap.conf, .ldaprc, ldaprc ... I'd like to be able to control my client options without the use of config files.
Go ahead and do that then. But don't waste time with options that don't actually have any meaning.
Regards Markus
----- Original Message ----- From: "Howard Chu" hyc@symas.com To: "Markus Moeller" huaraz@moeller.plus.com Cc: openldap-software@openldap.org Sent: Tuesday, June 19, 2007 12:01 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls, LDAP_OPT_X_TLS_ALLOW and TLS/SSL
Markus Moeller wrote:
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ? Is it a bug if it doesn't work ?
The LDAP_OPT_X_TLS option is incompatible with ldap_start_tls. You cannot use both together. In general, the LDAP_OPT_X_TLS option is deprecated and should not be used at all.
BTW If I look at the ldap.h file LDAP_OPT_X_TLS in not in a DEPRECATED section like ldap_open and ldap_init. How should I know it is deprecated ??
Regards Markus
----- Original Message ----- From: "Howard Chu" hyc@symas.com To: "Markus Moeller" huaraz@moeller.plus.com Cc: openldap-software@openldap.org Sent: Tuesday, June 19, 2007 12:01 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls, LDAP_OPT_X_TLS_ALLOW and TLS/SSL
Markus Moeller wrote:
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ? Is it a bug if it doesn't work ?
The LDAP_OPT_X_TLS option is incompatible with ldap_start_tls. You cannot use both together. In general, the LDAP_OPT_X_TLS option is deprecated and should not be used at all.
-- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
On Mon, 18 Jun 2007, Markus Moeller wrote:
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ?
Is it a bug if it doesn't work ?
...
I am new to Openldap and TLS/SSL. I have two small test programs (see details below). The first uses ldap_init the second ldap_initalize. My observation is:
- Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty
ldap.conf) It does not connect on port 389 nor 636
Don't confuse ports with protocols. The 'ldap' protocol, which is normally served on port 389, has an operation for initiating TLS. That operation is performed using the ldap_start_tls_s() function. The 'ldaps' protocol, which is normally served on port 636, runs over SSL from the get-go (the first data sent by the client is an SSL CLIENT-HELLO). As such, the client must know which protocol the server is expecting when it connects. This is part of why ldap_init() and ldap_open() are deprecated: they pass a host and port without passing the protocol. Don't use them: use ldap_initialize() instead.
Next, it should be clear from the above that you cannot use ldap_start_tls_s() when the server is expecting the 'ldaps' protocol. That call in you code is failing, but you aren't checking the return code so you didn't know that.
As Howard has separately noted, the LDAP_OPT_X_TLS option is deprecated. The setting you use actually has no effect.
So, to back up:
- Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty
ldap.conf) It does not connect on port 389 nor 636
It's failing on port 636 because the server is (presumably) expecting ldaps and you're doing ldap. It's probably failing on port 389 because your client can't validate the server's cert because it can't find the CA that signed the server's cert. That last bit is a guess but matches with this:
- Using ldap_init,ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (emprty
ldap.conf and only TLS_REQCERT ALL in ldaprc) It does not connect on port 636 but it does on port 389
I think you mean your ldaprc had "TLS_REQCERT ALLOW". If so, port 389 now succeeds because you've disabled the checking of the signatures on the server's cert.
It's failing on port 636 because the server is (presumably) expecting ldaps and you're doing ldap.
- Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
This can't work, because it tries to do ldaps when the server is expecting ldap: ./ldap_test ldaps://w2k3.windows2003.home:389
This doesn't work because the client can't find the CA that signed the server's cert. ./ldap_test ldaps://w2k3.windows2003.home:636
- Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf and
only TLS_REQCERT ALL in ldaprc) It does not connect on port 389 but it does on port 636
Again, I presume you mean your ldaprc contains "TLS_REQCERT ALLOW".
It doesn't work on port 389 because the server is expecting ldap and the client is doing ldaps. It works on port 636 because you've disabled the checking of the signatures on the server's cert.
My first question is why does
val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val);
not work ?
I'm guess that you meant to use LDAP_OPT_X_TLS_REQUIRE_CERT as the second argument to ldap_set_option(). That's the equivalent of the TLS_REQCERT entry in the ldaprc of ldap.conf.
Simply changing that won't do anything, because ldap_set_option() will start failing, though you would have never known that because you don't actually check return codes. CHECK ALL RETURN CODES AND INCLUDE THE OUTPUT OF ldap_err2string() IN YOUR ERROR MESSAGES.
The LDAP_OPT_X_TLS_REQUIRE_CERT option can only be set globally and not for particular LDAP handles. So, you need to invoke ldap_set_option() with a NULL first argument, ala: { int reqcert = LDAP_OPT_X_TLS_ALLOW; ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option: %s\n", ldap_err2string(ret)); } }
BTW, the desciption on the ldap.conf(5) manpage of the TLS_REQCERT setting's 'allow' and 'try' values (i.e., LDAP_OPT_X_TLS_ALLOW and LDAP_OPT_X_TLS_TRY) is incorrect. 'try' is really the same as 'hard' and 'demand', while 'allow' requires that the server's cert match the hostname used in the URL that was used to connect.
I filed an ITS about this (#4941) back in April, but it's still marked as incoming. <rant>Dear Maintainers, not applying patches to the docs is a *great* way to encourage better docs!</rant>
Secondly why behaves ldap_init different to ldap_initialize ?
Because ldap_init() only does the ldap protocol, while ldap_initialize() lets you do either and you told it to do ldaps.
Thirdly what do I need to do to be able to use TLS/SSL on either port 389 or 636 ?
Use ldap_initialize(). Then, if the URL specified "ldap:", call ldap_start_tls_s().
Philip Guenther
Philip,
thank you very much for the detailed answer. If I remember right the return code from ldap_start_tls was -11 which translates to "can't connect to server" and wasn't very specific if it was a missing cert or if I connected to an SSL only port (.e.g. 636) but I will confirm.
Regards Markus
----- Original Message ----- From: "Philip Guenther" guenther@sendmail.com To: "Markus Moeller" huaraz@moeller.plus.com Cc: openldap-software@openldap.org Sent: Tuesday, June 19, 2007 12:39 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls, LDAP_OPT_X_TLS_ALLOW and TLS/SSL
On Mon, 18 Jun 2007, Markus Moeller wrote:
Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ?
Is it a bug if it doesn't work ?
...
I am new to Openldap and TLS/SSL. I have two small test programs (see details below). The first uses ldap_init the second ldap_initalize. My observation is:
- Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty
ldap.conf) It does not connect on port 389 nor 636
Don't confuse ports with protocols. The 'ldap' protocol, which is normally served on port 389, has an operation for initiating TLS. That operation is performed using the ldap_start_tls_s() function. The 'ldaps' protocol, which is normally served on port 636, runs over SSL from the get-go (the first data sent by the client is an SSL CLIENT-HELLO). As such, the client must know which protocol the server is expecting when it connects. This is part of why ldap_init() and ldap_open() are deprecated: they pass a host and port without passing the protocol. Don't use them: use ldap_initialize() instead.
Next, it should be clear from the above that you cannot use ldap_start_tls_s() when the server is expecting the 'ldaps' protocol. That call in you code is failing, but you aren't checking the return code so you didn't know that.
As Howard has separately noted, the LDAP_OPT_X_TLS option is deprecated. The setting you use actually has no effect.
So, to back up:
- Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty
ldap.conf) It does not connect on port 389 nor 636
It's failing on port 636 because the server is (presumably) expecting ldaps and you're doing ldap. It's probably failing on port 389 because your client can't validate the server's cert because it can't find the CA that signed the server's cert. That last bit is a guess but matches with this:
- Using ldap_init,ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (emprty
ldap.conf and only TLS_REQCERT ALL in ldaprc) It does not connect on port 636 but it does on port 389
I think you mean your ldaprc had "TLS_REQCERT ALLOW". If so, port 389 now succeeds because you've disabled the checking of the signatures on the server's cert.
It's failing on port 636 because the server is (presumably) expecting ldaps and you're doing ldap.
- Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf) It does not connect on port 389 nor 636
This can't work, because it tries to do ldaps when the server is expecting ldap: ./ldap_test ldaps://w2k3.windows2003.home:389
This doesn't work because the client can't find the CA that signed the server's cert. ./ldap_test ldaps://w2k3.windows2003.home:636
- Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf
and only TLS_REQCERT ALL in ldaprc) It does not connect on port 389 but it does on port 636
Again, I presume you mean your ldaprc contains "TLS_REQCERT ALLOW".
It doesn't work on port 389 because the server is expecting ldap and the client is doing ldaps. It works on port 636 because you've disabled the checking of the signatures on the server's cert.
My first question is why does
val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val);
not work ?
I'm guess that you meant to use LDAP_OPT_X_TLS_REQUIRE_CERT as the second argument to ldap_set_option(). That's the equivalent of the TLS_REQCERT entry in the ldaprc of ldap.conf.
Simply changing that won't do anything, because ldap_set_option() will start failing, though you would have never known that because you don't actually check return codes. CHECK ALL RETURN CODES AND INCLUDE THE OUTPUT OF ldap_err2string() IN YOUR ERROR MESSAGES.
The LDAP_OPT_X_TLS_REQUIRE_CERT option can only be set globally and not for particular LDAP handles. So, you need to invoke ldap_set_option() with a NULL first argument, ala: { int reqcert = LDAP_OPT_X_TLS_ALLOW; ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option: %s\n", ldap_err2string(ret)); } }
BTW, the desciption on the ldap.conf(5) manpage of the TLS_REQCERT setting's 'allow' and 'try' values (i.e., LDAP_OPT_X_TLS_ALLOW and LDAP_OPT_X_TLS_TRY) is incorrect. 'try' is really the same as 'hard' and 'demand', while 'allow' requires that the server's cert match the hostname used in the URL that was used to connect.
I filed an ITS about this (#4941) back in April, but it's still marked as incoming. <rant>Dear Maintainers, not applying patches to the docs is a *great* way to encourage better docs!</rant>
Secondly why behaves ldap_init different to ldap_initialize ?
Because ldap_init() only does the ldap protocol, while ldap_initialize() lets you do either and you told it to do ldaps.
Thirdly what do I need to do to be able to use TLS/SSL on either port 389 or 636 ?
Use ldap_initialize(). Then, if the URL specified "ldap:", call ldap_start_tls_s().
Philip Guenther
On Tue, 19 Jun 2007, Markus Moeller wrote:
thank you very much for the detailed answer. If I remember right the return code from ldap_start_tls was -11 which translates to "can't connect to server" and wasn't very specific if it was a missing cert or if I connected to an SSL only port (.e.g. 636) but I will confirm.
You can usually get more info about an error using char *errmsg = NULL; ldap_get_option(ld, LDAP_OPT_ERROR_STRING, &errmsg);
If errmsg is not NULL after that, then it's additional text about the error. That wouldn't have helped with your ldap_start_tls_s() cert checking issues however, as the cert checking routine doesn't set that for errors involving CA checking. It *might* have given more info when you tried to use start_tls when the server was expecting ldaps.
Philip Guenther
--On Monday, June 18, 2007 5:39 PM -0600 Philip Guenther guenther@sendmail.com wrote:
I filed an ITS about this (#4941) back in April, but it's still marked as incoming. <rant>Dear Maintainers, not applying patches to the docs is a *great* way to encourage better docs!</rant>
This statement is somewhat misleading. There was follow-up discussion on your ITS, it has not simply been sitting idle. However, based on the discussion, I personally wasn't sure how things needed to proceed, so I didn't touch the documentation for the 2.3.36 release, and I'm guessing Gavin didn't either for similar reasons. Once you and Howard sort out your differences on how it is believed things work, I expect things will be patched promptly. You may wish to read the 2.3.36 release notes and note that several ITS' related to documentation were fixed, and if you go read the general changes documentation for OpenLDAP, I expect you'll find that nearly every release has documentation updates.
--Quanah
-- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
On Tue, 19 Jun 2007, Quanah Gibson-Mount wrote:
--On Monday, June 18, 2007 5:39 PM -0600 Philip Guenther guenther@sendmail.com wrote:
I filed an ITS about this (#4941) back in April, but it's still marked as incoming. <rant>Dear Maintainers, not applying patches to the docs is a *great* way to encourage better docs!</rant>
This statement is somewhat misleading. <..>
True, and my statement was much harsher than appropriate, for both of which I apologize. It had originally appeared to me that part of the original poster's problem involved the "'TLS_REQCERT ALLOW' *does* check certs some!" aspect of the mentioned ITS. That turned out to not be case, but I failed to mellow my already writen grousing. Again, my apologies.
Philip Guenther
openldap-software@openldap.org
-
Howard Chu -
Markus Moeller -
Philip Guenther -
Philip Guenther -
Quanah Gibson-Mount