Seems nobody run into this issue??

At 2010-09-20 10:02:10，ctosgh ctosgh@126.com wrote:

Hi, folks

I am using the APIs from openldap and recently run into a problem which upset me. Following is the framework of the function. ldaps_func() { LDAP* ld = NULL; char * uri ="ldaps://xxx.xxx.xxx:636"; ..... ldap_set_option(...); //using LDAP v3 ldap_set_option(...); // set LDAP_OPT_X_TLS_REQUIRE_CERT to deman ldap_set_option(...); // set LDAP_OPT_X_TLS_CACERTDIR to /tmp/ldapsCA/ ldap_initialize(&ld, uri); ..... ldap_simple_bind(.....); ldap_search_ext(...); ...... ldap_unbind(ld); ..... return 0; } Above function is called in a while loop to authenticate users to a LDAPS server when authentication request comes up. This function works fine. BUT after one successful authentication, if I delete CA certificates of server's certificate under /tmp/ldapsCA/, subsequent authentications will STILL succeed. If restart this daemon, no authentication will succeed, because CA certificates under /tmp/ldapsCA/ has been deleted. Why I delete CA certificates under /tmp/ldapsCA/? I just want to simulate "certificate change". Is the openssl library cache someting??

Any one has any ideas about this? I will really appreciate it.

Thanks, Jacky

全国最低价，天天在家冲照片，24小时发货上门！

On Tuesday 21 September 2010 03:17:48 ctosgh wrote:

Seems nobody run into this issue??

At 2010-09-20 10:02:10，ctosgh ctosgh@126.com wrote:

Hi, folks

I am using the APIs from openldap and recently run into a problem which upset me. Following is the framework of the function. ldaps_func() { LDAP* ld = NULL; char * uri ="ldaps://xxx.xxx.xxx:636"; ..... ldap_set_option(...); //using LDAP v3 ldap_set_option(...); // set LDAP_OPT_X_TLS_REQUIRE_CERT to deman ldap_set_option(...); // set LDAP_OPT_X_TLS_CACERTDIR to/tmp/ldapsCA/

If you really want the TLS context recreated with each iteration I think you can just call: ldap_set_option( NULL, LDAP_OPT_X_TLS_NEWCTX, LDAP_OPT_ON); after the above calls.

ldap_initialize(&ld, uri); ..... ldap_simple_bind(.....); ldap_search_ext(...); ...... ldap_unbind(ld); ..... return 0; } Above function is called in a while loop to authenticate users to a LDAPS server when authentication request comes up. This function works fine. BUT after one successful authentication, if I delete CA certificates of server's certificate under /tmp/ldapsCA/, subsequent authentications will STILL succeed. If restart this daemon, no authentication will succeed, because CA certificates under /tmp/ldapsCA/ has been deleted. Why I delete CA certificates under /tmp/ldapsCA/? I just want to simulate "certificate change". Is the openssl library cache someting??

Any one has any ideas about this? I will really appreciate it.

Ralf

On Wednesday 22 September 2010 19:05:58 Michael Ströder wrote:

Ralf Haferkamp wrote:

...

If you really want the TLS context recreated with each iteration I think you can just call: ldap_set_option( NULL, LDAP_OPT_X_TLS_NEWCTX, LDAP_OPT_ON); after the above calls.

Ralf, does that really work? I did not manage to get this working from python-ldap...

Last time I checked it did. That was some month ago. But looking at the libldap code it might be that LDAP_OPT_ON is probably the wrong value to pass to it. It seems you need to pass a pointer to an integer. That integer value is passed as the is_server argument to the functions that actually initialize the context. So I guess in client code you'd pass a int pointer to 0.

regards, Ralf

Am Freitag 24 September 2010, 10:08:32 schrieb Michael Ströder:

Ralf,

thanks for your followup on this.

Ralf Haferkamp wrote:

...

On Wednesday 22 September 2010 19:05:58 Michael Ströder wrote:

...

Ralf Haferkamp wrote:

...

If you really want the TLS context recreated with each iteration I think you can just call: ldap_set_option( NULL, LDAP_OPT_X_TLS_NEWCTX, LDAP_OPT_ON); after the above calls.

Ralf, does that really work? I did not manage to get this working from python-ldap...

Last time I checked it did. That was some month ago. But looking at the libldap code it might be that LDAP_OPT_ON is probably the wrong value to pass to it. It seems you need to pass a pointer to an integer. That integer value is passed as the is_server argument to the functions that actually initialize the context. So I guess in client code you'd pass a int pointer to 0.

The relevant code excerpts from python-ldap/Modules/options.c are:

[..] /* integer value options */ if (!PyArg_Parse(value, "i:set_option", &intval)) return 0; ptr = &intval; break; [..] if (res != LDAP_OPT_SUCCESS) { option_error(res, "ldap_set_option"); return 0; } [..]

That looks like your description. But I'd have to use 0 as the option value?

I think so. I am not exactly sure what your code does. My knowledge about Python C bindings is very limited. In plain C you would do this:

int value=0; [..] ldap_set_option(ldap, LDAP_OPT_X_TLS_NEWCTX, &value);

to create a new TLS context for a client. For a server context you'd use any non-zero value. BTW, this is also documented in the ldap_set_option(3) manpage (surprisingly :)).

regards, Ralf