Issue 5981 - TLSVerifyClient try setting fails with GnuTLS
Summary: TLSVerifyClient try setting fails with GnuTLS
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: 2.4.15
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-01 12:10 UTC by peter@adpm.de
Modified: 2014-08-01 21:04 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description peter@adpm.de 2009-03-01 12:10:15 UTC 
Full_Name: Peter Marschall
Version: 2.4.15
OS: Linux
URL: ftp://ftp.openldap.org/incoming/Peter-Marschall-090301.patch
Submission from: (NULL) (92.75.56.86)


Hi,

when OpenLDAP 2.4.15 is compiled with GnuTLS, then setting
  TLSVerifyClient Try
in slapd.conf makes TLS connections without certificates impossible.

This is caused by incomplete decoding in tls_g.c

The patch in ftp://ftp.openldap.org/incoming/Peter-Marschall-090301.patch
fixes this issue together with a few other little cleanups:
- remove unused variables (less compiler warnings)
- use correct types (less compiler warnings)
- detect failed calls for activation/exiration functions to
  avoid giving wrong information

Please consider adding this patch to OpenLDAP

Regards
Peter
Comment 1 Howard Chu 2009-03-02 02:02:27 UTC 
peter@adpm.de wrote:
> Full_Name: Peter Marschall
> Version: 2.4.15
> OS: Linux
> URL: ftp://ftp.openldap.org/incoming/Peter-Marschall-090301.patch
> Submission from: (NULL) (92.75.56.86)
>
>
> Hi,
>
> when OpenLDAP 2.4.15 is compiled with GnuTLS, then setting
>    TLSVerifyClient Try
> in slapd.conf makes TLS connections without certificates impossible.
>
> This is caused by incomplete decoding in tls_g.c
>
> The patch in ftp://ftp.openldap.org/incoming/Peter-Marschall-090301.patch
> fixes this issue together with a few other little cleanups:
> - remove unused variables (less compiler warnings)
> - use correct types (less compiler warnings)
> - detect failed calls for activation/exiration functions to
>    avoid giving wrong information
>
> Please consider adding this patch to OpenLDAP

Thanks for the patch, committed to HEAD.
>
> Regards
> Peter
>


-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
Comment 2 Howard Chu 2009-03-02 02:03:19 UTC 
changed notes
changed state Open to Test
moved from Incoming to Software Bugs
Comment 3 Quanah Gibson-Mount 2009-03-05 18:28:26 UTC 
changed notes
changed state Test to Release
Comment 4 Quanah Gibson-Mount 2009-04-06 08:02:49 UTC 
changed notes
changed state Release to Closed
Comment 5 OpenLDAP project 2014-08-01 21:04:20 UTC 
fixed in HEAD
fixed in RE24