(ITS#6462) DNS SRV records: ldaps ???

[jochen@keutel.de]

Full_Name: Jochen Keutel
Version: 2.4.21
OS: Solaris 10
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (87.159.206.14)


The code for detecting LDAP servers via DNS SRV records seems to handle only
ldap URLs - not ldaps URLs.

Esp.: If you access an OpenLDAP server with ldaps://host1/..., then the DNS SRV
code returns a URL like ldap://host2/... . So the LDAP server chains the
original ldaps request as a LDAP query without TLS.

This gets problematic when the (company / project) requirements clearly state
that only ldaps has to be used ...

The problematic code seems to be in libraries/libldap/dnssrv.c, function
ldap_domain2hostlist():

request = LDAP_MALLOC(strlen(domain) + sizeof("_ldap._tcp."));
...
sprintf(request, "_ldap._tcp.%s", domain);

So always "_ldap._tcp" is used (hard coded) - not "ldaps._tcp" in case of ldaps
in the original query.

I'd suggest to introduce a third parameter to that function:

int ldap_domain2hostlist(
	LDAP_CONST char *protocol,
	LDAP_CONST char *domain,
	char **list )

protocol is either "ldap" oder "ldaps".

The code calling this function (slapd/back-dnssrv/search.c and referral.c) has
to be adjusted as well.

I'm not sure whether you want me to deliver a complete patch or not ... 

Thanks to my colleague Manuel Gaupp for detecting this problem.

Best regards,  Jochen.