Issue 8735 - Significant delay setting LDAP_OPT_X_TLS_REQUIRE_CERT with invalid DNS
Summary: Significant delay setting LDAP_OPT_X_TLS_REQUIRE_CERT with invalid DNS
Status: UNCONFIRMED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: client tools (show other issues)
Version: 2.4.45
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-14 18:46 UTC by sean.haugh@vertivco.com
Modified: 2020-03-23 16:42 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description sean.haugh@vertivco.com 2017-09-14 18:46:06 UTC 
Full_Name: Sean Haugh
Version: 2.4.45
OS: Linux
URL: 
Submission from: (NULL) (143.166.81.254)


I'm seeing a significant delay (32s) when setting `LDAP_OPT_X_TLS_REQUIRE_CERT`
with unreachable DNS servers in resolv.conf. We initially discovered the issue
in 2.4.42 although I've confirmed it is present in 2.4.45. AFAIK it is not
present in 2.4.23.
Comment 1 Michael Ströder 2017-09-14 19:38:46 UTC 
sean.haugh@vertivco.com wrote:
> I'm seeing a significant delay (32s) when setting
> `LDAP_OPT_X_TLS_REQUIRE_CERT` with unreachable DNS servers in
> resolv.conf. We initially discovered the issue in 2.4.42
> although I've confirmed it is present in 2.4.45. AFAIK it is
> not present in 2.4.23.

I assume you see a delay at the client-side.

Are you sure that it is not something caused by the TLS library 
updated in the mean-time? Which one is used by the client?

You should re-test with server certs without any URLs (AIA, CRLDP 
extensions etc.) which might be accessed by your TLS lib.

You could also monitor the DNS traffic. Some resolvers allow to 
switch on query logging. Or tcpdump or similar.

And BTW: The most likely answer is that your resolver should 
always be up and running. Sometimes a local caching resolver helps 
to overcome upstream resolver outage.

Ciao, Michael.
Comment 2 Quanah Gibson-Mount 2020-03-23 16:42:55 UTC 
It would be extremely useful to know which TLS library was involved (openssl, gnutls, moznss).