Issue 7014 - TLS: certificate hostnames are being checked when TLS_REQCERT is se to allow
Summary: TLS: certificate hostnames are being checked when TLS_REQCERT is se to allow
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-09 14:05 UTC by jvcelak@redhat.com
Modified: 2014-08-01 21:04 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description jvcelak@redhat.com 2011-08-09 14:05:56 UTC 
Full_Name: Jan Vcelak
Version: master
OS: Linux
URL: http://jvcelak.fedorapeople.org/openldap/0001-TLS-do-not-check-hostname-when-reqcert-is-allow.patch
Submission from: (NULL) (209.132.186.34)


Hello.

If server certificate hostname does not match the server hostname, connection is
closed even if client has set TLS_REQCERT to 'allow'. This is wrong - the
documentation says, that bad certificates are being ignored when TLS_REQCERT is
set to 'allow'. (Other certificate failures (like invalid CA) are handled as
expected - at least with MozNSS.)

I'm attaching patch, which fixes this behavior. The patch applies on master
branch. (OpenLDAP FTP server for incoming patches reports 'No space left on
device.', that's why I uploaded the patch to fedorapeople.org.)

Regards,
Jan
Comment 1 Howard Chu 2011-08-24 22:29:00 UTC 
changed notes
changed state Open to Test
moved from Incoming to Software Bugs
Comment 2 Howard Chu 2011-08-24 22:32:07 UTC 
jvcelak@redhat.com wrote:
> Full_Name: Jan Vcelak
> Version: master
> OS: Linux
> URL: http://jvcelak.fedorapeople.org/openldap/0001-TLS-do-not-check-hostname-when-reqcert-is-allow.patch
> Submission from: (NULL) (209.132.186.34)
>
>
> Hello.
>
> If server certificate hostname does not match the server hostname, connection is
> closed even if client has set TLS_REQCERT to 'allow'. This is wrong - the
> documentation says, that bad certificates are being ignored when TLS_REQCERT is
> set to 'allow'. (Other certificate failures (like invalid CA) are handled as
> expected - at least with MozNSS.)
>
> I'm attaching patch, which fixes this behavior. The patch applies on master
> branch. (OpenLDAP FTP server for incoming patches reports 'No space left on
> device.', that's why I uploaded the patch to fedorapeople.org.)

Thanks, applied to master.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
Comment 3 Quanah Gibson-Mount 2011-10-28 02:10:26 UTC 
changed notes
changed state Test to Release
Comment 4 Quanah Gibson-Mount 2011-11-28 18:37:56 UTC 
changed notes
changed state Release to Closed
Comment 5 OpenLDAP project 2014-08-01 21:04:38 UTC 
applied to master
applied to RE24