(ITS#6131) "TLSVerifyClient try" not working with GNU TLS

[subbarao@computer.org]

Full_Name: Kartik Subbarao
Version: 2.4.16
OS: Debian 5.0.1
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (76.99.175.5)


When TLSVerifyClient is set to "try", OpenLDAP improperly rejects SSL
connections without a client certificate. The problem appears to start with this
section of code in tls.c around line 1564:

#ifdef HAVE_GNUTLS
    if ( ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER ) {
        err = tls_cert_verify( ssl );
        if ( err && ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW
)
            return err;
    }
#endif

tls_cert_verify() calls gnutls_certificate_verify_peers2(), which appears to
return error 49 when no client certificate is presented. tls_cert_verify()
doesn't seem to distinguish between this case, and the case of an invalid client
certificate, returning -1 in both cases.