Re: (ITS#5353) openssl vs gnutls: gnutls doesn't fit

[quanah@zimbra.com]

Read ITS#5341.  It has the fix.

--Quanah

--On February 6, 2008 5:44:26 PM +0000 korsani@caramail.com wrote:

> Full_Name: GG
> Version: 2.4.7
> OS: Linux
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (194.2.41.131)
>
>
> I was investigated a problem: I couldn't ldapsearch to my ldap directory
> in TLS:
> ldapsearch -Z -H ldap://127.0.0.1 -x uid=gab returns:
>
> ldap_start_tls: Connect error (-11)
> ldap_result: Can't contact LDAP server (-1)
>
> It is an openldap 2.4.7 on Debian (Etch). It is built against gnutls. And
> as it was working with openldap 2.3.30, and it works with openldap 2.4.7
> built on Crux (self-made package, built against openssl), I tried to
> compile it on my gentoo ('cause it has the .h of everything, and much
> more CPU :) ), from sources.
>
> When built with --with-tls=openssl, the ldapsearch above is ok.
> When built with --with-tls=gnutls, it fails:
>
> I modify slapd.conf accordingly to match the syntax of tlsciphersuite with
> gnutls or openssl
>
> Debugs
> slapd:
> [ ... ]
> TLS: gnutls_certificate_verify_peers2 failed -49
> connection_read(12): TLS accept failure error=-1 id=1, closing
> connection_closing: readying conn=1 sd=12 for close
> daemon: activity on 1 descriptor
> daemon: activity on:
> daemon: epoll: listen=7 active_threads=0 tvp=NULL
> connection_close: conn=1 sd=12
> daemon: removing 12
> tls_write: want=181, written=181
>   0000:  15 03 01 00 b0 0f 12 bd  11 3a 31 7b 10 f9 c3 f7
> .........:1{....   0010:  87 dd 18 94 3d 19 52 5b  9a 30 8a 9c f6 a0 ac
> c7   ....=.R[.0......   0020:  2f 7d 10 6a 21 55 aa b3  25 72 50 a1 c6 2e
> 16 e8   /}.j!U..%rP.....   0030:  50 89 bc 65 d0 2a 5e 61  b5 44 8a e9 b0
> 01 cb 9f   P..e.*^a.D......   0040:  e4 85 81 9e 33 16 57 8b  a8 32 ce 14
> 2f 5a 38 0e   ....3.W..2../Z8.   0050:  12 f0 85 75 77 df 1b 57  56 c1 fb
> ae 2a cc 72 29   ...uw..WV...*.r)   0060:  c7 38 eb d3 3c 3b d4 8e  ba 29
> e6 8d 09 15 70 5f   .8..<;...)....p_   0070:  79 07 3e 8e 5a 9e c1 82  9f
> 39 73 ac b0 22 a4 31   y.>.Z....9s..".1   0080:  d2 43 3a 09 b5 3d 07 b6
> e7 17 14 5e 65 d5 ed 2d   .C:..=.....^e..-   0090:  71 09 c2 ea b9 c8 6a
> 35  2c b7 18 4b 33 7e 72 52   q.....j5,..K3~rR   00a0:  bb b9 f4 bc 0a 23
> 4b f0  be dc 64 ef 3f bd a6 3a   .....#K...d.?..:   00b0:  71 8e 07 64 90
> q..d. tls_read: want=5 error=Ressource temporairement non disponible
> conn=1 fd=12 closed (TLS negotiation failure)
>
> ldapsearch:
> [ ... ]
> ldap_chkResponseList ld 0x8057dd8 msgid 2 all 1
> ldap_chkResponseList returns ld 0x8057dd8 NULL
> ldap_int_select
> read1msg: ld 0x8057dd8 msgid 2 all 1
> ber_get_next
> tls_read: want=5, got=5
>   0000:  15 03 01 00 b0                                     .....
> tls_read: want=176, got=176
>   0000:  0f 12 bd 11 3a 31 7b 10  f9 c3 f7 87 dd 18 94 3d
> ....:1{........=   0010:  19 52 5b 9a 30 8a 9c f6  a0 ac c7 2f 7d 10 6a
> 21   .R[.0....../}.j!   0020:  55 aa b3 25 72 50 a1 c6  2e 16 e8 50 89 bc
> 65 d0   U..%rP.....P..e.   0030:  2a 5e 61 b5 44 8a e9 b0  01 cb 9f e4 85
> 81 9e 33   *^a.D..........3   0040:  16 57 8b a8 32 ce 14 2f  5a 38 0e 12
> f0 85 75 77   .W..2../Z8....uw   0050:  df 1b 57 56 c1 fb ae 2a  cc 72 29
> c7 38 eb d3 3c   ..WV...*.r).8..<   0060:  3b d4 8e ba 29 e6 8d 09  15 70
> 5f 79 07 3e 8e 5a   ;...)....p_y.>.Z   0070:  9e c1 82 9f 39 73 ac b0  22
> a4 31 d2 43 3a 09 b5   ....9s..".1.C:..   0080:  3d 07 b6 e7 17 14 5e 65
> d5 ed 2d 71 09 c2 ea b9   =.....^e..-q....   0090:  c8 6a 35 2c b7 18 4b
> 33  7e 72 52 bb b9 f4 bc 0a   .j5,..K3~rR.....   00a0:  23 4b f0 be dc 64
> ef 3f  bd a6 3a 71 8e 07 64 90   #K...d.?..:q..d. TLS trace: SSL3 alert
> read:warning:close notify
> ldap_read: want=8, got=0
>
> ber_get_next failed.
> ldap_perror
> ldap_result: Can't contact LDAP server (-1)
>
> Versions:
> gnutls: 2.0.4
> openssl: 0.9.8g
>
>



--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration