Re: Spurious Start TLS failed errors on proxyed bind OpenLDAP 2.4.40

[openldap-technical@kolttonen.fi]

Hello again,

On Tue, 22 Jan 2019, openldap-technical@kolttonen.fi wrote:

> By the way, I am wondering here about the correctness of parameter
> 
>   li->li_timeout[ SLAP_OP_EXTENDED ]
> 
> slap.h has:
> 
> /*
>  * Operation indices
>  */
> typedef enum {
>         SLAP_OP_BIND = 0,
>         SLAP_OP_UNBIND,
>         SLAP_OP_SEARCH,
>         SLAP_OP_COMPARE,
>         SLAP_OP_MODIFY,
>         SLAP_OP_MODRDN,
>         SLAP_OP_ADD,
>         SLAP_OP_DELETE,
>         SLAP_OP_ABANDON,
>         SLAP_OP_EXTENDED,
>         SLAP_OP_LAST
> } slap_op_t;
> 
> So SLAP_OP_EXTENDED has value 9. But back-ldap/config.c has:
> 
> /* see enum in slap.h */
> static slap_cf_aux_table timeout_table[] = {
>     { BER_BVC("bind="), SLAP_OP_BIND * sizeof( time_t ),    'u', 0, NULL },
>     /* unbind makes no sense */
>     { BER_BVC("add="),  SLAP_OP_ADD * sizeof( time_t ),     'u', 0, NULL },
>     { BER_BVC("delete="),   SLAP_OP_DELETE * sizeof( time_t ),  'u', 0, NULL },
>     { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),  'u', 0, NULL },
>     { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),  'u', 0, NULL },
>     { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ), 'u', 0, NULL },
>     { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),  'u', 0, NULL },
>     /* abandon makes little sense */
> #if 0   /* not implemented yet */
>     { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
> #endif
>     { BER_BVNULL, 0, 0, 0, NULL }
> };
> 
> Hmmm, SLAP_OP_EXTENDED is not defined, so does li->li_timeout[ SLAP_OP_EXTENDED ] 
> end up pointing outside of this timeout_table[]? I am not sure.

No, it does not point there. I read some more code and "li" is of type 
struct ldapinfo_t that has member:

  time_t          li_timeout[ SLAP_OP_LAST ];

And hence we have an array: 

  li_timeout[ 10 ]

so pointing to li_timeout[ SLAP_OP_EXTENDED ] points to li_timeout[ 9 ] 
and there is nothing wrong with that. 

I do not know if I understand the code here, but I suppose this 
li_timeout[ SLAP_OP_EXTENDED ] has value 0. That is why the else-branch is 
taken, giving the default 0.1 second timeout for TLS initialization. Is
this correct, and perhaps safe to increase the value here?

Best regards,
Unto Sten