Bug 1027613 - tls_reqcert try has bad behavior
tls_reqcert try has bad behavior
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openldap (Show other bugs)
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Jan Synacek
Eduard Benes
Depends On:
Blocks: 1027618 1027796
  Show dependency treegraph
Reported: 2013-11-07 03:34 EST by David Spurek
Modified: 2015-03-05 08:35 EST (History)
3 users (show)

See Also:
Fixed In Version: openldap-2.4.39-5.el7
Doc Type: Bug Fix
Doc Text:
Cause: Confusing description in the manual page. Consequence: The user might be confused about the real behavior. Fix: Fix the description in the man page. Result: The man page description is now correct.
Story Points: ---
Clone Of:
: 1027618 1027796 (view as bug list)
Last Closed: 2015-03-05 08:35:25 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
OpenLDAP ITS 7744 None None None Never
Red Hat Product Errata RHBA-2015:0597 normal SHIPPED_LIVE openldap bug fix and enhancement update 2015-03-05 12:20:57 EST

  None (edit)
Description David Spurek 2013-11-07 03:34:04 EST
Description of problem:
'tls_reqcert try' option has bad behavior on client side. It should allow connection if certificate is not specified.

man page says:
try    The  server  certificate  is requested. If no cer‐
     tificate is provided, the  session  proceeds  nor‐
     mally.  If a bad certificate is provided, the ses‐
     sion is immediately terminated.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.Setup ldap server with certificates
2.remove all TLS_CACERT and TLS_CACERTDIR from /etc/openldap/ldap.conf
3.set TLS_REQCERT try to /etc/openldap/ldap.conf
4. try ldapsearch -ZZ -x -H ldap://<server_name> '*'

Actual results:
ldapsearch fail:
ldap_start_tls: Connect error (-11)
	additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.

Expected results:
ldapsearch should pass

Additional info:
Comment 1 David Spurek 2013-11-07 03:37:52 EST
if TLS_REQCERT allow is set then ldapsearch pass. TLS_REQCERT try and allow should have the same behavior in case if no ca cert is specified (according to description in man ldap.conf).
Comment 2 Jan Synacek 2013-11-12 03:52:24 EST
First observation: TLS_REQCERT has no effect if you use ldapsearch with -Z[Z]. This probably works as it should, see http://www.openldap.org/its/index.cgi?findid=7206.
Comment 3 Jan Synacek 2013-11-12 05:01:28 EST
I couldn't configure the server so it "provides no certificate" and connect to it using the ldapsearch client.

The manpage is talking about server certificates, TLS_CACERT and TLS_CACERTDIR are CA certificates that the client should use, therefore removing them is not relevant.
Comment 4 Jan Synacek 2013-11-13 06:42:45 EST
Upstream discussion at http://www.openldap.org/lists/openldap-technical/201311/msg00099.html.

Conclusion: the manpage should be fixed.
Comment 14 errata-xmlrpc 2015-03-05 08:35:25 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.