Bug 655134

In contrast to the RHEL-5 sibling (bug 655073 comment #2), we have ldap_init_fd() available in RHEL-6 openldap.  We, however, still need to patch lib/ldap.c, instead of lib/openldap.c, which the upstream patch is applied against.

Created attachment 461845 [details]
ugly draft of a patch

Great work!  I can indeed connect to LDAP with/without proxy on RHEL-6 using your patch and test-case, spotted only a few differences with the upstream patch:

1) There is no string given as URL to ldap_init_fd().  But to be honest, I am not sure if the string is ever used by the LDAP protocol.  The upstream code passes in something like "ldap://ldap.corp.redhat.com:3128", which feels wrong to me.  3128 is port of the http proxy, not the port of LDAP.

2) There is no check of ldap_init_fd() return value.  It seems to be OK, because the LDAP pointer is nullified before the first return from ldap_init_fd():

ldap_init_fd(
  ber_socket_t fd,
  int proto,
  LDAP_CONST char *url,
  LDAP **ldp
)
{
  int rc;
  LDAP *ld;
  LDAPConn *conn;

  *ldp = NULL;
  rc = ldap_create( &ld );
  if( rc != LDAP_SUCCESS )
    return( rc );
  ...

3) There is no #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY) around the proxy connection code, but that should be fine for RHEL-6.

(In reply to comment #8)
> 1) There is no string given as URL to ldap_init_fd().  But to be honest, I am
> not sure if the string is ever used by the LDAP protocol.  The upstream code
> passes in something like "ldap://ldap.corp.redhat.com:3128", which feels wrong
> to me.  3128 is port of the http proxy, not the port of LDAP.

I believe it was a bug, thus pushed a one-line fix for that upstream:

https://github.com/bagder/curl/commit/d212fe4

I quickly checked configure.ac and I don't think this patch would be much interesting from upstream perspective.  The choice between lib/ldap.c and lib/openldap.c is based exactly on the availability of ldap_init_fd().  So there is no point in making the lib/ldap.c code using that function, because the code would not run anyway in that case:

https://github.com/bagder/curl/blob/master/configure.ac#L878

I am fine with keeping your patch for RHEL-6 as it as now.

available updates for stable Fedora:

curl-7.20.1-5.fc13
curl-7.21.0-6.fc14

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
libcurl failed when an LDAP request was sent using curl through a HTTP proxy in tunnel mode (curl option "-p" or "--proxytunnel"). Curl tried to connect directly to the LDAP server via the proxy port, hence failed. This is now fixed to allow libcurl LDAP connections through HTTP proxies to work as expected.

    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1 @@
-libcurl failed when an LDAP request was sent using curl through a HTTP proxy in tunnel mode (curl option "-p" or "--proxytunnel"). Curl tried to connect directly to the LDAP server via the proxy port, hence failed. This is now fixed to allow libcurl LDAP connections through HTTP proxies to work as expected.+libcurl failed when an LDAP request was sent using curl through a HTTP proxy in tunnel mode (curl option "-p" or "--proxytunnel"). Curl tried to connect directly to the LDAP server via the proxy port and consequently failed. This is now fixed to allow libcurl LDAP connections through HTTP proxies to work as expected.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0573.html