Commit 27bdc1e7 authored by Stefan Fritsch's avatar Stefan Fritsch
Browse files

Fix segfault with Solaris LDAP SDK when enabling ldaps. 

Enable SSL by passing secure=1 to apr_ldap_init instead of calling
apr_ldap_set_option(... APR_LDAP_OPT_TLS ...).

This change carefully avoids any change of behavior on non-Solaris LDAP SDKs.

PR: 42682


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1209601 13f79535-47bb-0310-9956-ffa450edef68
parent 35cc2739

modules/ldap/util_ldap.c

+25 −4
Changes for modules/ldap/util_ldap.c: 25 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -262,6 +262,23 @@ static int uldap_connection_init(request_rec *r, 
    util_ldap_state_t *st =

        (util_ldap_state_t *)ap_get_module_config(r->server->module_config,

        &ldap_module);

    int have_client_certs = !apr_is_empty_array(ldc->client_certs);

#if !APR_HAS_SOLARIS_LDAPSDK

    /*

     * Normally we enable SSL/TLS with apr_ldap_set_option(), except

     * with Solaris LDAP, where this is broken.

     */

    int secure = APR_LDAP_NONE;

#else

    /*

     * With Solaris LDAP, we enable TSL via the secure argument

     * to apr_ldap_init(). This requires a fix from apr-util >= 1.4.0.

     *

     * Just in case client certificates ever get supported, we

     * handle those as with the other LDAP SDKs.

     */

    int secure = have_client_certs ? APR_LDAP_NONE : ldc->secure;

#endif



    /* Since the host will include a port if the default port is not used,

     * always specify the default ports for the port parameter.  This will
@@ -272,8 +289,7 @@ static int uldap_connection_init(request_rec *r, 
    apr_ldap_init(r->pool, &(ldc->ldap),

                  ldc->host,

                  APR_LDAP_SSL == ldc->secure ? LDAPS_PORT : LDAP_PORT,

                  APR_LDAP_NONE,

                  &(result));

                  secure, &(result));



    if (NULL == result) {

        /* something really bad happened */
@@ -318,7 +334,7 @@ static int uldap_connection_init(request_rec *r, 
    ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);



    /* set client certificates */

    if (!apr_is_empty_array(ldc->client_certs)) {

    if (have_client_certs) {

        apr_ldap_set_option(r->pool, ldc->ldap, APR_LDAP_OPT_TLS_CERT,

                            ldc->client_certs, &(result));

        if (LDAP_SUCCESS != result->rc) {
@@ -329,7 +345,12 @@ static int uldap_connection_init(request_rec *r, 
    }



    /* switch on SSL/TLS */

    if (APR_LDAP_NONE != ldc->secure) {

    if (APR_LDAP_NONE != ldc->secure

#if APR_HAS_SOLARIS_LDAPSDK

        /* See comments near apr_ldap_init() above */

        && have_client_certs

#endif

       ) {

        apr_ldap_set_option(r->pool, ldc->ldap,

                            APR_LDAP_OPT_TLS, &ldc->secure, &(result));

        if (LDAP_SUCCESS != result->rc) {