[SSSD] [PATCH] Log TLS errors to syslog

Stephen Gallagher sgallagh at redhat.com
Fri Jul 2 14:08:09 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/02/2010 09:51 AM, Dmitri Pal wrote:
> Stephen Gallagher wrote:
>> Also adds support for detecting LDAPS errors by adding a check for
>> SDAP_DIAGNOSTIC_MESSAGE after ldap_search_ext()
>>
>> This should make debugging an initial setup easier, as the most common
>> configuration errors will appear in /var/log/messages, instead of
>> requiring the user to turn on the debug logs.
>>
> Visual ack with nitpicks:
> 
> 
> +            syslog(LOG_ERR, "Could not start TLS. "
> +                            "Check for certificate issues\n");
> 
> 
> +            syslog(LOG_ERR, "Could not install TLS. "
> +                            "Check for certificate issues\n");
> 
> 
> 1) Trailing dots are missing

Yeah, I should be using a period instead of \n here.

> 2) Don't you want to print out the ldap_err2string(ret) anyways?

ldap_err2string(ret) doesn't actually give any information useful for
resolving the issue. It's a very generic error (e.g. "Could not contact
LDAP server").

The purpose of the SDAP_DIAGNOSTIC_MESSAGE is to provide actual useful
information like "Self-signed certificate in certificate chain".

> 3) What does "install" TLS means? This message sounds confusing. What is
> it that you are "installing"?
> 

This is standard terminology. When a START_TLS command is issued, TLS is
"installed" onto the existing connection.

Also note that this is the error handling for the ldap_install_tls()
function of the OpenLDAP library.


New patch attached to address 1)

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkwt8skACgkQeiVVYja6o6OGrQCfcCRv92SMLPBsMP/9J73UZAyL
6JQAn3o3JsKwN4oW9e6Akve6MXS+/eNJ
=k5Ki
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Log-TLS-errors-to-syslog.patch
Type: text/x-patch
Size: 4474 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100702/f239ace3/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Log-TLS-errors-to-syslog.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100702/f239ace3/attachment.sig>


More information about the sssd-devel mailing list