[SSSD] [PATCH] Do not attempt to use START_TLS on SSL connections

Stephen Gallagher sgallagh at redhat.com
Mon Feb 14 21:10:51 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/14/2011 03:31 PM, Sumit Bose wrote:
> On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote:
> On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
>>>> Not all LDAP servers are capable of handling dual-encryption with
>>>> both TLS and SSL.
>>>>
>>>> Fixes https://fedorahosted.org/sssd/ticket/795
>>>>
>>>> Patches attached for 1.5.x/HEAD and 1.2.x
> 
> I made a mistake with the backport to 1.2.x and it was having no effect.
> Corrected patch attached.
> 
> 
>> The patch is working as expected, but you might want to add a similar
>> check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there
>> might be setups where multiple ldap:// and ldaps:// servers are defined,
>> were an explict start TLS is only wnated for the ldap:// services.
> 

Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1ZmlsACgkQeiVVYja6o6MOfACfahWgHzajAnSbf+bE2aKze2WV
r/kAnRETX/cFGnB6hbC4CT+kSPoeGvkr
=/mkd
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-attempt-to-use-START_TLS-on-SSL-connections.patch
Type: text/x-patch
Size: 5471 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110214/38ec4432/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-attempt-to-use-START_TLS-on-SSL-connections-1.2.patch
Type: text/x-patch
Size: 4905 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110214/38ec4432/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-attempt-to-use-START_TLS-on-SSL-connections.patch.sig
Type: application/pgp-signature
Size: 71 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110214/38ec4432/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-attempt-to-use-START_TLS-on-SSL-connections-1.2.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110214/38ec4432/attachment-0001.sig>


More information about the sssd-devel mailing list