Merge r1209601:

Fix segfault with Solaris LDAP SDK when enabling ldaps.

Enable SSL by passing secure=1 to apr_ldap_init instead of calling
apr_ldap_set_option(... APR_LDAP_OPT_TLS ...).

This change carefully avoids any change of behavior on non-Solaris LDAP SDKs.

PR: 42682

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1209604 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index a92873fd0f3b5b9ae36786219883c0eb51fbaf05..f695a4bd7c7918d17bce4e36a42a68a2ce4ae417 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.0
 
+  *) mod_ldap: Fix segfault with Solaris LDAP when enabling ldaps. This
+     requires an apr-util fix in which is available in apr-util >= 1.4.0.
+     PR 42682. [Stefan Fritsch]
+
   *) mod_rewrite: Add the AllowNoSlash RewriteOption, which makes it possible
      for RewriteRules to be placed in .htaccess files that match the directory
      with no trailing slash. PR 48304.

diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
index 492af95037df3391b0eecbde8a4a4cfda14602ad..92f17ed358979d3852e0af0e03516dff14d9a95b 100644 (file)
--- a/modules/ldap/util_ldap.c
+++ b/modules/ldap/util_ldap.c
@@ -262,6 +262,23 @@ static int uldap_connection_init(request_rec *r,
     util_ldap_state_t *st =
         (util_ldap_state_t *)ap_get_module_config(r->server->module_config,
         &ldap_module);
+    int have_client_certs = !apr_is_empty_array(ldc->client_certs);
+#if !APR_HAS_SOLARIS_LDAPSDK
+    /*
+     * Normally we enable SSL/TLS with apr_ldap_set_option(), except
+     * with Solaris LDAP, where this is broken.
+     */
+    int secure = APR_LDAP_NONE;
+#else
+    /*
+     * With Solaris LDAP, we enable TSL via the secure argument
+     * to apr_ldap_init(). This requires a fix from apr-util >= 1.4.0.
+     *
+     * Just in case client certificates ever get supported, we
+     * handle those as with the other LDAP SDKs.
+     */
+    int secure = have_client_certs ? APR_LDAP_NONE : ldc->secure;
+#endif
 
     /* Since the host will include a port if the default port is not used,
      * always specify the default ports for the port parameter.  This will
@@ -272,8 +289,7 @@ static int uldap_connection_init(request_rec *r,
     apr_ldap_init(r->pool, &(ldc->ldap),
                   ldc->host,
                   APR_LDAP_SSL == ldc->secure ? LDAPS_PORT : LDAP_PORT,
-                  APR_LDAP_NONE,
-                  &(result));
+                  secure, &(result));
 
     if (NULL == result) {
         /* something really bad happened */
@@ -318,7 +334,7 @@ static int uldap_connection_init(request_rec *r,
     ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);
 
     /* set client certificates */
-    if (!apr_is_empty_array(ldc->client_certs)) {
+    if (have_client_certs) {
         apr_ldap_set_option(r->pool, ldc->ldap, APR_LDAP_OPT_TLS_CERT,
                             ldc->client_certs, &(result));
         if (LDAP_SUCCESS != result->rc) {
@@ -329,7 +345,12 @@ static int uldap_connection_init(request_rec *r,
     }
 
     /* switch on SSL/TLS */
-    if (APR_LDAP_NONE != ldc->secure) {
+    if (APR_LDAP_NONE != ldc->secure
+#if APR_HAS_SOLARIS_LDAPSDK
+        /* See comments near apr_ldap_init() above */
+        && have_client_certs
+#endif
+       ) {
         apr_ldap_set_option(r->pool, ldc->ldap,
                             APR_LDAP_OPT_TLS, &ldc->secure, &(result));
         if (LDAP_SUCCESS != result->rc) {