From: Todd C. Miller <Todd.Miller@courtesan.com>
Date: Tue, 24 Apr 2012 16:52:36 +0000 (-0400)
Subject: Need to call ldapssl_clientauth_init() for start_tls on Mozilla
X-Git-Tag: SUDO_1_8_5~1^2~23
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e82b67314c47cf3fa55f5123d039980e73f441b8;p=sudo

Need to call ldapssl_clientauth_init() for start_tls on Mozilla
LDAP SDK.
---

diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index bb6f5a668..d4ee6f511 100644
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -124,6 +124,7 @@ extern int ldapssl_set_strength(LDAP *ldap, int strength);
 #define CONF_LIST_STR	4
 #define CONF_DEREF_VAL	5
 
+#define SUDO_LDAP_CLEAR		0
 #define SUDO_LDAP_SSL		1
 #define SUDO_LDAP_STARTTLS	2
 
@@ -522,7 +523,8 @@ sudo_ldap_init(LDAP **ldp, const char *host, int port)
     debug_decl(sudo_ldap_init, SUDO_DEBUG_LDAP)
 
 #ifdef HAVE_LDAPSSL_INIT
-    if (ldap_conf.ssl_mode == SUDO_LDAP_SSL) {
+    if (ldap_conf.ssl_mode != SUDO_LDAP_CLEAR) {
+	const int defsecure = ldap_conf.ssl_mode == SUDO_LDAP_SSL;
 	DPRINTF(("ldapssl_clientauth_init(%s, %s)",
 	    ldap_conf.tls_certfile ? ldap_conf.tls_certfile : "NULL",
 	    ldap_conf.tls_keyfile ? ldap_conf.tls_keyfile : "NULL"), 2);
@@ -566,8 +568,8 @@ sudo_ldap_init(LDAP **ldp, const char *host, int port)
 	    goto done;
 	}
 
-	DPRINTF(("ldapssl_init(%s, %d, 1)", host, port), 2);
-	if ((ld = ldapssl_init(host, port, 1)) != NULL)
+	DPRINTF(("ldapssl_init(%s, %d, %d)", host, port, defsecure), 2);
+	if ((ld = ldapssl_init(host, port, defsecure)) != NULL)
 	    rc = LDAP_SUCCESS;
     } else
 #endif