From 04adeb4e59896d2ec21331006d9ddab661529ad5 Mon Sep 17 00:00:00 2001 From: Stefan Fritsch Date: Fri, 2 Dec 2011 17:50:02 +0000 Subject: [PATCH] Merge r1209601: Fix segfault with Solaris LDAP SDK when enabling ldaps. Enable SSL by passing secure=1 to apr_ldap_init instead of calling apr_ldap_set_option(... APR_LDAP_OPT_TLS ...). This change carefully avoids any change of behavior on non-Solaris LDAP SDKs. PR: 42682 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1209604 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 4 ++++ modules/ldap/util_ldap.c | 29 +++++++++++++++++++++++++---- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/CHANGES b/CHANGES index a92873fd0f..f695a4bd7c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,10 @@ -*- coding: utf-8 -*- Changes with Apache 2.4.0 + *) mod_ldap: Fix segfault with Solaris LDAP when enabling ldaps. This + requires an apr-util fix in which is available in apr-util >= 1.4.0. + PR 42682. [Stefan Fritsch] + *) mod_rewrite: Add the AllowNoSlash RewriteOption, which makes it possible for RewriteRules to be placed in .htaccess files that match the directory with no trailing slash. PR 48304. diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c index 492af95037..92f17ed358 100644 --- a/modules/ldap/util_ldap.c +++ b/modules/ldap/util_ldap.c @@ -262,6 +262,23 @@ static int uldap_connection_init(request_rec *r, util_ldap_state_t *st = (util_ldap_state_t *)ap_get_module_config(r->server->module_config, &ldap_module); + int have_client_certs = !apr_is_empty_array(ldc->client_certs); +#if !APR_HAS_SOLARIS_LDAPSDK + /* + * Normally we enable SSL/TLS with apr_ldap_set_option(), except + * with Solaris LDAP, where this is broken. + */ + int secure = APR_LDAP_NONE; +#else + /* + * With Solaris LDAP, we enable TSL via the secure argument + * to apr_ldap_init(). This requires a fix from apr-util >= 1.4.0. + * + * Just in case client certificates ever get supported, we + * handle those as with the other LDAP SDKs. + */ + int secure = have_client_certs ? APR_LDAP_NONE : ldc->secure; +#endif /* Since the host will include a port if the default port is not used, * always specify the default ports for the port parameter. This will @@ -272,8 +289,7 @@ static int uldap_connection_init(request_rec *r, apr_ldap_init(r->pool, &(ldc->ldap), ldc->host, APR_LDAP_SSL == ldc->secure ? LDAPS_PORT : LDAP_PORT, - APR_LDAP_NONE, - &(result)); + secure, &(result)); if (NULL == result) { /* something really bad happened */ @@ -318,7 +334,7 @@ static int uldap_connection_init(request_rec *r, ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version); /* set client certificates */ - if (!apr_is_empty_array(ldc->client_certs)) { + if (have_client_certs) { apr_ldap_set_option(r->pool, ldc->ldap, APR_LDAP_OPT_TLS_CERT, ldc->client_certs, &(result)); if (LDAP_SUCCESS != result->rc) { @@ -329,7 +345,12 @@ static int uldap_connection_init(request_rec *r, } /* switch on SSL/TLS */ - if (APR_LDAP_NONE != ldc->secure) { + if (APR_LDAP_NONE != ldc->secure +#if APR_HAS_SOLARIS_LDAPSDK + /* See comments near apr_ldap_init() above */ + && have_client_certs +#endif + ) { apr_ldap_set_option(r->pool, ldc->ldap, APR_LDAP_OPT_TLS, &ldc->secure, &(result)); if (LDAP_SUCCESS != result->rc) { -- 2.40.0