Commit 23af2c36 authored by Kurt Zeilenga's avatar Kurt Zeilenga Committed by Quanah Gibson-Mount
Browse files

ITS#8675 - Fix tools to not continue on TLS error

The spec says that upon StartTLS 'success', both TLS communications is
established on the octet following the Start TLS response (and the
request)... and that once one starts TLS communications, one can never
go back to LDAP without TLS. So if there's a TLS failure (whether as
part of TLS nego or later), LDAP communications cannot be continued
(without TLS).

Only ignoring LDAP errors (rc > 0) ensures that if TLS negotiation
fails, we don't attempt to send LDAP operations without TLS.
parent f4bfb5e0
......@@ -1451,7 +1451,7 @@ dnssrv_free:;
ldap_get_option( ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*)&msg);
tool_perror( "ldap_start_tls", rc, NULL, NULL, msg, NULL );
if ( use_tls > 1 ) {
if ( use_tls > 1 || rc < 0 ) {
tool_exit( ld, EXIT_FAILURE );
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment