denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ldap: Replace deprecated function calls and support LDAPS

Browse Source 
The use of the deprecated `ldap_init()` meant that LDAPS, although
announced by the plugin, was not actually supported.  The plugin just
always used a plaintext connection.  Now we use the current API and
get support for LDAPS (requires a bit of an awkward URI construction).
Based on the URI's scheme we also set an option to enforce a certificate
check.  The new NEWCTX option creates a connection-specific TLS context.
Without that we get a global default context once bind is called that is
not freed until the daemon exits (it leaks in LD and also seems unsafe
in regards to multiple threads fetching CRLs via LDAP).

Fixes: 552cc11b1f ("merged the modularization branch (credentials) back to trunk")
Fixes: 8c06e9c0ed ("added #define LDAP_DEPRECATED in order to use old ldap_init() function")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:37 +02:00
parent e64877b46c
commit e37aac7b4f
3 changed files with 115 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+1 -1
View File
@@ -1027,7 +1027,7 @@ if test x$gmp = xtrue; then
fi
if test x$ldap = xtrue; then
AC_CHECK_LIB([ldap],[ldap_init],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP library ldap not found])],[])
AC_CHECK_LIB([ldap],[ldap_initialize],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP library ldap not found])],[])
AC_CHECK_LIB([lber],[ber_free],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP library lber not found])],[])
AC_CHECK_HEADER([ldap.h],,[AC_MSG_ERROR([LDAP header ldap.h not found!])])
fi