|
 |
47a6a9 |
From 2dfe3f35c7fef4792f15f0b3f9c9a10e5f9a4692 Mon Sep 17 00:00:00 2001
|
|
|
47a6a9 |
From: Simon Pichugin <spichugi@rehdat.com>
|
|
|
47a6a9 |
Date: Thu, 5 Aug 2021 16:15:09 +0200
|
|
|
47a6a9 |
Subject: [PATCH] Change TLS_REQSAN default to TRY
|
|
|
47a6a9 |
|
|
|
47a6a9 |
---
|
|
|
47a6a9 |
doc/man/man5/ldap.conf.5 | 2 +-
|
|
|
47a6a9 |
libraries/libldap/init.c | 2 +-
|
|
|
47a6a9 |
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
47a6a9 |
|
|
|
47a6a9 |
diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5
|
|
|
47a6a9 |
index cde2c875f..9f1aa2c0a 100644
|
|
|
47a6a9 |
--- a/doc/man/man5/ldap.conf.5
|
|
|
47a6a9 |
+++ b/doc/man/man5/ldap.conf.5
|
|
|
47a6a9 |
@@ -479,7 +479,6 @@ The client will not check any SAN in the certificate.
|
|
|
47a6a9 |
The SAN is checked against the specified hostname. If a SAN is
|
|
|
47a6a9 |
present but none match the specified hostname, the SANs are ignored
|
|
|
47a6a9 |
and the usual check against the certificate DN is used.
|
|
|
47a6a9 |
-This is the default setting.
|
|
|
47a6a9 |
.TP
|
|
|
47a6a9 |
.B try
|
|
|
47a6a9 |
The SAN is checked against the specified hostname. If no SAN is present
|
|
|
47a6a9 |
@@ -487,6 +486,7 @@ in the server certificate, the usual check against the certificate DN
|
|
|
47a6a9 |
is used. If a SAN is present but doesn't match the specified hostname,
|
|
|
47a6a9 |
the session is immediately terminated. This setting may be preferred
|
|
|
47a6a9 |
when a mix of certs with and without SANs are in use.
|
|
|
47a6a9 |
+This is the default setting.
|
|
|
47a6a9 |
.TP
|
|
|
47a6a9 |
.B demand | hard
|
|
|
47a6a9 |
These keywords are equivalent. The SAN is checked against the specified
|
|
|
47a6a9 |
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
|
|
|
47a6a9 |
index 0d91808ec..fa4c176fd 100644
|
|
|
47a6a9 |
--- a/libraries/libldap/init.c
|
|
|
47a6a9 |
+++ b/libraries/libldap/init.c
|
|
|
47a6a9 |
@@ -625,7 +625,7 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl
|
|
|
47a6a9 |
gopts->ldo_tls_connect_cb = NULL;
|
|
|
47a6a9 |
gopts->ldo_tls_connect_arg = NULL;
|
|
|
47a6a9 |
gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND;
|
|
|
47a6a9 |
- gopts->ldo_tls_require_san = LDAP_OPT_X_TLS_ALLOW;
|
|
|
47a6a9 |
+ gopts->ldo_tls_require_san = LDAP_OPT_X_TLS_TRY;
|
|
|
47a6a9 |
#endif
|
|
|
47a6a9 |
gopts->ldo_keepalive_probes = 0;
|
|
|
47a6a9 |
gopts->ldo_keepalive_interval = 0;
|
|
|
47a6a9 |
--
|
|
|
47a6a9 |
2.31.1
|
|
|
47a6a9 |
|