Full_Name: Philippe Kueck
Version: 2.4.23 / 2.4.26
OS: RHEL 6.1
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (82.98.65.86)
When compiled against Mozilla/NSS OpenLDAP does not accept wildcard
certificates.
This is probably because in tls_m.c the certificate CN (*.domain.example) is
matched against the hostname (foo.domain.example), not against the domain
(.domain.example).
I suggest the following patch:
--%snip%--
diff -Nru openldap-2.4.26-orig/libraries/libldap/tls_m.c
openldap-2.4.26/libraries/libldap/tls_m.c
--- openldap-2.4.26-orig/libraries/libldap/tls_m.c 2011-06-30
17:13:36.000000000
+0200
+++ openldap-2.4.26/libraries/libldap/tls_m.c 2011-08-01 16:29:42.000000000
+0200
@@ -2590,7 +2590,7 @@
if ( av->len == nlen && !strncasecmp( name,
(char *)av->data, nlen )) {
ret = LDAP_SUCCESS;
} else if ( av->data[0] == '*' && av->data[1]
== '.' &&
- domain && dlen == av->len - 1 &&
!strncasecmp( name,
+ domain && dlen == av->len - 1 &&
!strncasecmp( domain,
(char *)(av->data+1), dlen )) {
ret = LDAP_SUCCESS;
} else {
--%snip%--
Kind regards,
Philippe Kueck
