From 5645e37044e77c72f8868ecf62b6c7983c0afc2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= Date: Mon, 21 Oct 2024 11:50:11 +0100 Subject: [PATCH 1/6] ITS#8047 Fix TLS connection timeout handling The test for async in ldap_int_tls_start was inverted, we already support calling ldap_int_tls_connect repeatedly. And so long as LBER_SB_OPT_NEEDS_* are managed correctly, the application should be able to do the right thing. Might require a new result code rather than reporposing LDAP_X_CONNECTING for this. --- libraries/libldap/ldap-int.h | 1 + libraries/libldap/tls2.c | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h index 3ef17643b1..7e754775e8 100644 --- a/libraries/libldap/ldap-int.h +++ b/libraries/libldap/ldap-int.h @@ -368,6 +368,7 @@ typedef struct ldap_conn { #define LDAP_CONNST_NEEDSOCKET 1 #define LDAP_CONNST_CONNECTING 2 #define LDAP_CONNST_CONNECTED 3 +#define LDAP_CONNST_TLS_INPROGRESS 4 LDAPURLDesc *lconn_server; BerElement *lconn_ber; /* ber receiving on this conn. */ diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c index dea46de0ad..cf6f4dcf9a 100644 --- a/libraries/libldap/tls2.c +++ b/libraries/libldap/tls2.c @@ -383,6 +383,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) if ( lo && lo->ldo_tls_connect_cb && lo->ldo_tls_connect_cb != ld->ld_options.ldo_tls_connect_cb ) lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + conn->lconn_status = LDAP_CONNST_TLS_INPROGRESS; } /* pass hostname for SNI, but only if it's an actual name @@ -441,9 +442,11 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) ber_sockbuf_remove_io( sb, &ber_sockbuf_io_debug, LBER_SBIOD_LEVEL_TRANSPORT ); #endif + conn->lconn_status = LDAP_CONNST_CONNECTED; return -1; } + conn->lconn_status = LDAP_CONNST_CONNECTED; return 0; } @@ -516,8 +519,9 @@ int ldap_tls_inplace( LDAP *ld ) { Sockbuf *sb = NULL; + LDAPConn *lc = ld->ld_defconn; - if ( ld->ld_defconn && ld->ld_defconn->lconn_sb ) { + if ( lc && lc->lconn_sb ) { sb = ld->ld_defconn->lconn_sb; } else if ( ld->ld_sb ) { @@ -527,6 +531,10 @@ ldap_tls_inplace( LDAP *ld ) return 0; } + if ( lc && lc->lconn_status == LDAP_CONNST_TLS_INPROGRESS ) { + return 0; + } + return ldap_pvt_tls_inplace( sb ); } @@ -1159,6 +1167,9 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) */ while ( ret > 0 ) { if ( async ) { + ld->ld_errno = LDAP_X_CONNECTING; + return (ld->ld_errno); + } else { struct timeval curr_time_tv, delta_tv; int wr=0; @@ -1217,6 +1228,11 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) ret = ldap_int_tls_connect( ld, conn, host ); } + if ( !async && ld->ld_options.ldo_tm_net.tv_sec >= 0 ) { + /* Restore original sb status */ + ber_sockbuf_ctrl( sb, LBER_SB_OPT_SET_NONBLOCK, (void*)0 ); + } + if ( ret < 0 ) { if ( ld->ld_errno == LDAP_SUCCESS ) ld->ld_errno = LDAP_CONNECT_ERROR; -- 2.47.1