47 lines
1.8 KiB
Diff
47 lines
1.8 KiB
Diff
From 2dfe3f35c7fef4792f15f0b3f9c9a10e5f9a4692 Mon Sep 17 00:00:00 2001
|
|
From: Simon Pichugin <spichugi@rehdat.com>
|
|
Date: Thu, 5 Aug 2021 16:15:09 +0200
|
|
Subject: [PATCH] Change TLS_REQSAN default to TRY
|
|
|
|
---
|
|
doc/man/man5/ldap.conf.5 | 2 +-
|
|
libraries/libldap/init.c | 2 +-
|
|
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5
|
|
index cde2c875f..9f1aa2c0a 100644
|
|
--- a/doc/man/man5/ldap.conf.5
|
|
+++ b/doc/man/man5/ldap.conf.5
|
|
@@ -479,7 +479,6 @@ The client will not check any SAN in the certificate.
|
|
The SAN is checked against the specified hostname. If a SAN is
|
|
present but none match the specified hostname, the SANs are ignored
|
|
and the usual check against the certificate DN is used.
|
|
-This is the default setting.
|
|
.TP
|
|
.B try
|
|
The SAN is checked against the specified hostname. If no SAN is present
|
|
@@ -487,6 +486,7 @@ in the server certificate, the usual check against the certificate DN
|
|
is used. If a SAN is present but doesn't match the specified hostname,
|
|
the session is immediately terminated. This setting may be preferred
|
|
when a mix of certs with and without SANs are in use.
|
|
+This is the default setting.
|
|
.TP
|
|
.B demand | hard
|
|
These keywords are equivalent. The SAN is checked against the specified
|
|
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
|
|
index 0d91808ec..fa4c176fd 100644
|
|
--- a/libraries/libldap/init.c
|
|
+++ b/libraries/libldap/init.c
|
|
@@ -625,7 +625,7 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl
|
|
gopts->ldo_tls_connect_cb = NULL;
|
|
gopts->ldo_tls_connect_arg = NULL;
|
|
gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND;
|
|
- gopts->ldo_tls_require_san = LDAP_OPT_X_TLS_ALLOW;
|
|
+ gopts->ldo_tls_require_san = LDAP_OPT_X_TLS_TRY;
|
|
#endif
|
|
gopts->ldo_keepalive_probes = 0;
|
|
gopts->ldo_keepalive_interval = 0;
|
|
--
|
|
2.31.1
|
|
|