~ius-coredev/ius/openldap24

TLS: allow MozNSS CA certdir together with PEM CA certfile

 

Author: Jan Vcelak <jvcelak@redhat.com>

Resolves: #818844

 

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c

index 50c03dd..8f8f2b0 100644

--- a/libraries/libldap/tls_m.c

+++ b/libraries/libldap/tls_m.c

@@ -1695,6 +1695,9 @@ tlsm_deferred_init( void *arg )

                        ctx->tc_initctx = initctx;

 #endif

 

+               }

+

+               if ( errcode || lt->lt_cacertfile ) {

                        /* initialize the PEM module */

 #ifdef LDAP_R_COMPILE

                        ldap_pvt_thread_mutex_lock( &tlsm_init_mutex );

@@ -1703,16 +1706,23 @@ tlsm_deferred_init( void *arg )

 #ifdef LDAP_R_COMPILE

                                ldap_pvt_thread_mutex_unlock( &tlsm_init_mutex );

 #endif /* LDAP_R_COMPILE */

-                               errcode = PORT_GetError();

+                               int pem_errcode = PORT_GetError();

                                Debug( LDAP_DEBUG_ANY,

                                           "TLS: could not initialize moznss PEM module - error %d:%s.\n",

-                                          errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );

-                               return -1;

+                                          pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 );

+

+                               if ( errcode ) /* PEM is required */

+                                       return -1;

+

+                       } else if ( !errcode ) {

+                               tlsm_init_ca_certs( ctx, lt->lt_cacertfile, NULL );

                        }

 #ifdef LDAP_R_COMPILE

                        ldap_pvt_thread_mutex_unlock( &tlsm_init_mutex );

 #endif /* LDAP_R_COMPILE */

+               }

 

+               if ( errcode ) {

                        if ( tlsm_init_ca_certs( ctx, lt->lt_cacertfile, lt->lt_cacertdir ) ) {

                                /* if we tried to use lt->lt_cacertdir as an NSS key/cert db, errcode 

                                   will be a value other than 1 - print an error message so that the

-- 

1.7.7.6