Fix ldap_set_tls_options #266

eehakkin · 2026-01-22T13:49:53Z

The OpenLDAP library has global options (which can be set by passing a NULL LDAP handle to ldap_set_setting()) and connection specific options (which can be set by passing a non-NULL LDAP handle to ldap_set_setting()). For TLS connection, the library uses either a default TLS context (which is based on global TLS options) or a connection specific TLS context (which can be create used the LDAP_OPT_X_TLS_NEWCTX option and which is based on connection specific TLS options).

The Dovecot LDAP libraries set and use the options and TLS contexts inconsistently and therefore it is not possible to set Dovecot LDAP TLS options as documented. Additionally, the ssl_min_protocol setting in handled wrongly.

Problems:

Inconsistent use of LDAP TLS contexts:
- LDAP connections are create by by the db_ldap_init_ld() in src/auth/db-ldap.c and by the ldap_connection_setup() in src/lib-ldap/ldap-connection.c (using ldap_initialize()). Both of these call the ldap_set_tls_options() to set connection specific TLS options (except for LDAP_OPT_X_TLS_REQUIRE_CERT also the global one).
- The ldap_connection_setup() in src/lib-ldap/ldap-connection.c also sets the LDAP_OPT_X_TLS_NEWCTX option and thus creates a new connection specific TLS context based on the connection specific TLS options which were set by the ldap_set_tls_options().
- But the db_ldap_init_ld() in src/auth/db-ldap.c does not set the LDAP_OPT_X_TLS_NEWCTX option and thus uses the default TLS context based on the global TLS options which were not set by the ldap_set_tls_options().
To fix this disparity, the ldap_set_tls_options() should set the LDAP_OPT_X_TLS_NEWCTX option.
Once the TLS context issue is fixed and only connection specific TLS options are used, it is not longer necessary to set the global LDAP_OPT_X_TLS_REQUIRE_CERT option in the ldap_set_tls_options().
The ldap_set_tls_options() uses the ssl_min_protocol setting string as-is as a LDAP_OPT_X_TLS_PROTOCOL_MIN option but the option is an int option. Typically the string is something like "TLSv1.3" or "\x54\x4C\x53\x76\x31\x2E\x33" which with typical 4 byte little endian ints means TLSv7754572.84 (0x76534C, 0x54) which LDAP servers do not provide.
To fix this, the ldap_set_tls_options() should convert the ssl_min_protocol setting to LDAP_OPT_X_TLS_PROTOCOL_TLSx_y constants.
The ldap_connection_setup() in src/lib-ldap/ldap-connection.c calls the ldap_set_tls_options() to set TLS options but overrides the LDAP_OPT_X_TLS_PROTOCOL_MIN option with the LDAP_OPT_X_TLS_PROTOCOL_SSL3 value.

Partial work-a-round for the current Dovecot 2.4.x is to configure at least LDAP TLS certificates also using import_environment as in

import_environment {
	LDAPTLS_CACERT    = /path/to/ca.pem
	LDAPTLS_CACERTDIR = /path/to/ca.dir/
	LDAPTLS_CERT      = /path/to/cert.pem
	LDAPTLS_KEY       = /path/to/key.pem
}

eehakkin · 2026-01-22T14:00:15Z

src/lib-ldap/ldap-connection.c

-	/* refuse to connect to SSLv2 as it's completely insecure */
-	opt = LDAP_OPT_X_TLS_PROTOCOL_SSL3;
-	ldap_set_option(conn->conn, LDAP_OPT_X_TLS_PROTOCOL_MIN, &opt);
-#endif


This should be done in ldap_set_tls_options().

eehakkin · 2026-01-22T14:00:18Z

src/lib-ldap/ldap-connection.c

-	opt = 0;
-	ldap_set_option(conn->conn, LDAP_OPT_X_TLS_NEWCTX, &opt);
-#endif
-


This should be done in ldap_set_tls_options().

eehakkin · 2026-01-22T14:00:27Z

src/lib-ldap/ldap-utils.c

 	int opt = requires ? LDAP_OPT_X_TLS_HARD : LDAP_OPT_X_TLS_ALLOW;
-
-	/* required for Bookworm */
-	if (ldap_set_opt(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &opt,


It's required for Bookworm and others to either set the global TLS options (by passing a NULL LDAP handle for ldap_set_option) and not to create a connection specific TLS context (by setting the LDAP_OPT_X_TLS_NEWCTX option) or to set the connection specific TLS options (by passing a non-NULL LDAP handle for ldap_set_option like on RHEL9) and to create a connection specific TLS context (by setting the LDAP_OPT_X_TLS_NEWCTX option).

It's better to set set the connection specific TLS options and to create a connection specific TLS context.

This should be in the commit message.

eehakkin · 2026-01-22T14:01:04Z

src/lib-ldap/ldap-utils.c

+	else if (strcasecmp(ssl_set->ssl_min_protocol, "ANY") == 0 ||
+		 *ssl_set->ssl_min_protocol == '\0')
+		/* refuse to connect to SSLv2 as it's completely insecure */
+		opt = LDAP_OPT_X_TLS_PROTOCOL_SSL3;


Should this minimum be increased to LDAP_OPT_X_TLS_PROTOCOL_TLS1_0?

We should probably disallow empty ssl_min_protocol value entirely (also in lib-ssl-iostream code).

sirainen · 2026-01-26T08:50:51Z

src/lib-ldap/ldap-utils.c

+	else if (strcasecmp(ssl_set->ssl_min_protocol, "ANY") == 0 ||
+		 *ssl_set->ssl_min_protocol == '\0')
+		/* refuse to connect to SSLv2 as it's completely insecure */
+		opt = LDAP_OPT_X_TLS_PROTOCOL_SSL3;


We should probably disallow empty ssl_min_protocol value entirely (also in lib-ssl-iostream code).

sirainen · 2026-01-26T08:51:35Z

src/lib-ldap/ldap-utils.c

+		opt = LDAP_OPT_X_TLS_PROTOCOL_TLS1_2;
+	else if (strcasecmp(ssl_set->ssl_min_protocol, "TLSv1.3") == 0 ||
+		 strcasecmp(ssl_set->ssl_min_protocol, "LATEST") == 0)
+		opt = LDAP_OPT_X_TLS_PROTOCOL_TLS1_3;


Should move this mapping into a table and loop through it, instead of many ifs.

sirainen · 2026-01-26T08:55:09Z

src/lib-ldap/ldap-utils.c

 	int opt = requires ? LDAP_OPT_X_TLS_HARD : LDAP_OPT_X_TLS_ALLOW;
-
-	/* required for Bookworm */
-	if (ldap_set_opt(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &opt,


This should be in the commit message.

Additionally, do not set the global peer certificate checking strategy (the global LDAP_OPT_X_TLS_REQUIRE_CERT option). It is not needed and has no effect after a new TLS context is created.

eehakkin commented Jan 22, 2026

View reviewed changes

cmouse assigned mbettini-ox Jan 22, 2026

cmouse requested a review from mbettini-ox January 22, 2026 17:08

sirainen requested changes Jan 26, 2026

View reviewed changes

eehakkin added 3 commits January 26, 2026 22:31

lib-ldap: Convert ssl_min_protocol properly to int

eec154e

lib-ldap: Do not override the tls_protocol_min setting with a lower one

5bdc89f

lib-ldap: Create a new TLS context for all LDAP TLS connections

f043a7a

Additionally, do not set the global peer certificate checking strategy (the global LDAP_OPT_X_TLS_REQUIRE_CERT option). It is not needed and has no effect after a new TLS context is created.

eehakkin force-pushed the fix/ldap-set-tls-options branch from e3b3d0c to f043a7a Compare January 26, 2026 20:45

eehakkin requested a review from sirainen January 26, 2026 20:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix ldap_set_tls_options #266

Fix ldap_set_tls_options #266

Uh oh!

eehakkin commented Jan 22, 2026 •

edited

Loading

Uh oh!

eehakkin Jan 22, 2026

Uh oh!

eehakkin Jan 22, 2026

Uh oh!

eehakkin Jan 22, 2026

Uh oh!

sirainen Jan 26, 2026

Uh oh!

eehakkin Jan 26, 2026

Uh oh!

eehakkin Jan 22, 2026

Uh oh!

sirainen Jan 26, 2026

Uh oh!

sirainen Jan 26, 2026

Uh oh!

sirainen Jan 26, 2026

Uh oh!

eehakkin Jan 26, 2026

Uh oh!

sirainen Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix ldap_set_tls_options #266

Are you sure you want to change the base?

Fix ldap_set_tls_options #266

Uh oh!

Conversation

eehakkin commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eehakkin commented Jan 22, 2026 •

edited

Loading