00db6a
From 2dfe3f35c7fef4792f15f0b3f9c9a10e5f9a4692 Mon Sep 17 00:00:00 2001
00db6a
From: Simon Pichugin <spichugi@rehdat.com>
00db6a
Date: Thu, 5 Aug 2021 16:15:09 +0200
00db6a
Subject: [PATCH] Change TLS_REQSAN default to TRY
00db6a
00db6a
---
00db6a
 doc/man/man5/ldap.conf.5 | 2 +-
00db6a
 libraries/libldap/init.c | 2 +-
00db6a
 2 files changed, 2 insertions(+), 2 deletions(-)
00db6a
00db6a
diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5
00db6a
index cde2c875f..9f1aa2c0a 100644
00db6a
--- a/doc/man/man5/ldap.conf.5
00db6a
+++ b/doc/man/man5/ldap.conf.5
00db6a
@@ -479,7 +479,6 @@ The client will not check any SAN in the certificate.
00db6a
 The SAN is checked against the specified hostname. If a SAN is
00db6a
 present but none match the specified hostname, the SANs are ignored
00db6a
 and the usual check against the certificate DN is used.
00db6a
-This is the default setting.
00db6a
 .TP
00db6a
 .B try
00db6a
 The SAN is checked against the specified hostname. If no SAN is present
00db6a
@@ -487,6 +486,7 @@ in the server certificate, the usual check against the certificate DN
00db6a
 is used. If a SAN is present but doesn't match the specified hostname,
00db6a
 the session is immediately terminated. This setting may be preferred
00db6a
 when a mix of certs with and without SANs are in use.
00db6a
+This is the default setting.
00db6a
 .TP
00db6a
 .B demand | hard
00db6a
 These keywords are equivalent. The SAN is checked against the specified
00db6a
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
00db6a
index 0d91808ec..fa4c176fd 100644
00db6a
--- a/libraries/libldap/init.c
00db6a
+++ b/libraries/libldap/init.c
00db6a
@@ -625,7 +625,7 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl
00db6a
 	gopts->ldo_tls_connect_cb = NULL;
00db6a
 	gopts->ldo_tls_connect_arg = NULL;
00db6a
 	gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND;
00db6a
-	gopts->ldo_tls_require_san = LDAP_OPT_X_TLS_ALLOW;
00db6a
+	gopts->ldo_tls_require_san = LDAP_OPT_X_TLS_TRY;
00db6a
 #endif
00db6a
 	gopts->ldo_keepalive_probes = 0;
00db6a
 	gopts->ldo_keepalive_interval = 0;
00db6a
-- 
00db6a
2.31.1
00db6a