blob: 32f00d4f0d79c8cb379df7d5164de9e5045f6b79 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
Description: Run STARTTLS *before* sending auth data
Avoid sending authentication data in clear if STARTTLS is available.
Author: Andre Pawlowski <sqall@h4des.org>
Bug: http://code.google.com/p/openvpn-auth-ldap/issues/detail?id=28
Bug-Debian: http://bugs.debian.org/610339
Forwarded: http://code.google.com/p/openvpn-auth-ldap/issues/detail?id=28
Reviewed-By: Alberto Gonzalez Iniesta <agi@inittab.org>
Last-Update: 2012-02-20
Index: openvpn-auth-ldap/src/auth-ldap.m
===================================================================
--- openvpn-auth-ldap.orig/src/auth-ldap.m 2014-07-25 12:48:50.067688930 +0200
+++ openvpn-auth-ldap/src/auth-ldap.m 2014-07-25 12:48:50.063688930 +0200
@@ -307,21 +307,13 @@
goto error;
}
- /* Bind if requested */
- if ([config bindDN]) {
- if (![ldap bindWithDN: [config bindDN] password: [config bindPassword]]) {
- [TRLog error: "Unable to bind as %s", [[config bindDN] cString]];
- goto error;
- }
- }
-
/* Certificate file */
- if ((value = [config tlsCACertFile]))
+ if ((value = [config tlsCACertFile]))
if (![ldap setTLSCACertFile: value])
goto error;
/* Certificate directory */
- if ((value = [config tlsCACertDir]))
+ if ((value = [config tlsCACertDir]))
if (![ldap setTLSCACertDir: value])
goto error;
@@ -340,6 +332,14 @@
if (![ldap startTLS])
goto error;
+ /* Bind if requested */
+ if ([config bindDN]) {
+ if (![ldap bindWithDN: [config bindDN] password: [config bindPassword]]) {
+ [TRLog error: "Unable to bind as %s", [[config bindDN] cString]];
+ goto error;
+ }
+ }
+
return ldap;
error:
|