LDAP: Check for errors of TLS initialisation

Report and patch from Dmitry Banschikov.

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 3a75ce0d62f8d1cbb5216f5ac70cedf397c4770d..b41783d7183192cb5a46c1235872d2f9193df36e 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -65,6 +65,10 @@ TK/01 Bugzilla 1239 - fix DKIM verification when signature was not inserted
 JH/01 Bugzilla 660 - Multi-valued attributes from ldap now parseable as a
       comma-sep list; embedded commas doubled.
 
+PP/15 LDAP: Check for errors of TLS initialisation, to give correct
+      diagnostics.
+      Report and patch from Dmitry Banschikov.
+
 
 Exim version 4.77
 -----------------

diff --git a/src/src/lookups/ldap.c b/src/src/lookups/ldap.c
index 698928a6a852e9a16aa8aa0e6817d34419956dc7..5c1ea0b569f22fd9630a08490c11ee777c18ae93 100644 (file)
--- a/src/src/lookups/ldap.c
+++ b/src/src/lookups/ldap.c
@@ -523,7 +523,12 @@ if (!lcp->bound ||
   /* The Oracle LDAP libraries (LDAP_LIB_TYPE=SOLARIS) don't support this: */
   if (eldap_start_tls)
     {
-    ldap_start_tls_s(lcp->ld, NULL, NULL);
+        if ( (rc = ldap_start_tls_s(lcp->ld, NULL, NULL)) != LDAP_SUCCESS) {
+            *errmsg = string_sprintf("failed to initiate TLS processing on an "
+                "LDAP session to server %s%s - ldap_start_tls_s() returned %d:"
+                " %s", host, porttext, rc, ldap_err2string(rc));
+            goto RETURN_ERROR;
+        }
     }
 #endif
   if ((msgid = ldap_bind(lcp->ld, CS user, CS password, LDAP_AUTH_SIMPLE))