[jan] Try starting TLS without querying the rootDSE (Bug #12157).

horde · Oct 17, 2013 · e5bba30 · e5bba30
1 parent 9a87baa
commit e5bba30
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 9 deletions.
diff --git a/framework/Ldap/lib/Horde/Ldap.php b/framework/Ldap/lib/Horde/Ldap.php
@@ -491,29 +491,36 @@ public function disconnect()
      */
     public function startTLS()
     {
-        /* Test to see if the server supports TLS first.
+        /* First try STARTTLS blindly, some servers don't even allow to receive
+         * the rootDSE without TLS. */
+        if (@ldap_start_tls($this->_link)) {
+            return;
+        }
+
+        /* Keep original error. */
+        $error = 'TLS not started: ' . @ldap_error($this->_link);
+        $errno = @ldap_errno($this->_link);
+
+        /* Test to see if the server supports TLS at all.
          * This is done via testing the extensions offered by the server.
          * The OID 1.3.6.1.4.1.1466.20037 tells whether TLS is supported. */
         try {
             $rootDSE = $this->rootDSE();
         } catch (Exception $e) {
-            throw new Horde_Ldap_Exception('Unable to fetch rootDSE entry to see if TLS is supported: ' . $e->getMessage(), $e->getCode());
+            throw new Horde_Ldap_Exception('Unable to start TLS and unable to fetch rootDSE entry to see if TLS is supported: ' . $e->getMessage(), $e->getCode());
         }
 
         try {
             $supported_extensions = $rootDSE->getValue('supportedExtension');
         } catch (Exception $e) {
-            throw new Horde_Ldap_Exception('Unable to fetch rootDSE attribute "supportedExtension" to see if TLS is supoported: ' . $e->getMessage(), $e->getCode());
+            throw new Horde_Ldap_Exception('Unable to start TLS and unable to fetch rootDSE attribute "supportedExtension" to see if TLS is supoported: ' . $e->getMessage(), $e->getCode());
         }
 
         if (!in_array('1.3.6.1.4.1.1466.20037', $supported_extensions)) {
             throw new Horde_Ldap_Exception('Server reports that it does not support TLS');
         }
 
-        if (!@ldap_start_tls($this->_link)) {
-            throw new Horde_Ldap_Exception('TLS not started: ' . @ldap_error($this->_link),
-                                           @ldap_errno($this->_link));
-        }
+        throw new Horde_Ldap_Exception($error, $errno);
     }
 
     /**

diff --git a/framework/Ldap/package.xml b/framework/Ldap/package.xml
@@ -29,7 +29,7 @@
  </stability>
  <license uri="http://opensource.org/licenses/lgpl-3.0.html">LGPL-3.0</license>
  <notes>
-* 
+* [jan] Try starting TLS without querying the rootDSE (Bug #12157).
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
@@ -389,7 +389,7 @@
    <date>2013-01-29</date>
    <license uri="http://opensource.org/licenses/lgpl-3.0.html">LGPL-3.0</license>
    <notes>
-* 
+* [jan] Try starting TLS without querying the rootDSE (Bug #12157).
    </notes>
   </release>
  </changelog>