You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@apr.apache.org by "Paul J. Reder" <re...@remulak.net> on 2007/07/19 01:20:26 UTC
[Patch]: Update build config files to recognize IBM's Tivoli Directory
Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Since I don't seem to have karma to commit to APR/APR-util trunks, I'm
attaching a patch that adds the ability to identify the existence of IBM's
Tivoli Directory Server LDAP client SDK. APR will then be able to look
for APR_HAS_TIVOLI_LDAPSDK to determine if that SDK is present.
--
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it. Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein
Re: [Patch]: Update build config files to recognize IBM's Tivoli Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by Eric Covener <co...@gmail.com>.
On 7/25/07, Graham Leggett <mi...@sharp.fm> wrote:
> Does the Tivoli SSL API have any docs anywhere? I don't have access to a
> Tivola server, but I can pick through some of the code that abstracts
> out the SSL stuff and come up with a patch for you to test, it can be a
> bit mind bending.
The only part that appears irreconcilable with the existing apr-util
ldap SSL API is client certificate selection. The SDK takes one big
keyring file with multiple CAs and private certs as an argument to the
one-time
http://www.mail-archive.com/dev@apr.apache.org/msg17772.html
http://issues.apache.org/bugzilla/show_bug.cgi?id=41351
--
Eric Covener
covener@gmail.com
Re: [Patch]: Update build config files to recognize IBM's Tivoli Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by Jeff Trawick <tr...@gmail.com>.
On 7/26/07, Paul J. Reder <re...@remulak.net> wrote:
> ... So I wanted to get the basics of recognizing
> the libs in to the build first, *then* the fun could begin.
+1; haven't had a chance to try your second patch though
Re: [Patch]: Update build config files to recognize IBM's Tivoli
Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by "Paul J. Reder" <re...@remulak.net>.
Graham Leggett wrote:
> Paul J. Reder wrote:
>
>> I didn't mean to imply I didn't have working SSL code, just that it is
>> likely to cause some debate.
(i.e. I *do* have working code currently - just not submitted yet)
>> So I wanted to get the basics of recognizing
>> the libs in to the build first, *then* the fun could begin.
>>
>> There are differences in the way the init has to happen and the way certs
>> are loaded/accessed.
>
> I managed to survive the joy of getting openldap, netscape/mozilla,
> novell and a few others bent into the common API, and they all had
> completely different ways of doing SSL.
>
> If you can point me at some documentation, I can take a look and see
> just how easy / hard it might be to support. The optimist in me has this
> theory that it's easier than we might think :)
>
> Regards,
> Graham
> --
My reason for not submitting the code is that it is likely to cause some debate,
not that it wasn't done. I didn't want the debate about how to do init
and handle certs to cloud getting the basics in.
The other complication is that the IBM Tivoli LDAP libs use IBM's GSKit SSL libs
rather than openSSL. That's not a problem, just another twist that encouraged me
to get the basics in first and build from there.
--
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it. Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein
Re: [Patch]: Update build config files to recognize IBM's Tivoli
Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by Graham Leggett <mi...@sharp.fm>.
Paul J. Reder wrote:
> I didn't mean to imply I didn't have working SSL code, just that it is
> likely to cause some debate. So I wanted to get the basics of recognizing
> the libs in to the build first, *then* the fun could begin.
>
> There are differences in the way the init has to happen and the way certs
> are loaded/accessed.
I managed to survive the joy of getting openldap, netscape/mozilla,
novell and a few others bent into the common API, and they all had
completely different ways of doing SSL.
If you can point me at some documentation, I can take a look and see
just how easy / hard it might be to support. The optimist in me has this
theory that it's easier than we might think :)
Regards,
Graham
--
Re: [Patch]: Update build config files to recognize IBM's Tivoli
Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by "Paul J. Reder" <re...@remulak.net>.
I didn't mean to imply I didn't have working SSL code, just that it is
likely to cause some debate. So I wanted to get the basics of recognizing
the libs in to the build first, *then* the fun could begin.
There are differences in the way the init has to happen and the way certs
are loaded/accessed.
Graham Leggett wrote:
> Paul J. Reder wrote:
>
>> I'll update the patch to include disabling the APR_HAS_LDAP_SSL flag
>> for the
>> time being and re-submit. IBM Tivoli LDAP does provide SSL support,
>> but I'm not
>> submitting the code to enable that right now. All of the LDAP SSL support
>> is unique and IBM Tivoli LDAP is no different in that sense. :)
>
> Does the Tivoli SSL API have any docs anywhere? I don't have access to a
> Tivola server, but I can pick through some of the code that abstracts
> out the SSL stuff and come up with a patch for you to test, it can be a
> bit mind bending.
>
> Regards,
> Graham
> --
--
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it. Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein
Re: [Patch]: Update build config files to recognize IBM's Tivoli
Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by Graham Leggett <mi...@sharp.fm>.
Paul J. Reder wrote:
> I'll update the patch to include disabling the APR_HAS_LDAP_SSL flag for
> the
> time being and re-submit. IBM Tivoli LDAP does provide SSL support, but
> I'm not
> submitting the code to enable that right now. All of the LDAP SSL support
> is unique and IBM Tivoli LDAP is no different in that sense. :)
Does the Tivoli SSL API have any docs anywhere? I don't have access to a
Tivola server, but I can pick through some of the code that abstracts
out the SSL stuff and come up with a patch for you to test, it can be a
bit mind bending.
Regards,
Graham
--
Re: [Patch]: Update build config files to recognize IBM's Tivoli
Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by "Paul J. Reder" <re...@remulak.net>.
I'll update the patch to include disabling the APR_HAS_LDAP_SSL flag for the
time being and re-submit. IBM Tivoli LDAP does provide SSL support, but I'm not
submitting the code to enable that right now. All of the LDAP SSL support
is unique and IBM Tivoli LDAP is no different in that sense. :)
Jeff Trawick wrote:
> On 7/18/07, Paul J. Reder <re...@remulak.net> wrote:
>> Since I don't seem to have karma to commit to APR/APR-util trunks, I'm
>> attaching a patch that adds the ability to identify the existence of
>> IBM's
>> Tivoli Directory Server LDAP client SDK. APR will then be able to look
>> for APR_HAS_TIVOLI_LDAPSDK to determine if that SDK is present.
>
> It seems that APR_HAS_LDAP_SSL gets defined but some of the guts are
> missing? In option_set_tls() there is a lack of code.
> option_set_cert() may have the same issue.
>
> If no guts, then no APR_HAS_LDAP_SSL glory.
>
--
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it. Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein
Re: [Patch]: Update build config files to recognize IBM's Tivoli Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by Jeff Trawick <tr...@gmail.com>.
On 7/25/07, Paul J. Reder <re...@remulak.net> wrote:
> Attached is an update that (for the time being) disables APR_HAS_LDAP_SSL
> if APR_HAS_TIVOLI_LDAPSDK is set. Later, when the rest of the SSL code gets
> added to the IBM Tivoli portions of the ldap modules, the disable code can
> be removed.
committed to trunk
Re: [Patch]: Update build config files to recognize IBM's Tivoli
Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by "Paul J. Reder" <re...@remulak.net>.
Attached is an update that (for the time being) disables APR_HAS_LDAP_SSL
if APR_HAS_TIVOLI_LDAPSDK is set. Later, when the rest of the SSL code gets
added to the IBM Tivoli portions of the ldap modules, the disable code can
be removed.
Jeff Trawick wrote:
> On 7/18/07, Paul J. Reder <re...@remulak.net> wrote:
>> Since I don't seem to have karma to commit to APR/APR-util trunks, I'm
>> attaching a patch that adds the ability to identify the existence of
>> IBM's
>> Tivoli Directory Server LDAP client SDK. APR will then be able to look
>> for APR_HAS_TIVOLI_LDAPSDK to determine if that SDK is present.
>
> It seems that APR_HAS_LDAP_SSL gets defined but some of the guts are
> missing? In option_set_tls() there is a lack of code.
> option_set_cert() may have the same issue.
>
> If no guts, then no APR_HAS_LDAP_SSL glory.
>
--
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it. Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein
Re: [Patch]: Update build config files to recognize IBM's Tivoli Directory Server LDAP client SDK (APR_HAS_TIVOLI_LDAPSDK).
Posted by Jeff Trawick <tr...@gmail.com>.
On 7/18/07, Paul J. Reder <re...@remulak.net> wrote:
> Since I don't seem to have karma to commit to APR/APR-util trunks, I'm
> attaching a patch that adds the ability to identify the existence of IBM's
> Tivoli Directory Server LDAP client SDK. APR will then be able to look
> for APR_HAS_TIVOLI_LDAPSDK to determine if that SDK is present.
It seems that APR_HAS_LDAP_SSL gets defined but some of the guts are
missing? In option_set_tls() there is a lack of code.
option_set_cert() may have the same issue.
If no guts, then no APR_HAS_LDAP_SSL glory.