From: Ansgar Burchardt <ansgar@debian.org>
Date: Mon, 22 Jul 2013 21:01:23 +0000 (+0200)
Subject: daklib/dbconn.py: use global LDAP options for TLS
X-Git-Url: https://git.decadent.org.uk/gitweb/?p=dak.git;a=commitdiff_plain;h=b42e8ecb651be5d4aa588fcc57d0339b17c6c902

daklib/dbconn.py: use global LDAP options for TLS

Using connection-specific options made the code fail when calling
simple_bind_s() for some reason.
---

diff --git a/daklib/dbconn.py b/daklib/dbconn.py
index c6c8e5a1..31caa902 100644
--- a/daklib/dbconn.py
+++ b/daklib/dbconn.py
@@ -1255,12 +1255,15 @@ class Keyring(object):
         l = ldap.open(LDAPServer)
 
         if ca_cert_file:
+            # TODO: This should request a new context and use
+            # connection-specific options (i.e. "l.set_option(...)")
+
             # Request a new TLS context. If there was already one, libldap
             # would not change the TLS options (like which CAs to trust).
-            l.set_option(ldap.OPT_X_TLS_NEWCTX, True)
-            l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
-            l.set_option(ldap.OPT_X_TLS_CACERTDIR, None)
-            l.set_option(ldap.OPT_X_TLS_CACERTFILE, ca_cert_file)
+            #l.set_option(ldap.OPT_X_TLS_NEWCTX, True)
+            ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
+            #ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, None)
+            ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, ca_cert_file)
             l.start_tls_s()
 
         l.simple_bind_s("","")