[Help-gnutls] Re: OpenLDAP related flaw in GnuTLS

[Simon Josefsson]

I'm adding the address@hidden list to the discussion.

Bejoy Abraham Mathews <address@hidden> writes:

> This is the output from "slapd -d -1"
>
> tls_read: want=5, got=0
>
> TLS: can't accept: A TLS packet with unexpected length was received..
> connection_read(13): TLS accept failure error=-1 id=1, closing
> connection_closing: readying conn=1 sd=13 for close
> connection_close: conn=1 sd=13
> daemon: removing 13
> conn=1 fd=13 closed (TLS negotiation failure)

Is there any way to enable GnuTLS debugging in OpenLDAP?  We need more
information to debug this.

What client is connecting to your slapd server above?  Are you sure the
client is configured properly?  What error messages does the client print?

/Simon

>
>
>
>
>
> ________________________________
> From: Bejoy Abraham Mathews <address@hidden>
> To: Simon Josefsson <address@hidden>
> Sent: Wednesday, 12 November, 2008 8:02:10 PM
> Subject: Re: OpenLDAP related flaw in GnuTLS
>
>
> I don't find any errors in compilation of OpenLDAP using --with-tls=gnutls. 
> But I don't know to read the StartTLS option. It is not reading the 
> certificates. Showing TLS handshake error :(
>
>
>
>
> ________________________________
> From: Bejoy Abraham Mathews <address@hidden>
> To: Simon Josefsson <address@hidden>
> Sent: Wednesday, 12 November, 2008 6:12:01 PM
> Subject: Re: OpenLDAP related flaw in GnuTLS
>
>
> Thanks for the advice Simon. I tried sending to it straight in the beginning 
> - but that mail got rejected. Anyway, when I do get a solution - I will send 
> one straight CCg you.
>
> With Regards
> Bejoy
>
>
>
>
> ________________________________
> From: Simon Josefsson <address@hidden>
> To: Bejoy Abraham Mathews <address@hidden>
> Sent: Wednesday, 12 November, 2008 5:01:14 PM
> Subject: Re: OpenLDAP related flaw in GnuTLS
>
> Bejoy Abraham Mathews <address@hidden> writes:
>
>> thanks Simon. You can close this thread. I'll add to this thread as a
>> solution when I get gnutls properly running with certificates.
>
> Others may have similar questions as you had, so posting what you find
> to the list can be useful.
>
>> I'm not member of address@hidden yet.
>
> It is moderated, so you can send to it even if you are not a member.
>
> /Simon
>
> ________________________________
>  Add more friends to your messenger and enjoy! Invite them now.
> ________________________________
>  Add more friends to your messenger and enjoy! Invite them now.
>
>
>       Bring your gang together. Do your thing. Find your favourite Yahoo! 
> group at http://in.promos.yahoo.com/groups/