Re: [Tcllib-devel] Support for LDAPS

[Pierre D. <pd...@gm...>]

On Tue, May 15, 2018 at 11:47:58AM +0200, Harald Oehlmann wrote:
>Am 15.05.2018 um 11:24 schrieb Pierre DAVID:
>> Hi everybody,
>>
>> could someone have a look on ticket
>> 60160205fe965d617482fd65dee13031fc16a1b7
>>    https://core.tcl.tk/tcllib/tktview?name=60160205fe
>>
>> I'm asking for comments before submitting a patch.
>>
>> Thanks,
>>
>> Pierre
>
>Pierre,
>
>thank you for the message. I think, this is o.k.
>
>Within the update of the autoproxy package, tls support was also
>touched. You may take this package for reference (tcllib folder http).
>
>- the handshake issue also arised there
>- twapi is supported as a 2nd possibility for a tls package
>
>Do you have write access to core.tcl.tk/tcllib ?
>If yes, best would be to prepare a branch.
>In the case of the upper package, Andreas cared about it and gave
>helpful hints.
>

The deeper I dig the problem, the more I'm lost.

LDAP, as well as many other modules, makes use of the TCL-TLS 
package.  Moreover, applications *must* take care of this package 
since their documentation explicitely mandate (see "TLS security 
considerations" in each manpage) the use of tls::init to configure 
TLS options such as root CA directory/file (while some other TLS 
options are simply given as ::ldap::* parameters, see ticket).

This is incompatible with the use of an alternate TLS package such 
the one you cite (twapi on Windows). Thus, for applications, there 
is yet another option, in order to configure the TLS package to 
use (see ::autoproxy::configure -tls_package), which is rather 
boring.

In my opinion, applications should not have to bother with TLS 
package at all: they should not have to configure WHICH package to 
use, neither use any low-level TLS configuration option such as 
::tls::init.  They should just specify which protocol or root CA 
location to use, and Tcllib modules should find the appropriate 
package.

In my opinion, the path Tcllib has taken so far to handle TLS is 
not the right one.

I started to implement a ::ldap::tls_options which just specify 
appropriate options, which are used by ::ldap::secure_connect as 
well as ::ldap::starttls. Same for ::ldapx::tls which is only a 
wrapper for the above ::ldap::tls_options. Doing so, LDAP (via a 
low-level internal Tcllib module) is free to use either TCL-TLS or 
TWAPI without asking the application to bother with guessing which 
TLS package is appropriate for the platform.

Any opinion on this?

Pierre