/usr/share/perl5/Net/SSLGlue/LDAP.pm is in libnet-sslglue-perl 1.057-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 | use strict;
use warnings;
package Net::SSLGlue::LDAP;
our $VERSION = '1.01';
use Net::LDAP;
use IO::Socket::SSL 1.19;
# can be reset with local
our %SSLopts;
# add SSL_verifycn_scheme to the SSL CTX args returned by
# Net::LDAP::_SSL_context_init_args
my $old = defined &Net::LDAP::_SSL_context_init_args
&& \&Net::LDAP::_SSL_context_init_args
|| die "cannot find Net::LDAP::_SSL_context_init_args";
no warnings 'redefine';
*Net::LDAP::_SSL_context_init_args = sub {
my %arg = $old->(@_);
$arg{SSL_verifycn_scheme} ||= 'ldap' if $arg{SSL_verify_mode};
while ( my ($k,$v) = each %SSLopts ) {
$arg{$k} = $v;
}
return %arg;
};
1;
=head1 NAME
Net::SSLGlue::LDAP - proper certificate checking for ldaps in Net::LDAP
=head1 SYNOPSIS
use Net::SSLGlue::LDAP;
local %Net::SSLGlue::LDAP = ( SSL_verifycn_name => $hostname_in_cert );
my $ldap = Net::LDAP->new( $hostname, capath => ... );
$ldap->start_tls;
=head1 DESCRIPTION
L<Net::SSLGlue::LDAP> modifies L<Net::LDAP> so that it does proper certificate
checking using the C<ldap> SSL_verify_scheme from L<IO::Socket::SSL>.
Because L<Net::LDAP> does not have a mechanism to forward arbitrary parameters for
the construction of the underlying socket these parameters can be set globally
when including the package, or with local settings of the
C<%Net::SSLGlue::LDAP::SSLopts> variable.
All of the C<SSL_*> parameters from L<IO::Socket::SSL> can be used; the
following parameter is especially useful:
=over 4
=item SSL_verifycn_name
Usually the name given as the hostname in the constructor is used to verify the
identity of the certificate. If you want to check the certificate against
another name you can specify it with this parameter.
=back
C<SSL_ca_path>, C<SSL_ca_file> for L<IO::Socket::SSL> can be set with the
C<capath> and C<cafile> parameters of L<Net::LDAP::new> and C<SSL_verify_mode>
can be set with C<verify>, but the meaning of the values differs (C<none> is 0,
e.g. disable certificate verification).
=head1 SEE ALSO
IO::Socket::SSL, LWP, Net::LDAP
=head1 COPYRIGHT
This module is copyright (c) 2008, Steffen Ullrich.
All Rights Reserved.
This module is free software. It may be used, redistributed and/or modified
under the same terms as Perl itself.
|