ensure TLS string options are properly inherited (regression)

[remicollet]

See #18529 regression in 8.3.21 and 8.4.7

This also fix the tests issue

• ldaps_basic.phpt was failing (XFAIL) because of ldap.conf (TLS_CACERT) set in setup-slapd.sh
• ldap_start_tls_basic.phpt was passing because global options not properly inherited

Using LDAPNOINIT=1 ensure ldap.conf is not used, so the local cert cannot be verified.

[bukka]

I think this is an improvement. I don't have time to properly verify but based on what was described, it makes sense to me.

Would be probably good to wait @rainerjung to confirm that it fixes issue for him too.

[rainerjung]

Wow, thanks for taking the hard way. I will rebuild 8.4.7 with this PR on top and run the tests plus our local tests that showed the original problem. I should be able to report back tomorrow.

[rainerjung]

The patch has a minor bug, which makes it disfunctional. Instead of

ldap_set_option(ld, opts[i], &path);

it has to be

ldap_set_option(ld, opts[i], path);

Then my simple tests are successful.

[remicollet]

@rainerjung Thanks

PR updated (and squashed)

[remicollet]

Merged in 8.3+ as 2760a3e + 8da9530

[remicollet]

Notice: test coverage is not good, as we can't easily verify this case

I start PR #18561 which add tests for this case, but in master only, as it requires for "skipif" to be able to check some global option, which is not allowed by ldap_get_option for now)

[bukka]

@remicollet Was there any reason why you omitted min and max TLS versions? I created #18676 as it seems like an omission to me but maybe I'm missing some logic.

[remicollet]

Le 27/05/2025 à 19:11, Jakub Zelenka a écrit :

*bukka* left a comment (php/php-src#18547) <https://github.com/php/php- src/pull/18547#issuecomment-2913334888> @remicollet <https://github.com/remicollet> Was there any reason why you omitted min and max TLS versions? I created #18676 <https://github.com/ php/php-src#18676> as it seems like an omission to me but maybe I'm missing some logic.

Indeed I miss the "int" options Don't know why I was thinking only "string" options were lost while all tls options are.