From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Thu, 2 Jul 2026 15:00:03 +0000 (+0000)
Subject: lib-ldap: Improve request timeout error when connection setup fails
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e211c1b4e4b00adf0361b83ab717cfff0d64dcc1;p=thirdparty%2Fdovecot%2Fcore.git

lib-ldap: Improve request timeout error when connection setup fails

When an LDAP request times out while the connection has not yet reached a
usable (bound) state, it timed out while still connecting rather than while
waiting for a server reply. Report that, and when TLS is in use also point at
the certificate.

This matters for OpenLDAP built against GnuTLS: that backend does not report a
handshake or certificate verification failure back to lib-ldap at all, so such
a failure previously surfaced only as a generic "Aborting LDAP request after
timeout".
---

diff --git a/src/lib-ldap/ldap-connection.c b/src/lib-ldap/ldap-connection.c
index 135cadb776..a221f5c8f6 100644
--- a/src/lib-ldap/ldap-connection.c
+++ b/src/lib-ldap/ldap-connection.c
@@ -362,7 +362,26 @@ void ldap_connection_abort_request(struct ldap_op_queue_entry *req)
 
 	i_zero(&res);
 	res.openldap_ret = LDAP_TIMEOUT;
-	res.error_string = "Aborting LDAP request after timeout";
+	/* If the connection never reached a usable (bound) state, the request
+	   timed out while still connecting rather than while waiting for a
+	   server reply. Point at that, and if TLS is in use mention the
+	   certificate: some libldap TLS backends (e.g. GnuTLS) do not report a
+	   handshake or certificate verification failure back to us at all, so
+	   such a failure only ever surfaces as this timeout. */
+	if (conn->state == LDAP_STATE_CONNECT)
+		res.error_string = "Aborting LDAP request after timeout";
+	else if (conn->set->starttls ||
+		 strstr(conn->set->uris, "ldaps://") != NULL) {
+		res.error_string = t_strdup_printf(
+			"Aborting LDAP request: timeout while connecting (uris=%s) - "
+			"check that the LDAP server is reachable and its TLS certificate is trusted",
+			conn->set->uris);
+	} else {
+		res.error_string = t_strdup_printf(
+			"Aborting LDAP request: timeout while connecting (uris=%s) - "
+			"check that the LDAP server is reachable",
+			conn->set->uris);
+	}
 	if (req->result_callback != NULL)
 		req->result_callback(&res, req->result_callback_ctx);