|
 |
dc8c34 |
From 7c4efde501b8af0469ff15602d8d046657dec4aa Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
dc8c34 |
Date: Tue, 10 May 2016 14:41:10 -0700
|
|
|
dc8c34 |
Subject: [PATCH 400/404] Ticket #48816 - (1.2.11 only) add a nsTLS1.0 on or
|
|
|
dc8c34 |
off new configuration parameter to cn=encryption,cn=config in RHEL 6
|
|
|
dc8c34 |
389-ds-base
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Description: 389-ds-base-1.2.11 has no way to disable TLS1.0. This patch is
|
|
|
dc8c34 |
adding config params nsTLS10, nsTLS11 and nsTLS12 to cn=encryption,cn=config
|
|
|
dc8c34 |
so that the definition of nsTLS1 remains intact if the new parameters are not
|
|
|
dc8c34 |
specified explicitely. If nsTLS10, nsTLS11 or nsTLS12 appear in the config
|
|
|
dc8c34 |
entry, nsTLS1 is ignored and the new parameters are added.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Default values:
|
|
|
dc8c34 |
nsTLS1: on
|
|
|
dc8c34 |
nsTLS10,nsTLS11,nsTLS12: ignored
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Examples:
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
[no SSL version settings]
|
|
|
dc8c34 |
==> sslVersionMin: TLS1.0
|
|
|
dc8c34 |
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
nsTLS1: on
|
|
|
dc8c34 |
==> sslVersionMin: TLS1.0
|
|
|
dc8c34 |
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
nsTLS1: on | off
|
|
|
dc8c34 |
nsTLS10: on
|
|
|
dc8c34 |
==> sslVersionMin: TLS1.0
|
|
|
dc8c34 |
==> Note: nsTLS1 is ignored.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
nsTLS11: on
|
|
|
dc8c34 |
==> sslVersionMin: TLS1.1
|
|
|
dc8c34 |
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
nsTLS12: on
|
|
|
dc8c34 |
==> sslVersionMin: TLS1.2
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Special cases:
|
|
|
dc8c34 |
If all SSL version config parameters are off, SSL fails to configure.
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
nsTLS10: off
|
|
|
dc8c34 |
nsTLS11: off
|
|
|
dc8c34 |
nsTLS12: off
|
|
|
dc8c34 |
nsTLS1: off
|
|
|
dc8c34 |
==> SSL configuration fails.
|
|
|
dc8c34 |
==> Note: nsSSL3 is off by default.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
cn=encryption,cn=config
|
|
|
dc8c34 |
nsTLS10: on
|
|
|
dc8c34 |
nsTLS12: off
|
|
|
dc8c34 |
==> sslVersionMin: TLS1.0
|
|
|
dc8c34 |
==> Note: nsTLS12 is ignored.
|
|
|
dc8c34 |
Even if off is set to the higher SSL version as in this example,
|
|
|
dc8c34 |
it is not used as sslVersionMax, but it is ignored.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/48816
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Thanks so much for the ideas, comments and discussions, William, Ludwig, and Mark!!
|
|
|
dc8c34 |
Final review was made by wibrown@redhat.com (Thank you, William!!)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
(cherry picked from commit 6111400a7b21785823e16b1071fc29bc21542213)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/schema/01core389.ldif | 5 +++-
|
|
|
dc8c34 |
ldap/servers/slapd/ssl.c | 71 +++++++++++++++++++++++++++++++++++++++-------
|
|
|
dc8c34 |
2 files changed, 65 insertions(+), 11 deletions(-)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif
|
|
|
dc8c34 |
index c962dc0..afa4ee6 100644
|
|
|
dc8c34 |
--- a/ldap/schema/01core389.ldif
|
|
|
dc8c34 |
+++ b/ldap/schema/01core389.ldif
|
|
|
dc8c34 |
@@ -119,6 +119,9 @@ attributeTypes: ( nsKeyfile-oid NAME 'nsKeyfile' DESC 'Netscape defined attribut
|
|
|
dc8c34 |
attributeTypes: ( nsSSL2-oid NAME 'nsSSL2' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
attributeTypes: ( nsSSL3-oid NAME 'nsSSL3' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
attributeTypes: ( nsTLS1-oid NAME 'nsTLS1' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
+attributeTypes: ( nsTLS10-oid NAME 'nsTLS10' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
+attributeTypes: ( nsTLS11-oid NAME 'nsTLS11' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
+attributeTypes: ( nsTLS12-oid NAME 'nsTLS12' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
attributeTypes: ( nsSSLClientAuth-oid NAME 'nsSSLClientAuth' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
attributeTypes: ( nsSSLSessionTimeout-oid NAME 'nsSSLSessionTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
attributeTypes: ( nsSSL3SessionTimeout-oid NAME 'nsSSL3SessionTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
@@ -172,5 +175,5 @@ objectClasses: ( 2.16.840.1.113730.3.2.103 NAME 'nsDS5ReplicationAgreement' DESC
|
|
|
dc8c34 |
objectClasses: ( 2.16.840.1.113730.3.2.39 NAME 'nsslapdConfig' DESC 'Netscape defined objectclass' SUP top MAY ( cn ) X-ORIGIN 'Netscape Directory Server' )
|
|
|
dc8c34 |
objectClasses: ( 2.16.840.1.113730.3.2.317 NAME 'nsSaslMapping' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsSaslMapRegexString $ nsSaslMapBaseDNTemplate $ nsSaslMapFilterTemplate ) X-ORIGIN 'Netscape Directory Server' )
|
|
|
dc8c34 |
objectClasses: ( 2.16.840.1.113730.3.2.43 NAME 'nsSNMP' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsSNMPEnabled ) MAY ( nsSNMPOrganization $ nsSNMPLocation $ nsSNMPContact $ nsSNMPDescription $ nsSNMPName $ nsSNMPMasterHost $ nsSNMPMasterPort ) X-ORIGIN 'Netscape Directory Server' )
|
|
|
dc8c34 |
-objectClasses: ( nsEncryptionConfig-oid NAME 'nsEncryptionConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsCertfile $ nsKeyfile $ nsSSL2 $ nsSSL3 $ nsTLS1 $ nsSSLSessionTimeout $ nsSSL3SessionTimeout $ nsSSLClientAuth $ nsSSL2Ciphers $ nsSSL3Ciphers $ nsSSLSupportedCiphers $ allowWeakDHParam ) X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
+objectClasses: ( nsEncryptionConfig-oid NAME 'nsEncryptionConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsCertfile $ nsKeyfile $ nsSSL2 $ nsSSL3 $ nsTLS1 $ nsTLS10 $ nsTLS11 $ nsTLS12 $ nsSSLSessionTimeout $ nsSSL3SessionTimeout $ nsSSLClientAuth $ nsSSL2Ciphers $ nsSSL3Ciphers $ nsSSLSupportedCiphers $ allowWeakDHParam ) X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
objectClasses: ( nsEncryptionModule-oid NAME 'nsEncryptionModule' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsSSLToken $ nsSSLPersonalityssl $ nsSSLActivation ) X-ORIGIN 'Netscape' )
|
|
|
dc8c34 |
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
|
|
|
dc8c34 |
index 090c328..37a176f 100644
|
|
|
dc8c34 |
--- a/ldap/servers/slapd/ssl.c
|
|
|
dc8c34 |
+++ b/ldap/servers/slapd/ssl.c
|
|
|
dc8c34 |
@@ -1058,6 +1058,9 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
|
|
|
dc8c34 |
Slapi_Entry *e = NULL;
|
|
|
dc8c34 |
PRBool enableSSL2 = PR_FALSE;
|
|
|
dc8c34 |
PRBool enableSSL3 = PR_FALSE;
|
|
|
dc8c34 |
+ int enableTLS10 = -1;
|
|
|
dc8c34 |
+ int enableTLS11 = -1;
|
|
|
dc8c34 |
+ int enableTLS12 = -1;
|
|
|
dc8c34 |
PRBool enableTLS1 = PR_TRUE;
|
|
|
dc8c34 |
PRBool fipsMode = PR_FALSE;
|
|
|
dc8c34 |
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
|
|
|
dc8c34 |
@@ -1414,6 +1417,39 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
slapi_ch_free_string( &val );
|
|
|
dc8c34 |
+ val = slapi_entry_attr_get_charptr( e, "nsTLS10" );
|
|
|
dc8c34 |
+ if ( val ) {
|
|
|
dc8c34 |
+ if ( !strcasecmp( val, "off" ) ) {
|
|
|
dc8c34 |
+ enableTLS10 = 0;
|
|
|
dc8c34 |
+ } else if ( !strcasecmp( val, "on" ) ) {
|
|
|
dc8c34 |
+ enableTLS10 = 1;
|
|
|
dc8c34 |
+ } else {
|
|
|
dc8c34 |
+ enableTLS10 = slapi_entry_attr_get_bool(e, "nsTLS10")?1:0;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ slapi_ch_free_string( &val );
|
|
|
dc8c34 |
+ val = slapi_entry_attr_get_charptr( e, "nsTLS11" );
|
|
|
dc8c34 |
+ if ( val ) {
|
|
|
dc8c34 |
+ if ( !strcasecmp( val, "off" ) ) {
|
|
|
dc8c34 |
+ enableTLS11 = 0;
|
|
|
dc8c34 |
+ } else if ( !strcasecmp( val, "on" ) ) {
|
|
|
dc8c34 |
+ enableTLS11 = 1;
|
|
|
dc8c34 |
+ } else {
|
|
|
dc8c34 |
+ enableTLS11 = slapi_entry_attr_get_bool(e, "nsTLS11")?1:0;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ slapi_ch_free_string( &val );
|
|
|
dc8c34 |
+ val = slapi_entry_attr_get_charptr( e, "nsTLS12" );
|
|
|
dc8c34 |
+ if ( val ) {
|
|
|
dc8c34 |
+ if ( !strcasecmp( val, "off" ) ) {
|
|
|
dc8c34 |
+ enableTLS12 = 0;
|
|
|
dc8c34 |
+ } else if ( !strcasecmp( val, "on" ) ) {
|
|
|
dc8c34 |
+ enableTLS12 = 1;
|
|
|
dc8c34 |
+ } else {
|
|
|
dc8c34 |
+ enableTLS12 = slapi_entry_attr_get_bool(e, "nsTLS12")?1:0;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ slapi_ch_free_string( &val );
|
|
|
dc8c34 |
val = slapi_entry_attr_get_charptr( e, "nsTLS1" );
|
|
|
dc8c34 |
if ( val ) {
|
|
|
dc8c34 |
if ( !strcasecmp( val, "off" ) ) {
|
|
|
dc8c34 |
@@ -1430,25 +1466,40 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
|
|
|
dc8c34 |
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
|
|
|
dc8c34 |
if (NSSVersionMin > 0) {
|
|
|
dc8c34 |
char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
|
|
|
dc8c34 |
+ NSSVersionMax = enabledNSSVersions.max;
|
|
|
dc8c34 |
/* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
|
|
|
dc8c34 |
- if (enableTLS1) {
|
|
|
dc8c34 |
+ if ((enableTLS10 >= 0) || (enableTLS11 >= 0) || (enableTLS12 >= 0)) {
|
|
|
dc8c34 |
+ if (enableTLS10 > 0) {
|
|
|
dc8c34 |
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
|
|
|
dc8c34 |
+ } else if (enableTLS11 > 0) {
|
|
|
dc8c34 |
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_1;
|
|
|
dc8c34 |
+ } else if (enableTLS12 > 0) {
|
|
|
dc8c34 |
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_2;
|
|
|
dc8c34 |
+ } else if (enableTLS1) {
|
|
|
dc8c34 |
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
|
|
|
dc8c34 |
+ } else if (enableSSL3) {
|
|
|
dc8c34 |
+ NSSVersionMin = SSL_LIBRARY_VERSION_3_0;
|
|
|
dc8c34 |
+ NSSVersionMax = SSL_LIBRARY_VERSION_3_0;
|
|
|
dc8c34 |
+ } else {
|
|
|
dc8c34 |
+ slapd_SSL_error("SSL Initialization 2: all SSL version parameters are off. "
|
|
|
dc8c34 |
+ "Enable nsTLS1 or nsTLS10, nsTLS11, nsTLS12.");
|
|
|
dc8c34 |
+ return 0;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ } else if (enableTLS1) {
|
|
|
dc8c34 |
NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
|
|
|
dc8c34 |
- } else {
|
|
|
dc8c34 |
+ } else if (enableSSL3) {
|
|
|
dc8c34 |
NSSVersionMin = SSL_LIBRARY_VERSION_3_0;
|
|
|
dc8c34 |
NSSVersionMax = SSL_LIBRARY_VERSION_3_0;
|
|
|
dc8c34 |
- }
|
|
|
dc8c34 |
- if (enableSSL3) {
|
|
|
dc8c34 |
- NSSVersionMin = SSL_LIBRARY_VERSION_3_0;
|
|
|
dc8c34 |
- } else if (!enableTLS1) {
|
|
|
dc8c34 |
- slapd_SSL_error("SSL Initialization 2: Both nsSSL3 and nsTLS1 are off. Enabling nsTLS1.");
|
|
|
dc8c34 |
- NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
|
|
|
dc8c34 |
- NSSVersionMax = enabledNSSVersions.max;
|
|
|
dc8c34 |
+ } else {
|
|
|
dc8c34 |
+ slapd_SSL_error("SSL Initialization 2: all SSL version parameters are off. "
|
|
|
dc8c34 |
+ "Enable nsTLS1 or nsTLS10, nsTLS11, nsTLS12.");
|
|
|
dc8c34 |
+ return 0;
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
slapdNSSVersions.min = NSSVersionMin;
|
|
|
dc8c34 |
slapdNSSVersions.max = NSSVersionMax;
|
|
|
dc8c34 |
(void) slapi_getSSLVersion_str(slapdNSSVersions.min, mymin, sizeof(mymin));
|
|
|
dc8c34 |
(void) slapi_getSSLVersion_str(slapdNSSVersions.max, mymax, sizeof(mymax));
|
|
|
dc8c34 |
- slapi_log_error(SLAPI_LOG_CONFIG, "SSL Initialization",
|
|
|
dc8c34 |
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
|
|
|
dc8c34 |
"Configured SSL version range: min: %s, max: %s\n",
|
|
|
dc8c34 |
mymin, mymax);
|
|
|
dc8c34 |
sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
2.4.11
|
|
|
dc8c34 |
|