From 389b2c825742392365262a719be7c8f594e7e522 Mon Sep 17 00:00:00 2001

From: William Brown <william@blackhats.net.au>

Date: Thu, 26 Nov 2020 09:08:13 +1000

Subject: [PATCH] Issue 4460 - BUG  - lib389 should use system tls policy

Bug Description: Due to some changes in dsrc for tlsreqcert

and how def open was structured in lib389, the system ldap.conf

policy was ignored.

Fix Description: Default to using the system ldap.conf policy

if undefined in lib389 or the tls_reqcert param in dsrc.

fixes: #4460

Author: William Brown <william@blackhats.net.au>

Review by: ???

---

 src/lib389/lib389/__init__.py      | 11 +++++++----

 src/lib389/lib389/cli_base/dsrc.py | 16 +++++++++-------

 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/src/lib389/lib389/__init__.py b/src/lib389/lib389/__init__.py

index 99ea9cc6a..4e6a1905a 100644

--- a/src/lib389/lib389/__init__.py

+++ b/src/lib389/lib389/__init__.py

@@ -962,7 +962,7 @@ class DirSrv(SimpleLDAPObject, object):

         # Now, we are still an allocated ds object so we can be re-installed

         self.state = DIRSRV_STATE_ALLOCATED

-    def open(self, uri=None, saslmethod=None, sasltoken=None, certdir=None, starttls=False, connOnly=False, reqcert=ldap.OPT_X_TLS_HARD,

+    def open(self, uri=None, saslmethod=None, sasltoken=None, certdir=None, starttls=False, connOnly=False, reqcert=None,

                 usercert=None, userkey=None):

         '''

             It opens a ldap bound connection to dirsrv so that online

@@ -1025,9 +1025,12 @@ class DirSrv(SimpleLDAPObject, object):

             try:

                 # Note this sets LDAP.OPT not SELF. Because once self has opened

                 # it can NOT change opts on reused (ie restart)

-                self.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, reqcert)

-                self.log.debug("Using certificate policy %s", reqcert)

-                self.log.debug("ldap.OPT_X_TLS_REQUIRE_CERT = %s", reqcert)

+                if reqcert is not None:

+                    self.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, reqcert)

+                    self.log.debug("Using lib389 certificate policy %s", reqcert)

+                else:

+                    self.log.debug("Using /etc/openldap/ldap.conf certificate policy")

+                self.log.debug("ldap.OPT_X_TLS_REQUIRE_CERT = %s", self.get_option(ldap.OPT_X_TLS_REQUIRE_CERT))

             except ldap.LDAPError as e:

                 self.log.fatal('TLS negotiation failed: %s', e)

                 raise e

diff --git a/src/lib389/lib389/cli_base/dsrc.py b/src/lib389/lib389/cli_base/dsrc.py

index fec18a5f9..9b09ea568 100644

--- a/src/lib389/lib389/cli_base/dsrc.py

+++ b/src/lib389/lib389/cli_base/dsrc.py

@@ -45,7 +45,7 @@ def dsrc_arg_concat(args, dsrc_inst):

             'tls_cacertdir': None,

             'tls_cert': None,

             'tls_key': None,

-            'tls_reqcert': ldap.OPT_X_TLS_HARD,

+            'tls_reqcert': None,

             'starttls': args.starttls,

             'prompt': False,

             'pwdfile': None,

@@ -134,7 +134,7 @@ def dsrc_to_ldap(path, instance_name, log):

     dsrc_inst['binddn'] = config.get(instance_name, 'binddn', fallback=None)

     dsrc_inst['saslmech'] = config.get(instance_name, 'saslmech', fallback=None)

     if dsrc_inst['saslmech'] is not None and dsrc_inst['saslmech'] not in ['EXTERNAL', 'PLAIN']:

-        raise Exception("%s [%s] saslmech must be one of EXTERNAL or PLAIN" % (path, instance_name))

+        raise ValueError("%s [%s] saslmech must be one of EXTERNAL or PLAIN" % (path, instance_name))

     dsrc_inst['tls_cacertdir'] = config.get(instance_name, 'tls_cacertdir', fallback=None)

     # At this point, we should check if the provided cacertdir is indeed, a dir. This can be a cause

@@ -145,16 +145,18 @@ def dsrc_to_ldap(path, instance_name, log):

     dsrc_inst['tls_cert'] = config.get(instance_name, 'tls_cert', fallback=None)

     dsrc_inst['tls_key'] = config.get(instance_name, 'tls_key', fallback=None)

-    dsrc_inst['tls_reqcert'] = config.get(instance_name, 'tls_reqcert', fallback='hard')

-    if dsrc_inst['tls_reqcert'] not in ['never', 'allow', 'hard']:

-        raise Exception("dsrc tls_reqcert value invalid. %s [%s] tls_reqcert should be one of never, allow or hard" % (instance_name,

-                                                                                                                       path))

+    dsrc_inst['tls_reqcert'] = config.get(instance_name, 'tls_reqcert', fallback=None)

     if dsrc_inst['tls_reqcert'] == 'never':

         dsrc_inst['tls_reqcert'] = ldap.OPT_X_TLS_NEVER

     elif dsrc_inst['tls_reqcert'] == 'allow':

         dsrc_inst['tls_reqcert'] = ldap.OPT_X_TLS_ALLOW

-    else:

+    elif dsrc_inst['tls_reqcert'] == 'hard':

         dsrc_inst['tls_reqcert'] = ldap.OPT_X_TLS_HARD

+    elif dsrc_inst['tls_reqcert'] is None:

+        # Use system value

+        pass

+    else:

+        raise ValueError("dsrc tls_reqcert value invalid. %s [%s] tls_reqcert should be one of never, allow or hard" % (instance_name, path))

     dsrc_inst['starttls'] = config.getboolean(instance_name, 'starttls', fallback=False)

     dsrc_inst['pwdfile'] = None

     dsrc_inst['prompt'] = False

-- 

2.26.2