Blame SOURCES/0002-add-option-use-ldaps.patch

48b328
From 85097245b57f190337225dbdbf6e33b58616c092 Mon Sep 17 00:00:00 2001
48b328
From: Sumit Bose <sbose@redhat.com>
48b328
Date: Thu, 19 Dec 2019 07:22:33 +0100
48b328
Subject: [PATCH 2/2] add option use-ldaps
48b328
48b328
In general using the LDAP port with GSS-SPNEGO should satifiy all
48b328
requirements an AD DC should have for authentication on an encrypted
48b328
LDAP connection.
48b328
48b328
But if e.g. the LDAP port is blocked by a firewall using the LDAPS port
48b328
with TLS encryption might be an alternative. For this use case the
48b328
--use-ldaps option is added.
48b328
48b328
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1762420
48b328
---
48b328
 doc/adcli.xml    | 24 +++++++++++++++
48b328
 library/adconn.c | 79 ++++++++++++++++++++++++++++++++++++++++++------
48b328
 library/adconn.h |  4 +++
48b328
 tools/computer.c | 10 ++++++
48b328
 tools/entry.c    | 11 +++++++
48b328
 5 files changed, 119 insertions(+), 9 deletions(-)
48b328
48b328
diff --git a/doc/adcli.xml b/doc/adcli.xml
48b328
index dd30435..acced25 100644
48b328
--- a/doc/adcli.xml
48b328
+++ b/doc/adcli.xml
48b328
@@ -128,6 +128,30 @@
48b328
 			If not specified, then an appropriate domain controller
48b328
 			is automatically discovered.</para></listitem>
48b328
 		</varlistentry>
48b328
+		<varlistentry>
48b328
+			<term><option>--use-ldaps</option></term>
48b328
+			<listitem><para>Connect to the domain controller
48b328
+			with LDAPS. By default the LDAP port is used and SASL
48b328
+			GSS-SPNEGO or GSSAPI is used for authentication and to
48b328
+			establish encryption. This should satisfy all
48b328
+			requirements set on the server side and LDAPS should
48b328
+			only be used if the LDAP port is not accessible due to
48b328
+			firewalls or other reasons.</para>
48b328
+			<para> Please note that the place where CA certificates
48b328
+			can be found to validate the AD DC certificates
48b328
+			must be configured in the OpenLDAP configuration
48b328
+			file, e.g. <filename>/etc/openldap/ldap.conf</filename>.
48b328
+			As an alternative it can be specified with the help of
48b328
+			an environment variable, e.g.
48b328
+<programlisting>
48b328
+$ LDAPTLS_CACERT=/path/to/ad_dc_ca_cert.pem adcli join --use-ldaps -D domain.example.com
48b328
+...
48b328
+</programlisting>
48b328
+			Please see
48b328
+			<citerefentry><refentrytitle>ldap.conf</refentrytitle>
48b328
+			<manvolnum>5</manvolnum></citerefentry> for details.
48b328
+			</para></listitem>
48b328
+		</varlistentry>
48b328
 		<varlistentry>
48b328
 			<term><option>-C, --login-ccache=<parameter>ccache_name</parameter></option></term>
48b328
 			<listitem><para>Use the specified kerberos credential
48b328
diff --git a/library/adconn.c b/library/adconn.c
48b328
index ffb54f9..7bab852 100644
48b328
--- a/library/adconn.c
48b328
+++ b/library/adconn.c
48b328
@@ -70,6 +70,7 @@ struct _adcli_conn_ctx {
48b328
 	char *domain_name;
48b328
 	char *domain_realm;
48b328
 	char *domain_controller;
48b328
+	bool use_ldaps;
48b328
 	char *canonical_host;
48b328
 	char *domain_short;
48b328
 	char *domain_sid;
48b328
@@ -773,7 +774,8 @@ int ldap_init_fd (ber_socket_t fd, int proto, LDAP_CONST char *url, struct ldap
48b328
 
48b328
 static LDAP *
48b328
 connect_to_address (const char *host,
48b328
-                    const char *canonical_host)
48b328
+                    const char *canonical_host,
48b328
+                    bool use_ldaps)
48b328
 {
48b328
 	struct addrinfo *res = NULL;
48b328
 	struct addrinfo *ai;
48b328
@@ -783,6 +785,16 @@ connect_to_address (const char *host,
48b328
 	char *url;
48b328
 	int sock;
48b328
 	int rc;
48b328
+	int opt_rc;
48b328
+	const char *port = "389";
48b328
+	const char *proto = "ldap";
48b328
+	const char *errmsg = NULL;
48b328
+
48b328
+	if (use_ldaps) {
48b328
+		port = "636";
48b328
+		proto = "ldaps";
48b328
+		_adcli_info ("Using LDAPS to connect to %s", host);
48b328
+	}
48b328
 
48b328
 	memset (&hints, '\0', sizeof(hints));
48b328
 #ifdef AI_ADDRCONFIG
48b328
@@ -794,7 +806,7 @@ connect_to_address (const char *host,
48b328
 	if (!canonical_host)
48b328
 		canonical_host = host;
48b328
 
48b328
-	rc = getaddrinfo (host, "389", &hints, &res;;
48b328
+	rc = getaddrinfo (host, port, &hints, &res;;
48b328
 	if (rc != 0) {
48b328
 		_adcli_err ("Couldn't resolve host name: %s: %s", host, gai_strerror (rc));
48b328
 		return NULL;
48b328
@@ -810,7 +822,7 @@ connect_to_address (const char *host,
48b328
 			close (sock);
48b328
 		} else {
48b328
 			error = 0;
48b328
-			if (asprintf (&url, "ldap://%s", canonical_host) < 0)
48b328
+			if (asprintf (&url, "%s://%s", proto, canonical_host) < 0)
48b328
 				return_val_if_reached (NULL);
48b328
 			rc = ldap_init_fd (sock, 1, url, &ldap);
48b328
 			free (url);
48b328
@@ -820,6 +832,25 @@ connect_to_address (const char *host,
48b328
 				            ldap_err2string (rc));
48b328
 				break;
48b328
 			}
48b328
+
48b328
+			if (use_ldaps) {
48b328
+				rc = ldap_install_tls (ldap);
48b328
+				if (rc != LDAP_SUCCESS) {
48b328
+					opt_rc = ldap_get_option (ldap,
48b328
+					                          LDAP_OPT_DIAGNOSTIC_MESSAGE,
48b328
+					                          (void *) &errmsg);
48b328
+					if (opt_rc != LDAP_SUCCESS) {
48b328
+						errmsg = NULL;
48b328
+					}
48b328
+					_adcli_err ("Couldn't initialize TLS [%s]: %s",
48b328
+					            ldap_err2string (rc),
48b328
+					            errmsg == NULL ? "- no details -"
48b328
+					                           : errmsg);
48b328
+					ldap_unbind_ext_s (ldap, NULL, NULL);
48b328
+					ldap = NULL;
48b328
+					break;
48b328
+				}
48b328
+			}
48b328
 		}
48b328
 	}
48b328
 
48b328
@@ -856,7 +887,8 @@ connect_and_lookup_naming (adcli_conn *conn,
48b328
 	if (!canonical_host)
48b328
 		canonical_host = disco->host_addr;
48b328
 
48b328
-	ldap = connect_to_address (disco->host_addr, canonical_host);
48b328
+	ldap = connect_to_address (disco->host_addr, canonical_host,
48b328
+	                           adcli_conn_get_use_ldaps (conn));
48b328
 	if (ldap == NULL)
48b328
 		return ADCLI_ERR_DIRECTORY;
48b328
 
48b328
@@ -1041,14 +1073,28 @@ authenticate_to_directory (adcli_conn *conn)
48b328
 	status = gss_krb5_ccache_name (&minor, conn->login_ccache_name, NULL);
48b328
 	return_unexpected_if_fail (status == 0);
48b328
 
48b328
-	/* Clumsily tell ldap + cyrus-sasl that we want encryption */
48b328
-	ssf = 1;
48b328
-	ret = ldap_set_option (conn->ldap, LDAP_OPT_X_SASL_SSF_MIN, &ssf;;
48b328
-	return_unexpected_if_fail (ret == 0);
48b328
+	if (adcli_conn_get_use_ldaps (conn)) {
48b328
+		/* do not use SASL encryption on LDAPS connection */
48b328
+		ssf = 0;
48b328
+		ret = ldap_set_option (conn->ldap, LDAP_OPT_X_SASL_SSF_MIN, &ssf;;
48b328
+		return_unexpected_if_fail (ret == 0);
48b328
+		ret = ldap_set_option (conn->ldap, LDAP_OPT_X_SASL_SSF_MAX, &ssf;;
48b328
+		return_unexpected_if_fail (ret == 0);
48b328
+	} else {
48b328
+		/* Clumsily tell ldap + cyrus-sasl that we want encryption */
48b328
+		ssf = 1;
48b328
+		ret = ldap_set_option (conn->ldap, LDAP_OPT_X_SASL_SSF_MIN, &ssf;;
48b328
+		return_unexpected_if_fail (ret == 0);
48b328
+	}
48b328
 
48b328
-	if (adcli_conn_server_has_sasl_mech (conn, "GSS-SPNEGO")) {
48b328
+	/* There are issues with cryrus-sasl and GSS-SPNEGO with TLS even if
48b328
+	 * ssf_max is set to 0. To be on the safe side GSS-SPNEGO is only used
48b328
+	 * without LDAPS. */
48b328
+	if (adcli_conn_server_has_sasl_mech (conn, "GSS-SPNEGO")
48b328
+	                     && !adcli_conn_get_use_ldaps (conn)) {
48b328
 		mech =  "GSS-SPNEGO";
48b328
 	}
48b328
+	_adcli_info ("Using %s for SASL bind", mech);
48b328
 
48b328
 	ret = ldap_sasl_interactive_bind_s (conn->ldap, NULL, mech, NULL, NULL,
48b328
 	                                    LDAP_SASL_QUIET, sasl_interact, NULL);
48b328
@@ -1230,6 +1276,7 @@ adcli_conn_new (const char *domain_name)
48b328
 	conn->refs = 1;
48b328
 	conn->logins_allowed = ADCLI_LOGIN_COMPUTER_ACCOUNT | ADCLI_LOGIN_USER_ACCOUNT;
48b328
 	adcli_conn_set_domain_name (conn, domain_name);
48b328
+	adcli_conn_set_use_ldaps (conn, false);
48b328
 	return conn;
48b328
 }
48b328
 
48b328
@@ -1389,6 +1436,20 @@ adcli_conn_set_domain_controller (adcli_conn *conn,
48b328
 	no_more_disco (conn);
48b328
 }
48b328
 
48b328
+bool
48b328
+adcli_conn_get_use_ldaps (adcli_conn *conn)
48b328
+{
48b328
+	return_val_if_fail (conn != NULL, NULL);
48b328
+	return conn->use_ldaps;
48b328
+}
48b328
+
48b328
+void
48b328
+adcli_conn_set_use_ldaps (adcli_conn *conn, bool value)
48b328
+{
48b328
+	return_if_fail (conn != NULL);
48b328
+	conn->use_ldaps = value;
48b328
+}
48b328
+
48b328
 const char *
48b328
 adcli_conn_get_domain_short (adcli_conn *conn)
48b328
 {
48b328
diff --git a/library/adconn.h b/library/adconn.h
48b328
index 37ebdd9..1d5faa8 100644
48b328
--- a/library/adconn.h
48b328
+++ b/library/adconn.h
48b328
@@ -89,6 +89,10 @@ const char *        adcli_conn_get_domain_controller (adcli_conn *conn);
48b328
 void                adcli_conn_set_domain_controller (adcli_conn *conn,
48b328
                                                       const char *value);
48b328
 
48b328
+bool                adcli_conn_get_use_ldaps         (adcli_conn *conn);
48b328
+void                adcli_conn_set_use_ldaps         (adcli_conn *conn,
48b328
+                                                      bool value);
48b328
+
48b328
 const char *        adcli_conn_get_domain_short      (adcli_conn *conn);
48b328
 
48b328
 const char *        adcli_conn_get_domain_sid        (adcli_conn *conn);
48b328
diff --git a/tools/computer.c b/tools/computer.c
48b328
index 840e334..292c4d8 100644
48b328
--- a/tools/computer.c
48b328
+++ b/tools/computer.c
48b328
@@ -113,12 +113,14 @@ typedef enum {
48b328
 	opt_add_service_principal,
48b328
 	opt_remove_service_principal,
48b328
 	opt_description,
48b328
+	opt_use_ldaps,
48b328
 } Option;
48b328
 
48b328
 static adcli_tool_desc common_usages[] = {
48b328
 	{ opt_domain, "active directory domain name" },
48b328
 	{ opt_domain_realm, "kerberos realm for the domain" },
48b328
 	{ opt_domain_controller, "domain controller to connect to" },
48b328
+	{ opt_use_ldaps, "use LDAPS port for communication" },
48b328
 	{ opt_host_fqdn, "override the fully qualified domain name of the\n"
48b328
 	                 "local machine" },
48b328
 	{ opt_host_keytab, "filename for the host kerberos keytab" },
48b328
@@ -311,6 +313,9 @@ parse_option (Option opt,
48b328
 	case opt_description:
48b328
 		adcli_enroll_set_description (enroll, optarg);
48b328
 		return ADCLI_SUCCESS;
48b328
+	case opt_use_ldaps:
48b328
+		adcli_conn_set_use_ldaps (conn, true);
48b328
+		return ADCLI_SUCCESS;
48b328
 	case opt_verbose:
48b328
 		return ADCLI_SUCCESS;
48b328
 
48b328
@@ -357,6 +362,7 @@ adcli_tool_computer_join (adcli_conn *conn,
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
 		{ "domain-server", required_argument, NULL, opt_domain_controller }, /* compat */
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "user", required_argument, NULL, opt_login_user }, /* compat */
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
@@ -688,6 +694,7 @@ adcli_tool_computer_preset (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "domain-ou", required_argument, NULL, opt_domain_ou },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
@@ -800,6 +807,7 @@ adcli_tool_computer_reset (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "login-type", required_argument, NULL, opt_login_type },
48b328
@@ -888,6 +896,7 @@ adcli_tool_computer_delete (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "no-password", no_argument, 0, opt_no_password },
48b328
@@ -985,6 +994,7 @@ adcli_tool_computer_show (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "login-type", required_argument, NULL, opt_login_type },
48b328
diff --git a/tools/entry.c b/tools/entry.c
48b328
index f361845..05e4313 100644
48b328
--- a/tools/entry.c
48b328
+++ b/tools/entry.c
48b328
@@ -53,6 +53,7 @@ typedef enum {
48b328
 	opt_unix_gid,
48b328
 	opt_unix_shell,
48b328
 	opt_nis_domain,
48b328
+	opt_use_ldaps,
48b328
 } Option;
48b328
 
48b328
 static adcli_tool_desc common_usages[] = {
48b328
@@ -67,6 +68,7 @@ static adcli_tool_desc common_usages[] = {
48b328
 	{ opt_domain, "active directory domain name" },
48b328
 	{ opt_domain_realm, "kerberos realm for the domain" },
48b328
 	{ opt_domain_controller, "domain directory server to connect to" },
48b328
+	{ opt_use_ldaps, "use LDAPS port for communication" },
48b328
 	{ opt_login_ccache, "kerberos credential cache file which contains\n"
48b328
 	                    "ticket to used to connect to the domain" },
48b328
 	{ opt_login_user, "user (usually administrative) login name of\n"
48b328
@@ -136,6 +138,9 @@ parse_option (Option opt,
48b328
 			stdin_password = 1;
48b328
 		}
48b328
 		return ADCLI_SUCCESS;
48b328
+	case opt_use_ldaps:
48b328
+		adcli_conn_set_use_ldaps (conn, true);
48b328
+		return ADCLI_SUCCESS;
48b328
 	case opt_verbose:
48b328
 		return ADCLI_SUCCESS;
48b328
 	default:
48b328
@@ -172,6 +177,7 @@ adcli_tool_user_create (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "no-password", no_argument, 0, opt_no_password },
48b328
@@ -306,6 +312,7 @@ adcli_tool_user_delete (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "no-password", no_argument, 0, opt_no_password },
48b328
@@ -394,6 +401,7 @@ adcli_tool_group_create (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "domain-ou", required_argument, NULL, opt_domain_ou },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
@@ -496,6 +504,7 @@ adcli_tool_group_delete (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "no-password", no_argument, 0, opt_no_password },
48b328
@@ -622,6 +631,7 @@ adcli_tool_member_add (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "no-password", no_argument, 0, opt_no_password },
48b328
@@ -722,6 +732,7 @@ adcli_tool_member_remove (adcli_conn *conn,
48b328
 		{ "domain", required_argument, NULL, opt_domain },
48b328
 		{ "domain-realm", required_argument, NULL, opt_domain_realm },
48b328
 		{ "domain-controller", required_argument, NULL, opt_domain_controller },
48b328
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
48b328
 		{ "login-user", required_argument, NULL, opt_login_user },
48b328
 		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
48b328
 		{ "no-password", no_argument, 0, opt_no_password },
48b328
-- 
48b328
2.21.0
48b328