|
 |
30390b |
From 3e4c42094c9660c710f544e31c49ff38180c7675 Mon Sep 17 00:00:00 2001
|
|
|
30390b |
From: Sumit Bose <sbose@redhat.com>
|
|
|
30390b |
Date: Wed, 2 Dec 2020 10:10:37 +0100
|
|
|
30390b |
Subject: [PATCH 3/3] service: make TLS check more releaxed
|
|
|
30390b |
|
|
|
30390b |
Since realmd is most often the first application called to discover a
|
|
|
30390b |
domain we do not require a strict certificate check when using the ldaps
|
|
|
30390b |
port to connect to a domain controller.
|
|
|
30390b |
|
|
|
30390b |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964
|
|
|
30390b |
---
|
|
|
30390b |
doc/manual/realm.xml | 8 +++++++-
|
|
|
30390b |
service/realm-ldap.c | 32 +++++++++++++++++++++++++++++++-
|
|
|
30390b |
2 files changed, 38 insertions(+), 2 deletions(-)
|
|
|
30390b |
|
|
|
30390b |
diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
|
|
|
30390b |
index 01af62e..d7d8e5e 100644
|
|
|
30390b |
--- a/doc/manual/realm.xml
|
|
|
30390b |
+++ b/doc/manual/realm.xml
|
|
|
30390b |
@@ -293,7 +293,13 @@ $ realm join --user=admin --computer-ou=OU=Special domain.example.com
|
|
|
30390b |
which offers a comparable level of security than ldaps.
|
|
|
30390b |
This option is only needed if the standard LDAP port
|
|
|
30390b |
(389/tcp) is blocked by a firewall and only the LDAPS
|
|
|
30390b |
- port (636/tcp) is available.</para>
|
|
|
30390b |
+ port (636/tcp) is available. Given that and to lower
|
|
|
30390b |
+ the initial effort to discover a remote domain
|
|
|
30390b |
+ <command>realmd</command> does not require a strict
|
|
|
30390b |
+ certificate check. If the validation of the LDAP server
|
|
|
30390b |
+ certificate fails <command>realmd</command> will
|
|
|
30390b |
+ continue to setup the encrypted connection to the LDAP
|
|
|
30390b |
+ server.</para>
|
|
|
30390b |
|
|
|
30390b |
<para>If this option is set to
|
|
|
30390b |
<parameter>yes</parameter> <command>realmd</command>
|
|
|
30390b |
diff --git a/service/realm-ldap.c b/service/realm-ldap.c
|
|
|
30390b |
index e07a299..bdfb96c 100644
|
|
|
30390b |
--- a/service/realm-ldap.c
|
|
|
30390b |
+++ b/service/realm-ldap.c
|
|
|
30390b |
@@ -199,6 +199,9 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
|
|
|
30390b |
gint port;
|
|
|
30390b |
gchar *url;
|
|
|
30390b |
int rc;
|
|
|
30390b |
+ int opt_rc;
|
|
|
30390b |
+ int ldap_opt_val;
|
|
|
30390b |
+ const char *errmsg = NULL;
|
|
|
30390b |
|
|
|
30390b |
g_return_val_if_fail (G_IS_INET_SOCKET_ADDRESS (address), NULL);
|
|
|
30390b |
|
|
|
30390b |
@@ -264,9 +267,36 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
|
|
|
30390b |
}
|
|
|
30390b |
|
|
|
30390b |
if (use_ldaps) {
|
|
|
30390b |
+ /* Since we currently use the IP address in the URI
|
|
|
30390b |
+ * the certificate check might fail because in most
|
|
|
30390b |
+ * cases the IP address won't be listed in the SANs of
|
|
|
30390b |
+ * the LDAP server certificate. We will try to
|
|
|
30390b |
+ * continue in this case and not fail. */
|
|
|
30390b |
+ ldap_opt_val = LDAP_OPT_X_TLS_ALLOW;
|
|
|
30390b |
+ rc = ldap_set_option (ls->ldap,
|
|
|
30390b |
+ LDAP_OPT_X_TLS_REQUIRE_CERT,
|
|
|
30390b |
+ &ldap_opt_val);
|
|
|
30390b |
+ if (rc != LDAP_OPT_SUCCESS) {
|
|
|
30390b |
+ g_debug ("Failed to disable certificate checking, trying without");
|
|
|
30390b |
+ }
|
|
|
30390b |
+
|
|
|
30390b |
+ ldap_opt_val = 0;
|
|
|
30390b |
+ rc = ldap_set_option (ls->ldap, LDAP_OPT_X_TLS_NEWCTX,
|
|
|
30390b |
+ &ldap_opt_val);
|
|
|
30390b |
+ if (rc != LDAP_OPT_SUCCESS) {
|
|
|
30390b |
+ g_debug ("Failed to refresh LDAP context for TLS, trying without");
|
|
|
30390b |
+ }
|
|
|
30390b |
+
|
|
|
30390b |
rc = ldap_install_tls (ls->ldap);
|
|
|
30390b |
if (rc != LDAP_SUCCESS) {
|
|
|
30390b |
- g_warning ("ldap_start_tls_s() failed: %s", ldap_err2string (rc));
|
|
|
30390b |
+ opt_rc = ldap_get_option (ls->ldap,
|
|
|
30390b |
+ LDAP_OPT_DIAGNOSTIC_MESSAGE,
|
|
|
30390b |
+ (void *) &errmsg);
|
|
|
30390b |
+ if (opt_rc != LDAP_SUCCESS) {
|
|
|
30390b |
+ errmsg = "- no details -";
|
|
|
30390b |
+ }
|
|
|
30390b |
+ g_warning ("ldap_start_tls_s() failed [%s]: %s",
|
|
|
30390b |
+ ldap_err2string (rc), errmsg);
|
|
|
30390b |
return NULL;
|
|
|
30390b |
}
|
|
|
30390b |
}
|
|
|
30390b |
--
|
|
|
30390b |
2.28.0
|
|
|
30390b |
|