From 3e4c42094c9660c710f544e31c49ff38180c7675 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 2 Dec 2020 10:10:37 +0100
Subject: [PATCH 3/3] service: make TLS check more releaxed

Since realmd is most often the first application called to discover a
domain we do not require a strict certificate check when using the ldaps
port to connect to a domain controller.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964
---
 doc/manual/realm.xml |  8 +++++++-
 service/realm-ldap.c | 32 +++++++++++++++++++++++++++++++-
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
index 01af62e..d7d8e5e 100644
--- a/doc/manual/realm.xml
+++ b/doc/manual/realm.xml
@@ -293,7 +293,13 @@ $ realm join --user=admin --computer-ou=OU=Special domain.example.com
 			which offers a comparable level of security than ldaps.
 			This option is only needed if the standard LDAP port
 			(389/tcp) is blocked by a firewall and only the LDAPS
-			port (636/tcp) is available.</para>
+			port (636/tcp) is available. Given that and to lower
+			the initial effort to discover a remote domain
+			<command>realmd</command> does not require a strict
+			certificate check. If the validation of the LDAP server
+			certificate fails <command>realmd</command> will
+			continue to setup the encrypted connection to the LDAP
+			server.</para>
 
 			<para>If this option is set to
 			<parameter>yes</parameter> <command>realmd</command>
diff --git a/service/realm-ldap.c b/service/realm-ldap.c
index e07a299..bdfb96c 100644
--- a/service/realm-ldap.c
+++ b/service/realm-ldap.c
@@ -199,6 +199,9 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
 	gint port;
 	gchar *url;
 	int rc;
+	int opt_rc;
+	int ldap_opt_val;
+	const char *errmsg = NULL;
 
 	g_return_val_if_fail (G_IS_INET_SOCKET_ADDRESS (address), NULL);
 
@@ -264,9 +267,36 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
 		}
 
 		if (use_ldaps) {
+			/* Since we currently use the IP address in the URI
+			 * the certificate check might fail because in most
+			 * cases the IP address won't be listed in the SANs of
+			 * the LDAP server certificate. We will try to
+			 * continue in this case and not fail. */
+			ldap_opt_val = LDAP_OPT_X_TLS_ALLOW;
+			rc = ldap_set_option (ls->ldap,
+			                       LDAP_OPT_X_TLS_REQUIRE_CERT,
+			                       &ldap_opt_val);
+			if (rc != LDAP_OPT_SUCCESS) {
+				g_debug ("Failed to disable certificate checking, trying without");
+			}
+
+			ldap_opt_val = 0;
+			rc = ldap_set_option (ls->ldap, LDAP_OPT_X_TLS_NEWCTX,
+			                       &ldap_opt_val);
+			if (rc != LDAP_OPT_SUCCESS) {
+				g_debug ("Failed to refresh LDAP context for TLS, trying without");
+			}
+
 			rc = ldap_install_tls (ls->ldap);
 			if (rc != LDAP_SUCCESS) {
-				g_warning ("ldap_start_tls_s() failed: %s", ldap_err2string (rc));
+				opt_rc = ldap_get_option (ls->ldap,
+				                          LDAP_OPT_DIAGNOSTIC_MESSAGE,
+				                          (void *) &errmsg);
+				if (opt_rc != LDAP_SUCCESS) {
+					errmsg = "- no details -";
+				}
+				g_warning ("ldap_start_tls_s() failed [%s]: %s",
+				           ldap_err2string (rc), errmsg);
 				return NULL;
 			}
 		}
-- 
2.28.0