From 30390b046304d493f4f232711125dbab77dad97e Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Dec 08 2020 10:10:38 +0000 Subject: import realmd-0.16.3-22.el8 --- diff --git a/SOURCES/0001-ldap-setup-TLS-when-using-ldaps.patch b/SOURCES/0001-ldap-setup-TLS-when-using-ldaps.patch new file mode 100644 index 0000000..ebfda2b --- /dev/null +++ b/SOURCES/0001-ldap-setup-TLS-when-using-ldaps.patch @@ -0,0 +1,32 @@ +From e41de8344a09092ae4d973f495eef54a106a11ee Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Thu, 26 Nov 2020 17:24:10 +0100 +Subject: [PATCH] ldap: setup TLS when using ldaps + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964 +--- + service/realm-ldap.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/service/realm-ldap.c b/service/realm-ldap.c +index 2076d1e..e07a299 100644 +--- a/service/realm-ldap.c ++++ b/service/realm-ldap.c +@@ -263,6 +263,14 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + return NULL; + } + ++ if (use_ldaps) { ++ rc = ldap_install_tls (ls->ldap); ++ if (rc != LDAP_SUCCESS) { ++ g_warning ("ldap_start_tls_s() failed: %s", ldap_err2string (rc)); ++ return NULL; ++ } ++ } ++ + break; + + case G_SOCKET_PROTOCOL_UDP: +-- +2.28.0 + diff --git a/SOURCES/0001-service-make-sure-use_ldaps-is-not-only-set-for-auto.patch b/SOURCES/0001-service-make-sure-use_ldaps-is-not-only-set-for-auto.patch new file mode 100644 index 0000000..fbbc2d4 --- /dev/null +++ b/SOURCES/0001-service-make-sure-use_ldaps-is-not-only-set-for-auto.patch @@ -0,0 +1,61 @@ +From ccf48aa7761065283483d667f3efaf33b5b2a728 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 1 Dec 2020 14:12:33 +0100 +Subject: [PATCH 1/3] service: make sure use_ldaps is not only set for + automatic join + +The check if ldaps is requested or not was only called if an automatic +join was enabled. With this patch it is checked in all cases. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964 +--- + service/realm-sssd-ad.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c +index 00a9093..ea5f28c 100644 +--- a/service/realm-sssd-ad.c ++++ b/service/realm-sssd-ad.c +@@ -349,19 +349,6 @@ parse_join_options (JoinClosure *join, + return FALSE; + } + +- /* +- * Check if ldaps should be used and if membership software supports +- * it. +- */ +- join->use_ldaps = realm_option_use_ldaps (options); +- if (join->use_ldaps && +- g_str_equal (software, REALM_DBUS_IDENTIFIER_SAMBA)) { +- realm_diagnostics_info (join->invocation, +- "Membership software %s does " +- "not support ldaps, trying " +- "without.", software); +- } +- + /* + * If we are enrolling with a user password, then we have to use samba, + * adcli only supports admin passwords. +@@ -393,6 +380,19 @@ parse_join_options (JoinClosure *join, + + g_assert (software != NULL); + ++ /* ++ * Check if ldaps should be used and if membership software supports ++ * it. ++ */ ++ join->use_ldaps = realm_option_use_ldaps (options); ++ if (join->use_ldaps && ++ g_str_equal (software, REALM_DBUS_IDENTIFIER_SAMBA)) { ++ realm_diagnostics_info (join->invocation, ++ "Membership software %s does " ++ "not support ldaps, trying " ++ "without.", software); ++ } ++ + if (g_str_equal (software, REALM_DBUS_IDENTIFIER_ADCLI)) { + join->use_adcli = TRUE; + join->packages = ADCLI_PACKAGES; +-- +2.28.0 + diff --git a/SOURCES/0002-service-avoid-crash-if-LDAP-connection-fails.patch b/SOURCES/0002-service-avoid-crash-if-LDAP-connection-fails.patch new file mode 100644 index 0000000..5ab6209 --- /dev/null +++ b/SOURCES/0002-service-avoid-crash-if-LDAP-connection-fails.patch @@ -0,0 +1,68 @@ +From d7089129b966df83f083cb56ee90f6b906971cb6 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 1 Dec 2020 16:09:10 +0100 +Subject: [PATCH 2/3] service: avoid crash if LDAP connection fails + +There was always a chance for a crash if the connection to LDAP failed. +In the ldaps case a failed connection became more likely e.g. due to +failed certificate checks. + +This patch avoids the crash and returns an error to the client cleanly. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964 +--- + po/POTFILES.in | 1 + + service/realm-disco-mscldap.c | 7 +++++++ + service/realm-disco-rootdse.c | 6 ++++++ + 3 files changed, 14 insertions(+) + +diff --git a/po/POTFILES.in b/po/POTFILES.in +index 2de67c8..140ed4c 100644 +--- a/po/POTFILES.in ++++ b/po/POTFILES.in +@@ -1,6 +1,7 @@ + service/org.freedesktop.realmd.policy.in + service/realm-command.c + service/realm-disco-mscldap.c ++service/realm-disco-rootdse.c + service/realm-example.c + service/realm-ini-config.c + service/realm-invocation.c +diff --git a/service/realm-disco-mscldap.c b/service/realm-disco-mscldap.c +index 2504904..003bb66 100644 +--- a/service/realm-disco-mscldap.c ++++ b/service/realm-disco-mscldap.c +@@ -349,6 +349,13 @@ realm_disco_mscldap_async (GSocketAddress *address, + } + + clo->source = realm_ldap_connect_anonymous (address, protocol, FALSE, cancellable); ++ if (clo->source == NULL) { ++ g_task_return_new_error (task, G_IO_ERROR, G_IO_ERROR_NOT_CONNECTED, ++ _("Failed to setup LDAP connection")); ++ g_object_unref (task); ++ return; ++ } ++ + g_source_set_callback (clo->source, (GSourceFunc)on_ldap_io, + g_object_ref (task), g_object_unref); + g_source_attach (clo->source, g_task_get_context (task)); +diff --git a/service/realm-disco-rootdse.c b/service/realm-disco-rootdse.c +index 4ed19e5..d9b44b3 100644 +--- a/service/realm-disco-rootdse.c ++++ b/service/realm-disco-rootdse.c +@@ -475,6 +475,12 @@ realm_disco_rootdse_async (GSocketAddress *address, + + clo->source = realm_ldap_connect_anonymous (address, G_SOCKET_PROTOCOL_TCP, + use_ldaps, cancellable); ++ if (clo->source == NULL) { ++ g_task_return_new_error (task, G_IO_ERROR, G_IO_ERROR_NOT_CONNECTED, ++ _("Failed to setup LDAP connection")); ++ g_object_unref (task); ++ return; ++ } + g_source_set_callback (clo->source, (GSourceFunc)on_ldap_io, + g_object_ref (task), g_object_unref); + g_source_attach (clo->source, g_task_get_context (task)); +-- +2.28.0 + diff --git a/SOURCES/0003-service-make-TLS-check-more-releaxed.patch b/SOURCES/0003-service-make-TLS-check-more-releaxed.patch new file mode 100644 index 0000000..292d0db --- /dev/null +++ b/SOURCES/0003-service-make-TLS-check-more-releaxed.patch @@ -0,0 +1,89 @@ +From 3e4c42094c9660c710f544e31c49ff38180c7675 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Wed, 2 Dec 2020 10:10:37 +0100 +Subject: [PATCH 3/3] service: make TLS check more releaxed + +Since realmd is most often the first application called to discover a +domain we do not require a strict certificate check when using the ldaps +port to connect to a domain controller. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964 +--- + doc/manual/realm.xml | 8 +++++++- + service/realm-ldap.c | 32 +++++++++++++++++++++++++++++++- + 2 files changed, 38 insertions(+), 2 deletions(-) + +diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml +index 01af62e..d7d8e5e 100644 +--- a/doc/manual/realm.xml ++++ b/doc/manual/realm.xml +@@ -293,7 +293,13 @@ $ realm join --user=admin --computer-ou=OU=Special domain.example.com + which offers a comparable level of security than ldaps. + This option is only needed if the standard LDAP port + (389/tcp) is blocked by a firewall and only the LDAPS +- port (636/tcp) is available. ++ port (636/tcp) is available. Given that and to lower ++ the initial effort to discover a remote domain ++ realmd does not require a strict ++ certificate check. If the validation of the LDAP server ++ certificate fails realmd will ++ continue to setup the encrypted connection to the LDAP ++ server. + + If this option is set to + yes realmd +diff --git a/service/realm-ldap.c b/service/realm-ldap.c +index e07a299..bdfb96c 100644 +--- a/service/realm-ldap.c ++++ b/service/realm-ldap.c +@@ -199,6 +199,9 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + gint port; + gchar *url; + int rc; ++ int opt_rc; ++ int ldap_opt_val; ++ const char *errmsg = NULL; + + g_return_val_if_fail (G_IS_INET_SOCKET_ADDRESS (address), NULL); + +@@ -264,9 +267,36 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + } + + if (use_ldaps) { ++ /* Since we currently use the IP address in the URI ++ * the certificate check might fail because in most ++ * cases the IP address won't be listed in the SANs of ++ * the LDAP server certificate. We will try to ++ * continue in this case and not fail. */ ++ ldap_opt_val = LDAP_OPT_X_TLS_ALLOW; ++ rc = ldap_set_option (ls->ldap, ++ LDAP_OPT_X_TLS_REQUIRE_CERT, ++ &ldap_opt_val); ++ if (rc != LDAP_OPT_SUCCESS) { ++ g_debug ("Failed to disable certificate checking, trying without"); ++ } ++ ++ ldap_opt_val = 0; ++ rc = ldap_set_option (ls->ldap, LDAP_OPT_X_TLS_NEWCTX, ++ &ldap_opt_val); ++ if (rc != LDAP_OPT_SUCCESS) { ++ g_debug ("Failed to refresh LDAP context for TLS, trying without"); ++ } ++ + rc = ldap_install_tls (ls->ldap); + if (rc != LDAP_SUCCESS) { +- g_warning ("ldap_start_tls_s() failed: %s", ldap_err2string (rc)); ++ opt_rc = ldap_get_option (ls->ldap, ++ LDAP_OPT_DIAGNOSTIC_MESSAGE, ++ (void *) &errmsg); ++ if (opt_rc != LDAP_SUCCESS) { ++ errmsg = "- no details -"; ++ } ++ g_warning ("ldap_start_tls_s() failed [%s]: %s", ++ ldap_err2string (rc), errmsg); + return NULL; + } + } +-- +2.28.0 + diff --git a/SPECS/realmd.spec b/SPECS/realmd.spec index e97d86f..8c79df9 100644 --- a/SPECS/realmd.spec +++ b/SPECS/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.16.3 -Release: 20%{?dist} +Release: 22%{?dist} Summary: Kerberos realm enrollment service License: LGPLv2+ URL: http://cgit.freedesktop.org/realmd/realmd/ @@ -59,6 +59,10 @@ Patch29: 0003-service-add-ldaps-support-when-using-adcli.patch Patch30: 0004-service-do-not-copy-option-values-to-avoid-memory-le.patch Patch31: 0005-tools-add-use-ldaps-option-for-discover-join-and-lea.patch Patch32: 0006-ldap-generate-proper-ldap-uri-for-IPv6-addresses.patch +Patch33: 0001-ldap-setup-TLS-when-using-ldaps.patch +Patch34: 0001-service-make-sure-use_ldaps-is-not-only-set-for-auto.patch +Patch35: 0002-service-avoid-crash-if-LDAP-connection-fails.patch +Patch36: 0003-service-make-TLS-check-more-releaxed.patch BuildRequires: gcc BuildRequires: automake @@ -127,6 +131,14 @@ make install DESTDIR=%{buildroot} %doc ChangeLog %changelog +* Thu Dec 03 2020 Sumit Bose - 0.16.3-22 +- Add fixes LDAPS functionality + Resolves: rhbz#1826964 + +* Thu Nov 26 2020 Sumit Bose - 0.16.3-21 +- Add missing patch for LDAPS functionality + Resolves: rhbz#1826964 + * Thu Nov 05 2020 Sumit Bose - 0.16.3-20 - realmd should handle default_realm in krb5.conf Resolves: rhbz#1791016