From 67884188a25c7de631fe969abe8768ff014c5941 Mon Sep 17 00:00:00 2001 From: Mark Reynolds Date: Thu, 1 Feb 2018 14:28:24 -0500 Subject: [PATCH] Ticket 49557 - Add config option for checking CRL on outbound SSL Connections Bug Description: There are cases where a CRL is not available during an outbound replication connection. This is seen as an error by openldap, and the connection fails. Fix Description: Add on/off option for checking the CRL. The default is not to check the CRL. https://pagure.io/389-ds-base/issue/49557 Reviewed by: ? --- ldap/schema/01core389.ldif | 1 + ldap/servers/slapd/ldaputil.c | 6 +++++- ldap/servers/slapd/libglobs.c | 33 +++++++++++++++++++++++++++++++-- ldap/servers/slapd/proto-slap.h | 2 ++ ldap/servers/slapd/slap.h | 3 ++- 5 files changed, 41 insertions(+), 4 deletions(-) diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index 2eccc0a6c..402f7681f 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -309,6 +309,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2338 NAME 'nsDS5ReplicaBindDNGroup' DESC attributeTypes: ( 2.16.840.1.113730.3.1.2339 NAME 'nsslapd-changelogdir' DESC 'The changelog5 directory storage location' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2340 NAME 'nsslapd-changelogmaxage' DESC 'The changelog5 time where an entry will be retained' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2341 NAME 'nsslapd-changelogmaxentries' DESC 'The changelog5 max entries limit' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2344 NAME 'nsslapd-ssl-check-crl' DESC 'Check CRL when opening outbound connections' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' ) # # objectclasses # diff --git a/ldap/servers/slapd/ldaputil.c b/ldap/servers/slapd/ldaputil.c index fa9d276a3..2b07ece31 100644 --- a/ldap/servers/slapd/ldaputil.c +++ b/ldap/servers/slapd/ldaputil.c @@ -570,6 +570,7 @@ slapi_ldif_parse_line( } #if defined(USE_OPENLDAP) + static int setup_ol_tls_conn(LDAP *ld, int clientauth) { @@ -602,7 +603,10 @@ setup_ol_tls_conn(LDAP *ld, int clientauth) } } if (slapi_client_uses_openssl(ld)) { - const int crlcheck = LDAP_OPT_X_TLS_CRL_ALL; + int32_t crlcheck = LDAP_OPT_X_TLS_CRL_NONE; + if (config_get_ssl_check_crl() ){ + crlcheck = LDAP_OPT_X_TLS_CRL_ALL; + } /* Sets the CRL evaluation strategy. */ rc = ldap_set_option(ld, LDAP_OPT_X_TLS_CRLCHECK, &crlcheck); if (rc) { diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index 304f47070..39354087c 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -214,6 +214,7 @@ slapi_onoff_t init_accesscontrol; slapi_onoff_t init_nagle; slapi_onoff_t init_security; slapi_onoff_t init_ssl_check_hostname; +slapi_onoff_t init_ssl_check_crl; slapi_onoff_t init_ldapi_switch; slapi_onoff_t init_ldapi_bind_switch; slapi_onoff_t init_ldapi_map_entries; @@ -1181,7 +1182,12 @@ static struct config_get_and_set {CONFIG_LOGGING_BACKEND, NULL, log_set_backend, 0, (void **)&global_slapdFrontendConfig.logging_backend, - CONFIG_STRING_OR_EMPTY, NULL, SLAPD_INIT_LOGGING_BACKEND_INTERNAL}}; + CONFIG_STRING_OR_EMPTY, NULL, SLAPD_INIT_LOGGING_BACKEND_INTERNAL}, + {CONFIG_SSL_CHECK_CRL_ATTRIBUTE, config_set_ssl_check_crl, + NULL, 0, + (void **)&global_slapdFrontendConfig.ssl_check_crl, + CONFIG_ON_OFF, (ConfigGetFunc)config_get_ssl_check_crl, + NULL /* deletion is not allowed */} }; /* * hashNocaseString - used for case insensitive hash lookups @@ -1514,7 +1520,6 @@ FrontendConfig_init(void) cfg->maxdescriptors = SLAPD_DEFAULT_MAXDESCRIPTORS; cfg->groupevalnestlevel = SLAPD_DEFAULT_GROUPEVALNESTLEVEL; cfg->snmp_index = SLAPD_DEFAULT_SNMP_INDEX; - cfg->SSLclientAuth = SLAPD_DEFAULT_SSLCLIENTAUTH; #ifdef USE_SYSCONF @@ -1532,6 +1537,7 @@ FrontendConfig_init(void) #endif init_security = cfg->security = LDAP_OFF; init_ssl_check_hostname = cfg->ssl_check_hostname = LDAP_ON; + init_ssl_check_crl = cfg->ssl_check_crl = LDAP_OFF; init_return_exact_case = cfg->return_exact_case = LDAP_ON; init_result_tweak = cfg->result_tweak = LDAP_OFF; init_attrname_exceptions = cfg->attrname_exceptions = LDAP_OFF; @@ -2050,6 +2056,7 @@ config_set_port(const char *attrname, char *port, char *errorbuf, int apply) return retVal; } + int config_set_secureport(const char *attrname, char *port, char *errorbuf, int apply) { @@ -2081,6 +2088,22 @@ config_set_secureport(const char *attrname, char *port, char *errorbuf, int appl } +int32_t +config_set_ssl_check_crl(const char *attrname, char *value, char *errorbuf, int apply) +{ + int32_t retVal = LDAP_SUCCESS; + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + + retVal = config_set_onoff(attrname, + value, + &(slapdFrontendConfig->ssl_check_crl), + errorbuf, + apply); + + return retVal; +} + + int config_set_SSLclientAuth(const char *attrname, char *value, char *errorbuf, int apply) { @@ -4600,6 +4623,12 @@ config_set_versionstring(const char *attrname __attribute__((unused)), char *ver #define config_copy_strval(s) s ? slapi_ch_strdup(s) : NULL; +int32_t +config_get_ssl_check_crl() { + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + return slapi_atomic_load_32(&(slapdFrontendConfig->ssl_check_crl), __ATOMIC_ACQUIRE); +} + int config_get_port() { diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 3b7ab53b2..b7d8ce19f 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -236,6 +236,7 @@ int config_set_port(const char *attrname, char *port, char *errorbuf, int apply) int config_set_secureport(const char *attrname, char *port, char *errorbuf, int apply); int config_set_SSLclientAuth(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ssl_check_hostname(const char *attrname, char *value, char *errorbuf, int apply); +int32_t config_set_ssl_check_crl(const char *attrname, char *value, char *errorbuf, int apply); int config_set_SSL3ciphers(const char *attrname, char *value, char *errorbuf, int apply); int config_set_localhost(const char *attrname, char *value, char *errorbuf, int apply); int config_set_listenhost(const char *attrname, char *value, char *errorbuf, int apply); @@ -397,6 +398,7 @@ void log_disable_hr_timestamps(void); int config_get_SSLclientAuth(void); int config_get_ssl_check_hostname(void); +int32_t config_get_ssl_check_crl(void); char *config_get_SSL3ciphers(void); char *config_get_localhost(void); char *config_get_listenhost(void); diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 3c26506df..975cfed2e 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -2151,6 +2151,7 @@ typedef struct _slapdEntryPoints #define CONFIG_RUNDIR_ATTRIBUTE "nsslapd-rundir" #define CONFIG_SSLCLIENTAUTH_ATTRIBUTE "nsslapd-SSLclientAuth" #define CONFIG_SSL_CHECK_HOSTNAME_ATTRIBUTE "nsslapd-ssl-check-hostname" +#define CONFIG_SSL_CHECK_CRL_ATTRIBUTE "nsslapd-ssl-check-crl" #define CONFIG_HASH_FILTERS_ATTRIBUTE "nsslapd-hash-filters" #define CONFIG_OUTBOUND_LDAP_IO_TIMEOUT_ATTRIBUTE "nsslapd-outbound-ldap-io-timeout" #define CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE "nsslapd-force-sasl-external" @@ -2270,6 +2271,7 @@ typedef struct _slapdFrontendConfig slapi_onoff_t security; int SSLclientAuth; slapi_onoff_t ssl_check_hostname; + slapi_onoff_t ssl_check_crl; int validate_cert; int sizelimit; int SNMPenabled; @@ -2301,7 +2303,6 @@ typedef struct _slapdFrontendConfig slapi_onoff_t plugin_track; slapi_onoff_t moddn_aci; struct pw_scheme *pw_storagescheme; - slapi_onoff_t pwpolicy_local; slapi_onoff_t pw_is_global_policy; slapi_onoff_t pwpolicy_inherit_global; -- 2.13.6