diff options
| author | Christian Heimes <cheimes@redhat.com> | 2019-02-05 15:19:43 +0100 |
|---|---|---|
| committer | Tibor Dudlák <tdudlak@redhat.com> | 2019-04-03 15:16:21 +0200 |
| commit | 350954589774499d99bf87cb5631c664bb0707c4 (patch) | |
| tree | ce1d4aa55dc92aeb1d2f6e2401a13c2d2c095120 /ipapython | |
| parent | 1dfac4f5b7e9986e1217d6979b854b94de094aae (diff) | |
| download | freeipa-350954589774499d99bf87cb5631c664bb0707c4.tar.gz freeipa-350954589774499d99bf87cb5631c664bb0707c4.tar.xz freeipa-350954589774499d99bf87cb5631c664bb0707c4.zip | |
Require a minimum SASL security factor of 56
SSF_MINX 56 level ensures data integrity and confidentiality for SASL
GSSAPI and SASL GSS SPNEGO connections.
Although at least AES128 is enforced pretty much everywhere, 56 is required
for backwards compatibility with systems that announce wrong SSF.
Related: https://pagure.io/freeipa/issue/7140
Related: https://pagure.io/freeipa/issue/4580
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
Diffstat (limited to 'ipapython')
| -rw-r--r-- | ipapython/ipaldap.py | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py index 9ff443fe4..d9d67be1d 100644 --- a/ipapython/ipaldap.py +++ b/ipapython/ipaldap.py @@ -43,7 +43,9 @@ import six # pylint: disable=ipa-forbidden-import from ipalib import errors, x509, _ -from ipalib.constants import LDAP_GENERALIZED_TIME_FORMAT +from ipalib.constants import ( + LDAP_GENERALIZED_TIME_FORMAT, LDAP_SSF_MIN_THRESHOLD +) # pylint: enable=ipa-forbidden-import from ipaplatform.paths import paths from ipapython.ipautil import format_netloc, CIDict @@ -103,7 +105,8 @@ def realm_to_ldapi_uri(realm_name): return 'ldapi://' + ldapurl.ldapUrlEscape(socketname) -def ldap_initialize(uri, cacertfile=None): +def ldap_initialize(uri, cacertfile=None, + ssf_min_threshold=LDAP_SSF_MIN_THRESHOLD): """Wrapper around ldap.initialize() The function undoes global and local ldap.conf settings that may cause @@ -114,6 +117,10 @@ def ldap_initialize(uri, cacertfile=None): locations, also known as system-wide trust store. * Cert validation is enforced. * SSLv2 and SSLv3 are disabled. + * Require a minimum SASL security factor of 56. That level ensures + data integrity and confidentiality. Although at least AES128 is + enforced pretty much everywhere, 56 is required for backwards + compatibility with systems that announce wrong SSF. """ conn = ldap.initialize(uri) @@ -121,6 +128,12 @@ def ldap_initialize(uri, cacertfile=None): conn.set_option(ldap.OPT_X_SASL_NOCANON, ldap.OPT_ON) if not uri.startswith('ldapi://'): + # require a minimum SSF for TCP connections, but don't lower SSF_MIN + # if the current value is already larger. + cur_min_ssf = conn.get_option(ldap.OPT_X_SASL_SSF_MIN) + if cur_min_ssf < ssf_min_threshold: + conn.set_option(ldap.OPT_X_SASL_SSF_MIN, ssf_min_threshold) + if cacertfile: if not os.path.isfile(cacertfile): raise IOError(errno.ENOENT, cacertfile) |