Disable cert validation when pre-establishing connections in rlm_rest

We don't have a valid TLS configuration to use.

libcurl appears to do the right thing, and validate the cert when reconfigured to for subsequent requests.

We tell libcurl to *only* establish the connection and not send any data, so there's no chance of us
leaking sensitive information.

diff --git a/raddb/mods-available/rest b/raddb/mods-available/rest
index 368ce2a041a4e6cdb70907534aea36a8ffe73eec..1a2a125ad9ba9256a7ad50305bdfaddae8864270 100644 (file)
--- a/raddb/mods-available/rest
+++ b/raddb/mods-available/rest
@@ -54,7 +54,7 @@ rest {
        #                   Values from expansion will not be escaped, this should be
        #                   done using the appropriate xlat method e.g. %{urlencode:<attr>}.
        #    force_to     - Force the response to be decoded with this decoder.
-       #                   May be 'plain' (created reply:REST-HTTP-Body), 'post'
+       #                   May be 'plain' (creates reply:REST-HTTP-Body), 'post'
        #                   or 'json'.
        #    tls          - TLS settings for HTTPS.
        #    auth         - HTTP auth method to use, one of 'none', 'srp', 'basic',

diff --git a/src/modules/rlm_rest/rest.c b/src/modules/rlm_rest/rest.c
index ce7abfe0dfd62f9d8fd3619f1e2c26ea1f5c7ebf..e7fca3e2e1539a49ea6265d67f016e2ffac0b3cf 100644 (file)
--- a/src/modules/rlm_rest/rest.c
+++ b/src/modules/rlm_rest/rest.c
@@ -342,6 +342,8 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
                 *  done on the first request, but we do it here to minimise
                 *  latency.
                 */
+               SET_OPTION(CURLOPT_SSL_VERIFYPEER, 0);
+               SET_OPTION(CURLOPT_SSL_VERIFYHOST, 0);
                SET_OPTION(CURLOPT_CONNECT_ONLY, 1);
                SET_OPTION(CURLOPT_URL, inst->connect_uri);
 
@@ -2043,11 +2045,8 @@ int rest_request_config(rlm_rest_t *instance, rlm_rest_section_t *section,
                SET_OPTION(CURLOPT_RANDOM_FILE, section->tls_random_file);
        }
 
-       if (section->tls_check_cert) {
-               SET_OPTION(CURLOPT_SSL_VERIFYHOST, (section->tls_check_cert_cn == true) ? 2 : 0);
-       } else {
-               SET_OPTION(CURLOPT_SSL_VERIFYPEER, 0);
-       }
+       SET_OPTION(CURLOPT_SSL_VERIFYPEER, (section->tls_check_cert == true) ? 1 : 0);
+       SET_OPTION(CURLOPT_SSL_VERIFYHOST, (section->tls_check_cert_cn == true) ? 2 : 0);
 
        /*
         *      Tell CURL how to get HTTP body content, and how to process incoming data.