From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 29 Aug 2014 09:38:36 +0000 (+0200)
Subject: Disable cert validation when pre-establishing connections in rlm_rest
X-Git-Tag: release_3_0_5~687
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2cb8d76dab5bb0347d5bf5b3484bf15dc0c5aa37;p=thirdparty%2Ffreeradius-server.git

Disable cert validation when pre-establishing connections in rlm_rest

We don't have a valid TLS configuration to use.

libcurl appears to do the right thing, and validate the cert when reconfigured to for subsequent requests.

We tell libcurl to *only* establish the connection and not send any data, so there's no chance of us
leaking sensitive information.
---

diff --git a/raddb/mods-available/rest b/raddb/mods-available/rest
index 368ce2a041a..1a2a125ad9b 100644
--- a/raddb/mods-available/rest
+++ b/raddb/mods-available/rest
@@ -54,7 +54,7 @@ rest {
 	#                   Values from expansion will not be escaped, this should be
 	#                   done using the appropriate xlat method e.g. %{urlencode:<attr>}.
 	#    force_to     - Force the response to be decoded with this decoder.
-	#                   May be 'plain' (created reply:REST-HTTP-Body), 'post'
+	#                   May be 'plain' (creates reply:REST-HTTP-Body), 'post'
 	#                   or 'json'.
 	#    tls          - TLS settings for HTTPS.
 	#    auth         - HTTP auth method to use, one of 'none', 'srp', 'basic',
diff --git a/src/modules/rlm_rest/rest.c b/src/modules/rlm_rest/rest.c
index ce7abfe0dfd..e7fca3e2e15 100644
--- a/src/modules/rlm_rest/rest.c
+++ b/src/modules/rlm_rest/rest.c
@@ -342,6 +342,8 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
 		 *  done on the first request, but we do it here to minimise
 		 *  latency.
 		 */
+		SET_OPTION(CURLOPT_SSL_VERIFYPEER, 0);
+		SET_OPTION(CURLOPT_SSL_VERIFYHOST, 0);
 		SET_OPTION(CURLOPT_CONNECT_ONLY, 1);
 		SET_OPTION(CURLOPT_URL, inst->connect_uri);
 
@@ -2043,11 +2045,8 @@ int rest_request_config(rlm_rest_t *instance, rlm_rest_section_t *section,
 		SET_OPTION(CURLOPT_RANDOM_FILE, section->tls_random_file);
 	}
 
-	if (section->tls_check_cert) {
-		SET_OPTION(CURLOPT_SSL_VERIFYHOST, (section->tls_check_cert_cn == true) ? 2 : 0);
-	} else {
-		SET_OPTION(CURLOPT_SSL_VERIFYPEER, 0);
-	}
+	SET_OPTION(CURLOPT_SSL_VERIFYPEER, (section->tls_check_cert == true) ? 1 : 0);
+	SET_OPTION(CURLOPT_SSL_VERIFYHOST, (section->tls_check_cert_cn == true) ? 2 : 0);
 
 	/*
 	 *	Tell CURL how to get HTTP body content, and how to process incoming data.