From: Jorge Pereira <jpereiran@gmail.com>
Date: Wed, 9 Dec 2020 17:30:17 +0000 (-0300)
Subject: :gear: Add and document tls_min_version
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c24db528165c41dc2b598abc3d30f74fa446e534;p=thirdparty%2Ffreeradius-server.git

:gear: Add and document tls_min_version
---

diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index 5aa910f1489..b6ccd15f59d 100644
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -742,10 +742,16 @@ ldap {
 		#  | 'demand' | fail if the certificate does not verify.
 		#  | 'hard'   | similar to 'demand' but fails if TLS cannot negotiate.
 		#  |===
- 		#
+		#
 		#  NOTE: The default is libldap's default, which varies based on the contents of `ldap.conf`.
 		#
 #		require_cert = 'demand'
+
+		#
+		#  Minimum TLS version to accept. We STRONGLY recommend
+		#  setting this to "1.2"
+		#
+#		tls_min_version = "1.2"
 	}
 
 	#
diff --git a/src/lib/ldap/base.h b/src/lib/ldap/base.h
index f0454e1a6ad..d5a2ebe4f5e 100644
--- a/src/lib/ldap/base.h
+++ b/src/lib/ldap/base.h
@@ -237,6 +237,8 @@ typedef struct {
 
 	int			tls_require_cert;	//!< OpenLDAP constant representing the require cert string.
 
+	char const		*tls_min_version_str;		//!< Minimum TLS version
+	int			tls_min_version;
 
 	/*
 	 *	For keep-alives.
diff --git a/src/lib/ldap/connection.c b/src/lib/ldap/connection.c
index e4ab5c43887..8d005330635 100644
--- a/src/lib/ldap/connection.c
+++ b/src/lib/ldap/connection.c
@@ -276,12 +276,18 @@ int fr_ldap_connection_configure(fr_ldap_connection_t *c, fr_ldap_config_t const
 	maybe_ldap_option(LDAP_OPT_X_TLS_CERTFILE, "certificate_file", config->tls_certificate_file);
 	maybe_ldap_option(LDAP_OPT_X_TLS_KEYFILE, "private_key_file", config->tls_private_key_file);
 
-#  ifdef LDAP_OPT_X_TLS_NEVER
+#  ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
 	if (config->tls_require_cert_str) {
 		do_ldap_option(LDAP_OPT_X_TLS_REQUIRE_CERT, "require_cert", &config->tls_require_cert);
 	}
 #  endif
 
+#  ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+	if (config->tls_min_version_str) {
+		do_ldap_option(LDAP_OPT_X_TLS_PROTOCOL_MIN, "tls_min_version", &config->tls_min_version);
+	}
+#  endif
+
 	/*
 	 *	Counter intuitively the TLS context appears to need to be initialised
 	 *	after all the TLS options are set on the handle.
diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index 21ea7c42525..b61ac2a7b43 100644
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -73,6 +73,10 @@ static CONF_PARSER tls_config[] = {
 
 	{ FR_CONF_OFFSET("require_cert", FR_TYPE_STRING, fr_ldap_config_t, tls_require_cert_str) },
 
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+	{ FR_CONF_OFFSET("tls_min_version", FR_TYPE_STRING, fr_ldap_config_t, tls_min_version_str) },
+#endif
+
 	CONF_PARSER_TERMINATOR
 };
 
@@ -1978,6 +1982,30 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf)
 			      "rebuild this module");
 
 		goto error;
+#endif
+	}
+
+if (inst->handle_config.tls_min_version_str) {
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+		if (strcmp(inst->handle_config.tls_min_version_str, "1.2") == 0) {
+			inst->handle_config.tls_min_version = LDAP_OPT_X_TLS_PROTOCOL_TLS1_2;
+
+		} else if (strcmp(inst->handle_config.tls_min_version_str, "1.1") == 0) {
+			inst->handle_config.tls_min_version = LDAP_OPT_X_TLS_PROTOCOL_TLS1_1;
+
+		} else if (strcmp(inst->handle_config.tls_min_version_str, "1.0") == 0) {
+			inst->handle_config.tls_min_version = LDAP_OPT_X_TLS_PROTOCOL_TLS1_0;
+
+		} else {
+			cf_log_err(conf, "Invalid 'tls.tls_min_version' value \"%s\"", inst->handle_config.tls_min_version_str);
+			goto error;
+		}
+#else
+		cf_log_err(conf, "This version of libldap does not support tls.tls_min_version."
+			      " Please upgrade or substitute current libldap and "
+			      "rebuild this module");
+		goto error;
+
 #endif
 	}