[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: undocumented TLSProtocolMin
On Tue, 23 Jul 2013, Quanah Gibson-Mount wrote:
> --On Tuesday, July 23, 2013 1:11 PM +0200 Manuel Gaupp <mgaupp@googlemail.com>
> wrote:
> > OpenLDAP seems to support an undocumented configuration parameter
> > "TLSProtocolMin" when linked against OpenSSL. It allows to set the
> > minimum SSL/TLS protocol version:
> >
> > * TLSProtocolMin 768 # (3 << 8) disables SSLv2
> > * TLSProtocolMin 769 # ((3 << 8)+1) disables SSLv2 and SSLv3
> >
> > As there's no documentation for TLSProtocolMin:
> > Is this feature ready for production or is it experimental?
>
> Please file an ITS about its lack of documentation:
> http://www.openldap.org/its
My original ITS for this included an update for ldap.conf(5) which was
never committed:
http://www.openldap.org/its/index.cgi/Software%20Enhancements?id=5655
I thought I had a diff for slapd.conf(5) as well, but I don't see it in
the src trees I have on hand. Maybe it's in that backup at home. The
bulk of the wording can be shared with the ldap.conf(5) diff, of course.
That reminds me: now that newer versions of OpenSSL have support for TLS
1.1 and 1.2, including the ability to disable them, here's a diff to add
support for doing so in OpenLDAP. Build tested only.
Philip Guenther
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
index 24d43ee..3c077f8 100644
--- a/libraries/libldap/tls_o.c
+++ b/libraries/libldap/tls_o.c
@@ -219,6 +219,25 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
(const unsigned char *) "OpenLDAP", sizeof("OpenLDAP")-1 );
}
+#ifdef SSL_OP_NO_TLSv1
+#ifdef SSL_OP_NO_TLSv1_1
+#ifdef SSL_OP_NO_TLSv1_2
+ if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_TLS1_2)
+ SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+ SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
+ SSL_OP_NO_TLSv1_2 );
+ else
+#endif
+ if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_TLS1_1)
+ SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+ SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 );
+ else
+#endif
+ if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_TLS1_0)
+ SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+ SSL_OP_NO_TLSv1);
+ else
+#endif
if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL3 )
SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 );
else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 )