From: Ansgar Burchardt <ansgar@debian.org>
Date: Mon, 18 May 2015 18:48:40 +0000 (+0200)
Subject: Re-enable TLS for LDAP
X-Git-Url: https://git.decadent.org.uk/gitweb/?a=commitdiff_plain;h=81ab2a927229365202670424f6b9bf55836da528;p=dak.git

Re-enable TLS for LDAP

CACERTFILE now must point to a CA, using service certificates directly
doesn't work.

Also use per-connection settings for TLS. Note that the order of
set_option calls matters (setting ldap.OPT_X_TLS_NEWCTX first
fails)...
---

diff --git a/config/debian-security/dak.conf b/config/debian-security/dak.conf
index 42aa1e47..901f9ac5 100644
--- a/config/debian-security/dak.conf
+++ b/config/debian-security/dak.conf
@@ -56,7 +56,7 @@ Import-LDAP-Fingerprints
 {
   LDAPDn "ou=users,dc=debian,dc=org";
   LDAPServer "db.debian.org";
-  // CACertFile "/etc/ssl/certs/db.debian.org.pem";
+  CACertFile "/etc/ssl/ca-debian/ca-certificates.crt";
   ExtraKeyrings
   {
     "/srv/keyring.debian.org/keyrings/removed-keys.pgp";
diff --git a/config/debian/dak.conf b/config/debian/dak.conf
index 8a189373..cf0ef40d 100644
--- a/config/debian/dak.conf
+++ b/config/debian/dak.conf
@@ -99,7 +99,7 @@ Import-LDAP-Fingerprints
 {
   LDAPDn "ou=users,dc=debian,dc=org";
   LDAPServer "db.debian.org";
-  // CACertFile "/etc/ssl/certs/db.debian.org.pem";
+  CACertFile "/etc/ssl/ca-debian/ca-certificates.crt";
   ExtraKeyrings
   {
     "/srv/keyring.debian.org/keyrings/removed-keys.pgp";
diff --git a/daklib/dbconn.py b/daklib/dbconn.py
index 3fab31bc..432ddf8a 100644
--- a/daklib/dbconn.py
+++ b/daklib/dbconn.py
@@ -1232,15 +1232,9 @@ class Keyring(object):
         l = ldap.open(LDAPServer)
 
         if ca_cert_file:
-            # TODO: This should request a new context and use
-            # connection-specific options (i.e. "l.set_option(...)")
-
-            # Request a new TLS context. If there was already one, libldap
-            # would not change the TLS options (like which CAs to trust).
-            #l.set_option(ldap.OPT_X_TLS_NEWCTX, True)
-            ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
-            #ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, None)
-            ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, ca_cert_file)
+            l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
+            l.set_option(ldap.OPT_X_TLS_CACERTFILE, ca_cert_file)
+            l.set_option(ldap.OPT_X_TLS_NEWCTX, True)
             l.start_tls_s()
 
         l.simple_bind_s("","")