Merge branch 'master' into feat/tls-improvement-by-hth2

v2/glauth.go

@@ -143,20 +143,32 @@ func startService() {
 	startConfigWatcher()
 
 	var err error
-	var tlsConfig *tls.Config
+	var starttlsConfig *tls.Config
 	if c := activeConfig.LDAP; c.Enabled && c.TLS {
 		// TODO check if tls params are string or bytes and change config accordingly
-		tlsConfig, err = _tls.MakeTLS([]byte(c.TLSCert), []byte(c.TLSKey))
+		starttlsConfig, err = _tls.MakeTLS([]byte(c.TLSCert), []byte(c.TLSKey), c.LegacyTLS)
 
 		if err != nil {
-			log.Warn().Err(err).Msg("unable to configure TLS, proceeding without....StartTLS won't be supported")
+			log.Warn().Err(err).Msg("unable to configure TLS for StartTLS: StartTLS won't be supported")
+		}
+	}
+
+	var ldapstlsConfig *tls.Config
+	if c := activeConfig.LDAPS; c.Enabled {
+		// TODO check if tls params are string or bytes and change config accordingly
+		ldapstlsConfig, err = _tls.MakeTLS([]byte(c.Cert), []byte(c.Key), c.LegacyTLS)
+
+		if err != nil {
+			log.Warn().Err(err).Msg("unable to configure TLS for LDAPS")
+			os.Exit(1)
 		}
 	}
 
 	s, err := server.NewServer(
 		server.Logger(log),
 		server.Config(activeConfig),
-		server.TLSConfig(tlsConfig),
+		server.StartTLSConfig(starttlsConfig),
+		server.LDAPSTLSConfig(ldapstlsConfig),
 		server.Monitor(monitor),
 		server.Tracer(tracer),
 	)

v2/go.sum

@@ -14,6 +14,7 @@ github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=

v2/internal/tls/tls.go

@@ -12,8 +12,29 @@ var (
 	log zerolog.Logger
 )
 
+var secureCipherSuites = []uint16{
+	// TLS 1.3 cipher suites (automatically used when TLS 1.3 is negotiated)
+	tls.TLS_AES_128_GCM_SHA256,
+	tls.TLS_AES_256_GCM_SHA384,
+	tls.TLS_CHACHA20_POLY1305_SHA256,
+
+	// TLS 1.2 ECDHE cipher suites (Forward Secrecy)
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+	tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+
+	// Additional secure TLS 1.2 cipher suites (CBC with HMAC-SHA256)
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+	// 	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+	// tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+}
+
 // MakeTLS generates a tls.Config
-func MakeTLS(clientCert, key []byte) (*tls.Config, error) {
+func MakeTLS(clientCert, key []byte, legacy bool) (*tls.Config, error) {
 	if clientCert == nil && key == nil {
 		return new(tls.Config), nil
 	}
@@ -55,11 +76,24 @@ func MakeTLS(clientCert, key []byte) (*tls.Config, error) {
 	log.Debug().Interface("root.ca", rootCAs)
 	log.Debug().Interface("certificates", []tls.Certificate{cert})
 
+	if legacy {
+		return &tls.Config{
+			RootCAs:                  rootCAs,
+			MinVersion:               tls.VersionTLS10,
+			MaxVersion:               tls.VersionTLS13,
+			PreferServerCipherSuites: true,
+			CipherSuites:             nil,
+			Certificates:             []tls.Certificate{cert},
+		}, nil
+	}
+
 	return &tls.Config{
-		RootCAs:      rootCAs,
-		MinVersion:   tls.VersionTLS10,
-		MaxVersion:   tls.VersionTLS13,
-		Certificates: []tls.Certificate{cert},
+		RootCAs:                  rootCAs,
+		MinVersion:               tls.VersionTLS12,
+		MaxVersion:               tls.VersionTLS13,
+		PreferServerCipherSuites: true,
+		CipherSuites:             secureCipherSuites,
+		Certificates:             []tls.Certificate{cert},
 	}, nil
 }
 
@@ -79,3 +113,11 @@ func DecodePEM(certPEM []byte) tls.Certificate {
 
 	return cert
 }
+
+func CipherSuiteNames(suites []uint16) []string {
+	var names []string
+	for _, suite := range suites {
+		names = append(names, tls.CipherSuiteName(suite))
+	}
+	return names
+}

v2/internal/toml/config.go

@@ -386,13 +386,47 @@ func validateConfig(cfg *config.Config) (*config.Config, error) {
 
 	if cfg.LDAPS.Enabled {
 		// LDAPS enabled - verify requirements (cert, key, listen)
-		if len(cfg.LDAPS.Cert) == 0 || len(cfg.LDAPS.Key) == 0 {
-			return cfg, fmt.Errorf("LDAPS was enabled but no certificate or key were specified: please disable LDAPS or use the 'cert' and 'key' options")
-		}
-
 		if len(cfg.LDAPS.Listen) == 0 {
 			return cfg, fmt.Errorf("no LDAPS bind address was specified: please disable LDAPS or use the 'listen' option")
 		}
+
+		if cfg.LDAPS.Cert == "" && cfg.LDAPS.CertPath != "" {
+			byteData, err := os.ReadFile(cfg.LDAPS.CertPath)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS certificate file")
+			}
+			cfg.LDAPS.Cert = string(byteData)
+		}
+
+		if cfg.LDAPS.Key == "" && cfg.LDAPS.KeyPath != "" {
+			byteData, err := os.ReadFile(cfg.LDAPS.KeyPath)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS key file")
+			}
+			cfg.LDAPS.Key = string(byteData)
+		}
+
+		// Ugly wart for backward compatibility
+		// In the olden times, we would simply say "please read from this file"
+		// This is now the role of the Path files.
+		if !strings.HasPrefix(cfg.LDAPS.Cert, "-----") {
+			byteData, err := os.ReadFile(cfg.LDAPS.Cert)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS certificate file")
+			}
+			cfg.LDAPS.Cert = string(byteData)
+		}
+		if !strings.HasPrefix(cfg.LDAPS.Key, "-----") {
+			byteData, err := os.ReadFile(cfg.LDAPS.Key)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS key file")
+			}
+			cfg.LDAPS.Key = string(byteData)
+		}
+
+		if cfg.LDAPS.Cert == "" || cfg.LDAPS.Key == "" {
+			return cfg, fmt.Errorf("LDAPS was enabled but no certificate or key were specified: please disable LDAPS or use the 'cert'/'key' or 'certpath'/'keypath' options")
+		}
 	}
 
 	if cfg.LDAP.Enabled {
@@ -401,24 +435,27 @@ func validateConfig(cfg *config.Config) (*config.Config, error) {
 			return cfg, fmt.Errorf("no LDAP bind address was specified: please disable LDAP or use the 'listen' option")
 		}
 
-		if cfg.LDAP.TLS && cfg.LDAP.TLSCert == "" && cfg.LDAP.TLSCertPath != "" {
-			byteData, err := os.ReadFile(cfg.LDAP.TLSCertPath)
-			cfg.LDAP.TLSCert = string(byteData)
+		if cfg.LDAP.TLS {
+			if cfg.LDAP.TLSCert == "" && cfg.LDAP.TLSCertPath != "" {
+				byteData, err := os.ReadFile(cfg.LDAP.TLSCertPath)
+				if err != nil {
+					return cfg, fmt.Errorf("unable to read TLS certificate file")
+				}
+				cfg.LDAP.TLSCert = string(byteData)
+			}
 
-			if err != nil {
-				return cfg, fmt.Errorf("unable to read TLS certificate file")
+			if cfg.LDAP.TLSKey == "" && cfg.LDAP.TLSKeyPath != "" {
+				byteData, err := os.ReadFile(cfg.LDAP.TLSKeyPath)
+				if err != nil {
+					return cfg, fmt.Errorf("unable to read TLS key file")
+				}
+				cfg.LDAP.TLSKey = string(byteData)
+			}
+
+			if cfg.LDAP.TLSCert == "" || cfg.LDAP.TLSKey == "" {
+				return cfg, fmt.Errorf("StartTLS was enabled but no certificate or key were specified: please disable StartTLS or use the 'tlscert'/'tlskey' or 'tlscertpath'/'tlskeypath' options")
 			}
 		}
-
-		if cfg.LDAP.TLS && cfg.LDAP.TLSKey == "" && cfg.LDAP.TLSKeyPath != "" {
-			byteData, err := os.ReadFile(cfg.LDAP.TLSKeyPath)
-			cfg.LDAP.TLSKey = string(byteData)
-
-			if err != nil {
-				return cfg, fmt.Errorf("unable to read TLS key file")
-			}
-		}
-
 	}
 
 	//spew.Dump(cfg)

v2/pkg/config/config.go

@@ -48,13 +48,18 @@ type (
 		TLSKey      string
 		TLSCertPath string
 		TLSKeyPath  string
+		LegacyTLS   bool
 	}
 
 	LDAPS struct {
 		Enabled bool
 		Listen  string
-		Cert    string
-		Key     string
+		// LDAPS TLS parameters
+		Cert      string
+		Key       string
+		CertPath  string
+		KeyPath   string
+		LegacyTLS bool
 	}
 
 	API struct {

v2/pkg/server/options.go

@@ -16,12 +16,13 @@ type Option func(o *Options)
 
 // Options defines the available options for this package.
 type Options struct {
-	Logger    zerolog.Logger
-	Config    *config.Config
-	TLSConfig *tls.Config
-	Monitor   monitoring.MonitorInterface
-	Tracer    trace.Tracer
-	Context   context.Context
+	Logger         zerolog.Logger
+	Config         *config.Config
+	StartTLSConfig *tls.Config
+	LDAPSTLSConfig *tls.Config
+	Monitor        monitoring.MonitorInterface
+	Tracer         trace.Tracer
+	Context        context.Context
 }
 
 // newOptions initializes the available default options.
@@ -56,10 +57,17 @@ func Context(val context.Context) Option {
 	}
 }
 
-// TLSConfig provides a function to set the TLS config option.
-func TLSConfig(val *tls.Config) Option {
+// TLSConfig provides a function to set the StartTLS config option.
+func StartTLSConfig(val *tls.Config) Option {
 	return func(o *Options) {
-		o.TLSConfig = val
+		o.StartTLSConfig = val
+	}
+}
+
+// TLSConfig provides a function to set the LDAPSTls config option.
+func LDAPSTLSConfig(val *tls.Config) Option {
+	return func(o *Options) {
+		o.LDAPSTLSConfig = val
 	}
 }
 

v2/pkg/server/server.go

@@ -1,10 +1,13 @@
 package server
 
 import (
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"plugin"
 
+	_tls "github.com/glauth/glauth/v2/internal/tls"
+
 	"github.com/rs/zerolog"
 	"go.opentelemetry.io/otel/trace"
 
@@ -20,9 +23,10 @@ type LdapSvc struct {
 	yubiAuth *yubigo.YubiAuth
 	l        *ldap.Server
 
-	monitor monitoring.MonitorInterface
-	tracer  trace.Tracer
-	log     zerolog.Logger
+	ldapstls *tls.Config
+	monitor  monitoring.MonitorInterface
+	tracer   trace.Tracer
+	log      zerolog.Logger
 }
 
 func NewServer(opts ...Option) (*LdapSvc, error) {
@@ -96,9 +100,22 @@ func NewServer(opts ...Option) (*LdapSvc, error) {
 	s.l = ldap.NewServer()
 	s.l.EnforceLDAP = true
 
-	if tlsConfig := options.TLSConfig; tlsConfig != nil {
+	if tlsConfig := options.StartTLSConfig; tlsConfig != nil {
 		s.l.TLSConfig = tlsConfig
-		s.log.Debug().Interface("tls.certificates", tlsConfig.Certificates).Msg("enabling LDAP over TLS")
+		s.log.Info().
+			Str("tls.min_version", tls.VersionName(tlsConfig.MinVersion)).
+			Str("tls.max_version", tls.VersionName(tlsConfig.MaxVersion)).
+			Interface("tls.cipher_suites", _tls.CipherSuiteNames(tlsConfig.CipherSuites)).
+			Msg("enabling LDAP over TLS")
+	}
+
+	if tlsConfig := options.LDAPSTLSConfig; tlsConfig != nil {
+		s.ldapstls = tlsConfig
+		s.log.Info().
+			Str("tls.min_version", tls.VersionName(tlsConfig.MinVersion)).
+			Str("tls.max_version", tls.VersionName(tlsConfig.MaxVersion)).
+			Interface("tls.cipher_suites", _tls.CipherSuiteNames(tlsConfig.CipherSuites)).
+			Msg("enabling LDAPS")
 	}
 
 	for i, backend := range s.c.Backends {
@@ -199,11 +216,11 @@ func (s *LdapSvc) ListenAndServe() error {
 // ListenAndServeTLS listens on the TCP network address s.c.LDAPS.Listen
 func (s *LdapSvc) ListenAndServeTLS() error {
 	s.log.Info().Str("address", s.c.LDAPS.Listen).Msg("LDAPS server listening")
-	return s.l.ListenAndServeTLS(
-		s.c.LDAPS.Listen,
-		s.c.LDAPS.Cert,
-		s.c.LDAPS.Key,
-	)
+	listener, err := tls.Listen("tcp", s.c.LDAPS.Listen, s.ldapstls)
+	if err != nil {
+		return err
+	}
+	return s.l.Serve(listener)
 }
 
 // Shutdown ends listeners by sending true to the ldap serves quit channel