Bug 1483979

Summary:	openldap: utilize system-wide crypto-policies
Product:	[Fedora] Fedora	Reporter:	Nikos Mavrogiannopoulos <nmavrogi>
Component:	openldap	Assignee:	Matus Honek <mhonek>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	28	CC:	mhonek, nmavrogi, rmeggins
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openldap-2.4.45-14.fc28	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-06-25 17:00:33 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1179209

Description Nikos Mavrogiannopoulos 2017-08-22 12:14:45 UTC

[similarly with curl, this is to make sure that crypto policies support is operational even when openldap is linked with openssl]

Please convert to use the system's crypto policy for SSL and TLS:
https://fedoraproject.org/wiki/Packaging:CryptoPolicies

If this program is compiled against gnutls, change the default priority string to be "@SYSTEM" or to use gnutls_set_default_priority().

If this program is compiled against openssl, and there is no default cipher list specified, you don't need to modify it. Otherwise replace the default cipher list with "PROFILE=SYSTEM".

In both cases please verify that the application uses the system's crypto policies.

If the package is already using the system-wide crypto policies, or it does not use SSL or TLS, no action is required, the bug can simply be closed.

Comment 1 Fedora End Of Life 2018-02-20 15:26:12 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle.
Changing version to '28'.

Comment 2 Matus Honek 2018-03-01 16:36:52 UTC

Hello Nikos,

nowadays we use OpenSSL for crypto. For OpenLDAP, there is an option to set the ciphers, however these are set only if explicitly set in a configuration file. By default the configuration files do not mention almost any options (apart from those that are different from upstream default) which is also the case of the option to set the ciphers. All the options are of course documented in according man pages.

Given the above and me inclining to not mention explicitly an implicit option value, I guess there is no need to do any change to openldap component. Does this reasoning align with the system-wide crypto policies recommended implementation? I am asking because the spelling of the documentation for system-wide crypto policies does not explicitly mention the case OpenLDAP has - the option is there but it is not shipped in default configuration files.

Thanks for clarification!

Comment 3 Nikos Mavrogiannopoulos 2018-03-02 08:34:50 UTC

Hi Matus, if there is a default config, I'd make sure that any ciphers are commented out, with a small comment that this is the recommended way in order to use the system-wide settings.

Comment 4 Matus Honek 2018-03-06 09:19:05 UTC

Thanks for the feedback, Nikos. I've done so:
https://src.fedoraproject.org/rpms/openldap/c/81afb5768a29e7c033514860da6e25d3d9242d24?branch=f28

Comment 5 Nikos Mavrogiannopoulos 2018-03-06 09:39:05 UTC

Thank you

Comment 6 Matus Honek 2018-06-25 17:00:33 UTC

Closing as CURRENTRELEASE, as the change has been in for quite some time already (see Fixed In Version of this bug).