From 5afacd39d3eb87f29a810f7434a27ac1dcf9edd2 Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Jan 31 2020 02:09:45 +0000
Subject: Ticket 50859 - support running only with ldaps socket


Bug Description: As plaintext protocols have shown they are
unable to be effectively secured, we should have the choice to
be able to run the server only as LDAPS for high assurance
environments.

Fix Description: Add a test to assert we can move to ldaps only
and back to ldap/ldaps. Add a command to help make this easier for
admins to find and discover.

https://pagure.io/389-ds-base/issue/50859

Author: William Brown <william@blackhats.net.au>

Review by: mreynolds (Thanks!)

---

diff --git a/dirsrvtests/tests/suites/tls/tls_ldaps_only_test.py b/dirsrvtests/tests/suites/tls/tls_ldaps_only_test.py
new file mode 100644
index 0000000..4bb5989
--- /dev/null
+++ b/dirsrvtests/tests/suites/tls/tls_ldaps_only_test.py
@@ -0,0 +1,46 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2020 William Brown <william@blackhats.net.au
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+import pytest
+import ldap
+from lib389.topologies import topology_st
+from lib389.utils import socket_check_open
+
+pytestmark = pytest.mark.tier1
+
+def test_tls_ldaps_only(topology_st):
+    """Test that the server can run with ldaps only.
+
+    :id: 812d806b-9368-4534-a291-cbc60ac92a23
+    :steps:
+        1. Enable TLS
+        2. Set the server to ldaps only and restart
+        3. Set the server to accept both and restart
+    :expectedresults:
+        1. TlS is setup
+        2. The server only works on ldaps
+        3. The server accepts both.
+    """
+    standalone = topology_st.standalone
+    # Enable TLS
+    standalone.enable_tls()
+    # Remember the existing port for later.
+    plain_port = standalone.config.get_attr_val_utf8('nsslapd-port')
+    tls_port = standalone.config.get_attr_val_utf8('nsslapd-securePort')
+    # Disable the plaintext port
+    standalone.config.disable_plaintext_port()
+    standalone.restart()
+    # Check we only have the tls port
+    nport = standalone.config.get_attr_val_utf8('nsslapd-port')
+    assert(nport == '0');
+    # Setup the plain again.
+    standalone.config.enable_plaintext_port(plain_port)
+    standalone.restart()
+    nport = standalone.config.get_attr_val_utf8('nsslapd-port')
+    assert(nport == plain_port);
+
diff --git a/src/lib389/lib389/cli_conf/security.py b/src/lib389/lib389/cli_conf/security.py
index 1d60a2f..d7390d1 100644
--- a/src/lib389/lib389/cli_conf/security.py
+++ b/src/lib389/lib389/cli_conf/security.py
@@ -11,6 +11,7 @@ import json
 import os
 from lib389.config import Config, Encryption, RSA
 from lib389.nss_ssl import NssSsl
+from lib389.cli_base import _warn
 
 
 Props = namedtuple('Props', ['cls', 'attr', 'help', 'values'])
@@ -203,6 +204,14 @@ def security_ciphers_list(inst, basedn, log, args):
             print(*lst, sep='\n')
 
 
+def security_disable_plaintext_port(inst, basedn, log, args, warn=True):
+    if warn and args.json is False:
+        _warn(True, msg="Disabling plaintext ldap port - you must have ldaps configured")
+    inst.config.disable_plaintext_port()
+    log.info("Plaintext port disabled - please restart your instance to take effect")
+    log.info("To undo this change run the subcommand - 'dsconf <instance> config replace nsslapd-port=<port number>'")
+
+
 def cert_add(inst, basedn, log, args):
     """Add server certificate
     """
@@ -367,6 +376,10 @@ def create_parser(subparsers):
         'Turn off security functionality. The rest of the configuration will be left untouched.'))
     security_disable_p.set_defaults(func=security_disable)
 
+    security_disable_plain_parser = security_sub.add_parser('disable_plain_port',
+        help="Disables the plain text LDAP port, allowing only LDAPS to function")
+    security_disable_plain_parser.set_defaults(func=security_disable_plaintext_port)
+
     # Server certificate management
     certs = security_sub.add_parser('certificate', help='Manage TLS certificates')
     certs_sub = certs.add_subparsers(help='certificate')
diff --git a/src/lib389/lib389/config.py b/src/lib389/lib389/config.py
index f71baf2..a2f0159 100644
--- a/src/lib389/lib389/config.py
+++ b/src/lib389/lib389/config.py
@@ -213,6 +213,19 @@ class Config(DSLdapObject):
             report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)
             yield report
 
+    def disable_plaintext_port(self):
+        """
+        Configure the server to not-provide the plaintext port.
+        """
+        self.set('nsslapd-port', '0')
+
+    def enable_plaintext_port(self, port):
+        """
+        Configure the server to provide the plaintext port on the specified port number.
+        """
+        self.set('nsslapd-port', port)
+
+
 class Encryption(DSLdapObject):
     """
         Manage "cn=encryption,cn=config" tree, including: