LDAP client's STARTTLS does not support LDAP servers that require 256-bit key lengths #1377

New Issue

GiteaMirror · 2025-11-02T03:58:38-06:00

GiteaMirror commented

2025-11-02 03:58:38 -06:00

Originally created by @smkent on GitHub (Dec 17, 2017).

Gitea version (or commit ref): 1.3.0
Git version: 2.13.6
Operating system: Gentoo Linux
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

I installed Gitea on my server and tried to connect it to my local OpenLDAP server, which requires STARTTLS with a security factor (ssf) of 256. Gitea's LDAP client does not enable the strongest TLS ciphers, and can only connect to OpenLDAP servers that allow a security factor (ssf) of 128 or lower. (OpenLDAP's ssf refers to the client's key size.)

I fixed this locally by applying the following patch while building Gitea:

diff -Naur gitea-1.3.0/modules/auth/ldap/ldap.go gitea-1.3.0-patched/modules/auth/ldap/ldap.go
--- src/code.gitea.io/gitea/modules/auth/ldap/ldap.go   2017-11-29 06:51:47.000000000 -0800
+++ src/code.gitea.io/gitea/modules/auth/ldap/ldap.go   2017-12-11 15:25:02.722116453 -0800
@@ -125,8 +125,17 @@
        log.Trace("Dialing LDAP with security protocol (%v) without verifying: %v", ls.SecurityProtocol, ls.SkipVerify)

        tlsCfg := &tls.Config{
-               ServerName:         ls.Host,
-               InsecureSkipVerify: ls.SkipVerify,
+               ServerName:               ls.Host,
+               InsecureSkipVerify:       ls.SkipVerify,
+               MinVersion:               tls.VersionTLS12,
+               CurvePreferences:         []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256},
+               PreferServerCipherSuites: true,
+               CipherSuites: []uint16{
+                       tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                       tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+                       tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+                       tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+               },
        }
        if ls.SecurityProtocol == SecurityProtocolLDAPS {
                return ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", ls.Host, ls.Port), tlsCfg)

I do not know what the proper solution is for upstream, but it would be nice if these ciphers were enabled in the LDAP client.

Originally created by @smkent on GitHub (Dec 17, 2017).  - Gitea version (or commit ref): 1.3.0 - Git version: 2.13.6 - Operating system: Gentoo Linux - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description I installed Gitea on my server and tried to connect it to my local OpenLDAP server, which requires STARTTLS with a security factor (`ssf`) of 256. Gitea's LDAP client does not enable the strongest TLS ciphers, and can only connect to OpenLDAP servers that allow a security factor (`ssf`) of 128 or lower. (OpenLDAP's `ssf` refers to the client's key size.) I fixed this locally by applying the following patch while building Gitea: ``` diff -Naur gitea-1.3.0/modules/auth/ldap/ldap.go gitea-1.3.0-patched/modules/auth/ldap/ldap.go --- src/code.gitea.io/gitea/modules/auth/ldap/ldap.go 2017-11-29 06:51:47.000000000 -0800 +++ src/code.gitea.io/gitea/modules/auth/ldap/ldap.go 2017-12-11 15:25:02.722116453 -0800 @@ -125,8 +125,17 @@ log.Trace("Dialing LDAP with security protocol (%v) without verifying: %v", ls.SecurityProtocol, ls.SkipVerify) tlsCfg := &tls.Config{ - ServerName: ls.Host, - InsecureSkipVerify: ls.SkipVerify, + ServerName: ls.Host, + InsecureSkipVerify: ls.SkipVerify, + MinVersion: tls.VersionTLS12, + CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256}, + PreferServerCipherSuites: true, + CipherSuites: []uint16{ + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + tls.TLS_RSA_WITH_AES_256_GCM_SHA384, + tls.TLS_RSA_WITH_AES_256_CBC_SHA, + }, } if ls.SecurityProtocol == SecurityProtocolLDAPS { return ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", ls.Host, ls.Port), tlsCfg) ``` I do not know what the proper solution is for upstream, but it would be nice if these ciphers were enabled in the LDAP client.

GiteaMirror added the type/enhancement issue/stale labels 2025-11-02 03:58:38 -06:00

GiteaMirror closed this issue

2025-11-02 03:58:38 -06:00

GiteaMirror commented

2025-11-02 03:58:39 -06:00

@stale[bot] commented on GitHub (Feb 10, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Feb 10, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 03:58:39 -06:00

@stale[bot] commented on GitHub (Feb 24, 2019):

This issue has been automatically closed because of inactivity. You can re-open it if needed.

@stale[bot] commented on GitHub (Feb 24, 2019): This issue has been automatically closed because of inactivity. You can re-open it if needed.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1377