(tooling-trusted-releases) branch sbp updated: Set explicit LDAP TLS cipher suites

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/sbp by this push:
     new 48761df6 Set explicit LDAP TLS cipher suites
48761df6 is described below

commit 48761df606315551d62cc132a2cd76f7e63886ce
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Tue Oct 13 15:23:01 2026 +0100

    Set explicit LDAP TLS cipher suites
---
 atr/ldap.py             |  1 +
 tests/unit/test_ldap.py | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/atr/ldap.py b/atr/ldap.py
index ca359b72..f7468df0 100644
--- a/atr/ldap.py
+++ b/atr/ldap.py
@@ -89,6 +89,7 @@ class Result(schema.Strict):
 
 _tls_config = ldap3.Tls(
     validate=ssl.CERT_REQUIRED,
+    ciphers="ECDHE+AESGCM:ECDHE+CHACHA20",
 )
 
 
diff --git a/tests/unit/test_ldap.py b/tests/unit/test_ldap.py
index 3cc100fa..9fd03e5e 100644
--- a/tests/unit/test_ldap.py
+++ b/tests/unit/test_ldap.py
@@ -16,6 +16,7 @@
 # under the License.
 
 import pathlib
+import ssl
 import unittest.mock as mock
 from typing import TYPE_CHECKING
 
@@ -487,6 +488,19 @@ def test_search_sets_failed_on_exception(monkeypatch: "MonkeyPatch"):
     assert params.err_msg is not None
 
 
+def test_tls_config_restricts_ciphers():
+    with mock.patch.object(ssl.SSLContext, "wrap_socket", autospec=True) as wrap_socket:
+        ldap._tls_config.wrap_socket(mock.Mock())
+
+    context = wrap_socket.call_args.args[0]
+    ciphers = context.get_ciphers()
+    assert context.verify_mode == ssl.CERT_REQUIRED
+    assert context.verify_flags & ssl.VERIFY_X509_STRICT
+    assert {cipher["protocol"] for cipher in ciphers} == {"TLSv1.2", "TLSv1.3"}
+    assert all(cipher["aead"] for cipher in ciphers)
+    assert all(cipher["kea"] in {"kx-any", "kx-ecdhe"} for cipher in ciphers)
+
+
 def _make_pubsub_payload(
     uid: str = "testuser",
     old_banned: list[str] | None = None,


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org