fix(ldap): [OCISDEV-1031] restore pinned-CA-only trust for LDAP TLS (#674)

tlsConfigFromLDAPConn's CA-cert branch built its RootCAs pool from
x509.SystemCertPool() plus the configured CA, so configuring a CA
cert also trusted every system-level CA instead of just the pinned
one — a trust-scope widening versus the pre-pool graph service
behavior (x509.NewCertPool()). It also ignored AppendCertsFromPEM's
return value, silently falling back to an unrestricted trust store
on a malformed/empty CA file instead of failing initialization.

Use x509.NewCertPool() and fail when the PEM contains no valid
certificates, matching the behavior callers relied on before this
helper was introduced in #658.

Flagged during review of owncloud/ocis#12660.

Signed-off-by: Lukas Hirt <info@hirt.cz>

Author: LukasHirt

changelog/unreleased/fix-ldap-ca-cert-trust-scope.md

@@ -0,0 +1,12 @@
+Bugfix: Restore pinned-CA-only trust and PEM validation for LDAP TLS
+
+`tlsConfigFromLDAPConn`'s CA-cert branch built its `RootCAs` pool from
+`x509.SystemCertPool()` plus the configured CA, so callers configuring a CA cert
+ended up trusting every system-level CA as well, not just the pinned one — a
+trust-scope widening versus the pre-pool behavior. It also ignored
+`AppendCertsFromPEM`'s return value, so a malformed or empty CA file would
+silently fall back to an unrestricted trust store instead of failing
+initialization. Use `x509.NewCertPool()` (pinned CA only) and fail
+`tlsConfigFromLDAPConn` when the PEM contains no valid certificates.
+
+https://github.com/owncloud/reva/pull/658

pkg/utils/ldap.go

@@ -64,8 +64,10 @@ func tlsConfigFromLDAPConn(c *LDAPConn) (*tls.Config, error) {
 		if err != nil {
 			return nil, errors.Wrapf(err, "Error reading LDAP CA Cert '%s.'", c.CACert)
 		}
-		rpool, _ := x509.SystemCertPool()
-		rpool.AppendCertsFromPEM(pemBytes)
+		rpool := x509.NewCertPool()
+		if !rpool.AppendCertsFromPEM(pemBytes) {
+			return nil, errors.Errorf("Error adding LDAP CA Cert '%s': no valid certificates found", c.CACert)
+		}
 		return &tls.Config{
 			MinVersion: tls.VersionTLS12,
 			RootCAs:    rpool,