81 lines
2.0 KiB
Diff
81 lines
2.0 KiB
Diff
From 341974aae7d0755fc32a0b7e2b34d8e1ef60d195 Mon Sep 17 00:00:00 2001
|
|
From: Sumit Bose <sbose@redhat.com>
|
|
Date: Thu, 20 Dec 2018 21:05:35 +0100
|
|
Subject: [PATCH 1/4] adenroll: make sure only allowed enctypes are used in
|
|
FIPS mode
|
|
|
|
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1717355
|
|
---
|
|
library/adenroll.c | 36 +++++++++++++++++++++++++++++++++++-
|
|
1 file changed, 35 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/library/adenroll.c b/library/adenroll.c
|
|
index 52aa8a8..f617f28 100644
|
|
--- a/library/adenroll.c
|
|
+++ b/library/adenroll.c
|
|
@@ -41,11 +41,19 @@
|
|
#include <netdb.h>
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
+#include <sys/stat.h>
|
|
+#include <fcntl.h>
|
|
|
|
#ifndef SAMBA_DATA_TOOL
|
|
#define SAMBA_DATA_TOOL "/usr/bin/net"
|
|
#endif
|
|
|
|
+static krb5_enctype v60_later_enctypes_fips[] = {
|
|
+ ENCTYPE_AES256_CTS_HMAC_SHA1_96,
|
|
+ ENCTYPE_AES128_CTS_HMAC_SHA1_96,
|
|
+ 0
|
|
+};
|
|
+
|
|
static krb5_enctype v60_later_enctypes[] = {
|
|
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
|
|
ENCTYPE_AES128_CTS_HMAC_SHA1_96,
|
|
@@ -2594,6 +2602,28 @@ adcli_enroll_set_keytab_name (adcli_enroll *enroll,
|
|
enroll->keytab_name_is_krb5 = 0;
|
|
}
|
|
|
|
+#define PROC_SYS_FIPS "/proc/sys/crypto/fips_enabled"
|
|
+
|
|
+static bool adcli_fips_enabled (void)
|
|
+{
|
|
+ int fd;
|
|
+ ssize_t len;
|
|
+ char buf[8];
|
|
+
|
|
+ fd = open (PROC_SYS_FIPS, O_RDONLY);
|
|
+ if (fd != -1) {
|
|
+ len = read (fd, buf, sizeof (buf));
|
|
+ close (fd);
|
|
+ /* Assume FIPS in enabled if PROC_SYS_FIPS contains a
|
|
+ * non-0 value. */
|
|
+ if ( ! (len == 2 && buf[0] == '0' && buf[1] == '\n')) {
|
|
+ return true;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return false;
|
|
+}
|
|
+
|
|
krb5_enctype *
|
|
adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
|
|
{
|
|
@@ -2602,7 +2632,11 @@ adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
|
|
return enroll->keytab_enctypes;
|
|
|
|
if (adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID))
|
|
- return v60_later_enctypes;
|
|
+ if (adcli_fips_enabled ()) {
|
|
+ return v60_later_enctypes_fips;
|
|
+ } else {
|
|
+ return v60_later_enctypes;
|
|
+ }
|
|
else
|
|
return v51_earlier_enctypes;
|
|
}
|
|
--
|
|
2.21.0
|
|
|