|
 |
ac7d03 |
From 84be5dc9e72fbf4c85b6f061da94a4316c90d65e Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ac7d03 |
Date: Fri, 16 Jun 2017 17:49:44 +0200
|
|
|
ac7d03 |
Subject: [PATCH] ipa_pwd_extop: do not generate NT hashes in FIPS mode
|
|
|
ac7d03 |
|
|
|
ac7d03 |
In FIPS mode NT hashes (aka md4) are not allowed. If FIPS more is
|
|
|
ac7d03 |
detected we disable NT hashes even is the are allowed by IPA
|
|
|
ac7d03 |
configuration.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Resolves https://pagure.io/freeipa/issue/7026
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c | 53 ++++++++++++++++++------
|
|
|
ac7d03 |
1 file changed, 40 insertions(+), 13 deletions(-)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c
|
|
|
ac7d03 |
index 761f7a8e3e9ee539f97797c98b8719ad752bdcf1..5efadac5b1fd57e5f91a886224fa2f1ab88305ac 100644
|
|
|
ac7d03 |
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c
|
|
|
ac7d03 |
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c
|
|
|
ac7d03 |
@@ -46,6 +46,8 @@
|
|
|
ac7d03 |
/* Type of connection for this operation;*/
|
|
|
ac7d03 |
#define LDAP_EXTOP_PASSMOD_CONN_SECURE
|
|
|
ac7d03 |
|
|
|
ac7d03 |
+#define PROC_SYS_FIPS "/proc/sys/crypto/fips_enabled"
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
/* Uncomment the following #undef FOR TESTING:
|
|
|
ac7d03 |
* allows non-SSL connections to use the password change extended op */
|
|
|
ac7d03 |
/* #undef LDAP_EXTOP_PASSMOD_CONN_SECURE */
|
|
|
ac7d03 |
@@ -62,6 +64,27 @@ static const char *ipapwd_def_encsalts[] = {
|
|
|
ac7d03 |
NULL
|
|
|
ac7d03 |
};
|
|
|
ac7d03 |
|
|
|
ac7d03 |
+static bool fips_enabled(void)
|
|
|
ac7d03 |
+{
|
|
|
ac7d03 |
+ int fd;
|
|
|
ac7d03 |
+ ssize_t len;
|
|
|
ac7d03 |
+ char buf[8];
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ fd = open(PROC_SYS_FIPS, O_RDONLY);
|
|
|
ac7d03 |
+ if (fd != -1) {
|
|
|
ac7d03 |
+ len = read(fd, buf, sizeof(buf));
|
|
|
ac7d03 |
+ close(fd);
|
|
|
ac7d03 |
+ /* Assume FIPS in enabled if PROC_SYS_FIPS contains a non-0 value
|
|
|
ac7d03 |
+ * similar to the is_fips_enabled() check in
|
|
|
ac7d03 |
+ * ipaplatform/redhat/tasks.py */
|
|
|
ac7d03 |
+ if (!(len == 2 && buf[0] == '0' && buf[1] == '\n')) {
|
|
|
ac7d03 |
+ return true;
|
|
|
ac7d03 |
+ }
|
|
|
ac7d03 |
+ }
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ return false;
|
|
|
ac7d03 |
+}
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
static struct ipapwd_krbcfg *ipapwd_getConfig(void)
|
|
|
ac7d03 |
{
|
|
|
ac7d03 |
krb5_error_code krberr;
|
|
|
ac7d03 |
@@ -232,23 +255,27 @@ static struct ipapwd_krbcfg *ipapwd_getConfig(void)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
/* get the ipa etc/ipaConfig entry */
|
|
|
ac7d03 |
config->allow_nt_hash = false;
|
|
|
ac7d03 |
- ret = ipapwd_getEntry(ipa_etc_config_dn, &config_entry, NULL);
|
|
|
ac7d03 |
- if (ret != LDAP_SUCCESS) {
|
|
|
ac7d03 |
- LOG_FATAL("No config Entry?\n");
|
|
|
ac7d03 |
- goto free_and_error;
|
|
|
ac7d03 |
+ if (fips_enabled()) {
|
|
|
ac7d03 |
+ LOG("FIPS mode is enabled, NT hashes are not allowed.\n");
|
|
|
ac7d03 |
} else {
|
|
|
ac7d03 |
- tmparray = slapi_entry_attr_get_charray(config_entry,
|
|
|
ac7d03 |
- "ipaConfigString");
|
|
|
ac7d03 |
- for (i = 0; tmparray && tmparray[i]; i++) {
|
|
|
ac7d03 |
- if (strcasecmp(tmparray[i], "AllowNThash") == 0) {
|
|
|
ac7d03 |
- config->allow_nt_hash = true;
|
|
|
ac7d03 |
- continue;
|
|
|
ac7d03 |
+ ret = ipapwd_getEntry(ipa_etc_config_dn, &config_entry, NULL);
|
|
|
ac7d03 |
+ if (ret != LDAP_SUCCESS) {
|
|
|
ac7d03 |
+ LOG_FATAL("No config Entry?\n");
|
|
|
ac7d03 |
+ goto free_and_error;
|
|
|
ac7d03 |
+ } else {
|
|
|
ac7d03 |
+ tmparray = slapi_entry_attr_get_charray(config_entry,
|
|
|
ac7d03 |
+ "ipaConfigString");
|
|
|
ac7d03 |
+ for (i = 0; tmparray && tmparray[i]; i++) {
|
|
|
ac7d03 |
+ if (strcasecmp(tmparray[i], "AllowNThash") == 0) {
|
|
|
ac7d03 |
+ config->allow_nt_hash = true;
|
|
|
ac7d03 |
+ continue;
|
|
|
ac7d03 |
+ }
|
|
|
ac7d03 |
}
|
|
|
ac7d03 |
+ if (tmparray) slapi_ch_array_free(tmparray);
|
|
|
ac7d03 |
}
|
|
|
ac7d03 |
- if (tmparray) slapi_ch_array_free(tmparray);
|
|
|
ac7d03 |
- }
|
|
|
ac7d03 |
|
|
|
ac7d03 |
- slapi_entry_free(config_entry);
|
|
|
ac7d03 |
+ slapi_entry_free(config_entry);
|
|
|
ac7d03 |
+ }
|
|
|
ac7d03 |
|
|
|
ac7d03 |
return config;
|
|
|
ac7d03 |
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.9.4
|
|
|
ac7d03 |
|