Blame SOURCES/0001-adenroll-make-sure-only-allowed-enctypes-are-used-in.patch

f441eb
From 341974aae7d0755fc32a0b7e2b34d8e1ef60d195 Mon Sep 17 00:00:00 2001
f441eb
From: Sumit Bose <sbose@redhat.com>
f441eb
Date: Thu, 20 Dec 2018 21:05:35 +0100
f441eb
Subject: [PATCH 1/4] adenroll: make sure only allowed enctypes are used in
f441eb
 FIPS mode
f441eb
f441eb
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1717355
f441eb
---
f441eb
 library/adenroll.c | 36 +++++++++++++++++++++++++++++++++++-
f441eb
 1 file changed, 35 insertions(+), 1 deletion(-)
f441eb
f441eb
diff --git a/library/adenroll.c b/library/adenroll.c
f441eb
index 52aa8a8..f617f28 100644
f441eb
--- a/library/adenroll.c
f441eb
+++ b/library/adenroll.c
f441eb
@@ -41,11 +41,19 @@
f441eb
 #include <netdb.h>
f441eb
 #include <stdio.h>
f441eb
 #include <unistd.h>
f441eb
+#include <sys/stat.h>
f441eb
+#include <fcntl.h>
f441eb
 
f441eb
 #ifndef SAMBA_DATA_TOOL
f441eb
 #define SAMBA_DATA_TOOL "/usr/bin/net"
f441eb
 #endif
f441eb
 
f441eb
+static krb5_enctype v60_later_enctypes_fips[] = {
f441eb
+	ENCTYPE_AES256_CTS_HMAC_SHA1_96,
f441eb
+	ENCTYPE_AES128_CTS_HMAC_SHA1_96,
f441eb
+	0
f441eb
+};
f441eb
+
f441eb
 static krb5_enctype v60_later_enctypes[] = {
f441eb
 	ENCTYPE_AES256_CTS_HMAC_SHA1_96,
f441eb
 	ENCTYPE_AES128_CTS_HMAC_SHA1_96,
f441eb
@@ -2594,6 +2602,28 @@ adcli_enroll_set_keytab_name (adcli_enroll *enroll,
f441eb
 	enroll->keytab_name_is_krb5 = 0;
f441eb
 }
f441eb
 
f441eb
+#define PROC_SYS_FIPS "/proc/sys/crypto/fips_enabled"
f441eb
+
f441eb
+static bool adcli_fips_enabled (void)
f441eb
+{
f441eb
+	int fd;
f441eb
+	ssize_t len;
f441eb
+	char buf[8];
f441eb
+
f441eb
+	fd = open (PROC_SYS_FIPS, O_RDONLY);
f441eb
+	if (fd != -1) {
f441eb
+		len = read (fd, buf, sizeof (buf));
f441eb
+		close (fd);
f441eb
+		/* Assume FIPS in enabled if PROC_SYS_FIPS contains a
f441eb
+		 * non-0 value. */
f441eb
+		if ( ! (len == 2 && buf[0] == '0' && buf[1] == '\n')) {
f441eb
+			return true;
f441eb
+		}
f441eb
+	}
f441eb
+
f441eb
+	return false;
f441eb
+}
f441eb
+
f441eb
 krb5_enctype *
f441eb
 adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
f441eb
 {
f441eb
@@ -2602,7 +2632,11 @@ adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
f441eb
 		return enroll->keytab_enctypes;
f441eb
 
f441eb
 	if (adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID))
f441eb
-		return v60_later_enctypes;
f441eb
+		if (adcli_fips_enabled ()) {
f441eb
+			return v60_later_enctypes_fips;
f441eb
+		} else {
f441eb
+			return v60_later_enctypes;
f441eb
+		}
f441eb
 	else
f441eb
 		return v51_earlier_enctypes;
f441eb
 }
f441eb
-- 
f441eb
2.21.0
f441eb