Blame SOURCES/0001-adenroll-make-sure-only-allowed-enctypes-are-used-in.patch

bfd5b6
From 341974aae7d0755fc32a0b7e2b34d8e1ef60d195 Mon Sep 17 00:00:00 2001
bfd5b6
From: Sumit Bose <sbose@redhat.com>
bfd5b6
Date: Thu, 20 Dec 2018 21:05:35 +0100
bfd5b6
Subject: [PATCH 1/4] adenroll: make sure only allowed enctypes are used in
bfd5b6
 FIPS mode
bfd5b6
bfd5b6
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1717355
bfd5b6
---
bfd5b6
 library/adenroll.c | 36 +++++++++++++++++++++++++++++++++++-
bfd5b6
 1 file changed, 35 insertions(+), 1 deletion(-)
bfd5b6
bfd5b6
diff --git a/library/adenroll.c b/library/adenroll.c
bfd5b6
index 52aa8a8..f617f28 100644
bfd5b6
--- a/library/adenroll.c
bfd5b6
+++ b/library/adenroll.c
bfd5b6
@@ -41,11 +41,19 @@
bfd5b6
 #include <netdb.h>
bfd5b6
 #include <stdio.h>
bfd5b6
 #include <unistd.h>
bfd5b6
+#include <sys/stat.h>
bfd5b6
+#include <fcntl.h>
bfd5b6
 
bfd5b6
 #ifndef SAMBA_DATA_TOOL
bfd5b6
 #define SAMBA_DATA_TOOL "/usr/bin/net"
bfd5b6
 #endif
bfd5b6
 
bfd5b6
+static krb5_enctype v60_later_enctypes_fips[] = {
bfd5b6
+	ENCTYPE_AES256_CTS_HMAC_SHA1_96,
bfd5b6
+	ENCTYPE_AES128_CTS_HMAC_SHA1_96,
bfd5b6
+	0
bfd5b6
+};
bfd5b6
+
bfd5b6
 static krb5_enctype v60_later_enctypes[] = {
bfd5b6
 	ENCTYPE_AES256_CTS_HMAC_SHA1_96,
bfd5b6
 	ENCTYPE_AES128_CTS_HMAC_SHA1_96,
bfd5b6
@@ -2594,6 +2602,28 @@ adcli_enroll_set_keytab_name (adcli_enroll *enroll,
bfd5b6
 	enroll->keytab_name_is_krb5 = 0;
bfd5b6
 }
bfd5b6
 
bfd5b6
+#define PROC_SYS_FIPS "/proc/sys/crypto/fips_enabled"
bfd5b6
+
bfd5b6
+static bool adcli_fips_enabled (void)
bfd5b6
+{
bfd5b6
+	int fd;
bfd5b6
+	ssize_t len;
bfd5b6
+	char buf[8];
bfd5b6
+
bfd5b6
+	fd = open (PROC_SYS_FIPS, O_RDONLY);
bfd5b6
+	if (fd != -1) {
bfd5b6
+		len = read (fd, buf, sizeof (buf));
bfd5b6
+		close (fd);
bfd5b6
+		/* Assume FIPS in enabled if PROC_SYS_FIPS contains a
bfd5b6
+		 * non-0 value. */
bfd5b6
+		if ( ! (len == 2 && buf[0] == '0' && buf[1] == '\n')) {
bfd5b6
+			return true;
bfd5b6
+		}
bfd5b6
+	}
bfd5b6
+
bfd5b6
+	return false;
bfd5b6
+}
bfd5b6
+
bfd5b6
 krb5_enctype *
bfd5b6
 adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
bfd5b6
 {
bfd5b6
@@ -2602,7 +2632,11 @@ adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
bfd5b6
 		return enroll->keytab_enctypes;
bfd5b6
 
bfd5b6
 	if (adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID))
bfd5b6
-		return v60_later_enctypes;
bfd5b6
+		if (adcli_fips_enabled ()) {
bfd5b6
+			return v60_later_enctypes_fips;
bfd5b6
+		} else {
bfd5b6
+			return v60_later_enctypes;
bfd5b6
+		}
bfd5b6
 	else
bfd5b6
 		return v51_earlier_enctypes;
bfd5b6
 }
bfd5b6
-- 
bfd5b6
2.21.0
bfd5b6