From 341974aae7d0755fc32a0b7e2b34d8e1ef60d195 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 20 Dec 2018 21:05:35 +0100
Subject: [PATCH 1/4] adenroll: make sure only allowed enctypes are used in
 FIPS mode

Related to https://bugzilla.redhat.com/show_bug.cgi?id=1717355
---
 library/adenroll.c | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/library/adenroll.c b/library/adenroll.c
index 52aa8a8..f617f28 100644
--- a/library/adenroll.c
+++ b/library/adenroll.c
@@ -41,11 +41,19 @@
 #include <netdb.h>
 #include <stdio.h>
 #include <unistd.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 
 #ifndef SAMBA_DATA_TOOL
 #define SAMBA_DATA_TOOL "/usr/bin/net"
 #endif
 
+static krb5_enctype v60_later_enctypes_fips[] = {
+	ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+	ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+	0
+};
+
 static krb5_enctype v60_later_enctypes[] = {
 	ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 	ENCTYPE_AES128_CTS_HMAC_SHA1_96,
@@ -2594,6 +2602,28 @@ adcli_enroll_set_keytab_name (adcli_enroll *enroll,
 	enroll->keytab_name_is_krb5 = 0;
 }
 
+#define PROC_SYS_FIPS "/proc/sys/crypto/fips_enabled"
+
+static bool adcli_fips_enabled (void)
+{
+	int fd;
+	ssize_t len;
+	char buf[8];
+
+	fd = open (PROC_SYS_FIPS, O_RDONLY);
+	if (fd != -1) {
+		len = read (fd, buf, sizeof (buf));
+		close (fd);
+		/* Assume FIPS in enabled if PROC_SYS_FIPS contains a
+		 * non-0 value. */
+		if ( ! (len == 2 && buf[0] == '0' && buf[1] == '\n')) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 krb5_enctype *
 adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
 {
@@ -2602,7 +2632,11 @@ adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll)
 		return enroll->keytab_enctypes;
 
 	if (adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID))
-		return v60_later_enctypes;
+		if (adcli_fips_enabled ()) {
+			return v60_later_enctypes_fips;
+		} else {
+			return v60_later_enctypes;
+		}
 	else
 		return v51_earlier_enctypes;
 }
-- 
2.21.0