|
 |
95ea96 |
From 1a7538f0d73b4b35769c4df5ba32ed836e26a648 Mon Sep 17 00:00:00 2001
|
|
|
95ea96 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
95ea96 |
Date: Wed, 8 Aug 2018 13:04:04 +0300
|
|
|
95ea96 |
Subject: [PATCH] ipasam: do not use RC4 in FIPS mode
|
|
|
95ea96 |
|
|
|
95ea96 |
When creating Kerberos keys for trusted domain object account, ipasam
|
|
|
95ea96 |
module requests to generate keys using a series of well-known encryption
|
|
|
95ea96 |
types. In FIPS mode it is not possible to generate RC4-HMAC key:
|
|
|
95ea96 |
MIT Kerberos is using openssl crypto backend and openssl does not allow
|
|
|
95ea96 |
use of RC4 in FIPS mode.
|
|
|
95ea96 |
|
|
|
95ea96 |
Thus, we have to filter out RC4-HMAC encryption type when running in
|
|
|
95ea96 |
FIPS mode. A side-effect is that a trust to Active Directory running
|
|
|
95ea96 |
with Windows Server 2003 will not be possible anymore in FIPS mode.
|
|
|
95ea96 |
|
|
|
95ea96 |
Resolves: https://pagure.io/freeipa/issue/7659
|
|
|
95ea96 |
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
|
|
|
95ea96 |
---
|
|
|
95ea96 |
daemons/ipa-sam/ipa_sam.c | 23 +++++++++++++++++++----
|
|
|
95ea96 |
1 file changed, 19 insertions(+), 4 deletions(-)
|
|
|
95ea96 |
|
|
|
95ea96 |
diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
|
|
|
95ea96 |
index 0cd48d845b2edf9f328de0a949f80f98f9ef9025..675a511f0febf13cc5e00b547c18a050ac534f2e 100644
|
|
|
95ea96 |
--- a/daemons/ipa-sam/ipa_sam.c
|
|
|
95ea96 |
+++ b/daemons/ipa-sam/ipa_sam.c
|
|
|
95ea96 |
@@ -213,6 +213,7 @@ struct ipasam_private {
|
|
|
95ea96 |
char *client_princ;
|
|
|
95ea96 |
struct sss_idmap_ctx *idmap_ctx;
|
|
|
95ea96 |
uint32_t supported_enctypes;
|
|
|
95ea96 |
+ bool fips_enabled;
|
|
|
95ea96 |
};
|
|
|
95ea96 |
|
|
|
95ea96 |
|
|
|
95ea96 |
@@ -1737,6 +1738,10 @@ static bool search_krb_princ(struct ipasam_private *ipasam_state,
|
|
|
95ea96 |
return true;
|
|
|
95ea96 |
}
|
|
|
95ea96 |
|
|
|
95ea96 |
+/* Please keep ENCTYPE_ARCFOUR_HMAC the last in the list
|
|
|
95ea96 |
+ * of the default encryption types so that we can exclude
|
|
|
95ea96 |
+ * it when running in a FIPS mode where it is not allowed
|
|
|
95ea96 |
+ */
|
|
|
95ea96 |
#define DEF_ENCTYPE_NUM 3
|
|
|
95ea96 |
long default_enctypes[DEF_ENCTYPE_NUM] = {
|
|
|
95ea96 |
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
|
|
|
95ea96 |
@@ -1754,9 +1759,14 @@ static int set_cross_realm_pw(struct ipasam_private *ipasam_state,
|
|
|
95ea96 |
struct berval reqdata = { 0 };
|
|
|
95ea96 |
struct berval *retdata = NULL;
|
|
|
95ea96 |
char *retoid;
|
|
|
95ea96 |
+ int enctypes_num = DEF_ENCTYPE_NUM;
|
|
|
95ea96 |
|
|
|
95ea96 |
+ if (ipasam_state->fips_enabled) {
|
|
|
95ea96 |
+ DEBUG(1, ("FIPS mode enabled: TDO account credentials will not have RC4-HMAC!\n"));
|
|
|
95ea96 |
+ enctypes_num = DEF_ENCTYPE_NUM - 1;
|
|
|
95ea96 |
+ }
|
|
|
95ea96 |
ret = ipaasn1_enc_getkt(true, princ, pwd,
|
|
|
95ea96 |
- default_enctypes, DEF_ENCTYPE_NUM,
|
|
|
95ea96 |
+ default_enctypes, enctypes_num,
|
|
|
95ea96 |
&buffer, &buflen);
|
|
|
95ea96 |
if (!ret) goto done;
|
|
|
95ea96 |
|
|
|
95ea96 |
@@ -3935,7 +3945,9 @@ static NTSTATUS ipasam_get_enctypes(struct ipasam_private *ipasam_state,
|
|
|
95ea96 |
*enctypes |= KERB_ENCTYPE_DES_CBC_MD5;
|
|
|
95ea96 |
break;
|
|
|
95ea96 |
case ENCTYPE_ARCFOUR_HMAC:
|
|
|
95ea96 |
- *enctypes |= KERB_ENCTYPE_RC4_HMAC_MD5;
|
|
|
95ea96 |
+ if (!ipasam_state->fips_enabled) {
|
|
|
95ea96 |
+ *enctypes |= KERB_ENCTYPE_RC4_HMAC_MD5;
|
|
|
95ea96 |
+ }
|
|
|
95ea96 |
break;
|
|
|
95ea96 |
case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
|
|
|
95ea96 |
*enctypes |= KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96;
|
|
|
95ea96 |
@@ -4563,6 +4575,7 @@ static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
|
|
|
95ea96 |
return NT_STATUS_INVALID_PARAMETER;
|
|
|
95ea96 |
}
|
|
|
95ea96 |
|
|
|
95ea96 |
+ ipasam_state->fips_enabled = ipapwd_fips_enabled();
|
|
|
95ea96 |
ipasam_state->trust_dn = talloc_asprintf(ipasam_state,
|
|
|
95ea96 |
"cn=ad,cn=trusts,%s",
|
|
|
95ea96 |
ipasam_state->base_dn);
|
|
|
95ea96 |
@@ -4684,9 +4697,11 @@ static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
|
|
|
95ea96 |
&enctypes);
|
|
|
95ea96 |
|
|
|
95ea96 |
if (!NT_STATUS_IS_OK(status)) {
|
|
|
95ea96 |
- enctypes = KERB_ENCTYPE_RC4_HMAC_MD5 |
|
|
|
95ea96 |
- KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 |
|
|
|
95ea96 |
+ enctypes = KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 |
|
|
|
95ea96 |
KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96;
|
|
|
95ea96 |
+ if (!ipasam_state->fips_enabled) {
|
|
|
95ea96 |
+ enctypes |= KERB_ENCTYPE_RC4_HMAC_MD5;
|
|
|
95ea96 |
+ }
|
|
|
95ea96 |
}
|
|
|
95ea96 |
|
|
|
95ea96 |
ipasam_state->supported_enctypes = enctypes;
|
|
|
95ea96 |
--
|
|
|
95ea96 |
2.17.1
|
|
|
95ea96 |
|