From 49d9147e38c5b50c52a1ebc7283753c779c2f81f Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 3 Mar 2022 14:38:57 +0200 Subject: [PATCH] ipatests: extend AES keyset to SHA2-based ones Fixes: https://pagure.io/freeipa/issue/9119 Signed-off-by: Alexander Bokovoy Reviewed-By: Julien Rische Reviewed-By: Francisco Trivino --- ipaserver/install/plugins/adtrust.py | 3 ++- ipatests/pytest_ipa/integration/tasks.py | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py index 5b87ac47c6919de287b07c9ceef7ae22e1e79398..67e372bdb40a0b1f6815f107fc567f0ae056dad8 100644 --- a/ipaserver/install/plugins/adtrust.py +++ b/ipaserver/install/plugins/adtrust.py @@ -754,7 +754,8 @@ class update_host_cifs_keytabs(Updater): """ host_princ_template = "host/{master}@{realm}" - valid_etypes = ['aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] + valid_etypes = ['aes256-cts-hmac-sha384-192', 'aes128-cts-hmac-sha256-128', + 'aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] def extract_key_refs(self, keytab): host_princ = self.host_princ_template.format( diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py index 13d84e23fa7dc8a5e562e8498c9142e2bcad696a..d06f8eb2cf6c36956ec200a1abb7c488d1dad9aa 100755 --- a/ipatests/pytest_ipa/integration/tasks.py +++ b/ipatests/pytest_ipa/integration/tasks.py @@ -2261,7 +2261,8 @@ class KerberosKeyCopier: copier.copy_keys('/etc/krb5.keytab', tmpname, replacement=replacement) """ host_princ_template = "host/{master}@{realm}" - valid_etypes = ['aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] + valid_etypes = ['aes256-cts-hmac-sha384-192', 'aes128-cts-hmac-sha256-128', + 'aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] def __init__(self, host): self.host = host -- 2.34.1