|
 |
b6b438 |
From 4e54b3526ae140a419fc50eae3a2e30e25373529 Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Tue, 21 May 2019 09:31:02 +0200
|
|
|
b6b438 |
Subject: [PATCH 204/208] lib:crypto: Allow py_crypto to use RC4 in FIPS mode
|
|
|
b6b438 |
|
|
|
b6b438 |
This is a public functions, so it can be consumed by others. E.g.
|
|
|
b6b438 |
FreeIPA is using it to establish trusts. Not sure if this is
|
|
|
b6b438 |
a problem with FIPS.
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
---
|
|
|
b6b438 |
lib/crypto/py_crypto.c | 9 ++++++++-
|
|
|
b6b438 |
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c
|
|
|
b6b438 |
index c85cd2c13d2..f4b5b745daf 100644
|
|
|
b6b438 |
--- a/lib/crypto/py_crypto.c
|
|
|
b6b438 |
+++ b/lib/crypto/py_crypto.c
|
|
|
b6b438 |
@@ -22,7 +22,7 @@
|
|
|
b6b438 |
#include "includes.h"
|
|
|
b6b438 |
#include "python/py3compat.h"
|
|
|
b6b438 |
|
|
|
b6b438 |
-#include <gnutls/gnutls.h>
|
|
|
b6b438 |
+#include "gnutls_helpers.h"
|
|
|
b6b438 |
#include <gnutls/crypto.h>
|
|
|
b6b438 |
|
|
|
b6b438 |
static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
|
|
|
b6b438 |
@@ -61,11 +61,15 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
|
|
|
b6b438 |
.size = PyBytes_Size(py_key),
|
|
|
b6b438 |
};
|
|
|
b6b438 |
|
|
|
b6b438 |
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
b6b438 |
+
|
|
|
b6b438 |
rc = gnutls_cipher_init(&cipher_hnd,
|
|
|
b6b438 |
GNUTLS_CIPHER_ARCFOUR_128,
|
|
|
b6b438 |
&key,
|
|
|
b6b438 |
NULL);
|
|
|
b6b438 |
if (rc < 0) {
|
|
|
b6b438 |
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
b6b438 |
+
|
|
|
b6b438 |
talloc_free(ctx);
|
|
|
b6b438 |
PyErr_Format(PyExc_OSError, "encryption failed");
|
|
|
b6b438 |
return NULL;
|
|
|
b6b438 |
@@ -74,6 +78,9 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
|
|
|
b6b438 |
data.data,
|
|
|
b6b438 |
data.length);
|
|
|
b6b438 |
gnutls_cipher_deinit(cipher_hnd);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
b6b438 |
+
|
|
|
b6b438 |
if (rc < 0) {
|
|
|
b6b438 |
talloc_free(ctx);
|
|
|
b6b438 |
PyErr_Format(PyExc_OSError, "encryption failed");
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|