From fa0c97dd4960e56864b6446ae4f5ff072763b6a2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 4 Nov 2019 17:15:14 +0100 Subject: [PATCH 194/208] lib:param: Add lp(cfg)_weak_crypto() Signed-off-by: Andreas Schneider --- lib/param/loadparm.c | 15 +++++++++++++++ lib/param/loadparm.h | 10 +++++++++- lib/param/wscript_build | 2 +- source3/include/proto.h | 1 + source3/param/loadparm.c | 14 ++++++++++++++ 5 files changed, 40 insertions(+), 2 deletions(-) diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index 883d4167bf4..83dc111c05c 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -71,6 +71,7 @@ #include "libds/common/roles.h" #include "lib/util/samba_util.h" #include "libcli/auth/ntlm_check.h" +#include "lib/crypto/gnutls_helpers.h" #ifdef HAVE_HTTPCONNECTENCRYPT #include @@ -95,6 +96,19 @@ int lpcfg_rpc_high_port(struct loadparm_context *lp_ctx) return lp_ctx->globals->rpc_high_port; } +enum samba_weak_crypto lpcfg_weak_crypto(struct loadparm_context *lp_ctx) +{ + if (lp_ctx->globals->weak_crypto == SAMBA_WEAK_CRYPTO_UNKNOWN) { + lp_ctx->globals->weak_crypto = SAMBA_WEAK_CRYPTO_DISALLOWED; + + if (samba_gnutls_weak_crypto_allowed()) { + lp_ctx->globals->weak_crypto = SAMBA_WEAK_CRYPTO_ALLOWED; + } + } + + return lp_ctx->globals->weak_crypto; +} + /** * Convenience routine to grab string parameters into temporary memory * and run standard_sub_basic on them. @@ -2592,6 +2606,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lp_ctx->globals->ctx = lp_ctx->globals; lp_ctx->globals->rpc_low_port = SERVER_TCP_LOW_PORT; lp_ctx->globals->rpc_high_port = SERVER_TCP_HIGH_PORT; + lp_ctx->globals->weak_crypto = SAMBA_WEAK_CRYPTO_UNKNOWN; lp_ctx->sDefault = talloc_zero(lp_ctx, struct loadparm_service); lp_ctx->flags = talloc_zero_array(lp_ctx, unsigned int, num_parameters()); diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h index 0b2e302d2a9..897031985f8 100644 --- a/lib/param/loadparm.h +++ b/lib/param/loadparm.h @@ -248,6 +248,13 @@ enum inheritowner_options { /* mangled names options */ enum mangled_names_options {MANGLED_NAMES_NO, MANGLED_NAMES_YES, MANGLED_NAMES_ILLEGAL}; +/* FIPS values */ +enum samba_weak_crypto { + SAMBA_WEAK_CRYPTO_UNKNOWN, + SAMBA_WEAK_CRYPTO_ALLOWED, + SAMBA_WEAK_CRYPTO_DISALLOWED, +}; + /* * Default passwd chat script. */ @@ -285,7 +292,8 @@ enum mangled_names_options {MANGLED_NAMES_NO, MANGLED_NAMES_YES, MANGLED_NAMES_I struct parmlist_entry *param_opt; \ char *dnsdomain; \ int rpc_low_port; \ - int rpc_high_port; + int rpc_high_port; \ + enum samba_weak_crypto weak_crypto; const char* server_role_str(uint32_t role); int lp_find_server_role(int server_role, int security, int domain_logons, int domain_master); diff --git a/lib/param/wscript_build b/lib/param/wscript_build index 20c8bcab22a..864975a5884 100644 --- a/lib/param/wscript_build +++ b/lib/param/wscript_build @@ -40,7 +40,7 @@ bld.SAMBA_LIBRARY('samba-hostconfig', pc_files='samba-hostconfig.pc', vnum='0.0.1', deps='DYNCONFIG server-role tdb', - public_deps='samba-util param_local.h', + public_deps='GNUTLS_HELPERS samba-util param_local.h', public_headers='param.h', autoproto='param_proto.h' ) diff --git a/source3/include/proto.h b/source3/include/proto.h index 43a4b8f8b4d..956a328b626 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -755,6 +755,7 @@ bool lp_widelinks(int ); int lp_rpc_low_port(void); int lp_rpc_high_port(void); bool lp_lanman_auth(void); +enum samba_weak_crypto lp_weak_crypto(void); int lp_wi_scan_global_parametrics( const char *regex, size_t max_matches, diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index a8d5fdc5954..923c2473662 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -72,6 +72,7 @@ #include "librpc/gen_ndr/nbt.h" #include "source4/lib/tls/tls.h" #include "libcli/auth/ntlm_check.h" +#include "lib/crypto/gnutls_helpers.h" #ifdef HAVE_SYS_SYSCTL_H #include @@ -4677,3 +4678,16 @@ unsigned int * get_flags(void) return flags_list; } + +enum samba_weak_crypto lp_weak_crypto() +{ + if (Globals.weak_crypto == SAMBA_WEAK_CRYPTO_UNKNOWN) { + Globals.weak_crypto = SAMBA_WEAK_CRYPTO_DISALLOWED; + + if (samba_gnutls_weak_crypto_allowed()) { + Globals.weak_crypto = SAMBA_WEAK_CRYPTO_ALLOWED; + } + } + + return Globals.weak_crypto; +} -- 2.23.0