IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Block camellia in krbenctypes update in FIPS

Browse Source 
Add FIPS conditional to updates to prevent updater from adding camellia
encsalttypes.

Fixes: https://pagure.io/freeipa/issue/8111
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2019-11-04 10:08:33 +01:00
committed by Rob Crittenden
parent 66ff6114b0
commit 9023033e18
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
install/updates/50-krbenctypes.update
View File

@@ -1,8 +1,8 @@
dn: cn=$REALM,cn=kerberos,$SUFFIX dn: cn=$REALM,cn=kerberos,$SUFFIX
add: krbSupportedEncSaltTypes: camellia128-cts-cmac:normal ${FIPS}add: krbSupportedEncSaltTypes: camellia128-cts-cmac:normal
add: krbSupportedEncSaltTypes: camellia128-cts-cmac:special ${FIPS}add: krbSupportedEncSaltTypes: camellia128-cts-cmac:special
add: krbSupportedEncSaltTypes: camellia256-cts-cmac:normal ${FIPS}add: krbSupportedEncSaltTypes: camellia256-cts-cmac:normal
add: krbSupportedEncSaltTypes: camellia256-cts-cmac:special ${FIPS}add: krbSupportedEncSaltTypes: camellia256-cts-cmac:special
add: krbSupportedEncSaltTypes: aes128-sha2:normal add: krbSupportedEncSaltTypes: aes128-sha2:normal
add: krbSupportedEncSaltTypes: aes128-sha2:special add: krbSupportedEncSaltTypes: aes128-sha2:special
add: krbSupportedEncSaltTypes: aes256-sha2:normal add: krbSupportedEncSaltTypes: aes256-sha2:normal

3
ipaserver/install/ldapupdate.py
View File

@@ -42,6 +42,7 @@ from ipalib import api, create_api
from ipalib import constants from ipalib import constants
from ipaplatform.constants import constants as platformconstants from ipaplatform.constants import constants as platformconstants
from ipaplatform.paths import paths from ipaplatform.paths import paths
from ipaplatform.tasks import tasks
from ipapython.dn import DN from ipapython.dn import DN
if six.PY3: if six.PY3:
@@ -325,6 +326,8 @@ class LDAPUpdate:
if not self.sub_dict.get("SELINUX_USERMAP_ORDER"): if not self.sub_dict.get("SELINUX_USERMAP_ORDER"):
self.sub_dict["SELINUX_USERMAP_ORDER"] = \ self.sub_dict["SELINUX_USERMAP_ORDER"] = \
platformconstants.SELINUX_USERMAP_ORDER platformconstants.SELINUX_USERMAP_ORDER
if "FIPS" not in self.sub_dict:
self.sub_dict["FIPS"] = '#' if tasks.is_fips_enabled() else ''
self.api = create_api(mode=None) self.api = create_api(mode=None)
self.api.bootstrap(in_server=True, self.api.bootstrap(in_server=True,
context='updates', context='updates',