IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Use system-wide crypto-policies on Fedora

Browse Source 
HTTPS connections from IPA framework and bind named instance now use
system-wide crypto-policies on Fedora.

For HTTPS the 'DEFAULT' crypto policy also includes unnecessary ciphers
for PSK, SRP, aDSS and 3DES. Since these ciphers are not used by freeIPA,
they are explicitly excluded.

See: https://bugzilla.redhat.com/show_bug.cgi?id=1179925
See: https://bugzilla.redhat.com/show_bug.cgi?id=1179220
Fixes: https://pagure.io/freeipa/issue/4853
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
This commit is contained in:
Christian Heimes
2018-02-09 11:50:32 +01:00
parent db2222fee4
commit 90a75f0d43
8 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ipalib/constants.py
View File

@@ -304,9 +304,7 @@ TLS_VERSIONS = [
"tls1.2"
]
TLS_VERSION_MINIMAL = "tls1.0"
# high ciphers without RC4, MD5, TripleDES, pre-shared key
# and secure remote password
TLS_HIGH_CIPHERS = "HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES:!PSK:!SRP"
# Use cache path
USER_CACHE_PATH = (

9
ipalib/util.py
View File

@@ -56,9 +56,10 @@ except ImportError:
from ipalib import errors, messages
from ipalib.constants import (
DOMAIN_LEVEL_0,
TLS_VERSIONS, TLS_VERSION_MINIMAL, TLS_HIGH_CIPHERS
TLS_VERSIONS, TLS_VERSION_MINIMAL
)
from ipalib.text import _
from ipaplatform.constants import constants
from ipaplatform.paths import paths
from ipapython.ssh import SSHPublicKey
from ipapython.dn import DN, RDN
@@ -335,9 +336,9 @@ def create_https_connection(
ssl.OP_SINGLE_ECDH_USE
)
# high ciphers without RC4, MD5, TripleDES, pre-shared key
# and secure remote password
ctx.set_ciphers(TLS_HIGH_CIPHERS)
# high ciphers without RC4, MD5, TripleDES, pre-shared key and secure
# remote password. Uses system crypto policies on some platforms.
ctx.set_ciphers(constants.TLS_HIGH_CIPHERS)
# pylint: enable=no-member
# set up the correct TLS version flags for the SSL context