From 985dffe147501e1b9cba3ab0be378115a23c3564 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 3 Mar 2022 14:38:57 +0200 Subject: [PATCH] ipatests: extend AES keyset to SHA2-based ones Fixes: https://pagure.io/freeipa/issue/9119 Signed-off-by: Alexander Bokovoy Reviewed-By: Julien Rische Reviewed-By: Francisco Trivino --- ipaserver/install/plugins/adtrust.py | 3 ++- ipatests/pytest_ipa/integration/tasks.py | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py index 5b87ac47c..67e372bdb 100644 --- a/ipaserver/install/plugins/adtrust.py +++ b/ipaserver/install/plugins/adtrust.py @@ -754,7 +754,8 @@ class update_host_cifs_keytabs(Updater): """ host_princ_template = "host/{master}@{realm}" - valid_etypes = ['aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] + valid_etypes = ['aes256-cts-hmac-sha384-192', 'aes128-cts-hmac-sha256-128', + 'aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] def extract_key_refs(self, keytab): host_princ = self.host_princ_template.format( diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py index 13d84e23f..d06f8eb2c 100755 --- a/ipatests/pytest_ipa/integration/tasks.py +++ b/ipatests/pytest_ipa/integration/tasks.py @@ -2261,7 +2261,8 @@ class KerberosKeyCopier: copier.copy_keys('/etc/krb5.keytab', tmpname, replacement=replacement) """ host_princ_template = "host/{master}@{realm}" - valid_etypes = ['aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] + valid_etypes = ['aes256-cts-hmac-sha384-192', 'aes128-cts-hmac-sha256-128', + 'aes256-cts-hmac-sha1-96', 'aes128-cts-hmac-sha1-96'] def __init__(self, host): self.host = host