Use ipaplatform tasks for krb5 enctypes

Provide the master key encryption type and the list of supported
encryption types as ipaplatform.<platform>.tasks methods. This allows
to generate the list at runtime based on the environment (e.g. FIPS) and
override the list depending of the platform.

3DES HMAC-SHA1 encryption type is now removed from supported encryption
types if it is present.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

install/share/kerberos.ldif

@@ -14,25 +14,9 @@ objectClass: krbrealmcontainer
 objectClass: krbticketpolicyaux
 krbSubTrees: $SUFFIX
 krbSearchScope: 2
-krbSupportedEncSaltTypes: aes256-cts:normal
-krbSupportedEncSaltTypes: aes256-cts:special
-krbSupportedEncSaltTypes: aes128-cts:normal
-krbSupportedEncSaltTypes: aes128-cts:special
-krbSupportedEncSaltTypes: aes128-sha2:normal
-krbSupportedEncSaltTypes: aes128-sha2:special
-krbSupportedEncSaltTypes: aes256-sha2:normal
-krbSupportedEncSaltTypes: aes256-sha2:special
-${FIPS}krbSupportedEncSaltTypes: camellia128-cts-cmac:normal
-${FIPS}krbSupportedEncSaltTypes: camellia128-cts-cmac:special
-${FIPS}krbSupportedEncSaltTypes: camellia256-cts-cmac:normal
-${FIPS}krbSupportedEncSaltTypes: camellia256-cts-cmac:special
 krbMaxTicketLife: 86400
 krbMaxRenewableAge: 604800
-krbDefaultEncSaltTypes: aes256-sha2:special
-krbDefaultEncSaltTypes: aes128-sha2:special
-krbDefaultEncSaltTypes: aes256-cts:special
-krbDefaultEncSaltTypes: aes128-cts:special
-
+${LDIF_SUPPORTED_ENCTYPES}${LDIF_DEFAULT_ENCTYPES}
 # Default password Policy
 dn: cn=global_policy,cn=$REALM,cn=kerberos,$SUFFIX
 changetype: add

install/updates/50-krbenctypes.update

@@ -1,11 +1,2 @@
 dn: cn=$REALM,cn=kerberos,$SUFFIX
-${FIPS}add: krbSupportedEncSaltTypes: camellia128-cts-cmac:normal
-${FIPS}add: krbSupportedEncSaltTypes: camellia128-cts-cmac:special
-${FIPS}add: krbSupportedEncSaltTypes: camellia256-cts-cmac:normal
-${FIPS}add: krbSupportedEncSaltTypes: camellia256-cts-cmac:special
-add: krbSupportedEncSaltTypes: aes128-sha2:normal
-add: krbSupportedEncSaltTypes: aes128-sha2:special
-add: krbSupportedEncSaltTypes: aes256-sha2:normal
-add: krbSupportedEncSaltTypes: aes256-sha2:special
-remove: krbDefaultEncSaltTypes: des3-hmac-sha1:special
-remove: krbDefaultEncSaltTypes: arcfour-hmac:special
+${ADD_SUPPORTED_ENCTYPES}${ADD_DEFAULT_ENCTYPES}${REMOVE_SUPPORTED_ENCTYPES}${REMOVE_DEFAULT_ENCTYPES}

ipaplatform/base/tasks.py

@@ -540,4 +540,29 @@ class BaseTaskNamespace:
                 'ipa-client-automount-nsswitch', 'previous-automount'
             )
 
+    def get_masterkey_enctype(self):
+        return 'aes256-sha2'
+
+    # Encryption types allowed for Kerberos keys
+    def get_supported_enctypes(self):
+        return ('aes256-sha2:special', 'aes128-sha2:special',
+                'aes256-sha2:normal', 'aes128-sha2:normal',
+                'aes256-cts:special', 'aes128-cts:special',
+                'aes256-cts:normal', 'aes128-cts:normal',
+                'camellia256-cts:special', 'camellia128-cts:special',
+                'camellia256-cts:normal', 'camellia128-cts:normal')
+
+    # Encryption types used in the past, not supported anymore
+    def get_removed_supported_enctypes(self):
+        return ('des3-hmac-sha1:special')
+
+    # Encryption types used by default when generating Kerberos keys
+    def get_default_enctypes(self):
+        return ('aes256-sha2:special', 'aes128-sha2:special',
+                'aes256-cts:special', 'aes128-cts:special')
+
+    # Encryption types no longer used by default when generating keys
+    def get_removed_default_enctypes(self):
+        return ('des3-hmac-sha1:special', 'arcfour-hmac:special')
+
 tasks = BaseTaskNamespace()

ipaplatform/redhat/tasks.py

@@ -751,5 +751,13 @@ class RedHatTaskNamespace(BaseTaskNamespace):
             logger.info("It may happen if the configuration was done "
                         "using authconfig instead of authselect")
 
+    def get_supported_enctypes(self):
+        enctypes = super().get_supported_enctypes()
+
+        if not self.is_fips_enabled():
+            return enctypes
+
+        return tuple(e for e in enctypes if not e.startswith('camellia'))
+
 
 tasks = RedHatTaskNamespace()

ipaserver/install/krbinstance.py

@@ -55,14 +55,6 @@ from ipaplatform.paths import paths
 
 logger = logging.getLogger(__name__)
 
-MASTER_KEY_TYPE = 'aes256-sha2'
-SUPPORTED_ENCTYPES = ('aes256-sha2:special', 'aes128-sha2:special',
-                      'aes256-sha2:normal', 'aes128-sha2:normal',
-                      'aes256-cts:special', 'aes128-cts:special',
-                      'aes256-cts:normal', 'aes128-cts:normal',
-                      'camellia256-cts:special', 'camellia128-cts:special',
-                      'camellia256-cts:normal', 'camellia128-cts:normal')
-
 
 def get_pkinit_request_ca():
     """
@@ -299,15 +291,18 @@ class KrbInstance(service.Service):
                              INCLUDES=includes,
                              FIPS='#' if fips_enabled else '')
 
-        if fips_enabled:
-            supported_enctypes = list(
-                filter(lambda e: not e.startswith('camellia'),
-                       SUPPORTED_ENCTYPES))
-        else:
-            supported_enctypes = SUPPORTED_ENCTYPES
-        self.sub_dict['SUPPORTED_ENCTYPES'] = ' '.join(supported_enctypes)
+        supported_enctypes = tasks.get_supported_enctypes()
+        str_supported_enctypes = ' '.join(supported_enctypes)
+        ldif_supported_enctypes = ''.join(f'krbSupportedEncSaltTypes: {e}\n'
+                                          for e in supported_enctypes)
+        ldif_default_enctypes = ''.join(f'krbDefaultEncSaltTypes: {e}\n'
+                                        for e in tasks.get_default_enctypes())
 
-        self.sub_dict['MASTER_KEY_TYPE'] = MASTER_KEY_TYPE
+        self.sub_dict['SUPPORTED_ENCTYPES'] = str_supported_enctypes
+        self.sub_dict['LDIF_SUPPORTED_ENCTYPES'] = ldif_supported_enctypes
+        self.sub_dict['LDIF_DEFAULT_ENCTYPES'] = ldif_default_enctypes
+
+        self.sub_dict['MASTER_KEY_TYPE'] = tasks.get_masterkey_enctype()
 
         # IPA server/KDC is not a subdomain of default domain
         # Proper domain-realm mapping needs to be specified

ipaserver/install/ldapupdate.py

@@ -54,6 +54,9 @@ UPDATES_DIR=paths.UPDATES_DIR
 UPDATE_SEARCH_TIME_LIMIT = 30  # seconds
 
 
+def ldif_mod(op, attr, values):
+    return ''.join(f'{op}: {attr}: {v}\n' for v in values)
+
 def get_sub_dict(realm, domain, suffix, fqdn, idstart=None, idmax=None):
     """LDAP template substitution dict for installer and updater
     """
@@ -73,6 +76,15 @@ def get_sub_dict(realm, domain, suffix, fqdn, idstart=None, idmax=None):
         named_uid = None
         named_gid = None
 
+    add_supported_enctypes = ldif_mod('add', 'krbSupportedEncSaltTypes',
+                                      tasks.get_supported_enctypes())
+    add_default_enctypes = ldif_mod('add', 'krbDefaultEncSaltTypes',
+                                    tasks.get_default_enctypes())
+    rm_supported_enctypes = ldif_mod('remove', 'krbSupportedEncSaltTypes',
+                                     tasks.get_removed_supported_enctypes())
+    rm_default_enctypes = ldif_mod('remove', 'krbDefaultEncSaltTypes',
+                                   tasks.get_removed_default_enctypes())
+
     return dict(
         REALM=realm,
         DOMAIN=domain,
@@ -82,7 +94,10 @@ def get_sub_dict(realm, domain, suffix, fqdn, idstart=None, idmax=None):
         HOST=fqdn,
         LIBARCH=paths.LIBARCH,
         TIME=int(time.time()),
-        FIPS="#" if tasks.is_fips_enabled() else "",
+        ADD_SUPPORTED_ENCTYPES=add_supported_enctypes,
+        ADD_DEFAULT_ENCTYPES=add_default_enctypes,
+        REMOVE_SUPPORTED_ENCTYPES=rm_supported_enctypes,
+        REMOVE_DEFAULT_ENCTYPES=rm_default_enctypes,
         # idstart, idmax, and idrange_size may be None
         IDSTART=idstart,
         IDMAX=idmax,