|
 |
59dcbd |
From 158468507bb723aa62196846749c23c121d4b298 Mon Sep 17 00:00:00 2001
|
|
|
59dcbd |
From: Sumit Bose <sbose@redhat.com>
|
|
|
59dcbd |
Date: Mon, 8 Apr 2019 10:55:39 +0200
|
|
|
59dcbd |
Subject: [PATCH] Do not use arcfour-hmac-md5 when discovering the salt
|
|
|
59dcbd |
|
|
|
59dcbd |
Since the arcfour-hmac-md5 encryption types does not use salts it cannot
|
|
|
59dcbd |
be used to discover the right salt.
|
|
|
59dcbd |
|
|
|
59dcbd |
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1683745
|
|
|
59dcbd |
|
|
|
59dcbd |
diff --git a/library/adkrb5.c b/library/adkrb5.c
|
|
|
59dcbd |
index da835d7..be3ede5 100644
|
|
|
59dcbd |
--- a/library/adkrb5.c
|
|
|
59dcbd |
+++ b/library/adkrb5.c
|
|
|
59dcbd |
@@ -395,15 +395,33 @@ _adcli_krb5_keytab_discover_salt (krb5_context k5,
|
|
|
59dcbd |
krb5_keytab scratch;
|
|
|
59dcbd |
krb5_error_code code;
|
|
|
59dcbd |
int i;
|
|
|
59dcbd |
+ krb5_enctype *salt_enctypes = NULL;
|
|
|
59dcbd |
+ size_t c;
|
|
|
59dcbd |
+ size_t s;
|
|
|
59dcbd |
|
|
|
59dcbd |
/* TODO: This should be a unique name */
|
|
|
59dcbd |
|
|
|
59dcbd |
code = krb5_kt_resolve (k5, "MEMORY:adcli-discover-salt", &scratch);
|
|
|
59dcbd |
return_val_if_fail (code == 0, code);
|
|
|
59dcbd |
|
|
|
59dcbd |
+ for (c = 0; enctypes[c] != 0; c++); /* count enctypes */
|
|
|
59dcbd |
+ salt_enctypes = calloc (c + 1, sizeof (krb5_enctype));
|
|
|
59dcbd |
+ return_val_if_fail (salt_enctypes != NULL, ENOMEM);
|
|
|
59dcbd |
+
|
|
|
59dcbd |
+ /* ENCTYPE_ARCFOUR_HMAC does not use salts, so it cannot be used to
|
|
|
59dcbd |
+ * discover the right salt. */
|
|
|
59dcbd |
+ s = 0;
|
|
|
59dcbd |
+ for (c = 0; enctypes[c] != 0; c++) {
|
|
|
59dcbd |
+ if (enctypes[c] == ENCTYPE_ARCFOUR_HMAC) {
|
|
|
59dcbd |
+ continue;
|
|
|
59dcbd |
+ }
|
|
|
59dcbd |
+
|
|
|
59dcbd |
+ salt_enctypes[s++] = enctypes[c];
|
|
|
59dcbd |
+ }
|
|
|
59dcbd |
+
|
|
|
59dcbd |
for (i = 0; salts[i].data != NULL; i++) {
|
|
|
59dcbd |
code = _adcli_krb5_keytab_test_salt (k5, scratch, principal, kvno,
|
|
|
59dcbd |
- password, enctypes, &salts[i]);
|
|
|
59dcbd |
+ password, salt_enctypes, &salts[i]);
|
|
|
59dcbd |
if (code == 0) {
|
|
|
59dcbd |
*discovered = i;
|
|
|
59dcbd |
break;
|
|
|
59dcbd |
@@ -412,6 +430,7 @@ _adcli_krb5_keytab_discover_salt (krb5_context k5,
|
|
|
59dcbd |
}
|
|
|
59dcbd |
}
|
|
|
59dcbd |
|
|
|
59dcbd |
+ free (salt_enctypes);
|
|
|
59dcbd |
krb5_kt_close (k5, scratch);
|
|
|
59dcbd |
return code;
|
|
|
59dcbd |
}
|
|
|
59dcbd |
--
|
|
|
59dcbd |
2.21.0
|
|
|
59dcbd |
|