svn rev #21823: trunk/src/ include/ kadmin/testing/proto/ lib/crypto/ lib/krb5/krb/ ...
tlyu@MIT.EDU
tlyu at MIT.EDU
Wed Jan 28 18:22:32 EST 2009
http://src.mit.edu/fisheye/changelog/krb5/?cs=21823
Commit By: tlyu
Log Message:
ticket: 6353
subject: disable single-DES by default
status: open
Mark all single-DES enctypes as "weak", and create a new libdefaults
variable "allow_weak_crypto", which defaults to "false".
Changed Files:
U trunk/src/include/k5-int.h
U trunk/src/kadmin/testing/proto/krb5.conf.proto
U trunk/src/lib/crypto/etypes.c
U trunk/src/lib/crypto/etypes.h
U trunk/src/lib/crypto/libk5crypto.exports
U trunk/src/lib/crypto/valid_enctype.c
U trunk/src/lib/krb5/krb/init_ctx.c
U trunk/src/tests/dejagnu/config/default.exp
Modified: trunk/src/include/k5-int.h
===================================================================
--- trunk/src/include/k5-int.h 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/include/k5-int.h 2009-01-28 23:22:27 UTC (rev 21823)
@@ -1228,6 +1228,8 @@
/* For Sun iprop code; does this really have to be here? */
struct _kdb_log_context *kdblog_context;
+
+ krb5_boolean allow_weak_crypto;
};
/* could be used in a table to find an etype and initialize a block */
@@ -2318,6 +2320,8 @@
krb5_boolean krb5_is_permitted_enctype_ext
( krb5_context, krb5_etypes_permitted *);
+krb5_boolean KRB5_CALLCONV krb5_c_weak_enctype(krb5_enctype);
+
krb5_error_code krb5_kdc_rep_decrypt_proc
(krb5_context,
const krb5_keyblock *,
Modified: trunk/src/kadmin/testing/proto/krb5.conf.proto
===================================================================
--- trunk/src/kadmin/testing/proto/krb5.conf.proto 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/kadmin/testing/proto/krb5.conf.proto 2009-01-28 23:22:27 UTC (rev 21823)
@@ -2,6 +2,7 @@
default_realm = __REALM__
default_keytab_name = FILE:__K5ROOT__/v5srvtab
dns_fallback = no
+ allow_weak_crypto = true
[realms]
__REALM__ = {
Modified: trunk/src/lib/crypto/etypes.c
===================================================================
--- trunk/src/lib/crypto/etypes.c 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/lib/crypto/etypes.c 2009-01-28 23:22:27 UTC (rev 21823)
@@ -49,7 +49,8 @@
krb5int_des_string_to_key,
NULL, /*PRF*/
CKSUMTYPE_RSA_MD5,
- NULL /*AEAD*/ },
+ NULL, /*AEAD*/
+ ETYPE_WEAK },
{ ENCTYPE_DES_CBC_MD4,
"des-cbc-md4", { 0 }, "DES cbc mode with RSA-MD4",
&krb5int_enc_des, &krb5int_hash_md4,
@@ -58,7 +59,8 @@
krb5int_des_string_to_key,
NULL, /*PRF*/
CKSUMTYPE_RSA_MD4,
- NULL /*AEAD*/ },
+ NULL, /*AEAD*/
+ ETYPE_WEAK },
{ ENCTYPE_DES_CBC_MD5,
"des-cbc-md5", { "des" }, "DES cbc mode with RSA-MD5",
&krb5int_enc_des, &krb5int_hash_md5,
@@ -67,7 +69,8 @@
krb5int_des_string_to_key,
NULL, /*PRF*/
CKSUMTYPE_RSA_MD5,
- NULL /*AEAD*/ },
+ NULL, /*AEAD*/
+ ETYPE_WEAK },
{ ENCTYPE_DES_CBC_RAW,
"des-cbc-raw", { 0 }, "DES cbc mode raw",
&krb5int_enc_des, NULL,
@@ -76,7 +79,8 @@
krb5int_des_string_to_key,
NULL, /*PRF*/
0,
- &krb5int_aead_raw },
+ &krb5int_aead_raw,
+ ETYPE_WEAK },
{ ENCTYPE_DES3_CBC_RAW,
"des3-cbc-raw", { 0 }, "Triple DES cbc mode raw",
&krb5int_enc_des3, NULL,
@@ -85,7 +89,8 @@
krb5int_dk_string_to_key,
NULL, /*PRF*/
0,
- &krb5int_aead_raw },
+ &krb5int_aead_raw,
+ ETYPE_WEAK },
{ ENCTYPE_DES3_CBC_SHA1,
"des3-cbc-sha1", { "des3-hmac-sha1", "des3-cbc-sha1-kd" },
@@ -96,7 +101,8 @@
krb5int_dk_string_to_key,
NULL, /*PRF*/
CKSUMTYPE_HMAC_SHA1_DES3,
- &krb5int_aead_dk },
+ &krb5int_aead_dk,
+ 0 /*flags*/ },
{ ENCTYPE_DES_HMAC_SHA1,
"des-hmac-sha1", { 0 }, "DES with HMAC/sha1",
@@ -106,7 +112,8 @@
krb5int_dk_string_to_key,
NULL, /*PRF*/
0,
- NULL },
+ NULL,
+ ETYPE_WEAK },
{ ENCTYPE_ARCFOUR_HMAC,
"arcfour-hmac", { "rc4-hmac", "arcfour-hmac-md5" },
"ArcFour with HMAC/md5",
@@ -117,7 +124,8 @@
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR,
- &krb5int_aead_arcfour },
+ &krb5int_aead_arcfour,
+ 0 /*flags*/ },
{ ENCTYPE_ARCFOUR_HMAC_EXP,
"arcfour-hmac-exp", { "rc4-hmac-exp", "arcfour-hmac-md5-exp" },
"Exportable ArcFour with HMAC/md5",
@@ -128,7 +136,8 @@
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR,
- &krb5int_aead_arcfour },
+ &krb5int_aead_arcfour,
+ 0 /*flags*/ },
{ ENCTYPE_AES128_CTS_HMAC_SHA1_96,
"aes128-cts-hmac-sha1-96", { "aes128-cts" },
@@ -139,7 +148,8 @@
krb5int_aes_string_to_key,
krb5int_dk_prf,
CKSUMTYPE_HMAC_SHA1_96_AES128,
- &krb5int_aead_aes },
+ &krb5int_aead_aes,
+ 0 /*flags*/ },
{ ENCTYPE_AES256_CTS_HMAC_SHA1_96,
"aes256-cts-hmac-sha1-96", { "aes256-cts" },
"AES-256 CTS mode with 96-bit SHA-1 HMAC",
@@ -149,7 +159,8 @@
krb5int_aes_string_to_key,
krb5int_dk_prf,
CKSUMTYPE_HMAC_SHA1_96_AES256,
- &krb5int_aead_aes },
+ &krb5int_aead_aes,
+ 0 /*flags*/ },
};
const int krb5_enctypes_length =
Modified: trunk/src/lib/crypto/etypes.h
===================================================================
--- trunk/src/lib/crypto/etypes.h 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/lib/crypto/etypes.h 2009-01-28 23:22:27 UTC (rev 21823)
@@ -60,7 +60,10 @@
krb5_prf_func prf;
krb5_cksumtype required_ctype;
const struct krb5_aead_provider *aead;
+ krb5_flags flags;
};
+#define ETYPE_WEAK 1
+
extern const struct krb5_keytypes krb5_enctypes_list[];
extern const int krb5_enctypes_length;
Modified: trunk/src/lib/crypto/libk5crypto.exports
===================================================================
--- trunk/src/lib/crypto/libk5crypto.exports 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/lib/crypto/libk5crypto.exports 2009-01-28 23:22:27 UTC (rev 21823)
@@ -45,6 +45,7 @@
krb5_c_valid_enctype
krb5_c_verify_checksum
krb5_c_verify_checksum_iov
+krb5_c_weak_enctype
krb5_calculate_checksum
krb5_checksum_size
krb5_cksumtype_to_string
Modified: trunk/src/lib/crypto/valid_enctype.c
===================================================================
--- trunk/src/lib/crypto/valid_enctype.c 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/lib/crypto/valid_enctype.c 2009-01-28 23:22:27 UTC (rev 21823)
@@ -45,3 +45,24 @@
{
return krb5_c_valid_enctype (etype);
}
+
+krb5_boolean KRB5_CALLCONV
+krb5_c_weak_enctype(krb5_enctype etype)
+{
+ int i;
+ const struct krb5_keytypes *k;
+
+ for (i = 0; i < krb5_enctypes_length; i++) {
+#if 0
+ if (krb5_enctypes_list[i].etype == etype &&
+ krb5_enctypes_list[i].flags | ETYPE_WEAK)
+ return(1);
+#endif
+ k = &krb5_enctypes_list[i];
+ if (k->etype == etype && (k->flags & ETYPE_WEAK)) {
+ return(1);
+ }
+ }
+
+ return(0);
+}
Modified: trunk/src/lib/krb5/krb/init_ctx.c
===================================================================
--- trunk/src/lib/krb5/krb/init_ctx.c 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/lib/krb5/krb/init_ctx.c 2009-01-28 23:22:27 UTC (rev 21823)
@@ -171,6 +171,12 @@
if ((retval = krb5_os_init_context(ctx, kdc)))
goto cleanup;
+ retval = profile_get_boolean(ctx->profile, "libdefaults",
+ "allow_weak_crypto", NULL, 0, &tmp);
+ if (retval)
+ goto cleanup;
+ ctx->allow_weak_crypto = tmp;
+
/* initialize the prng (not well, but passable) */
if ((retval = krb5_c_random_os_entropy( ctx, 0, NULL)) !=0)
goto cleanup;
@@ -289,6 +295,8 @@
for (i = 0; ktypes[i]; i++) {
if (!krb5_c_valid_enctype(ktypes[i]))
return KRB5_PROG_ETYPE_NOSUPP;
+ if (!context->allow_weak_crypto && krb5_c_weak_enctype(ktypes[i]))
+ return KRB5_PROG_ETYPE_NOSUPP;
}
/* Now copy the default ktypes into the context pointer */
@@ -314,6 +322,7 @@
unsigned int ctx_count, krb5_enctype *ctx_list)
{
krb5_enctype *old_ktypes;
+ krb5_enctype ktype;
if (ctx_count) {
/* application-set defaults */
@@ -367,9 +376,11 @@
j = 0;
i = 1;
while (1) {
- if (! krb5_string_to_enctype(sp, &old_ktypes[j]))
+ if (!krb5_string_to_enctype(sp, &ktype) &&
+ (context->allow_weak_crypto || !krb5_c_weak_enctype(ktype))) {
+ old_ktypes[j] = ktype;
j++;
-
+ }
if (i++ >= count)
break;
@@ -410,6 +421,8 @@
for (i = 0; ktypes[i]; i++) {
if (!krb5_c_valid_enctype(ktypes[i]))
return KRB5_PROG_ETYPE_NOSUPP;
+ if (!context->allow_weak_crypto && krb5_c_weak_enctype(ktypes[i]))
+ return KRB5_PROG_ETYPE_NOSUPP;
}
/* Now copy the default ktypes into the context pointer */
Modified: trunk/src/tests/dejagnu/config/default.exp
===================================================================
--- trunk/src/tests/dejagnu/config/default.exp 2009-01-28 21:15:46 UTC (rev 21822)
+++ trunk/src/tests/dejagnu/config/default.exp 2009-01-28 23:22:27 UTC (rev 21823)
@@ -1024,6 +1024,7 @@
puts $conffile "\[libdefaults\]"
puts $conffile " default_realm = $REALMNAME"
puts $conffile " dns_lookup_kdc = false"
+ puts $conffile " allow_weak_crypto = true"
if [info exists default_tgs_enctypes($type)] {
puts $conffile \
" default_tgs_enctypes = $default_tgs_enctypes($type)"
More information about the cvs-krb5
mailing list