Blame 0005-adenroll-use-only-enctypes-permitted-by-Kerberos-con.patch

c2be30f
From cc3ef52884a48863a81acbfc741735fe09cd85f7 Mon Sep 17 00:00:00 2001
c2be30f
From: Sumit Bose <sbose@redhat.com>
c2be30f
Date: Thu, 13 Jun 2019 18:27:49 +0200
c2be30f
Subject: [PATCH 3/3] adenroll: use only enctypes permitted by Kerberos config
c2be30f
c2be30f
Realted to https://gitlab.freedesktop.org/realmd/adcli/issues/3
c2be30f
---
c2be30f
 doc/adcli.xml      | 10 ++++++++++
c2be30f
 library/adenroll.c | 22 +++++++++++++++++++---
c2be30f
 2 files changed, 29 insertions(+), 3 deletions(-)
c2be30f
c2be30f
diff --git a/doc/adcli.xml b/doc/adcli.xml
c2be30f
index 9605b4a..094f577 100644
c2be30f
--- a/doc/adcli.xml
c2be30f
+++ b/doc/adcli.xml
c2be30f
@@ -342,6 +342,11 @@ Password for Administrator:
c2be30f
 		</varlistentry>
c2be30f
 	</variablelist>
c2be30f
 
c2be30f
+	<para>If supported on the AD side the
c2be30f
+	<option>msDS-supportedEncryptionTypes</option> attribute will be set as
c2be30f
+	well. Either the current value or the default list of AD's supported
c2be30f
+	encryption types filtered by the permitted encryption types of the
c2be30f
+	client's Kerberos configuration are written.</para>
c2be30f
 </refsect1>
c2be30f
 
c2be30f
 <refsect1 id='updating'>
c2be30f
@@ -475,6 +480,11 @@ $ adcli update --login-ccache=/tmp/krbcc_123
c2be30f
 		</varlistentry>
c2be30f
 	</variablelist>
c2be30f
 
c2be30f
+	<para>If supported on the AD side the
c2be30f
+	<option>msDS-supportedEncryptionTypes</option> attribute will be set as
c2be30f
+	well. Either the current value or the default list of AD's supported
c2be30f
+	encryption types filtered by the permitted encryption types of the
c2be30f
+	client's Kerberos configuration are written.</para>
c2be30f
 </refsect1>
c2be30f
 
c2be30f
 <refsect1 id='testjoin'>
c2be30f
diff --git a/library/adenroll.c b/library/adenroll.c
c2be30f
index 95c07cd..53cd812 100644
c2be30f
--- a/library/adenroll.c
c2be30f
+++ b/library/adenroll.c
c2be30f
@@ -639,6 +639,7 @@ calculate_enctypes (adcli_enroll *enroll, char **enctype)
c2be30f
 {
c2be30f
 	char *value = NULL;
c2be30f
 	krb5_enctype *read_enctypes;
c2be30f
+	krb5_enctype *new_enctypes;
c2be30f
 	char *new_value = NULL;
c2be30f
 	int is_2008_or_later;
c2be30f
 	LDAP *ldap;
c2be30f
@@ -685,7 +686,14 @@ calculate_enctypes (adcli_enroll *enroll, char **enctype)
c2be30f
 		value = _adcli_krb5_format_enctypes (v51_earlier_enctypes);
c2be30f
 	}
c2be30f
 
c2be30f
-	new_value = _adcli_krb5_format_enctypes (adcli_enroll_get_keytab_enctypes (enroll));
c2be30f
+	new_enctypes = adcli_enroll_get_permitted_keytab_enctypes (enroll);
c2be30f
+	if (new_enctypes == NULL) {
c2be30f
+		_adcli_warn ("No permitted encryption type found.");
c2be30f
+		return ADCLI_ERR_UNEXPECTED;
c2be30f
+	}
c2be30f
+
c2be30f
+	new_value = _adcli_krb5_format_enctypes (new_enctypes);
c2be30f
+	krb5_free_enctypes (adcli_conn_get_krb5_context (enroll->conn), new_enctypes);
c2be30f
 	if (new_value == NULL) {
c2be30f
 		free (value);
c2be30f
 		_adcli_warn ("The encryption types desired are not available in active directory");
c2be30f
@@ -1758,7 +1766,11 @@ add_principal_to_keytab (adcli_enroll *enroll,
c2be30f
 		             enroll->keytab_name);
c2be30f
 	}
c2be30f
 
c2be30f
-	enctypes = adcli_enroll_get_keytab_enctypes (enroll);
c2be30f
+	enctypes = adcli_enroll_get_permitted_keytab_enctypes (enroll);
c2be30f
+	if (enctypes == NULL) {
c2be30f
+		_adcli_warn ("No permitted encryption type found.");
c2be30f
+		return ADCLI_ERR_UNEXPECTED;
c2be30f
+	}
c2be30f
 
c2be30f
 	if (flags & ADCLI_ENROLL_PASSWORD_VALID) {
c2be30f
 		code = _adcli_krb5_keytab_copy_entries (k5, enroll->keytab, principal,
c2be30f
@@ -1774,7 +1786,10 @@ add_principal_to_keytab (adcli_enroll *enroll,
c2be30f
 		 */
c2be30f
 
c2be30f
 		salts = build_principal_salts (enroll, k5, principal);
c2be30f
-		return_unexpected_if_fail (salts != NULL);
c2be30f
+		if (salts == NULL) {
c2be30f
+			krb5_free_enctypes (k5, enctypes);
c2be30f
+			return ADCLI_ERR_UNEXPECTED;
c2be30f
+		}
c2be30f
 
c2be30f
 		if (*which_salt < 0) {
c2be30f
 			code = _adcli_krb5_keytab_discover_salt (k5, principal, enroll->kvno, &password,
c2be30f
@@ -1794,6 +1809,7 @@ add_principal_to_keytab (adcli_enroll *enroll,
c2be30f
 
c2be30f
 		free_principal_salts (k5, salts);
c2be30f
 	}
c2be30f
+	krb5_free_enctypes (k5, enctypes);
c2be30f
 
c2be30f
 	if (code != 0) {
c2be30f
 		_adcli_err ("Couldn't add keytab entries: %s: %s",
c2be30f
-- 
c2be30f
2.20.1
c2be30f