diff options
| author | Simo Sorce <simo@redhat.com> | 2014-11-17 21:05:56 -0500 |
|---|---|---|
| committer | Simo Sorce <simo@redhat.com> | 2014-11-20 10:52:13 -0500 |
| commit | b170851058d6712442d553ef3d11ecd21b282443 (patch) | |
| tree | e1e8086c83bcfdf1efb92e6a9940cbd809c9df8b /daemons | |
| parent | 35dad9684b22819a2c848e7ebb78cfbc438a30e6 (diff) | |
| download | freeipa-b170851058d6712442d553ef3d11ecd21b282443.tar.gz freeipa-b170851058d6712442d553ef3d11ecd21b282443.tar.xz freeipa-b170851058d6712442d553ef3d11ecd21b282443.zip | |
Fix filtering of enctypes in server code.
The filtering was incorrect and would result in always discarding all values.
Also make sure there are no duplicates in the list.
Partial fix for:
https://fedorahosted.org/freeipa/ticket/4718
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Diffstat (limited to 'daemons')
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c | 60 |
1 files changed, 43 insertions, 17 deletions
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c index f0346a343..b87ae0dc7 100644 --- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c +++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c @@ -125,6 +125,48 @@ static void filter_keys(struct ipapwd_krbcfg *krbcfg, } } +static void filter_enctypes(struct ipapwd_krbcfg *krbcfg, + krb5_key_salt_tuple *kenctypes, + int *num_kenctypes) +{ + /* first filter for duplicates */ + for (int i = 0; i + 1 < *num_kenctypes; i++) { + for (int j = i + 1; j < *num_kenctypes; j++) { + if (kenctypes[i].ks_enctype == kenctypes[j].ks_enctype) { + /* duplicate, filter out */ + for (int k = j; k + 1 < *num_kenctypes; k++) { + kenctypes[k].ks_enctype = kenctypes[k + 1].ks_enctype; + kenctypes[k].ks_salttype = kenctypes[k + 1].ks_salttype; + } + (*num_kenctypes)--; + j--; + } + } + } + + /* then filter for supported */ + for (int i = 0; i < *num_kenctypes; i++) { + int j; + + /* Check if supported */ + for (j = 0; j < krbcfg->num_supp_encsalts; j++) { + if (kenctypes[i].ks_enctype == + krbcfg->supp_encsalts[j].ks_enctype) { + break; + } + } + if (j == krbcfg->num_supp_encsalts) { + /* Unsupported, filter out */ + for (int k = i; k + 1 < *num_kenctypes; k++) { + kenctypes[k].ks_enctype = kenctypes[k + 1].ks_enctype; + kenctypes[k].ks_salttype = kenctypes[k + 1].ks_salttype; + } + (*num_kenctypes)--; + i--; + } + } +} + static int ipapwd_to_ldap_pwpolicy_error(int ipapwderr) { switch (ipapwderr) { @@ -1740,23 +1782,7 @@ static int ipapwd_getkeytab(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg) goto free_and_return; } - for (int i = 0; i < num_kenctypes; i++) { - - /* Check if supported */ - for (int j = 0; j < krbcfg->num_supp_encsalts; j++) { - if (kenctypes[i].ks_enctype == - krbcfg->supp_encsalts[j].ks_enctype) { - continue; - } - } - /* Unsupported, filter out */ - for (int j = i; j + 1 < num_kenctypes; j++) { - kenctypes[j].ks_enctype = kenctypes[j + 1].ks_enctype; - kenctypes[j].ks_salttype = kenctypes[j + 1].ks_salttype; - } - num_kenctypes--; - i--; - } + filter_enctypes(krbcfg, kenctypes, &num_kenctypes); /* check if we have any left */ if (num_kenctypes == 0 && kenctypes != NULL) { |