diff options
| author | Tom Yu <tlyu@mit.edu> | 2013-04-09 23:47:54 -0400 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2013-06-04 21:40:31 -0400 |
| commit | 508ef6703dc429dccbe8a0940ca0ecb80e3bd9b2 (patch) | |
| tree | 9b0701778818c0e61e85a75535005b1147d45d3f | |
| parent | 3598d0990ec176c98fb82c3b8846058c6e576878 (diff) | |
| download | krb5-508ef6703dc429dccbe8a0940ca0ecb80e3bd9b2.zip krb5-508ef6703dc429dccbe8a0940ca0ecb80e3bd9b2.tar.gz krb5-508ef6703dc429dccbe8a0940ca0ecb80e3bd9b2.tar.bz2 | |
Allow config of dh_min_bits < 2048
Allow configuration to override the default dh_min_bits of 2048 to
1024. Disallow configuration of dh_min_bits < 1024, but continue to
default to 2048.
(cherry picked from commit cae44d2d014985022a001924dce4a56d12c63818)
ticket: 7659 (new)
version_fixed: 1.10.6
status: resolved
| -rw-r--r-- | src/plugins/preauth/pkinit/pkinit.h | 1 | ||||
| -rw-r--r-- | src/plugins/preauth/pkinit/pkinit_srv.c | 7 |
2 files changed, 5 insertions, 3 deletions
diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h index 48e57fe..d8a8d31 100644 --- a/src/plugins/preauth/pkinit/pkinit.h +++ b/src/plugins/preauth/pkinit/pkinit.h @@ -72,6 +72,7 @@ extern int longhorn; /* XXX Talking to a Longhorn server? */ #define PKINIT_REQ_CTX_MAGIC 0xdeadbeef #define PKINIT_DEFAULT_DH_MIN_BITS 2048 +#define PKINIT_DH_MIN_CONFIG_BITS 1024 #define KRB5_CONF_KDCDEFAULTS "kdcdefaults" #define KRB5_CONF_LIBDEFAULTS "libdefaults" diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c index c271bf9..2402f88 100644 --- a/src/plugins/preauth/pkinit/pkinit_srv.c +++ b/src/plugins/preauth/pkinit/pkinit_srv.c @@ -1176,10 +1176,11 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx) KRB5_CONF_PKINIT_DH_MIN_BITS, PKINIT_DEFAULT_DH_MIN_BITS, &plgctx->opts->dh_min_bits); - if (plgctx->opts->dh_min_bits < PKINIT_DEFAULT_DH_MIN_BITS) { - pkiDebug("%s: invalid value (%d) for pkinit_dh_min_bits, " + if (plgctx->opts->dh_min_bits < PKINIT_DH_MIN_CONFIG_BITS) { + pkiDebug("%s: invalid value (%d < %d) for pkinit_dh_min_bits, " "using default value (%d) instead\n", __FUNCTION__, - plgctx->opts->dh_min_bits, PKINIT_DEFAULT_DH_MIN_BITS); + plgctx->opts->dh_min_bits, PKINIT_DH_MIN_CONFIG_BITS, + PKINIT_DEFAULT_DH_MIN_BITS); plgctx->opts->dh_min_bits = PKINIT_DEFAULT_DH_MIN_BITS; } |