From 508ef6703dc429dccbe8a0940ca0ecb80e3bd9b2 Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Tue, 9 Apr 2013 23:47:54 -0400 Subject: Allow config of dh_min_bits < 2048 Allow configuration to override the default dh_min_bits of 2048 to 1024. Disallow configuration of dh_min_bits < 1024, but continue to default to 2048. (cherry picked from commit cae44d2d014985022a001924dce4a56d12c63818) ticket: 7659 (new) version_fixed: 1.10.6 status: resolved --- src/plugins/preauth/pkinit/pkinit.h | 1 + src/plugins/preauth/pkinit/pkinit_srv.c | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h index 48e57fe..d8a8d31 100644 --- a/src/plugins/preauth/pkinit/pkinit.h +++ b/src/plugins/preauth/pkinit/pkinit.h @@ -72,6 +72,7 @@ extern int longhorn; /* XXX Talking to a Longhorn server? */ #define PKINIT_REQ_CTX_MAGIC 0xdeadbeef #define PKINIT_DEFAULT_DH_MIN_BITS 2048 +#define PKINIT_DH_MIN_CONFIG_BITS 1024 #define KRB5_CONF_KDCDEFAULTS "kdcdefaults" #define KRB5_CONF_LIBDEFAULTS "libdefaults" diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c index c271bf9..2402f88 100644 --- a/src/plugins/preauth/pkinit/pkinit_srv.c +++ b/src/plugins/preauth/pkinit/pkinit_srv.c @@ -1176,10 +1176,11 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx) KRB5_CONF_PKINIT_DH_MIN_BITS, PKINIT_DEFAULT_DH_MIN_BITS, &plgctx->opts->dh_min_bits); - if (plgctx->opts->dh_min_bits < PKINIT_DEFAULT_DH_MIN_BITS) { - pkiDebug("%s: invalid value (%d) for pkinit_dh_min_bits, " + if (plgctx->opts->dh_min_bits < PKINIT_DH_MIN_CONFIG_BITS) { + pkiDebug("%s: invalid value (%d < %d) for pkinit_dh_min_bits, " "using default value (%d) instead\n", __FUNCTION__, - plgctx->opts->dh_min_bits, PKINIT_DEFAULT_DH_MIN_BITS); + plgctx->opts->dh_min_bits, PKINIT_DH_MIN_CONFIG_BITS, + PKINIT_DEFAULT_DH_MIN_BITS); plgctx->opts->dh_min_bits = PKINIT_DEFAULT_DH_MIN_BITS; } -- cgit v1.1