[27716] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.11]: Allow config of dh_min_bits < 2048
daemon@ATHENA.MIT.EDU (Tom Yu)
Thu Apr 25 14:23:01 2013
Date: Thu, 25 Apr 2013 14:22:57 -0400
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201304251822.r3PIMvLQ006509@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/dfaaf09bd0da8df2d52bea63dcb6f89c3ed7cfd3
commit dfaaf09bd0da8df2d52bea63dcb6f89c3ed7cfd3
Author: Tom Yu <tlyu@mit.edu>
Date: Tue Apr 9 23:47:54 2013 -0400
Allow config of dh_min_bits < 2048
Allow configuration to override the default dh_min_bits of 2048 to
1024. Disallow configuration of dh_min_bits < 1024, but continue to
default to 2048.
(cherry picked from commit cae44d2d014985022a001924dce4a56d12c63818)
ticket: 7602
version_fixed: 1.11.3
status: resolved
src/plugins/preauth/pkinit/pkinit.h | 1 +
src/plugins/preauth/pkinit/pkinit_srv.c | 7 ++++---
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
index 5ecc489..39d4aaa 100644
--- a/src/plugins/preauth/pkinit/pkinit.h
+++ b/src/plugins/preauth/pkinit/pkinit.h
@@ -73,6 +73,7 @@ extern int longhorn; /* XXX Talking to a Longhorn server? */
#define PKINIT_REQ_CTX_MAGIC 0xdeadbeef
#define PKINIT_DEFAULT_DH_MIN_BITS 2048
+#define PKINIT_DH_MIN_CONFIG_BITS 1024
#define KRB5_CONF_KDCDEFAULTS "kdcdefaults"
#define KRB5_CONF_LIBDEFAULTS "libdefaults"
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index 132eef6..710a9dd 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -1184,10 +1184,11 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx)
KRB5_CONF_PKINIT_DH_MIN_BITS,
PKINIT_DEFAULT_DH_MIN_BITS,
&plgctx->opts->dh_min_bits);
- if (plgctx->opts->dh_min_bits < PKINIT_DEFAULT_DH_MIN_BITS) {
- pkiDebug("%s: invalid value (%d) for pkinit_dh_min_bits, "
+ if (plgctx->opts->dh_min_bits < PKINIT_DH_MIN_CONFIG_BITS) {
+ pkiDebug("%s: invalid value (%d < %d) for pkinit_dh_min_bits, "
"using default value (%d) instead\n", __FUNCTION__,
- plgctx->opts->dh_min_bits, PKINIT_DEFAULT_DH_MIN_BITS);
+ plgctx->opts->dh_min_bits, PKINIT_DH_MIN_CONFIG_BITS,
+ PKINIT_DEFAULT_DH_MIN_BITS);
plgctx->opts->dh_min_bits = PKINIT_DEFAULT_DH_MIN_BITS;
}
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
