oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Allow selection of minium bits from the DH parameters.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19167 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2006-11-28 04:00:35 +00:00
parent 444753045a
commit 997dc9aebb
1 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
lib/krb5/pkinit.c
View File

@@ -1521,9 +1521,25 @@ select_dh_group(krb5_context context, DH *dh, unsigned long bits,
{ {
const struct krb5_dh_moduli *m; const struct krb5_dh_moduli *m;
m = moduli[1]; /* XXX */ if (bits == 0) {
if (m == NULL) m = moduli[1]; /* XXX */
m = moduli[0]; /* XXX */ if (m == NULL)
m = moduli[0]; /* XXX */
} else {
int i;
for (i = 0; moduli[i] != NULL; i++) {
if (bits < moduli[i]->bits)
break;
}
if (moduli[i] == NULL) {
krb5_set_error_string(context,
"Did not find a DH group parameter "
"matching requirement of %lu bits",
bits);
return EINVAL;
}
m = moduli[i];
}
dh->p = integer_to_BN(context, "p", &m->p); dh->p = integer_to_BN(context, "p", &m->p);
if (dh->p == NULL) if (dh->p == NULL)
@@ -1878,12 +1894,19 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
if ((flags & 2) == 0) { if ((flags & 2) == 0) {
const char *moduli_file; const char *moduli_file;
unsigned long dh_min_bits;
moduli_file = krb5_config_get_string(context, NULL, moduli_file = krb5_config_get_string(context, NULL,
"libdefaults", "libdefaults",
"moduli", "moduli",
NULL); NULL);
dh_min_bits =
krb5_config_get_int_default(context, NULL, 0,
"libdefaults",
"pkinit_dh_min_bits",
NULL);
ret = _krb5_parse_moduli(context, moduli_file, ret = _krb5_parse_moduli(context, moduli_file,
&opt->opt_private->pk_init_ctx->m); &opt->opt_private->pk_init_ctx->m);
if (ret) { if (ret) {
@@ -1898,7 +1921,8 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
return ENOMEM; return ENOMEM;
} }
ret = select_dh_group(context, opt->opt_private->pk_init_ctx->dh, 0, ret = select_dh_group(context, opt->opt_private->pk_init_ctx->dh,
dh_min_bits,
opt->opt_private->pk_init_ctx->m); opt->opt_private->pk_init_ctx->m);
if (ret) { if (ret) {
_krb5_get_init_creds_opt_free_pkinit(opt); _krb5_get_init_creds_opt_free_pkinit(opt);