more enctypes...

diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
index c8aa9191c7ee6f307a2a1640da074880b0bebfee..bb6b91ee95e4066e14d44ef1cd8e2435e1df5460 100644 (file)
--- a/source3/libads/kerberos.c
+++ b/source3/libads/kerberos.c
@@ -599,6 +599,28 @@ static char *get_enctypes(TALLOC_CTX *mem_ctx)
 }
 #endif
 
+uint32_t kerberos_supported_encryption_types(void)
+{
+       uint32_t encryption_types = 0;
+
+       if (lp_kerberos_encryption_types() == KERBEROS_ETYPES_ALL ||
+           lp_kerberos_encryption_types() == KERBEROS_ETYPES_STRONG) {
+#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+               encryption_types |= ENC_HMAC_SHA1_96_AES128;
+#endif
+#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
+               encryption_types |= ENC_HMAC_SHA1_96_AES256;
+#endif
+       }
+
+       if (lp_kerberos_encryption_types() == KERBEROS_ETYPES_ALL ||
+           lp_kerberos_encryption_types() == KERBEROS_ETYPES_LEGACY) {
+               encryption_types |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
+       }
+
+       return encryption_types;
+}
+
 bool create_local_private_krb5_conf_for_domain(const char *realm,
                                                const char *domain,
                                                const char *sitename,

diff --git a/source3/libads/kerberos_proto.h b/source3/libads/kerberos_proto.h
index f92cabd757ebf3d755bba4835af1f0f7c682a6f0..aac8d311b39438640acdb6f8e9599034763e0a8c 100644 (file)
--- a/source3/libads/kerberos_proto.h
+++ b/source3/libads/kerberos_proto.h
@@ -61,6 +61,7 @@ int kerberos_kinit_password(const char *principal,
                            const char *password,
                            int time_offset,
                            const char *cache_name);
+uint32_t kerberos_supported_encryption_types(void);
 bool create_local_private_krb5_conf_for_domain(const char *realm,
                                                const char *domain,
                                                const char *sitename,

diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index 27fc5135442cf47bb36ad7e64bc8e24cc3b6acf9..5a0834520820b2de77d86d2a4c72a7a80c4ffdb3 100644 (file)
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -2361,15 +2361,7 @@ WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
 
        ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
 
-       ctx->in.desired_encryption_types = ENC_CRC32 |
-                                          ENC_RSA_MD5 |
-                                          ENC_RC4_HMAC_MD5;
-#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
-       ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES128;
-#endif
-#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
-       ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES256;
-#endif
+       ctx->in.desired_encryption_types = kerberos_supported_encryption_types();
 
        *r = ctx;
 

diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c
index 172616ca3dc220c59a3b5016ec069b6f3c9052a9..c64566f2d4041bbbc6dc8cbe9fb9f13a1281a592 100644 (file)
--- a/source3/librpc/crypto/gse_krb5.c
+++ b/source3/librpc/crypto/gse_krb5.c
@@ -165,6 +165,8 @@ static krb5_error_code fill_mem_keytab_from_secrets(krb5_context krbctx,
        krb5_principal princ = NULL;
        krb5_kvno kvno = 0; /* FIXME: fetch current vno from KDC ? */
        NTSTATUS status;
+       uint32_t announced_enc_types;
+       uint32_t supported_enc_types;
 
        if (!secrets_init()) {
                DEBUG(1, (__location__ ": secrets_init failed\n"));
@@ -182,7 +184,10 @@ static krb5_error_code fill_mem_keytab_from_secrets(krb5_context krbctx,
                return KRB5_LIBOS_CANTREADPWD;
        }
        ct = &info->password->cleartext_blob;
-
+       {
+       const char *str = secrets_domain_info_string(frame, info, domain, false);
+       DBG_ERR("%s\n", str);
+       }
        if (info->domain_info.dns_domain.string != NULL) {
                realm = strupper_talloc(frame,
                                info->domain_info.dns_domain.string);
@@ -257,6 +262,31 @@ static krb5_error_code fill_mem_keytab_from_secrets(krb5_context krbctx,
                goto out;
        }
 
+       /*
+        * we use the effective configured value
+        * instead of the one we stored on the domain controller.
+        */
+       announced_enc_types = info->supported_enc_types;
+       if (announced_enc_types == 0) {
+               announced_enc_types |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
+               if (lp_server_role() >= ROLE_ACTIVE_DIRECTORY_DC) {
+                       /* DCs and RODCs comptuer accounts use AES */
+#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+                       announced_enc_types |= ENC_HMAC_SHA1_96_AES128;
+#endif
+#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
+                       announced_enc_types |= ENC_HMAC_SHA1_96_AES256;
+#endif
+               }
+       }
+       supported_enc_types = kerberos_supported_encryption_types();
+       if (announced_enc_types != supported_enc_types) {
+               DBG_NOTICE("announced_enc_types[0x%08X] != "
+                          "supported_enc_types[0x%08X]\n",
+                          (unsigned)announced_enc_types,
+                          (unsigned)supported_enc_types);
+       }
+
        ret = fill_keytab_from_password(krbctx, *keytab,
                                        princ, kvno,
                                        info->password);

diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 1f055507ad723950b47b035304cecac115997dc6..ae2a03dbe9789aa50cd8932b6823c2b9c623d94c 100644 (file)
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -3599,6 +3599,15 @@ static void net_ads_enctype_dump_enctypes(const char *username,
                ENC_HMAC_SHA1_96_AES256);
 }
 
+#if 0
+static void net_ads_enctype_secrets_update__enctypes(const char *domain,
+                                                    const char *enctype_str)
+{
+//     int enctypes = atoi(enctype_str);
+
+}
+#endif
+
 static int net_ads_enctypes_list(struct net_context *c, int argc, const char **argv)
 {
        int ret = -1;