lib/crypto: Use GnuTLS RC4 for samba_gnutls_arcfour_confounded_md5()

This allows Samba to use GnuTLS for drsuapi_{en,de}crypt_attribute_value()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/lib/crypto/gnutls_arcfour_confounded_md5.c b/lib/crypto/gnutls_arcfour_confounded_md5.c
index 27fede2656e1e24e073be0a6183c6b70a35a90cc..b99e611df7550769d69ef40534f0ae35b3787ad0 100644 (file)
--- a/lib/crypto/gnutls_arcfour_confounded_md5.c
+++ b/lib/crypto/gnutls_arcfour_confounded_md5.c
@@ -36,19 +36,22 @@
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 #include "gnutls_helpers.h"
-#include "arcfour.h"
 #include "lib/util/memory.h"
 
 int samba_gnutls_arcfour_confounded_md5(const DATA_BLOB *key_input1,
                                        const DATA_BLOB *key_input2,
-                                       DATA_BLOB *data)
+                                       DATA_BLOB *data,
+                                       enum samba_gnutls_direction encrypt)
 {
        int rc;
        gnutls_hash_hd_t hash_hnd = NULL;
        uint8_t confounded_key[16];
-       DATA_BLOB confounded_key_as_blob
-               = data_blob_const(confounded_key,
-                                 sizeof(confounded_key));
+       gnutls_cipher_hd_t cipher_hnd = NULL;
+       gnutls_datum_t confounded_key_datum = {
+               .data = confounded_key,
+               .size = sizeof(confounded_key),
+       };
+
        rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
        if (rc < 0) {
                return rc;
@@ -64,12 +67,27 @@ int samba_gnutls_arcfour_confounded_md5(const DATA_BLOB *key_input1,
                return rc;
        }
 
-       gnutls_hash_deinit(hash_hnd, confounded_key_as_blob.data);
+       gnutls_hash_deinit(hash_hnd, confounded_key);
 
-       arcfour_crypt_blob(data->data, data->length,
-                          &confounded_key_as_blob);
+       rc = gnutls_cipher_init(&cipher_hnd,
+                               GNUTLS_CIPHER_ARCFOUR_128,
+                               &confounded_key_datum,
+                               NULL);
+       if (rc < 0) {
+               return rc;
+       }
 
+       if (encrypt == SAMBA_GNUTLS_ENCRYPT) {
+               rc = gnutls_cipher_encrypt(cipher_hnd,
+                                          data->data,
+                                          data->length);
+       } else {
+               rc = gnutls_cipher_decrypt(cipher_hnd,
+                                          data->data,
+                                          data->length);
+       }
+       gnutls_cipher_deinit(cipher_hnd);
        ZERO_ARRAY(confounded_key);
 
-       return 0;
+       return rc;
 }

diff --git a/lib/crypto/gnutls_helpers.h b/lib/crypto/gnutls_helpers.h
index fedbb5307e0697acfacf52cadb8b8aa29407b142..b8288c25649432564ac3ead6c43d6df4a37f2117 100644 (file)
--- a/lib/crypto/gnutls_helpers.h
+++ b/lib/crypto/gnutls_helpers.h
@@ -37,8 +37,14 @@ WERROR _gnutls_error_to_werror(int gnutls_rc,
        _gnutls_error_to_werror(gnutls_rc, blocked_werr, \
                                __FUNCTION__, __location__)
 
+enum samba_gnutls_direction {
+       SAMBA_GNUTLS_ENCRYPT,
+       SAMBA_GNUTLS_DECRYPT
+};
+
 int samba_gnutls_arcfour_confounded_md5(const DATA_BLOB *key_input1,
                                        const DATA_BLOB *key_input2,
-                                       DATA_BLOB *data);
+                                       DATA_BLOB *data,
+                                       enum samba_gnutls_direction encrypt);
 
 #endif /* _GNUTLS_HELPERS_H */

diff --git a/lib/crypto/wscript_build b/lib/crypto/wscript_build
index a263d08f6389fc787ca6ff253cc57ec4010af99a..2ad8dfe2cd02a322bf10613884c4747df5f66c2c 100644 (file)
--- a/lib/crypto/wscript_build
+++ b/lib/crypto/wscript_build
@@ -10,7 +10,7 @@ bld.SAMBA_SUBSYSTEM('GNUTLS_HELPERS',
                     gnutls_error.c
                     gnutls_arcfour_confounded_md5.c
                     ''',
-                    deps='gnutls samba-errors LIBCRYPTO');
+                    deps='gnutls samba-errors');
 
 bld.SAMBA_SUBSYSTEM('LIBCRYPTO',
         source='''md4.c arcfour.c

diff --git a/libcli/drsuapi/repl_decrypt.c b/libcli/drsuapi/repl_decrypt.c
index 5425eef96317b9f49c8151443e1396ba97f22116..83275360c7d3c1f042b21dc119a157450e6161c2 100644 (file)
--- a/libcli/drsuapi/repl_decrypt.c
+++ b/libcli/drsuapi/repl_decrypt.c
@@ -88,7 +88,8 @@ static WERROR drsuapi_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
 
        rc = samba_gnutls_arcfour_confounded_md5(gensec_skey,
                                                 &confounder,
-                                                &dec_buffer);
+                                                &dec_buffer,
+                                                SAMBA_GNUTLS_DECRYPT);
        if (rc < 0) {
                result = gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);
                goto out;
@@ -302,7 +303,8 @@ static WERROR drsuapi_encrypt_attribute_value(TALLOC_CTX *mem_ctx,
 
        rc = samba_gnutls_arcfour_confounded_md5(gensec_skey,
                                                 &confounder,
-                                                &to_encrypt);
+                                                &to_encrypt,
+                                                SAMBA_GNUTLS_ENCRYPT);
        if (rc < 0) {
                result = gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);
                goto out;