libcli:smb: Use GnuTLS SHA256 HMAC in smb2_key_derivation()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c
index 18f5911ad5e45319865cf7fa7998efc65b57164a..1577dee5b0b54b5ef8f8341514aefab0bf160f23 100644 (file)
--- a/libcli/smb/smb2_signing.c
+++ b/libcli/smb/smb2_signing.c
@@ -24,6 +24,9 @@
 #include "../lib/crypto/crypto.h"
 #include "lib/util/iov_buf.h"
 
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+
 NTSTATUS smb2_signing_sign_pdu(DATA_BLOB signing_key,
                               enum protocol_types protocol,
                               struct iovec *vector,
@@ -184,31 +187,60 @@ void smb2_key_derivation(const uint8_t *KI, size_t KI_len,
                         const uint8_t *Context, size_t Context_len,
                         uint8_t KO[16])
 {
-       struct HMACSHA256Context ctx;
+       gnutls_hmac_hd_t hmac_hnd = NULL;
        uint8_t buf[4];
        static const uint8_t zero = 0;
-       uint8_t digest[SHA256_DIGEST_LENGTH];
+       uint8_t digest[gnutls_hash_get_len(GNUTLS_MAC_SHA256)];
        uint32_t i = 1;
        uint32_t L = 128;
+       int rc;
 
        /*
         * a simplified version of
         * "NIST Special Publication 800-108" section 5.1
         * using hmac-sha256.
         */
-       hmac_sha256_init(KI, KI_len, &ctx);
+       rc = gnutls_hmac_init(&hmac_hnd,
+                             GNUTLS_MAC_SHA256,
+                             KI,
+                             KI_len);
+       if (rc != 0) {
+               return;
+       }
 
        RSIVAL(buf, 0, i);
-       hmac_sha256_update(buf, sizeof(buf), &ctx);
-       hmac_sha256_update(Label, Label_len, &ctx);
-       hmac_sha256_update(&zero, 1, &ctx);
-       hmac_sha256_update(Context, Context_len, &ctx);
+       rc = gnutls_hmac(hmac_hnd, buf, sizeof(buf));
+       if (rc < 0) {
+               gnutls_hmac_deinit(hmac_hnd, NULL);
+               return;
+       }
+       rc = gnutls_hmac(hmac_hnd, Label, Label_len);
+       if (rc < 0) {
+               gnutls_hmac_deinit(hmac_hnd, NULL);
+               return;
+       }
+       rc = gnutls_hmac(hmac_hnd, &zero, 1);
+       if (rc < 0) {
+               gnutls_hmac_deinit(hmac_hnd, NULL);
+               return;
+       }
+       rc = gnutls_hmac(hmac_hnd, Context, Context_len);
+       if (rc < 0) {
+               gnutls_hmac_deinit(hmac_hnd, NULL);
+               return;
+       }
        RSIVAL(buf, 0, L);
-       hmac_sha256_update(buf, sizeof(buf), &ctx);
+       rc = gnutls_hmac(hmac_hnd, buf, sizeof(buf));
+       if (rc < 0) {
+               gnutls_hmac_deinit(hmac_hnd, NULL);
+               return;
+       }
 
-       hmac_sha256_final(digest, &ctx);
+       gnutls_hmac_deinit(hmac_hnd, digest);
 
        memcpy(KO, digest, 16);
+
+       ZERO_ARRAY(digest);
 }
 
 NTSTATUS smb2_signing_encrypt_pdu(DATA_BLOB encryption_key,

diff --git a/libcli/smb/wscript b/libcli/smb/wscript
index 53a5c2139538e7fea8faef626ddd7a0492a8395d..4665703fdef63032a3b2fc3cb76fb9e9dd511367 100644 (file)
--- a/libcli/smb/wscript
+++ b/libcli/smb/wscript
@@ -46,7 +46,7 @@ def build(bld):
            tstream_smbXcli_np.c
     ''',
     deps='''
-        LIBCRYPTO NDR_SMB2_LEASE_STRUCT samba-errors gensec krb5samba
+        LIBCRYPTO gnutls NDR_SMB2_LEASE_STRUCT samba-errors gensec krb5samba
         smb_transport
     ''',
     public_deps='talloc samba-util iov_buf',