|
 |
b6b438 |
From 0d2898429e7eb2ca144885d5a1f9485cca620464 Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Mon, 8 Jul 2019 18:21:18 +0200
|
|
|
b6b438 |
Subject: [PATCH 028/187] libcli:auth: Use
|
|
|
b6b438 |
samba_gnutls_arcfour_confounded_md5() in decode_wkssvc_join_password_buffer()
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit bcf7808d3aa8a5932a40955e4b764f55061e07d7)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
libcli/auth/smbencrypt.c | 71 ++++++++++++++--------------------------
|
|
|
b6b438 |
1 file changed, 24 insertions(+), 47 deletions(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
index 823e16a3387..cc5e1fbb899 100644
|
|
|
b6b438 |
--- a/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
+++ b/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
@@ -1011,70 +1011,47 @@ WERROR decode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
DATA_BLOB *session_key,
|
|
|
b6b438 |
char **pwd)
|
|
|
b6b438 |
{
|
|
|
b6b438 |
- gnutls_hash_hd_t hash_hnd = NULL;
|
|
|
b6b438 |
- uint8_t buffer[516];
|
|
|
b6b438 |
- size_t pwd_len;
|
|
|
b6b438 |
- WERROR result;
|
|
|
b6b438 |
+ uint8_t _confounder[8];
|
|
|
b6b438 |
+ DATA_BLOB confounder = data_blob_const(_confounder, 8);
|
|
|
b6b438 |
+ uint8_t pwbuf[516] = {0};
|
|
|
b6b438 |
+ DATA_BLOB decrypt_pwbuf = data_blob_const(pwbuf, 516);
|
|
|
b6b438 |
bool ok;
|
|
|
b6b438 |
int rc;
|
|
|
b6b438 |
|
|
|
b6b438 |
- DATA_BLOB confounded_session_key;
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- int confounder_len = 8;
|
|
|
b6b438 |
- uint8_t confounder[8];
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- *pwd = NULL;
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- if (!pwd_buf) {
|
|
|
b6b438 |
+ if (pwd_buf == NULL) {
|
|
|
b6b438 |
return WERR_INVALID_PASSWORD;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
+ *pwd = NULL;
|
|
|
b6b438 |
+
|
|
|
b6b438 |
if (session_key->length != 16) {
|
|
|
b6b438 |
DEBUG(10,("invalid session key\n"));
|
|
|
b6b438 |
return WERR_INVALID_PASSWORD;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
|
|
|
b6b438 |
+ confounder = data_blob_const(&pwd_buf->data[0], 8);
|
|
|
b6b438 |
+ memcpy(&pwbuf, &pwd_buf->data[8], 516);
|
|
|
b6b438 |
|
|
|
b6b438 |
- memcpy(&confounder, &pwd_buf->data[0], confounder_len);
|
|
|
b6b438 |
- memcpy(&buffer, &pwd_buf->data[8], 516);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
|
|
|
b6b438 |
- if (rc < 0) {
|
|
|
b6b438 |
- result = gnutls_error_to_werror(rc, WERR_CONTENT_BLOCKED);
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
- }
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- rc = gnutls_hash(hash_hnd, session_key->data, session_key->length);
|
|
|
b6b438 |
- if (rc < 0) {
|
|
|
b6b438 |
- gnutls_hash_deinit(hash_hnd, NULL);
|
|
|
b6b438 |
- result = gnutls_error_to_werror(rc, WERR_CONTENT_BLOCKED);
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
- }
|
|
|
b6b438 |
- rc = gnutls_hash(hash_hnd, confounder, confounder_len);
|
|
|
b6b438 |
+ rc = samba_gnutls_arcfour_confounded_md5(session_key,
|
|
|
b6b438 |
+ &confounder,
|
|
|
b6b438 |
+ &decrypt_pwbuf,
|
|
|
b6b438 |
+ SAMBA_GNUTLS_ENCRYPT);
|
|
|
b6b438 |
if (rc < 0) {
|
|
|
b6b438 |
- gnutls_hash_deinit(hash_hnd, NULL);
|
|
|
b6b438 |
- result = gnutls_error_to_werror(rc, WERR_CONTENT_BLOCKED);
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
+ ZERO_ARRAY(_confounder);
|
|
|
b6b438 |
+ TALLOC_FREE(pwd_buf);
|
|
|
b6b438 |
+ return gnutls_error_to_werror(rc, WERR_CONTENT_BLOCKED);
|
|
|
b6b438 |
}
|
|
|
b6b438 |
- gnutls_hash_deinit(hash_hnd, confounded_session_key.data);
|
|
|
b6b438 |
|
|
|
b6b438 |
- arcfour_crypt_blob(buffer, 516, &confounded_session_key);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- ok = decode_pw_buffer(mem_ctx, buffer, pwd, &pwd_len, CH_UTF16);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- ZERO_ARRAY(confounder);
|
|
|
b6b438 |
- ZERO_ARRAY(buffer);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- data_blob_clear_free(&confounded_session_key);
|
|
|
b6b438 |
+ ok = decode_pw_buffer(mem_ctx,
|
|
|
b6b438 |
+ decrypt_pwbuf.data,
|
|
|
b6b438 |
+ pwd,
|
|
|
b6b438 |
+ &decrypt_pwbuf.length,
|
|
|
b6b438 |
+ CH_UTF16);
|
|
|
b6b438 |
+ ZERO_ARRAY(pwbuf);
|
|
|
b6b438 |
|
|
|
b6b438 |
if (!ok) {
|
|
|
b6b438 |
- result = WERR_INVALID_PASSWORD;
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
+ return WERR_INVALID_PASSWORD;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- result = WERR_OK;
|
|
|
b6b438 |
-out:
|
|
|
b6b438 |
- return result;
|
|
|
b6b438 |
+ return WERR_OK;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
-
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|