|
 |
b6b438 |
From 7d0f882b196ce9045488dee68ec979b4fb96d6d5 Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
|
|
b6b438 |
Date: Fri, 20 Sep 2019 18:32:43 +0200
|
|
|
b6b438 |
Subject: [PATCH 132/187] auth/gensec: fix non-AES schannel seal
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14134
|
|
|
b6b438 |
|
|
|
b6b438 |
Guenther
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Guenther Deschner <gd@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
(cherry picked from commit 709d54d68a9c2cb3cda91d9ab63228a7adbaceb4)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
auth/gensec/schannel.c | 9 +++++++++
|
|
|
b6b438 |
selftest/knownfail | 1 +
|
|
|
b6b438 |
2 files changed, 10 insertions(+)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c
|
|
|
b6b438 |
index b5e6289ef3f..9f2611e5f04 100644
|
|
|
b6b438 |
--- a/auth/gensec/schannel.c
|
|
|
b6b438 |
+++ b/auth/gensec/schannel.c
|
|
|
b6b438 |
@@ -428,6 +428,15 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state,
|
|
|
b6b438 |
ZERO_ARRAY(_sealing_key);
|
|
|
b6b438 |
return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
|
b6b438 |
}
|
|
|
b6b438 |
+ gnutls_cipher_deinit(cipher_hnd);
|
|
|
b6b438 |
+ rc = gnutls_cipher_init(&cipher_hnd,
|
|
|
b6b438 |
+ GNUTLS_CIPHER_ARCFOUR_128,
|
|
|
b6b438 |
+ &sealing_key,
|
|
|
b6b438 |
+ NULL);
|
|
|
b6b438 |
+ if (rc < 0) {
|
|
|
b6b438 |
+ ZERO_ARRAY(_sealing_key);
|
|
|
b6b438 |
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
rc = gnutls_cipher_encrypt(cipher_hnd,
|
|
|
b6b438 |
data,
|
|
|
b6b438 |
length);
|
|
|
b6b438 |
diff --git a/selftest/knownfail b/selftest/knownfail
|
|
|
b6b438 |
index 7b54b77a708..95db97a44e0 100644
|
|
|
b6b438 |
--- a/selftest/knownfail
|
|
|
b6b438 |
+++ b/selftest/knownfail
|
|
|
b6b438 |
@@ -374,3 +374,4 @@
|
|
|
b6b438 |
^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\)
|
|
|
b6b438 |
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
|
|
|
b6b438 |
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
|
|
|
b6b438 |
+^samba.unittests.schannel.torture_schannel_seal_aes
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|