|
 |
b6b438 |
From 3c64a236dfecbe396766ec0e8d326443358d4ab3 Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Mon, 4 Nov 2019 17:01:50 +0100
|
|
|
b6b438 |
Subject: [PATCH 192/208] lib:crypto: Add samba_gnutls_weak_crypto()
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
---
|
|
|
b6b438 |
lib/crypto/gnutls_helpers.h | 7 +++++
|
|
|
b6b438 |
lib/crypto/gnutls_weak_crypto.c | 48 +++++++++++++++++++++++++++++++++
|
|
|
b6b438 |
lib/crypto/wscript_build | 1 +
|
|
|
b6b438 |
3 files changed, 56 insertions(+)
|
|
|
b6b438 |
create mode 100644 lib/crypto/gnutls_weak_crypto.c
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/lib/crypto/gnutls_helpers.h b/lib/crypto/gnutls_helpers.h
|
|
|
b6b438 |
index d6000c7b316..a985c028e9d 100644
|
|
|
b6b438 |
--- a/lib/crypto/gnutls_helpers.h
|
|
|
b6b438 |
+++ b/lib/crypto/gnutls_helpers.h
|
|
|
b6b438 |
@@ -92,4 +92,11 @@ int samba_gnutls_arcfour_confounded_md5(const DATA_BLOB *key_input1,
|
|
|
b6b438 |
DATA_BLOB *data,
|
|
|
b6b438 |
enum samba_gnutls_direction encrypt);
|
|
|
b6b438 |
|
|
|
b6b438 |
+/**
|
|
|
b6b438 |
+ * @brief Check if weak crypto is allowed.
|
|
|
b6b438 |
+ *
|
|
|
b6b438 |
+ * @return true if weak crypo is allowed, false otherwise.
|
|
|
b6b438 |
+ */
|
|
|
b6b438 |
+bool samba_gnutls_weak_crypto_allowed(void);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
#endif /* _GNUTLS_HELPERS_H */
|
|
|
b6b438 |
diff --git a/lib/crypto/gnutls_weak_crypto.c b/lib/crypto/gnutls_weak_crypto.c
|
|
|
b6b438 |
new file mode 100644
|
|
|
b6b438 |
index 00000000000..68ce588243f
|
|
|
b6b438 |
--- /dev/null
|
|
|
b6b438 |
+++ b/lib/crypto/gnutls_weak_crypto.c
|
|
|
b6b438 |
@@ -0,0 +1,48 @@
|
|
|
b6b438 |
+/*
|
|
|
b6b438 |
+ * Copyright (c) 2019 Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
+ *
|
|
|
b6b438 |
+ * This program is free software: you can redistribute it and/or modify
|
|
|
b6b438 |
+ * it under the terms of the GNU General Public License as published by
|
|
|
b6b438 |
+ * the Free Software Foundation, either version 3 of the License, or
|
|
|
b6b438 |
+ * (at your option) any later version.
|
|
|
b6b438 |
+ *
|
|
|
b6b438 |
+ * This program is distributed in the hope that it will be useful,
|
|
|
b6b438 |
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
b6b438 |
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
b6b438 |
+ * GNU General Public License for more details.
|
|
|
b6b438 |
+ *
|
|
|
b6b438 |
+ * You should have received a copy of the GNU General Public License
|
|
|
b6b438 |
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
b6b438 |
+ */
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+#include "includes.h"
|
|
|
b6b438 |
+#include "lib/crypto/gnutls_helpers.h"
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+#include <gnutls/crypto.h>
|
|
|
b6b438 |
+#include <gnutls/gnutls.h>
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+bool samba_gnutls_weak_crypto_allowed(void)
|
|
|
b6b438 |
+{
|
|
|
b6b438 |
+ gnutls_cipher_hd_t cipher_hnd = NULL;
|
|
|
b6b438 |
+ gnutls_datum_t key = {
|
|
|
b6b438 |
+ .data = discard_const_p(unsigned char, "SystemLibraryDTC"),
|
|
|
b6b438 |
+ .size = 16,
|
|
|
b6b438 |
+ };
|
|
|
b6b438 |
+ int rc;
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ /*
|
|
|
b6b438 |
+ * If RC4 is not allowed to be initialzed then weak crypto is not
|
|
|
b6b438 |
+ * allowed.
|
|
|
b6b438 |
+ */
|
|
|
b6b438 |
+ rc = gnutls_cipher_init(&cipher_hnd,
|
|
|
b6b438 |
+ GNUTLS_CIPHER_ARCFOUR_128,
|
|
|
b6b438 |
+ &key,
|
|
|
b6b438 |
+ NULL);
|
|
|
b6b438 |
+ if (rc == GNUTLS_E_UNWANTED_ALGORITHM) {
|
|
|
b6b438 |
+ return false;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ gnutls_cipher_deinit(cipher_hnd);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ return true;
|
|
|
b6b438 |
+}
|
|
|
b6b438 |
diff --git a/lib/crypto/wscript_build b/lib/crypto/wscript_build
|
|
|
b6b438 |
index eb67af63f26..e5766042541 100644
|
|
|
b6b438 |
--- a/lib/crypto/wscript_build
|
|
|
b6b438 |
+++ b/lib/crypto/wscript_build
|
|
|
b6b438 |
@@ -10,6 +10,7 @@ bld.SAMBA_SUBSYSTEM('GNUTLS_HELPERS',
|
|
|
b6b438 |
source='''
|
|
|
b6b438 |
gnutls_error.c
|
|
|
b6b438 |
gnutls_arcfour_confounded_md5.c
|
|
|
b6b438 |
+ gnutls_weak_crypto.c
|
|
|
b6b438 |
''',
|
|
|
b6b438 |
deps='gnutls samba-errors');
|
|
|
b6b438 |
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|