From 7d0f882b196ce9045488dee68ec979b4fb96d6d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 20 Sep 2019 18:32:43 +0200 Subject: [PATCH 132/187] auth/gensec: fix non-AES schannel seal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14134 Guenther Signed-off-by: Guenther Deschner Reviewed-by: Andreas Schneider (cherry picked from commit 709d54d68a9c2cb3cda91d9ab63228a7adbaceb4) --- auth/gensec/schannel.c | 9 +++++++++ selftest/knownfail | 1 + 2 files changed, 10 insertions(+) diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c index b5e6289ef3f..9f2611e5f04 100644 --- a/auth/gensec/schannel.c +++ b/auth/gensec/schannel.c @@ -428,6 +428,15 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state, ZERO_ARRAY(_sealing_key); return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); } + gnutls_cipher_deinit(cipher_hnd); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &sealing_key, + NULL); + if (rc < 0) { + ZERO_ARRAY(_sealing_key); + return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + } rc = gnutls_cipher_encrypt(cipher_hnd, data, length); diff --git a/selftest/knownfail b/selftest/knownfail index 7b54b77a708..95db97a44e0 100644 --- a/selftest/knownfail +++ b/selftest/knownfail @@ -374,3 +374,4 @@ ^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\) ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\) ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\) +^samba.unittests.schannel.torture_schannel_seal_aes -- 2.23.0