sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

libcli:auth: Use GnuTLS SHA256 HMAC for credentials

Browse Source 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andreas Schneider 2018-10-10 15:37:18 +02:00 committed by Andrew Bartlett
parent 75d45f6d2b
commit 8bed91c999
2 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
libcli/auth/credentials.c
View File

@ -26,6 +26,9 @@
#include "libcli/auth/libcli_auth.h"
#include "../libcli/security/dom_sid.h"
#include <gnutls/gnutls.h>
#include <gnutls/crypto.h>
static void netlogon_creds_step_crypt(struct netlogon_creds_CredentialState *creds,
const struct netr_Credential *in,
struct netr_Credential *out)
@ -102,22 +105,38 @@ static void netlogon_creds_init_hmac_sha256(struct netlogon_creds_CredentialStat
const struct netr_Credential *server_challenge,
const struct samr_Password *machine_password)
{
struct HMACSHA256Context ctx;
uint8_t digest[SHA256_DIGEST_LENGTH];
gnutls_hmac_hd_t hmac_hnd = NULL;
uint8_t digest[gnutls_hash_get_len(GNUTLS_MAC_SHA256)];
int rc;
ZERO_ARRAY(creds->session_key);
hmac_sha256_init(machine_password->hash,
sizeof(machine_password->hash),
&ctx);
hmac_sha256_update(client_challenge->data, 8, &ctx);
hmac_sha256_update(server_challenge->data, 8, &ctx);
hmac_sha256_final(digest, &ctx);
rc = gnutls_hmac_init(&hmac_hnd,
GNUTLS_MAC_SHA256,
machine_password->hash,
sizeof(machine_password->hash));
if (rc < 0) {
return;
}
rc = gnutls_hmac(hmac_hnd,
client_challenge->data,
8);
if (rc < 0) {
gnutls_hmac_deinit(hmac_hnd, NULL);
return;
}
rc = gnutls_hmac(hmac_hnd,
server_challenge->data,
8);
if (rc < 0) {
gnutls_hmac_deinit(hmac_hnd, NULL);
return;
}
gnutls_hmac_deinit(hmac_hnd, digest);
memcpy(creds->session_key, digest, sizeof(creds->session_key));
ZERO_STRUCT(digest);
ZERO_STRUCT(ctx);
ZERO_ARRAY(digest);
}
static void netlogon_creds_first_step(struct netlogon_creds_CredentialState *creds,

2
libcli/auth/wscript_build
View File

@ -18,7 +18,7 @@ bld.SAMBA_SUBSYSTEM('NTLM_CHECK',
bld.SAMBA_SUBSYSTEM('LIBCLI_AUTH',
source='credentials.c session.c smbencrypt.c smbdes.c',
public_deps='MSRPC_PARSE',
public_deps='MSRPC_PARSE gnutls',
public_headers='credentials.h:domain_credentials.h'
)