sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-07-25 00:59:11 +03:00
Code Activity

lib/crypto: implement samba.crypto Python module for RC4

Browse Source 
Implement a small Python module that exposes arcfour_crypt_blob()
function widely used in Samba C code.

When Samba Python bindings are used to call LSA CreateTrustedDomainEx2,
there is a need to encrypt trusted credentials with RC4 cipher.

Current Samba Python code relies on Python runtime to provide RC4
cipher. However, in FIPS 140-2 mode system crypto libraries do not
provide access RC4 cipher at all. According to Microsoft dochelp team,
Windows is treating AuthenticationInformation blob encryption as 'plain
text' in terms of FIPS 140-2, thus doing application-level encryption.

Replace samba.arcfour_encrypt() implementation with a call to
samba.crypto.arcfour_crypt_blob().

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Mar 15 01:30:24 CET 2017 on sn-devel-144
This commit is contained in:
Alexander Bokovoy
2017-03-10 16:20:06 +02:00
committed by Günther Deschner
parent 64b20a1d42
commit bbeef554f2
3 changed files with 99 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
python/samba/__init__.py
View File

@ -375,20 +375,8 @@ def string_to_byte_array(string):
return blob
def arcfour_encrypt(key, data):
try:
from Crypto.Cipher import ARC4
c = ARC4.new(key)
return c.encrypt(data)
except ImportError as e:
pass
try:
from M2Crypto.RC4 import RC4
c = RC4(key)
return c.update(data)
except ImportError as e:
pass
raise Exception("arcfour_encrypt() requires " +
"python*-crypto or python*-m2crypto or m2crypto")
from samba.crypto import arcfour_crypt_blob
return arcfour_crypt_blob(data, key)
version = _glue.version
interface_ips = _glue.interface_ips