sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

libcli:smb: Use GnuTLS SHA512 in smbXcli_base

Browse Source 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andreas Schneider 2018-10-17 18:09:06 +02:00 committed by Andrew Bartlett
parent 1d8c4c64b1
commit d2a4088cc3
1 changed files with 91 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

112
libcli/smb/smbXcli_base.c
View File

@ -34,11 +34,13 @@
#include "librpc/ndr/libndr.h"
#include "libcli/smb/smb2_negotiate_context.h"
#include "libcli/smb/smb2_signing.h"
#include "lib/crypto/sha512.h"
#include "lib/crypto/aes.h"
#include "lib/crypto/aes_ccm_128.h"
#include "lib/crypto/aes_gcm_128.h"
#include <gnutls/gnutls.h>
#include <gnutls/crypto.h>
struct smbXcli_conn;
struct smbXcli_req;
struct smbXcli_session;
@ -4853,7 +4855,7 @@ static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
uint16_t hash_count;
uint16_t salt_length;
uint16_t hash_selected;
struct hc_sha512state sctx;
gnutls_hash_hd_t hash_hnd = NULL;
struct smb2_negotiate_context *cipher = NULL;
struct iovec sent_iov[3];
static const struct smb2cli_req_expected_response expected[] = {
@ -4862,6 +4864,7 @@ static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
.body_size = 0x41
}
};
int rc;
status = smb2cli_req_recv(subreq, state, &iov,
expected, ARRAY_SIZE(expected));
@ -5086,23 +5089,73 @@ static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
/* First we hash the request */
smb2cli_req_get_sent_iov(subreq, sent_iov);
samba_SHA512_Init(&sctx);
samba_SHA512_Update(&sctx, conn->smb2.preauth_sha512,
sizeof(conn->smb2.preauth_sha512));
for (i = 0; i < 3; i++) {
samba_SHA512_Update(&sctx, sent_iov[i].iov_base, sent_iov[i].iov_len);
rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_SHA512);
if (rc < 0) {
tevent_req_nterror(req,
NT_STATUS_NO_MEMORY);
return;
}
samba_SHA512_Final(conn->smb2.preauth_sha512, &sctx);
rc = gnutls_hash(hash_hnd,
conn->smb2.preauth_sha512,
sizeof(conn->smb2.preauth_sha512));
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
tevent_req_nterror(req,
NT_STATUS_ACCESS_DENIED);
return;
}
for (i = 0; i < 3; i++) {
rc = gnutls_hash(hash_hnd,
sent_iov[i].iov_base,
sent_iov[i].iov_len);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
tevent_req_nterror(req,
NT_STATUS_ACCESS_DENIED);
return;
}
}
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
tevent_req_nterror(req,
NT_STATUS_ACCESS_DENIED);
return;
}
/* This resets the hash state */
gnutls_hash_output(hash_hnd, conn->smb2.preauth_sha512);
TALLOC_FREE(subreq);
/* And now we hash the response */
samba_SHA512_Init(&sctx);
samba_SHA512_Update(&sctx, conn->smb2.preauth_sha512,
sizeof(conn->smb2.preauth_sha512));
for (i = 0; i < 3; i++) {
samba_SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
rc = gnutls_hash(hash_hnd,
conn->smb2.preauth_sha512,
sizeof(conn->smb2.preauth_sha512));
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
tevent_req_nterror(req,
NT_STATUS_ACCESS_DENIED);
return;
}
for (i = 0; i < 3; i++) {
rc = gnutls_hash(hash_hnd,
iov[i].iov_base,
iov[i].iov_len);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
tevent_req_nterror(req,
NT_STATUS_ACCESS_DENIED);
return;
}
}
gnutls_hash_deinit(hash_hnd, conn->smb2.preauth_sha512);
if (rc < 0) {
tevent_req_nterror(req,
NT_STATUS_UNSUCCESSFUL);
return;
}
samba_SHA512_Final(conn->smb2.preauth_sha512, &sctx);
tevent_req_done(req);
}
@ -5831,8 +5884,9 @@ void smb2cli_session_require_signed_response(struct smbXcli_session *session,
NTSTATUS smb2cli_session_update_preauth(struct smbXcli_session *session,
const struct iovec *iov)
{
struct hc_sha512state sctx;
gnutls_hash_hd_t hash_hnd = NULL;
size_t i;
int rc;
if (session->conn == NULL) {
return NT_STATUS_INTERNAL_ERROR;
@ -5846,13 +5900,29 @@ NTSTATUS smb2cli_session_update_preauth(struct smbXcli_session *session,
return NT_STATUS_OK;
}
samba_SHA512_Init(&sctx);
samba_SHA512_Update(&sctx, session->smb2_channel.preauth_sha512,
sizeof(session->smb2_channel.preauth_sha512));
for (i = 0; i < 3; i++) {
samba_SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
rc = gnutls_hash_init(&hash_hnd,
GNUTLS_DIG_SHA512);
if (rc < 0) {
return NT_STATUS_NO_MEMORY;
}
samba_SHA512_Final(session->smb2_channel.preauth_sha512, &sctx);
rc = gnutls_hash(hash_hnd,
session->smb2_channel.preauth_sha512,
sizeof(session->smb2_channel.preauth_sha512));
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
return NT_STATUS_INTERNAL_ERROR;
}
for (i = 0; i < 3; i++) {
rc = gnutls_hash(hash_hnd,
iov[i].iov_base,
iov[i].iov_len);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
return NT_STATUS_INTERNAL_ERROR;
}
}
gnutls_hash_deinit(hash_hnd, session->smb2_channel.preauth_sha512);
return NT_STATUS_OK;
}