auth/gensec: fix non-AES schannel seal

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14134

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c
index 18ed92b703b08bc955d36d573aeb4b828e331b11..b5e6289ef3f8cfa273b90a5ea3b890781930d88e 100644 (file)
--- a/auth/gensec/schannel.c
+++ b/auth/gensec/schannel.c
@@ -419,6 +419,15 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state,
                        ZERO_ARRAY(_sealing_key);
                        return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
                }
+               gnutls_cipher_deinit(cipher_hnd);
+               rc = gnutls_cipher_init(&cipher_hnd,
+                                       GNUTLS_CIPHER_ARCFOUR_128,
+                                       &sealing_key,
+                                       NULL);
+               if (rc < 0) {
+                       ZERO_ARRAY(_sealing_key);
+                       return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
+               }
                rc = gnutls_cipher_encrypt(cipher_hnd,
                                           data,
                                           length);

diff --git a/selftest/knownfail b/selftest/knownfail
index a106b11eb8719589ea6d1326e5e48dadecd2e74b..6d229192e013ea8b912ac9d28107cc9dc10b9b1e 100644 (file)
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -375,5 +375,4 @@
 ^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\)
 ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
 ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
-^samba.unittests.schannel.torture_schannel_seal_rc4
 ^samba.unittests.schannel.torture_schannel_seal_aes