From: Günther Deschner Date: Fri, 20 Sep 2019 16:32:43 +0000 (+0200) Subject: auth/gensec: fix non-AES schannel seal X-Git-Tag: talloc-2.3.1~477 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=709d54d68a9c2cb3cda91d9ab63228a7adbaceb4;p=thirdparty%2Fsamba.git auth/gensec: fix non-AES schannel seal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14134 Guenther Signed-off-by: Guenther Deschner Reviewed-by: Andreas Schneider --- diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c index 18ed92b703b..b5e6289ef3f 100644 --- a/auth/gensec/schannel.c +++ b/auth/gensec/schannel.c @@ -419,6 +419,15 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state, ZERO_ARRAY(_sealing_key); return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); } + gnutls_cipher_deinit(cipher_hnd); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &sealing_key, + NULL); + if (rc < 0) { + ZERO_ARRAY(_sealing_key); + return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + } rc = gnutls_cipher_encrypt(cipher_hnd, data, length); diff --git a/selftest/knownfail b/selftest/knownfail index a106b11eb87..6d229192e01 100644 --- a/selftest/knownfail +++ b/selftest/knownfail @@ -375,5 +375,4 @@ ^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\) ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\) ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\) -^samba.unittests.schannel.torture_schannel_seal_rc4 ^samba.unittests.schannel.torture_schannel_seal_aes