2 Unix SMB/CIFS implementation.
4 code to encrypt/decrypt data using the user session key
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/auth/libcli_auth.h"
26 encrypt or decrypt a blob of data using the user session key
27 as used in lsa_SetSecret
29 before calling, the out blob must be initialised to be the same size
32 int sess_crypt_blob(DATA_BLOB
*out
, const DATA_BLOB
*in
, const DATA_BLOB
*session_key
,
33 enum samba_gnutls_direction encrypt
)
37 if (in
->length
% 8 != 0) {
38 return GNUTLS_E_INVALID_REQUEST
;
44 uint8_t bin
[8], bout
[8], key
[7];
46 memcpy(bin
, &in
->data
[i
], 8);
48 if (k
+ 7 > session_key
->length
) {
49 k
= (session_key
->length
- k
);
51 memcpy(key
, &session_key
->data
[k
], 7);
53 rc
= des_crypt56_gnutls(bout
, bin
, key
, encrypt
);
58 memcpy(&out
->data
[i
], bout
, 8);
65 a convenient wrapper around sess_crypt_blob() for strings, using the LSA convention
67 note that we round the length to a multiple of 8. This seems to be needed for
68 compatibility with windows
70 caller should free using data_blob_free()
72 DATA_BLOB
sess_encrypt_string(const char *str
, const DATA_BLOB
*session_key
)
75 int slen
= strlen(str
);
76 int dlen
= (slen
+7) & ~7;
79 src
= data_blob(NULL
, 8+dlen
);
81 return data_blob(NULL
, 0);
84 ret
= data_blob(NULL
, 8+dlen
);
87 return data_blob(NULL
, 0);
90 SIVAL(src
.data
, 0, slen
);
91 SIVAL(src
.data
, 4, 1);
92 memset(src
.data
+8, 0, dlen
);
93 memcpy(src
.data
+8, str
, slen
);
95 rc
= sess_crypt_blob(&ret
, &src
, session_key
, SAMBA_GNUTLS_ENCRYPT
);
100 return data_blob(NULL
, 0);
107 a convenient wrapper around sess_crypt_blob() for strings, using the LSA convention
109 caller should free the returned string
111 char *sess_decrypt_string(TALLOC_CTX
*mem_ctx
,
112 DATA_BLOB
*blob
, const DATA_BLOB
*session_key
)
118 if (blob
->length
< 8) {
122 out
= data_blob_talloc(mem_ctx
, NULL
, blob
->length
);
127 rc
= sess_crypt_blob(&out
, blob
, session_key
, SAMBA_GNUTLS_DECRYPT
);
129 data_blob_free(&out
);
133 if (IVAL(out
.data
, 4) != 1) {
134 DEBUG(0,("Unexpected revision number %d in session crypted string\n",
136 data_blob_free(&out
);
140 slen
= IVAL(out
.data
, 0);
141 if (slen
> blob
->length
- 8) {
142 DEBUG(0,("Invalid crypt length %d\n", slen
));
143 data_blob_free(&out
);
147 ret
= talloc_strndup(mem_ctx
, (const char *)(out
.data
+8), slen
);
149 data_blob_free(&out
);
151 DEBUG(0,("decrypted string '%s' of length %d\n", ret
, slen
));
157 a convenient wrapper around sess_crypt_blob() for DATA_BLOBs, using the LSA convention
159 note that we round the length to a multiple of 8. This seems to be needed for
160 compatibility with windows
162 caller should free using data_blob_free()
164 DATA_BLOB
sess_encrypt_blob(TALLOC_CTX
*mem_ctx
, DATA_BLOB
*blob_in
, const DATA_BLOB
*session_key
)
167 int dlen
= (blob_in
->length
+7) & ~7;
170 src
= data_blob_talloc(mem_ctx
, NULL
, 8+dlen
);
172 return data_blob(NULL
, 0);
175 ret
= data_blob_talloc(mem_ctx
, NULL
, 8+dlen
);
177 data_blob_free(&src
);
178 return data_blob(NULL
, 0);
181 SIVAL(src
.data
, 0, blob_in
->length
);
182 SIVAL(src
.data
, 4, 1);
183 memset(src
.data
+8, 0, dlen
);
184 memcpy(src
.data
+8, blob_in
->data
, blob_in
->length
);
186 rc
= sess_crypt_blob(&ret
, &src
, session_key
, SAMBA_GNUTLS_ENCRYPT
);
188 data_blob_free(&src
);
190 data_blob_free(&ret
);
191 return data_blob(NULL
, 0);
198 Decrypt a DATA_BLOB using the LSA convention
200 NTSTATUS
sess_decrypt_blob(TALLOC_CTX
*mem_ctx
, const DATA_BLOB
*blob
, const DATA_BLOB
*session_key
,
206 if (blob
->length
< 8) {
207 DEBUG(0, ("Unexpected length %d in session crypted secret (BLOB)\n",
209 return NT_STATUS_INVALID_PARAMETER
;
212 out
= data_blob_talloc(mem_ctx
, NULL
, blob
->length
);
214 return NT_STATUS_NO_MEMORY
;
217 rc
= sess_crypt_blob(&out
, blob
, session_key
, SAMBA_GNUTLS_DECRYPT
);
219 data_blob_free(&out
);
220 return gnutls_error_to_ntstatus(rc
, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER
);
223 if (IVAL(out
.data
, 4) != 1) {
224 DEBUG(2,("Unexpected revision number %d in session crypted secret (BLOB)\n",
226 return NT_STATUS_UNKNOWN_REVISION
;
229 slen
= IVAL(out
.data
, 0);
230 if (slen
> blob
->length
- 8) {
231 DEBUG(0,("Invalid crypt length %d in session crypted secret (BLOB)\n", slen
));
232 return NT_STATUS_WRONG_PASSWORD
;
235 *ret
= data_blob_talloc(mem_ctx
, out
.data
+8, slen
);
236 if (slen
&& !ret
->data
) {
237 return NT_STATUS_NO_MEMORY
;
240 data_blob_free(&out
);