lib/crypto/gnutls_helpers.h

   1 /*
   2  * Copyright (c) 2019      Andreas Schneider <asn@samba.org>
   3  *
   4  * This program is free software: you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License as published by
   6  * the Free Software Foundation, either version 3 of the License, or
   7  * (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16  */
  17
  18 #ifndef _GNUTLS_HELPERS_H
  19 #define _GNUTLS_HELPERS_H
  20
  21 #include <gnutls/gnutls.h>
  22
  23 #include "libcli/util/ntstatus.h"
  24 #include "libcli/util/werror.h"
  25
  26 /* Those macros are only available in GnuTLS >= 3.6.4 */
  27 #ifndef GNUTLS_FIPS140_SET_LAX_MODE
  28 #define GNUTLS_FIPS140_SET_LAX_MODE()
  29 #endif
  30
  31 #ifndef GNUTLS_FIPS140_SET_STRICT_MODE
  32 #define GNUTLS_FIPS140_SET_STRICT_MODE()
  33 #endif
  34
  35 #ifdef DOXYGEN
  36 /**
  37  * @brief Convert a gnutls error code to a corresponding NTSTATUS.
  38  *
  39  * @param[in]  gnutls_rc      The GnuTLS return code.
  40  *
  41  * @param[in]  blocked_status The NTSTATUS return code which should be returned
  42  *                            in case the e.g. the cipher might be blocked due
  43  *                            to FIPS mode.
  44  *
  45  * @return A corresponding NTSTATUS code.
  46  */
  47 NTSTATUS gnutls_error_to_ntstatus(int gnutls_rc,
  48                                   NTSTATUS blocked_status);
  49 #else
  50 NTSTATUS _gnutls_error_to_ntstatus(int gnutls_rc,
  51                                    NTSTATUS blocked_status,
  52                                    const char *function,
  53                                    const char *location);
  54 #define gnutls_error_to_ntstatus(gnutls_rc, blocked_status) \
  55         _gnutls_error_to_ntstatus(gnutls_rc, blocked_status, \
  56                                   __FUNCTION__, __location__)
  57 #endif
  58
  59 #ifdef DOXYGEN
  60 /**
  61  * @brief Convert a gnutls error code to a corresponding WERROR.
  62  *
  63  * @param[in]  gnutls_rc      The GnuTLS return code.
  64  *
  65  * @param[in]  blocked_werr   The WERROR code which should be returned if e.g
  66  *                            the cipher we want to used it not allowed to be
  67  *                            used because of FIPS mode.
  68  *
  69  * @return A corresponding WERROR code.
  70  */
  71 WERROR gnutls_error_to_werror(int gnutls_rc,
  72                                WERROR blocked_werr);
  73 #else
  74 WERROR _gnutls_error_to_werror(int gnutls_rc,
  75                                WERROR blocked_werr,
  76                                const char *function,
  77                                const char *location);
  78 #define gnutls_error_to_werror(gnutls_rc, blocked_werr) \
  79         _gnutls_error_to_werror(gnutls_rc, blocked_werr, \
  80                                 __FUNCTION__, __location__)
  81 #endif
  82
  83 enum samba_gnutls_direction {
  84         SAMBA_GNUTLS_ENCRYPT,
  85         SAMBA_GNUTLS_DECRYPT
  86 };
  87
  88 /**
  89  * @brief Encrypt or decrypt a data blob using RC4 with a key and salt.
  90  *
  91  * One of the key input should be a session key and the other a confounder
  92  * (aka salt). Which one depends on the implementation details of the
  93  * protocol.
  94  *
  95  * @param[in]  key_input1 Either a session_key or a confounder.
  96  *
  97  * @param[in]  key_input2 Either a session_key or a confounder.
  98  *
  99  * @param[in]  data       The data blob to either encrypt or decrypt. The data
 100  *                        will be encrypted or decrypted in place.
 101  *
 102  * @param[in]  encrypt    The encryption direction.
 103  *
 104  * @return A gnutls error code.
 105  */
 106 int samba_gnutls_arcfour_confounded_md5(const DATA_BLOB *key_input1,
 107                                         const DATA_BLOB *key_input2,
 108                                         DATA_BLOB *data,
 109                                         enum samba_gnutls_direction encrypt);
 110
 111 #endif /* _GNUTLS_HELPERS_H */