The branch, master has been updated
via 5283ad11bdd87daf2e9ed6d4644bfb1d8c978b04 (commit)
from a08d17342d0affa3769875ad87dadbb1f4161a06 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 5283ad11bdd87daf2e9ed6d4644bfb1d8c978b04
Author: Andrew Bartlett <[email protected]>
Date: Thu Sep 10 15:50:32 2009 +1000
libcli:drsuapi Add function to encrypt data for transport over DRSUAPI
This is for the server side of the GetNCChanges call.
Andrew Bartlett
-----------------------------------------------------------------------
Summary of changes:
libcli/drsuapi/repl_decrypt.c | 102 +++++++++++++++++++++++++++++++++++++++++
1 files changed, 102 insertions(+), 0 deletions(-)
Changeset truncated at 500 lines:
diff --git a/libcli/drsuapi/repl_decrypt.c b/libcli/drsuapi/repl_decrypt.c
index 9d7c1b6..33dfbe5 100644
--- a/libcli/drsuapi/repl_decrypt.c
+++ b/libcli/drsuapi/repl_decrypt.c
@@ -3,6 +3,7 @@
Helper functions for applying replicated objects
Copyright (C) Stefan Metzmacher <[email protected]> 2007
+ Copyright (C) Andrew Bartlett <[email protected]> 2009
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -186,3 +187,104 @@ WERROR drsuapi_decrypt_attribute(TALLOC_CTX *mem_ctx,
return WERR_OK;
}
+
+WERROR drsuapi_encrypt_attribute_value(TALLOC_CTX *mem_ctx,
+ const DATA_BLOB *gensec_skey,
+ bool rid_crypt,
+ uint32_t rid,
+ DATA_BLOB *in,
+ DATA_BLOB *out)
+{
+ DATA_BLOB rid_crypt_out = data_blob(NULL, 0);
+ DATA_BLOB confounder;
+
+ struct MD5Context md5;
+ uint8_t _enc_key[16];
+ DATA_BLOB enc_key;
+
+ DATA_BLOB enc_buffer;
+
+ uint32_t crc32_calc;
+
+ /*
+ * users with rid == 0 should not exist
+ */
+ if (rid_crypt && rid == 0) {
+ return WERR_DS_DRA_INVALID_PARAMETER;
+ }
+
+ /*
+ * The following rid_crypt obfuscation isn't session specific
+ * and not really needed here, because we allways know the rid of the
+ * user account.
+ *
+ * some attributes with this 'additional encryption' include
+ * dBCSPwd, unicodePwd, ntPwdHistory, lmPwdHistory
+ *
+ * But for the rest of samba it's easier when we remove this static
+ * obfuscation here
+ */
+ if (rid_crypt) {
+ uint32_t i, num_hashes;
+ rid_crypt_out = data_blob_talloc(mem_ctx, in->data, in->length);
+ W_ERROR_HAVE_NO_MEMORY(rid_crypt_out.data);
+
+ if ((rid_crypt_out.length % 16) != 0) {
+ return WERR_DS_DRA_INVALID_PARAMETER;
+ }
+
+ num_hashes = rid_crypt_out.length / 16;
+ for (i = 0; i < num_hashes; i++) {
+ uint32_t offset = i * 16;
+ sam_rid_crypt(rid, in->data + offset,
rid_crypt_out.data + offset, 1);
+ }
+ in = &rid_crypt_out;
+ }
+
+ /*
+ * the first 16 bytes at the beginning are the confounder
+ * followed by the 4 byte crc32 checksum
+ */
+
+ enc_buffer = data_blob_talloc(mem_ctx, NULL, in->length+20);
+ if (!enc_buffer.data) {
+ talloc_free(rid_crypt_out.data);
+ return WERR_NOMEM;
+ };
+
+ confounder = data_blob_const(enc_buffer.data, 16);
+ generate_random_buffer(confounder.data, confounder.length);
+
+ /*
+ * build the encryption key md5 over the session key followed
+ * by the confounder
+ *
+ * here the gensec session key is used and
+ * not the dcerpc ncacn_ip_tcp "SystemLibraryDTC" key!
+ */
+ enc_key = data_blob_const(_enc_key, sizeof(_enc_key));
+ MD5Init(&md5);
+ MD5Update(&md5, gensec_skey->data, gensec_skey->length);
+ MD5Update(&md5, confounder.data, confounder.length);
+ MD5Final(enc_key.data, &md5);
+
+ /*
+ * the first 4 byte are the crc32 checksum
+ * of the remaining bytes
+ */
+ crc32_calc = crc32_calc_buffer(in->data, in->length);
+ SIVAL(enc_buffer.data, 4, crc32_calc);
+
+ /*
+ * copy the plain buffer part and
+ * encrypt it using the created encryption key using arcfour
+ */
+ memcpy(enc_buffer.data+20, in->data, in->length);
+ talloc_free(rid_crypt_out.data);
+
+ arcfour_crypt_blob(enc_buffer.data+20, enc_buffer.length-20, &enc_key);
+
+ *out = enc_buffer;
+ return WERR_OK;
+}
+
--
Samba Shared Repository
