lib:crypto: Add samba_gnutls_weak_crypto()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/crypto/gnutls_helpers.h b/lib/crypto/gnutls_helpers.h
index 49689e4c860e7513e64f6548a05628f8d3b053f4..e74dcc833f22de6ffc6de7604184611815524322 100644 (file)
--- a/lib/crypto/gnutls_helpers.h
+++ b/lib/crypto/gnutls_helpers.h
@@ -108,4 +108,11 @@ int samba_gnutls_arcfour_confounded_md5(const DATA_BLOB *key_input1,
                                        DATA_BLOB *data,
                                        enum samba_gnutls_direction encrypt);
 
+/**
+ * @brief Check if weak crypto is allowed.
+ *
+ * @return true if weak crypo is allowed, false otherwise.
+ */
+bool samba_gnutls_weak_crypto_allowed(void);
+
 #endif /* _GNUTLS_HELPERS_H */

diff --git a/lib/crypto/gnutls_weak_crypto.c b/lib/crypto/gnutls_weak_crypto.c
new file mode 100644 (file)
index 0000000..68ce588
--- /dev/null
+++ b/lib/crypto/gnutls_weak_crypto.c
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2019      Andreas Schneider <asn@samba.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+#include "lib/crypto/gnutls_helpers.h"
+
+#include <gnutls/crypto.h>
+#include <gnutls/gnutls.h>
+
+bool samba_gnutls_weak_crypto_allowed(void)
+{
+       gnutls_cipher_hd_t cipher_hnd = NULL;
+       gnutls_datum_t key = {
+               .data = discard_const_p(unsigned char, "SystemLibraryDTC"),
+               .size = 16,
+       };
+       int rc;
+
+       /*
+        * If RC4 is not allowed to be initialzed then weak crypto is not
+        * allowed.
+        */
+       rc = gnutls_cipher_init(&cipher_hnd,
+                               GNUTLS_CIPHER_ARCFOUR_128,
+                               &key,
+                               NULL);
+       if (rc == GNUTLS_E_UNWANTED_ALGORITHM) {
+               return false;
+       }
+
+       gnutls_cipher_deinit(cipher_hnd);
+
+       return true;
+}

diff --git a/lib/crypto/wscript_build b/lib/crypto/wscript_build
index eb67af63f26025844285579d5b31c173003e976c..e5766042541cb93bfb662cb34e5e102d43c3d097 100644 (file)
--- a/lib/crypto/wscript_build
+++ b/lib/crypto/wscript_build
@@ -10,6 +10,7 @@ bld.SAMBA_SUBSYSTEM('GNUTLS_HELPERS',
                     source='''
                     gnutls_error.c
                     gnutls_arcfour_confounded_md5.c
+                    gnutls_weak_crypto.c
                     ''',
                     deps='gnutls samba-errors');