static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
				       TALLOC_CTX *mem_ctx, DATA_BLOB *auth_blob,
				       struct trustDomainPasswords *auth_struct)
{
	DATA_BLOB session_key = data_blob(NULL, 0);
	enum ndr_err_code ndr_err;
	NTSTATUS nt_status;
	gnutls_cipher_hd_t cipher_hnd = NULL;
	gnutls_datum_t _session_key;
	int rc;
	struct auth_session_info *session_info =
		dcesrv_call_session_info(dce_call);
	struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
	bool encrypted;

	encrypted =
		dcerpc_is_transport_encrypted(session_info);
	if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED &&
	    !encrypted) {
		DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n");
		return NT_STATUS_ACCESS_DENIED;
	}


	nt_status = dcesrv_transport_session_key(dce_call, &session_key);
	if (!NT_STATUS_IS_OK(nt_status)) {
		return nt_status;
	}

	_session_key = (gnutls_datum_t) {
		.data = session_key.data,
		.size = session_key.length,
	};

	GNUTLS_FIPS140_SET_LAX_MODE();
	rc = gnutls_cipher_init(&cipher_hnd,
				GNUTLS_CIPHER_ARCFOUR_128,
				&_session_key,
				NULL);
	if (rc < 0) {
		GNUTLS_FIPS140_SET_STRICT_MODE();
		nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
		goto out;
	}

	rc = gnutls_cipher_decrypt(cipher_hnd,
				   auth_blob->data,
				   auth_blob->length);
	gnutls_cipher_deinit(cipher_hnd);
	GNUTLS_FIPS140_SET_STRICT_MODE();
	if (rc < 0) {
		nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
		goto out;
	}

	ndr_err = ndr_pull_struct_blob(auth_blob, mem_ctx,
				       auth_struct,
				       (ndr_pull_flags_fn_t)ndr_pull_trustDomainPasswords);
	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	nt_status = NT_STATUS_OK;
out:
	return nt_status;
}
static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
				       TALLOC_CTX *mem_ctx, DATA_BLOB *auth_blob,
				       struct trustDomainPasswords *auth_struct)
{
	DATA_BLOB session_key = data_blob(NULL, 0);
	enum ndr_err_code ndr_err;
	NTSTATUS nt_status;
	gnutls_cipher_hd_t cipher_hnd = NULL;
	gnutls_datum_t _session_key;
	int rc;
	struct auth_session_info *session_info =
		dcesrv_call_session_info(dce_call);
	struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
	bool encrypted;

	encrypted =
		dcerpc_is_transport_encrypted(session_info);
	if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED &&
	    !encrypted) {
		DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n");
		return NT_STATUS_ACCESS_DENIED;
	}


	nt_status = dcesrv_transport_session_key(dce_call, &session_key);
	if (!NT_STATUS_IS_OK(nt_status)) {
		return nt_status;
	}

	_session_key = (gnutls_datum_t) {
		.data = session_key.data,
		.size = session_key.length,
	};

	GNUTLS_FIPS140_SET_LAX_MODE();
	rc = gnutls_cipher_init(&cipher_hnd,
				GNUTLS_CIPHER_ARCFOUR_128,
				&_session_key,
				NULL);
	if (rc < 0) {
		GNUTLS_FIPS140_SET_STRICT_MODE();
		nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
		goto out;
	}

	rc = gnutls_cipher_decrypt(cipher_hnd,
				   auth_blob->data,
				   auth_blob->length);
	gnutls_cipher_deinit(cipher_hnd);
	GNUTLS_FIPS140_SET_STRICT_MODE();
	if (rc < 0) {
		nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
		goto out;
	}

	ndr_err = ndr_pull_struct_blob(auth_blob, mem_ctx,
				       auth_struct,
				       (ndr_pull_flags_fn_t)ndr_pull_trustDomainPasswords);
	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	nt_status = NT_STATUS_OK;
out:
	return nt_status;
}