summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2008-09-22 14:23:22 -0700
committerAndrew Bartlett <abartlet@samba.org>2008-09-22 14:23:22 -0700
commitcebd9a9013a76073c3035b74175d228116fc7e48 (patch)
tree242265c7e48a3401be2d065aee453de2771d8e9e
parent1d92b2211cc507dd62526f564ec7f75a07110e00 (diff)
downloadsamba-cebd9a9013a76073c3035b74175d228116fc7e48.tar.gz
samba-cebd9a9013a76073c3035b74175d228116fc7e48.tar.bz2
samba-cebd9a9013a76073c3035b74175d228116fc7e48.zip
This torture test and skipping of the server-side check was bogus.
The IDL is declared to force the MessageType to 3 on output, so we instead checked the same thing 255 times... Andrew Bartlett
-rw-r--r--source4/kdc/kdc.c4
-rw-r--r--source4/torture/rpc/remote_pac.c49
2 files changed, 1 insertions, 52 deletions
diff --git a/source4/kdc/kdc.c b/source4/kdc/kdc.c
index 307c39a43c..030eb23c10 100644
--- a/source4/kdc/kdc.c
+++ b/source4/kdc/kdc.c
@@ -584,13 +584,11 @@ static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
return NT_STATUS_INVALID_PARAMETER;
}
-#if 0
- /* Windows does not check this */
if (pac_validate.MessageType != 3) {
/* We don't implement any other message types - such as certificate validation - yet */
return NT_STATUS_INVALID_PARAMETER;
}
-#endif
+
if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
|| pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
|| pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
index 6419e40014..b32881cc69 100644
--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
@@ -137,7 +137,6 @@ static bool test_PACVerify(struct torture_context *tctx,
status = gensec_session_info(gensec_server_context, &session_info);
torture_assert_ntstatus_ok(tctx, status, "gensec_session_info failed");
- pac_wrapped_struct.MessageType = 0x3;
pac_wrapped_struct.ChecksumLength = session_info->server_info->pac_srv_sig.signature.length;
pac_wrapped_struct.SignatureType = session_info->server_info->pac_kdc_sig.type;
pac_wrapped_struct.SignatureLength = session_info->server_info->pac_kdc_sig.signature.length;
@@ -207,51 +206,6 @@ static bool test_PACVerify(struct torture_context *tctx,
torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
"Credential chaining failed");
- /* This will break message type, check that however we still get NT_STATUS_OK */
- for (i=0; i < 256; i++) {
- pac_wrapped_struct.MessageType = i;
- pac_wrapped_struct.ChecksumLength = session_info->server_info->pac_srv_sig.signature.length;
- pac_wrapped_struct.SignatureType = session_info->server_info->pac_kdc_sig.type;
- pac_wrapped_struct.SignatureLength = session_info->server_info->pac_kdc_sig.signature.length;
- pac_wrapped_struct.ChecksumAndSignature = payload
- = data_blob_talloc(tmp_ctx, NULL,
- pac_wrapped_struct.ChecksumLength
- + pac_wrapped_struct.SignatureLength);
- memcpy(&payload.data[0],
- session_info->server_info->pac_srv_sig.signature.data,
- pac_wrapped_struct.ChecksumLength);
- memcpy(&payload.data[pac_wrapped_struct.ChecksumLength],
- session_info->server_info->pac_kdc_sig.signature.data,
- pac_wrapped_struct.SignatureLength);
-
- ndr_err = ndr_push_struct_blob(&pac_wrapped, tmp_ctx, lp_iconv_convenience(tctx->lp_ctx), &pac_wrapped_struct,
- (ndr_push_flags_fn_t)ndr_push_PAC_Validate);
- torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
-
- torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
- creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
-
- generic.length = pac_wrapped.length;
- generic.data = pac_wrapped.data;
-
- ZERO_STRUCT(auth2);
- creds_client_authenticator(creds, &auth);
- r.in.credential = &auth;
- r.in.return_authenticator = &auth2;
- r.in.logon_level = NetlogonGenericInformation;
- r.in.logon.generic = &generic;
- r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
- r.in.computer_name = cli_credentials_get_workstation(credentials);
- r.in.validation_level = NetlogonValidationGenericInfo2;
-
- status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
-
- torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
-
- torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
- "Credential chaining failed");
- }
-
/* This will break the parsing nicely (even in the crypto wrapping), check we get INVALID_PARAMETER */
generic.length--;
@@ -272,7 +226,6 @@ static bool test_PACVerify(struct torture_context *tctx,
torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
"Credential chaining failed");
- pac_wrapped_struct.MessageType = 0x3;
pac_wrapped_struct.ChecksumLength = session_info->server_info->pac_srv_sig.signature.length;
pac_wrapped_struct.SignatureType = session_info->server_info->pac_kdc_sig.type;
@@ -318,8 +271,6 @@ static bool test_PACVerify(struct torture_context *tctx,
torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
"Credential chaining failed");
-
- pac_wrapped_struct.MessageType = 0x3;
pac_wrapped_struct.ChecksumLength = session_info->server_info->pac_srv_sig.signature.length;
pac_wrapped_struct.SignatureType = session_info->server_info->pac_kdc_sig.type;
pac_wrapped_struct.SignatureLength = session_info->server_info->pac_kdc_sig.signature.length;