diff options
| -rw-r--r-- | source4/torture/rpc/netlogon.c | 271 |
1 files changed, 146 insertions, 125 deletions
diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c index 5cb4caa942..fba39c14c9 100644 --- a/source4/torture/rpc/netlogon.c +++ b/source4/torture/rpc/netlogon.c @@ -296,131 +296,126 @@ static NTSTATUS check_samlogon(struct samlogon_state *samlogon_state, { NTSTATUS status; struct netr_LogonSamLogon *r = &samlogon_state->r; - int levels[] = { 2, 6 }; - int i; struct netr_NetworkInfo ninfo; - for (i=0;i<ARRAY_SIZE(levels);i++) { - struct netr_SamBaseInfo *base; - - printf("testing netr_LogonSamLogon with logon level %d\n", levels[i]); - - samlogon_state->r.in.logon_level = levels[i]; - samlogon_state->r.in.logon.network = &ninfo; + struct netr_SamBaseInfo *base; + + printf("testing netr_LogonSamLogon\n"); - ninfo.identity_info.domain_name.string = samlogon_state->account_domain; - ninfo.identity_info.parameter_control = 0; - ninfo.identity_info.logon_id_low = 0; - ninfo.identity_info.logon_id_high = 0; - ninfo.identity_info.account_name.string = samlogon_state->account_name; - ninfo.identity_info.workstation.string = TEST_MACHINE_NAME; + samlogon_state->r.in.logon.network = &ninfo; + + ninfo.identity_info.domain_name.string = samlogon_state->account_domain; + ninfo.identity_info.parameter_control = 0; + ninfo.identity_info.logon_id_low = 0; + ninfo.identity_info.logon_id_high = 0; + ninfo.identity_info.account_name.string = samlogon_state->account_name; + ninfo.identity_info.workstation.string = TEST_MACHINE_NAME; - memcpy(ninfo.challenge, chall->data, 8); + memcpy(ninfo.challenge, chall->data, 8); - switch (break_which) { - case BREAK_NONE: - break; - case BREAK_LM: - if (lm_response && lm_response->data) { - lm_response->data[0]++; - } - break; - case BREAK_NT: - if (nt_response && nt_response->data) { - nt_response->data[0]++; - } - break; - case NO_LM: - data_blob_free(lm_response); - break; - case NO_NT: - data_blob_free(nt_response); - break; + switch (break_which) { + case BREAK_NONE: + break; + case BREAK_LM: + if (lm_response && lm_response->data) { + lm_response->data[0]++; } - - if (nt_response) { - ninfo.nt.data = nt_response->data; - ninfo.nt.length = nt_response->length; - } else { - ninfo.nt.data = NULL; - ninfo.nt.length = 0; + break; + case BREAK_NT: + if (nt_response && nt_response->data) { + nt_response->data[0]++; } + break; + case NO_LM: + data_blob_free(lm_response); + break; + case NO_NT: + data_blob_free(nt_response); + break; + } - if (lm_response) { - ninfo.lm.data = lm_response->data; - ninfo.lm.length = lm_response->length; - } else { - ninfo.lm.data = NULL; - ninfo.lm.length = 0; - } + if (nt_response) { + ninfo.nt.data = nt_response->data; + ninfo.nt.length = nt_response->length; + } else { + ninfo.nt.data = NULL; + ninfo.nt.length = 0; + } - ZERO_STRUCT(samlogon_state->auth2); - creds_client_authenticator(&samlogon_state->creds, &samlogon_state->auth); + if (lm_response) { + ninfo.lm.data = lm_response->data; + ninfo.lm.length = lm_response->length; + } else { + ninfo.lm.data = NULL; + ninfo.lm.length = 0; + } - r->out.return_authenticator = NULL; - status = dcerpc_netr_LogonSamLogon(samlogon_state->p, samlogon_state->mem_ctx, r); - if (!NT_STATUS_IS_OK(status)) { - if (error_string) { - *error_string = strdup(nt_errstr(status)); - } - } + ZERO_STRUCT(samlogon_state->auth2); + creds_client_authenticator(&samlogon_state->creds, &samlogon_state->auth); - if (!r->out.return_authenticator || - !creds_client_check(&samlogon_state->creds, &r->out.return_authenticator->cred)) { - printf("Credential chaining failed\n"); - } - - if (!NT_STATUS_IS_OK(status)) { - /* we cannot check the session key, if the logon failed... */ - return status; + r->out.return_authenticator = NULL; + status = dcerpc_netr_LogonSamLogon(samlogon_state->p, samlogon_state->mem_ctx, r); + if (!NT_STATUS_IS_OK(status)) { + if (error_string) { + *error_string = strdup(nt_errstr(status)); } + } - /* find and decyrpt the session keys, return in parameters above */ - if (r->in.validation_level == 2) { - base = &r->out.validation.sam2->base; - } else if (r->in.validation_level == 3) { - base = &r->out.validation.sam3->base; - } else if (r->in.validation_level == 6) { - base = &r->out.validation.sam6->base; - } else { - base = NULL; - } + if (!r->out.return_authenticator || + !creds_client_check(&samlogon_state->creds, &r->out.return_authenticator->cred)) { + printf("Credential chaining failed\n"); + } - if (r->in.validation_level != 6) { - static const char zeros[16]; + if (!NT_STATUS_IS_OK(status)) { + /* we cannot check the session key, if the logon failed... */ + return status; + } + + /* find and decyrpt the session keys, return in parameters above */ + if (r->in.validation_level == 2) { + base = &r->out.validation.sam2->base; + } else if (r->in.validation_level == 3) { + base = &r->out.validation.sam3->base; + } else if (r->in.validation_level == 6) { + base = &r->out.validation.sam6->base; + } else { + base = NULL; + } + + if (r->in.validation_level != 6) { + static const char zeros[16]; - if (memcmp(base->key.key, zeros, - sizeof(base->key.key)) != 0) { - creds_arcfour_crypt(&samlogon_state->creds, - base->key.key, - sizeof(base->key.key)); - } + if (memcmp(base->key.key, zeros, + sizeof(base->key.key)) != 0) { + creds_arcfour_crypt(&samlogon_state->creds, + base->key.key, + sizeof(base->key.key)); + } - if (user_session_key) { - memcpy(user_session_key, base->key.key, 16); - } + if (user_session_key) { + memcpy(user_session_key, base->key.key, 16); + } - if (memcmp(base->LMSessKey.key, zeros, - sizeof(base->LMSessKey.key)) != 0) { - creds_arcfour_crypt(&samlogon_state->creds, - base->LMSessKey.key, - sizeof(base->LMSessKey.key)); - } + if (memcmp(base->LMSessKey.key, zeros, + sizeof(base->LMSessKey.key)) != 0) { + creds_arcfour_crypt(&samlogon_state->creds, + base->LMSessKey.key, + sizeof(base->LMSessKey.key)); + } - if (lm_key) { - memcpy(lm_key, base->LMSessKey.key, 8); - } - } else { - /* they aren't encrypted! */ - if (user_session_key) { - memcpy(user_session_key, base->key.key, 16); - } - if (lm_key) { - memcpy(lm_key, base->LMSessKey.key, 8); - } + if (lm_key) { + memcpy(lm_key, base->LMSessKey.key, 8); + } + } else { + /* they aren't encrypted! */ + if (user_session_key) { + memcpy(user_session_key, base->key.key, 16); + } + if (lm_key) { + memcpy(lm_key, base->LMSessKey.key, 8); } } - + return status; } @@ -432,6 +427,7 @@ static NTSTATUS check_samlogon(struct samlogon_state *samlogon_state, static BOOL test_lm_ntlm_broken(struct samlogon_state *samlogon_state, enum ntlm_break break_which, char **error_string) { BOOL pass = True; + BOOL lm_good; NTSTATUS nt_status; DATA_BLOB lm_response = data_blob_talloc(samlogon_state->mem_ctx, NULL, 24); DATA_BLOB nt_response = data_blob_talloc(samlogon_state->mem_ctx, NULL, 24); @@ -445,9 +441,13 @@ static BOOL test_lm_ntlm_broken(struct samlogon_state *samlogon_state, enum ntlm ZERO_STRUCT(lm_key); ZERO_STRUCT(user_session_key); - SMBencrypt(samlogon_state->password, samlogon_state->chall.data, lm_response.data); - E_deshash(samlogon_state->password, lm_hash); - + lm_good = SMBencrypt(samlogon_state->password, samlogon_state->chall.data, lm_response.data); + if (samlogon_state->r.in.logon_level == 6 || !lm_good) { + ZERO_STRUCT(lm_hash); + } else { + E_deshash(samlogon_state->password, lm_hash); + } + SMBNTencrypt(samlogon_state->password, samlogon_state->chall.data, nt_response.data); E_md4hash(samlogon_state->password, nt_hash); @@ -464,14 +464,27 @@ static BOOL test_lm_ntlm_broken(struct samlogon_state *samlogon_state, enum ntlm data_blob_free(&lm_response); - if (!NT_STATUS_IS_OK(nt_status)) { + if (NT_STATUS_EQUAL(NT_STATUS_WRONG_PASSWORD, nt_status)) { + /* for 'long' passwords, the LM password is invalid */ + if (break_which == NO_NT && !lm_good) { + return True; + } return break_which == BREAK_NT; } + if (!NT_STATUS_IS_OK(nt_status)) { + return False; + } + + if (break_which == NO_NT && !lm_good) { + printf("LM password is 'long' (> 14 chars and therefore invalid) but login did not fail!"); + return False; + } + if (memcmp(lm_hash, lm_key, sizeof(lm_key)) != 0) { printf("LM Key does not match expectations!\n"); - printf("lm_key:\n"); + printf("lm_key:\n"); dump_data(1, (const char *)lm_key, 8); printf("expected:\n"); dump_data(1, (const char *)lm_hash, 8); @@ -590,6 +603,7 @@ static BOOL test_ntlm_in_lm(struct samlogon_state *samlogon_state, char **error_ static BOOL test_ntlm_in_both(struct samlogon_state *samlogon_state, char **error_string) { BOOL pass = True; + BOOL lm_good; NTSTATUS nt_status; DATA_BLOB nt_response = data_blob_talloc(samlogon_state->mem_ctx, NULL, 24); DATA_BLOB session_key = data_blob_talloc(samlogon_state->mem_ctx, NULL, 16); @@ -608,7 +622,10 @@ static BOOL test_ntlm_in_both(struct samlogon_state *samlogon_state, char **erro SMBsesskeygen_ntv1((const uint8_t *)nt_hash, session_key.data); - E_deshash(samlogon_state->password, (uint8_t *)lm_hash); + lm_good = E_deshash(samlogon_state->password, (uint8_t *)lm_hash); + if (!lm_good) { + ZERO_STRUCT(lm_hash); + } nt_status = check_samlogon(samlogon_state, BREAK_NONE, @@ -882,9 +899,10 @@ static const struct ntlm_tests { */ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx) { - int i, j; + int i, v, l; BOOL ret = True; int validation_levels[] = {2,3,6}; + int logon_levels[] = { 2, 6 }; struct samlogon_state samlogon_state; samlogon_state.mem_ctx = mem_ctx; @@ -914,21 +932,24 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx) samlogon_state.r.in.credential = &samlogon_state.auth; samlogon_state.r.in.return_authenticator = &samlogon_state.auth2; - for (i=0;i<ARRAY_SIZE(validation_levels);i++) { - samlogon_state.r.in.validation_level = validation_levels[i]; - for (j=0; test_table[j].fn; j++) { - char *error_string = NULL; - printf("Testing SamLogon with '%s' at validation level %d\n", - test_table[j].name, validation_levels[i]); + for (i=0; test_table[i].fn; i++) { + for (v=0;v<ARRAY_SIZE(validation_levels);v++) { + for (l=0;l<ARRAY_SIZE(logon_levels);l++) { + char *error_string = NULL; + samlogon_state.r.in.validation_level = validation_levels[v]; + samlogon_state.r.in.logon_level = logon_levels[l]; + printf("Testing SamLogon with '%s' at validation level %d, logon level %d\n", + test_table[i].name, validation_levels[v], logon_levels[l]); - if (!test_table[j].fn(&samlogon_state, &error_string)) { - if (test_table[j].expect_fail) { - printf("Test %s failed (expected, test incomplete): %s\n", test_table[j].name, error_string); - } else { - printf("Test %s failed: %s\n", test_table[j].name, error_string); - ret = False; + if (!test_table[i].fn(&samlogon_state, &error_string)) { + if (test_table[i].expect_fail) { + printf("Test %s failed (expected, test incomplete): %s\n", test_table[i].name, error_string); + } else { + printf("Test %s failed: %s\n", test_table[i].name, error_string); + ret = False; + } + SAFE_FREE(error_string); } - SAFE_FREE(error_string); } } } |