sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code
7b706c7091
samba-mirror/source4/script/tests/test_session_key.sh

55 lines
3.1 KiB
Bash
Raw Normal View History

r7684: Add a test aimed at checking we have agreement between client and server as to the CIFS session key. JRA had pain with this being wrong against NT4 (without spnego), hence this specific test. Andrew Bartlett (This used to be commit 47f433708ba38db9bf569567cc048e65f2786ebe)
2005-06-17 15:48:01 +04:00
#!/bin/sh
if [ $# -lt 4 ]; then
cat <<EOF
r15426: Implement SPNEGO as the default RPC authentication mechanism. Where this isn't supported, fallback to NTLM. Also, where we get a failure as 'logon failure', try and do a '3 tries' for the password, like we already do for CIFS. (Incomplete: needs a mapping between RPC errors and the logon failure NTSTATUS). Because we don't yet support Kerberos sign/seal to win2k3 SP1 for DCE/RPC, disable this (causing SPNEGO to negotiate NTLM) when kerberos isn't demanded. Andrew Bartlett (This used to be commit b3212d1fb91b26c1d326a289560106dffe1d2e80)
2006-05-04 14:03:41 +04:00
Usage: test_session_key.sh SERVER USERNAME PASSWORD DOMAIN NETBIOSNAME
r7684: Add a test aimed at checking we have agreement between client and server as to the CIFS session key. JRA had pain with this being wrong against NT4 (without spnego), hence this specific test. Andrew Bartlett (This used to be commit 47f433708ba38db9bf569567cc048e65f2786ebe)
2005-06-17 15:48:01 +04:00
EOF
exit 1;
fi
server="$1"
username="$2"
password="$3"
domain="$4"
r15426: Implement SPNEGO as the default RPC authentication mechanism. Where this isn't supported, fallback to NTLM. Also, where we get a failure as 'logon failure', try and do a '3 tries' for the password, like we already do for CIFS. (Incomplete: needs a mapping between RPC errors and the logon failure NTSTATUS). Because we don't yet support Kerberos sign/seal to win2k3 SP1 for DCE/RPC, disable this (causing SPNEGO to negotiate NTLM) when kerberos isn't demanded. Andrew Bartlett (This used to be commit b3212d1fb91b26c1d326a289560106dffe1d2e80)
2006-05-04 14:03:41 +04:00
netbios_name="$5"
shift 5
r7684: Add a test aimed at checking we have agreement between client and server as to the CIFS session key. JRA had pain with this being wrong against NT4 (without spnego), hence this specific test. Andrew Bartlett (This used to be commit 47f433708ba38db9bf569567cc048e65f2786ebe)
2005-06-17 15:48:01 +04:00
incdir=`dirname $0`
. $incdir/test_functions.sh
failed=0
transport="ncacn_np"
r19589: Because we what we really wanted was coverage of seal and non-seal, rather than validate or not, change $VALIDATE to bigendian in the session_key test. Andrew Bartlett (This used to be commit 4f79f3b0c4cb15903f019a2dd62281ff65753b73)
2006-11-07 02:17:48 +03:00
for bindoptions in bigendian seal; do
r13472: After Volker's advise, try every combination of parameters. This isn't every parameter on NTLMSSP, but it is most of the important ones. This showed up that we had the '128bit && LM_KEY' case messed up. This isn't supported, so we must look instead at the 56 bit flag. Andrew Bartlett (This used to be commit 990da31b5f63f1e707651af8bf1a3241a8309811)
2006-02-12 17:19:31 +03:00
for keyexchange in "yes" "no"; do
for ntlm2 in "yes" "no"; do
for lm_key in "yes" "no"; do
r7684: Add a test aimed at checking we have agreement between client and server as to the CIFS session key. JRA had pain with this being wrong against NT4 (without spnego), hence this specific test. Andrew Bartlett (This used to be commit 47f433708ba38db9bf569567cc048e65f2786ebe)
2005-06-17 15:48:01 +04:00
for ntlmoptions in \
r13472: After Volker's advise, try every combination of parameters. This isn't every parameter on NTLMSSP, but it is most of the important ones. This showed up that we had the '128bit && LM_KEY' case messed up. This isn't supported, so we must look instead at the 56 bit flag. Andrew Bartlett (This used to be commit 990da31b5f63f1e707651af8bf1a3241a8309811)
2006-02-12 17:19:31 +03:00
"-k no --option=usespnego=yes" \
"-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no" \
"-k no --option=usespnego=yes --option=ntlmssp_client:56bit=yes" \
r16967: Test another NTLMSSP flags combination. Andrew Bartlett (This used to be commit 9e4eee5a2d7f44355f79ae12759df9991e7b171a)
2006-07-12 06:05:08 +04:00
"-k no --option=usespnego=yes --option=ntlmssp_client:56bit=no" \
r13472: After Volker's advise, try every combination of parameters. This isn't every parameter on NTLMSSP, but it is most of the important ones. This showed up that we had the '128bit && LM_KEY' case messed up. This isn't supported, so we must look instead at the 56 bit flag. Andrew Bartlett (This used to be commit 990da31b5f63f1e707651af8bf1a3241a8309811)
2006-02-12 17:19:31 +03:00
"-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=yes" \
"-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=no" \
"-k no --option=usespnego=yes --option=clientntlmv2auth=yes" \
"-k no --option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:128bit=no" \
"-k no --option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=yes" \
"-k no --option=usespnego=no --option=clientntlmv2auth=yes" \
r13850: Test (and fix) not using SPNEGO at all, but instead using raw NTLMSSP. The switch to turn off SPNEGO in the client is a bit messy, but it works. Andrew Bartlett (This used to be commit 085ba80cc8a954bd84ecf30e5d57a1583f54062f)
2006-03-06 02:06:37 +03:00
"-k no --option=gensec:spnego=no --option=clientntlmv2auth=yes" \
r15426: Implement SPNEGO as the default RPC authentication mechanism. Where this isn't supported, fallback to NTLM. Also, where we get a failure as 'logon failure', try and do a '3 tries' for the password, like we already do for CIFS. (Incomplete: needs a mapping between RPC errors and the logon failure NTSTATUS). Because we don't yet support Kerberos sign/seal to win2k3 SP1 for DCE/RPC, disable this (causing SPNEGO to negotiate NTLM) when kerberos isn't demanded. Andrew Bartlett (This used to be commit b3212d1fb91b26c1d326a289560106dffe1d2e80)
2006-05-04 14:03:41 +04:00
"-k no --option=usespnego=no"; do
r19723: don't use [,],(,) in test names to make the build-farm output happy metze (This used to be commit 8a0a92e2dc107797055421196f430269699510fe)
2006-11-15 20:01:26 +03:00
name="RPC-SECRETS on $transport with $bindoptions with NTLM2:$ntlm2 KEYEX:$keyexchange LM_KEY:$lm_key $ntlmoptions"
r21029: - Remove now unused failure checking code - Use --list option for smbtorture for local and nbt tests as well (This used to be commit 053d5a40bc96b9503220f17f59677a0df6677a1e)
2007-01-26 16:33:06 +03:00
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" --option=ntlmssp_client:keyexchange=$keyexchange --option=ntlmssp_client:ntlm2=$ntlm2 --option=ntlmssp_client:lm_key=$lm_key $ntlmoptions -U"$username"%"$password" -W $domain --option=gensec:target_hostname=$netbios_name RPC-SECRETS "$*"
r7684: Add a test aimed at checking we have agreement between client and server as to the CIFS session key. JRA had pain with this being wrong against NT4 (without spnego), hence this specific test. Andrew Bartlett (This used to be commit 47f433708ba38db9bf569567cc048e65f2786ebe)
2005-06-17 15:48:01 +04:00
done
r13472: After Volker's advise, try every combination of parameters. This isn't every parameter on NTLMSSP, but it is most of the important ones. This showed up that we had the '128bit && LM_KEY' case messed up. This isn't supported, so we must look instead at the 56 bit flag. Andrew Bartlett (This used to be commit 990da31b5f63f1e707651af8bf1a3241a8309811)
2006-02-12 17:19:31 +03:00
done
done
done
r19723: don't use [,],(,) in test names to make the build-farm output happy metze (This used to be commit 8a0a92e2dc107797055421196f430269699510fe)
2006-11-15 20:01:26 +03:00
name="RPC-SECRETS on $transport with $bindoptions with Kerberos"
r21029: - Remove now unused failure checking code - Use --list option for smbtorture for local and nbt tests as well (This used to be commit 053d5a40bc96b9503220f17f59677a0df6677a1e)
2007-01-26 16:33:06 +03:00
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" -k yes -U"$username"%"$password" -W $domain "--option=gensec:target_hostname=$netbios_name" RPC-SECRETS "$*"
r19723: don't use [,],(,) in test names to make the build-farm output happy metze (This used to be commit 8a0a92e2dc107797055421196f430269699510fe)
2006-11-15 20:01:26 +03:00
name="RPC-SECRETS on $transport with $bindoptions with Kerberos - use target principal"
r21029: - Remove now unused failure checking code - Use --list option for smbtorture for local and nbt tests as well (This used to be commit 053d5a40bc96b9503220f17f59677a0df6677a1e)
2007-01-26 16:33:06 +03:00
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" -k yes -U"$username"%"$password" -W $domain "--option=clientusespnegoprincipal=yes" "--option=gensec:target_hostname=$netbios_name" RPC-SECRETS "$*"
r13472: After Volker's advise, try every combination of parameters. This isn't every parameter on NTLMSSP, but it is most of the important ones. This showed up that we had the '128bit && LM_KEY' case messed up. This isn't supported, so we must look instead at the 56 bit flag. Andrew Bartlett (This used to be commit 990da31b5f63f1e707651af8bf1a3241a8309811)
2006-02-12 17:19:31 +03:00
done
r19723: don't use [,],(,) in test names to make the build-farm output happy metze (This used to be commit 8a0a92e2dc107797055421196f430269699510fe)
2006-11-15 20:01:26 +03:00
name="RPC-SECRETS on $transport with Kerberos - use Samba3 style login"
r21029: - Remove now unused failure checking code - Use --list option for smbtorture for local and nbt tests as well (This used to be commit 053d5a40bc96b9503220f17f59677a0df6677a1e)
2007-01-26 16:33:06 +03:00
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server" -k yes -U"$username"%"$password" -W $domain "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=$netbios_name" RPC-SECRETS "$*"
r19723: don't use [,],(,) in test names to make the build-farm output happy metze (This used to be commit 8a0a92e2dc107797055421196f430269699510fe)
2006-11-15 20:01:26 +03:00
name="RPC-SECRETS on $transport with Kerberos - use Samba3 style login, use target principal"
r21029: - Remove now unused failure checking code - Use --list option for smbtorture for local and nbt tests as well (This used to be commit 053d5a40bc96b9503220f17f59677a0df6677a1e)
2007-01-26 16:33:06 +03:00
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server" -k yes -U"$username"%"$password" -W $domain "--option=clientusespnegoprincipal=yes" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=$netbios_name" RPC-SECRETS "$*"
r7684: Add a test aimed at checking we have agreement between client and server as to the CIFS session key. JRA had pain with this being wrong against NT4 (without spnego), hence this specific test. Andrew Bartlett (This used to be commit 47f433708ba38db9bf569567cc048e65f2786ebe)
2005-06-17 15:48:01 +04:00
testok $0 $failed
Copy Permalink