sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-03 13:47:25 +03:00
Code

r13472: After Volker's advise, try every combination of parameters. This

Browse Source 
isn't every parameter on NTLMSSP, but it is most of the important
ones.

This showed up that we had the '128bit && LM_KEY' case messed up.
This isn't supported, so we must look instead at the 56 bit flag.

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2006-02-12 14:19:31 +00:00 committed by Gerald (Jerry) Carter
parent 16e5c96875
commit 990da31b5f
2 changed files with 26 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source/auth/ntlmssp/ntlmssp.c
View File

@ -302,16 +302,18 @@ DATA_BLOB ntlmssp_weakend_key(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
to do this for the LM_KEY.
*/
if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
} else if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
/* LM key doesn't support 128 bit crypto, so this is
* the best we can do. If you negotiate 128 bit, but
* not 56, you end up with 40 bit... */
if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
weakened_key.data[7] = 0xa0;
weakened_key.length = 8;
} else { /* forty bits */
weakened_key.data[5] = 0xe5;
weakened_key.data[6] = 0x38;
weakened_key.data[7] = 0xb0;
weakened_key.length = 8;
}
weakened_key.length = 8;
}
return weakened_key;
}

35
source/script/tests/test_session_key.sh
View File

@ -18,22 +18,27 @@ incdir=`dirname $0`
failed=0
transport="ncacn_np"
for bindoptions in validate seal; do
for keyexchange in "yes" "no"; do
for ntlm2 in "yes" "no"; do
for lm_key in "yes" "no"; do
for ntlmoptions in \
"--option=usespnego=yes --option=ntlmssp_client:ntlm2=yes" \
"--option=usespnego=yes --option=ntlmssp_client:ntlm2=no" \
"--option=usespnego=yes --option=ntlmssp_client:ntlm2=yes --option=ntlmssp_client:128bit=no" \
"--option=usespnego=yes --option=ntlmssp_client:ntlm2=no --option=ntlmssp_client:128bit=no" \
"--option=usespnego=yes --option=ntlmssp_client:ntlm2=yes --option=ntlmssp_client:keyexchange=no" \
"--option=usespnego=yes --option=ntlmssp_client:ntlm2=no --option=ntlmssp_client:keyexchange=no" \
"--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=no" \
"--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=yes" \
"--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=yes --option=ntlmssp_client:128bit=no" \
"--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=no --option=ntlmssp_client:128bit=no" \
"--option=usespnego=no --option=clientntlmv2auth=yes" \
"--option=usespnego=no" \
"-k no --option=usespnego=yes" \
"-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no" \
"-k no --option=usespnego=yes --option=ntlmssp_client:56bit=yes" \
"-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=yes" \
"-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=no" \
"-k no --option=usespnego=yes --option=clientntlmv2auth=yes" \
"-k no --option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:128bit=no" \
"-k no --option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=yes" \
"-k no --option=usespnego=no --option=clientntlmv2auth=yes" \
"-k no --option=usespnego=no" \
; do
name="RPC-SECRETS on $transport with $ntlmoptions"
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" $ntlmoptions -U"$username"%"$password" -W $domain RPC-SECRETS "$*" || failed=`expr $failed + 1`
name="RPC-SECRETS on $transport:$server[$bindoptions] with NTLM2:$ntlm2 KEYEX:$keyexchange LM_KEY:$lm_key $ntlmoptions"
testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" --option=ntlmssp_client:keyexchange=$keyexchange --option=ntlmssp_client:ntlm2=$ntlm2 --option=ntlmssp_client:lm_key=$lm_key $ntlmoptions -U"$username"%"$password" -W $domain RPC-SECRETS "$*" || failed=`expr $failed + 1`
done
done
done
done
done
testok $0 $failed