/
githubmirror
/
ipxe
Обзор
Документация
Войти
/
githubmirror
/
ipxe
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
src/tests/ntlm_test.c
312 строк
10 KB
Michael Brown
[ntlm] Add support for NTLM authentication mechanism
12 ноя 2017, 21:52
12 ноя 2017, 21:52
fc2f0dd
Код
Авторство
О чём код?
/* * Copyright (C) 2017 Michael Brown <mbrown@fensystems.co.uk>. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or any later version. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. * * You can also choose to distribute this program under the terms of * the Unmodified Binary Distribution Licence (as given in the file * COPYING.UBDL), provided that you have satisfied its requirements. */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** @file * * NTLM authentication self-tests * * The test vectors are taken from the MS-NLMP specification document. * */ /* Forcibly enable assertions */ #undef NDEBUG #include <stdlib.h> #include <string.h> #include <byteswap.h> #include <ipxe/ntlm.h> #include <ipxe/test.h> /** A key generation test */ struct ntlm_key_test { /** Domain name (or NULL) */ const char *domain; /** User name (or NULL) */ const char *username; /** Password (or NULL) */ const char *password; /** Expected key */ struct ntlm_key expected; }; /** An authentication test */ struct ntlm_authenticate_test { /** Domain name (or NULL) */ const char *domain; /** User name (or NULL) */ const char *username; /** Password (or NULL) */ const char *password; /** Workstation (or NULL) */ const char *workstation; /** Nonce */ struct ntlm_nonce nonce; /** Challenge message */ struct ntlm_challenge *challenge; /** Length of Challenge message */ size_t challenge_len; /** Expected Authenticate message */ struct ntlm_authenticate *expected; /** Expected length of Authenticate message */ size_t expected_len; }; /** Define inline message data */ #define DATA(...) { __VA_ARGS__ } /** Define a key generation digest test */ #define KEY_TEST( name, DOMAIN, USERNAME, PASSWORD, EXPECTED ) \ static struct ntlm_key_test name = { \ .domain = DOMAIN, \ .username = USERNAME, \ .password = PASSWORD, \ .expected = { \ .raw = EXPECTED, \ }, \ }; /** Define an authentication test */ #define AUTHENTICATE_TEST( name, DOMAIN, USERNAME, PASSWORD, \ WORKSTATION, NONCE, CHALLENGE, EXPECTED ) \ static const uint8_t name ## _challenge[] = CHALLENGE; \ static const uint8_t name ## _expected[] = EXPECTED; \ static struct ntlm_authenticate_test name = { \ .domain = DOMAIN, \ .username = USERNAME, \ .password = PASSWORD, \ .workstation = WORKSTATION, \ .nonce = { \ .raw = NONCE, \ }, \ .challenge = ( ( void * ) name ## _challenge ), \ .challenge_len = sizeof ( name ## _challenge ), \ .expected = ( ( void * ) name ## _expected ), \ .expected_len = sizeof ( name ## _expected ), \ }; /** NTOWFv2() test from MS-NLMP specification */ KEY_TEST ( msnlmp_ntowfv2, "Domain", "User", "Password", DATA ( 0x0c, 0x86, 0x8a, 0x40, 0x3b, 0xfd, 0x7a, 0x93, 0xa3, 0x00, 0x1e, 0xf2, 0x2e, 0xf0, 0x2e, 0x3f ) ); /** Authentication test from MS-NLMP specification */ AUTHENTICATE_TEST ( msnlmp_authenticate, "Domain", "User", "Password", "COMPUTER", DATA ( 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa ), DATA ( 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x0c, 0x00, 0x38, 0x00, 0x00, 0x00, 0x33, 0x82, 0x8a, 0xe2, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x00, 0x24, 0x00, 0x44, 0x00, 0x00, 0x00, 0x06, 0x00, 0x70, 0x17, 0x00, 0x00, 0x00, 0x0f, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x02, 0x00, 0x0c, 0x00, 0x44, 0x00, 0x6f, 0x00, 0x6d, 0x00, 0x61, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x01, 0x00, 0x0c, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x00, 0x00, 0x00, 0x00 ), DATA ( 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18, 0x00, 0x18, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x54, 0x00, 0x54, 0x00, 0x84, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x0c, 0x00, 0x48, 0x00, 0x00, 0x00, 0x08, 0x00, 0x08, 0x00, 0x54, 0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x5c, 0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0xd8, 0x00, 0x00, 0x00, 0x35, 0x82, 0x88, 0xe2, 0x05, 0x01, 0x28, 0x0a, 0x00, 0x00, 0x00, 0x0f, 0x44, 0x00, 0x6f, 0x00, 0x6d, 0x00, 0x61, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x55, 0x00, 0x73, 0x00, 0x65, 0x00, 0x72, 0x00, 0x43, 0x00, 0x4f, 0x00, 0x4d, 0x00, 0x50, 0x00, 0x55, 0x00, 0x54, 0x00, 0x45, 0x00, 0x52, 0x00, 0x86, 0xc3, 0x50, 0x97, 0xac, 0x9c, 0xec, 0x10, 0x25, 0x54, 0x76, 0x4a, 0x57, 0xcc, 0xcc, 0x19, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x68, 0xcd, 0x0a, 0xb8, 0x51, 0xe5, 0x1c, 0x96, 0xaa, 0xbc, 0x92, 0x7b, 0xeb, 0xef, 0x6a, 0x1c, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x0c, 0x00, 0x44, 0x00, 0x6f, 0x00, 0x6d, 0x00, 0x61, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x01, 0x00, 0x0c, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xda, 0xd2, 0x54, 0x4f, 0xc9, 0x79, 0x90, 0x94, 0xce, 0x1c, 0xe9, 0x0b, 0xc9, 0xd0, 0x3e ) ); /** * Report key generation test result * * @v test Key generation test * @v file Test code file * @v line Test code line */ static void ntlm_key_okx ( struct ntlm_key_test *test, const char *file, unsigned int line ) { struct ntlm_key key; ntlm_key ( test->domain, test->username, test->password, &key ); okx ( memcmp ( &key, &test->expected, sizeof ( key ) ) == 0, file, line ); } #define ntlm_key_ok( test ) \ ntlm_key_okx ( test, __FILE__, __LINE__ ) /** * Report NTLM variable-length data test result * * @v msg Message header * @v msg_len Length of message * @v data Variable-length data descriptor * @v expected Expected message header * @v expected_data Expected variable-length data descriptor * @v field Field name * @v file Test code file * @v line Test code line */ static void ntlm_data_okx ( struct ntlm_header *msg, size_t msg_len, struct ntlm_data *data, struct ntlm_header *expected, struct ntlm_data *expected_data, const char *field, const char *file, unsigned int line ) { size_t offset; size_t len; void *raw; void *expected_raw; /* Verify data lies within message */ okx ( data->len == data->max_len, file, line ); offset = le32_to_cpu ( data->offset ); len = le16_to_cpu ( data->len ); okx ( offset <= msg_len, file, line ); okx ( len <= ( msg_len - offset ), file, line ); /* Verify content matches expected content */ raw = ( ( ( void * ) msg ) + offset ); expected_raw = ( ( ( void * ) expected ) + le32_to_cpu ( expected_data->offset ) ); DBGC ( msg, "NTLM %s expected:\n", field ); DBGC_HDA ( msg, 0, expected_raw, le16_to_cpu ( expected_data->len ) ); DBGC ( msg, "NTLM %s actual:\n", field ); DBGC_HDA ( msg, 0, raw, len ); okx ( data->len == expected_data->len, file, line ); okx ( memcmp ( raw, expected_raw, len ) == 0, file, line ); } #define ntlm_data_ok( msg, msg_len, data, expected, expected_data ) \ ntlm_data_okx ( msg, msg_len, data, expected, expected_data, \ __FILE__, __LINE__ ) /** * Report NTLM authentication test result * * @v test Authentication test * @v file Test code file * @v line Test code line */ static void ntlm_authenticate_okx ( struct ntlm_authenticate_test *test, const char *file, unsigned int line ) { struct ntlm_authenticate *expected = test->expected; struct ntlm_challenge_info info; struct ntlm_authenticate *auth; struct ntlm_key key; struct ntlm_lm_response lm; struct ntlm_nt_response nt; size_t len; /* Parse Challenge message */ okx ( ntlm_challenge ( test->challenge, test->challenge_len, &info ) == 0, file, line ); /* Generate key */ ntlm_key ( test->domain, test->username, test->password, &key ); /* Generate responses */ ntlm_response ( &info, &key, &test->nonce, &lm, &nt ); /* Allocate buffer for Authenticate message */ len = ntlm_authenticate_len ( &info, test->domain, test->username, test->workstation ); okx ( len >= sizeof ( *auth ), file, line ); auth = malloc ( len ); okx ( auth != NULL, file, line ); /* Construct Authenticate message */ okx ( ntlm_authenticate ( &info, test->domain, test->username, test->workstation, &lm, &nt, auth ) == len, file, line ); /* Verify header */ okx ( memcmp ( &auth->header, &expected->header, sizeof ( auth->header ) ) == 0, file, line ); /* Verify LAN Manager response */ ntlm_data_okx ( &auth->header, len, &auth->lm, &expected->header, &expected->lm, "LM", file, line ); /* Verify NT response */ ntlm_data_okx ( &auth->header, len, &auth->nt, &expected->header, &expected->nt, "NT", file, line ); /* Verify domain name */ ntlm_data_okx ( &auth->header, len, &auth->domain, &expected->header, &expected->domain, "domain", file, line ); /* Verify user name */ ntlm_data_okx ( &auth->header, len, &auth->user, &expected->header, &expected->user, "user", file, line ); /* Verify workstation name */ ntlm_data_okx ( &auth->header, len, &auth->workstation, &expected->header, &expected->workstation, "workstation",file, line ); /* Verify session key */ if ( auth->flags & NTLM_NEGOTIATE_KEY_EXCH ) { ntlm_data_okx ( &auth->header, len, &auth->session, &expected->header, &expected->session, "session", file, line ); } /* Free Authenticate message */ free ( auth ); } #define ntlm_authenticate_ok( test ) \ ntlm_authenticate_okx ( test, __FILE__, __LINE__ ) /** * Perform NTLM self-test * */ static void ntlm_test_exec ( void ) { /* Verify key generation */ ntlm_key_ok ( &msnlmp_ntowfv2 ); /* Verify authentication response */ ntlm_authenticate_ok ( &msnlmp_authenticate ); } /** NTLM self-test */ struct self_test ntlm_test __self_test = { .name = "ntlm", .exec = ntlm_test_exec, };