svn commit: samba r13472 - in branches/SAMBA_4_0/source:
auth/ntlmssp script/tests
abartlet at samba.org
abartlet at samba.org
Sun Feb 12 14:19:32 GMT 2006
Author: abartlet
Date: 2006-02-12 14:19:31 +0000 (Sun, 12 Feb 2006)
New Revision: 13472
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=13472
Log:
After Volker's advise, try every combination of parameters. This
isn't every parameter on NTLMSSP, but it is most of the important
ones.
This showed up that we had the '128bit && LM_KEY' case messed up.
This isn't supported, so we must look instead at the 56 bit flag.
Andrew Bartlett
Modified:
branches/SAMBA_4_0/source/auth/ntlmssp/ntlmssp.c
branches/SAMBA_4_0/source/script/tests/test_session_key.sh
Changeset:
Modified: branches/SAMBA_4_0/source/auth/ntlmssp/ntlmssp.c
===================================================================
--- branches/SAMBA_4_0/source/auth/ntlmssp/ntlmssp.c 2006-02-12 13:53:42 UTC (rev 13471)
+++ branches/SAMBA_4_0/source/auth/ntlmssp/ntlmssp.c 2006-02-12 14:19:31 UTC (rev 13472)
@@ -302,16 +302,18 @@
to do this for the LM_KEY.
*/
if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
- if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
-
- } else if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
+ /* LM key doesn't support 128 bit crypto, so this is
+ * the best we can do. If you negotiate 128 bit, but
+ * not 56, you end up with 40 bit... */
+ if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
weakened_key.data[7] = 0xa0;
+ weakened_key.length = 8;
} else { /* forty bits */
weakened_key.data[5] = 0xe5;
weakened_key.data[6] = 0x38;
weakened_key.data[7] = 0xb0;
+ weakened_key.length = 8;
}
- weakened_key.length = 8;
}
return weakened_key;
}
Modified: branches/SAMBA_4_0/source/script/tests/test_session_key.sh
===================================================================
--- branches/SAMBA_4_0/source/script/tests/test_session_key.sh 2006-02-12 13:53:42 UTC (rev 13471)
+++ branches/SAMBA_4_0/source/script/tests/test_session_key.sh 2006-02-12 14:19:31 UTC (rev 13472)
@@ -18,22 +18,27 @@
failed=0
transport="ncacn_np"
+for bindoptions in validate seal; do
+ for keyexchange in "yes" "no"; do
+ for ntlm2 in "yes" "no"; do
+ for lm_key in "yes" "no"; do
for ntlmoptions in \
- "--option=usespnego=yes --option=ntlmssp_client:ntlm2=yes" \
- "--option=usespnego=yes --option=ntlmssp_client:ntlm2=no" \
- "--option=usespnego=yes --option=ntlmssp_client:ntlm2=yes --option=ntlmssp_client:128bit=no" \
- "--option=usespnego=yes --option=ntlmssp_client:ntlm2=no --option=ntlmssp_client:128bit=no" \
- "--option=usespnego=yes --option=ntlmssp_client:ntlm2=yes --option=ntlmssp_client:keyexchange=no" \
- "--option=usespnego=yes --option=ntlmssp_client:ntlm2=no --option=ntlmssp_client:keyexchange=no" \
- "--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=no" \
- "--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=yes" \
- "--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=yes --option=ntlmssp_client:128bit=no" \
- "--option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:keyexchange=no --option=ntlmssp_client:128bit=no" \
- "--option=usespnego=no --option=clientntlmv2auth=yes" \
- "--option=usespnego=no" \
+ "-k no --option=usespnego=yes" \
+ "-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no" \
+ "-k no --option=usespnego=yes --option=ntlmssp_client:56bit=yes" \
+ "-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=yes" \
+ "-k no --option=usespnego=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=no" \
+ "-k no --option=usespnego=yes --option=clientntlmv2auth=yes" \
+ "-k no --option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:128bit=no" \
+ "-k no --option=usespnego=yes --option=clientntlmv2auth=yes --option=ntlmssp_client:128bit=no --option=ntlmssp_client:56bit=yes" \
+ "-k no --option=usespnego=no --option=clientntlmv2auth=yes" \
+ "-k no --option=usespnego=no" \
; do
- name="RPC-SECRETS on $transport with $ntlmoptions"
- testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" $ntlmoptions -U"$username"%"$password" -W $domain RPC-SECRETS "$*" || failed=`expr $failed + 1`
+ name="RPC-SECRETS on $transport:$server[$bindoptions] with NTLM2:$ntlm2 KEYEX:$keyexchange LM_KEY:$lm_key $ntlmoptions"
+ testit "$name" bin/smbtorture $TORTURE_OPTIONS $transport:"$server[$bindoptions]" --option=ntlmssp_client:keyexchange=$keyexchange --option=ntlmssp_client:ntlm2=$ntlm2 --option=ntlmssp_client:lm_key=$lm_key $ntlmoptions -U"$username"%"$password" -W $domain RPC-SECRETS "$*" || failed=`expr $failed + 1`
done
-
+ done
+ done
+ done
+done
testok $0 $failed
More information about the samba-cvs
mailing list