python/samba/tests/password_hash_fl2003.py

   1 # Tests for Tests for source4/dsdb/samdb/ldb_modules/password_hash.c
   2 #
   3 # Copyright (C) Catalyst IT Ltd. 2017
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """
  20 Tests for source4/dsdb/samdb/ldb_modules/password_hash.c
  21
  22 These tests need to be run in an environment in which
  23 io->ac->gpg_key_ids == NULL, so that the gpg supplemental credentials
  24 are not generated. And also need to be in an environment with a
  25 functional level less than 2008 to ensure the kerberos newer keys are not
  26 generated
  27 """
  28
  29 from samba.tests.password_hash import (
  30     PassWordHashTests,
  31     get_package,
  32     USER_PASS
  33 )
  34 from samba.ndr import ndr_unpack
  35 from samba.dcerpc import drsblobs
  36 import binascii
  37
  38
  39 class PassWordHashFl2003Tests(PassWordHashTests):
  40
  41     def setUp(self):
  42         super(PassWordHashFl2003Tests, self).setUp()
  43
  44     def test_default_supplementalCredentials(self):
  45         self.add_user(options=[("password hash userPassword schemes", "")])
  46
  47         sc = self.get_supplemental_creds()
  48
  49         # Check that we got all the expected supplemental credentials
  50         # And they are in the expected order.
  51         size = len(sc.sub.packages)
  52         self.assertEqual(3, size)
  53
  54         (pos, package) = get_package(sc, "Primary:Kerberos")
  55         self.assertEqual(1, pos)
  56         self.assertEqual("Primary:Kerberos", package.name)
  57
  58         (pos, package) = get_package(sc, "Packages")
  59         self.assertEqual(2, pos)
  60         self.assertEqual("Packages", package.name)
  61
  62         (pos, package) = get_package(sc, "Primary:WDigest")
  63         self.assertEqual(3, pos)
  64         self.assertEqual("Primary:WDigest", package.name)
  65
  66         # Check that the WDigest values are correct.
  67         #
  68         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
  69                              binascii.a2b_hex(package.data))
  70         self.check_wdigests(digests)
  71
  72     def test_userPassword_sha256(self):
  73         self.add_user(options=[("password hash userPassword schemes",
  74                                 "CryptSHA256")])
  75
  76         sc = self.get_supplemental_creds()
  77
  78         # Check that we got all the expected supplemental credentials
  79         # And they are in the expected order.
  80         size = len(sc.sub.packages)
  81         self.assertEqual(4, size)
  82
  83         (pos, package) = get_package(sc, "Primary:Kerberos")
  84         self.assertEqual(1, pos)
  85         self.assertEqual("Primary:Kerberos", package.name)
  86
  87         (pos, wd_package) = get_package(sc, "Primary:WDigest")
  88         self.assertEqual(2, pos)
  89         self.assertEqual("Primary:WDigest", wd_package.name)
  90
  91         (pos, package) = get_package(sc, "Packages")
  92         self.assertEqual(3, pos)
  93         self.assertEqual("Packages", package.name)
  94
  95         (pos, up_package) = get_package(sc, "Primary:userPassword")
  96         self.assertEqual(4, pos)
  97         self.assertEqual("Primary:userPassword", up_package.name)
  98
  99         # Check that the WDigest values are correct.
 100         #
 101         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
 102                              binascii.a2b_hex(wd_package.data))
 103         self.check_wdigests(digests)
 104
 105         # Check that the userPassword hashes are computed correctly
 106         #
 107         up = ndr_unpack(drsblobs.package_PrimaryUserPasswordBlob,
 108                         binascii.a2b_hex(up_package.data))
 109
 110         self.checkUserPassword(up, [("{CRYPT}", "5", None)])
 111         self.checkNtHash(USER_PASS, up.current_nt_hash.hash)
 112
 113     def test_supplementalCredentials_cleartext(self):
 114         self.add_user(clear_text=True,
 115                       options=[("password hash userPassword schemes", "")])
 116
 117         sc = self.get_supplemental_creds()
 118
 119         # Check that we got all the expected supplemental credentials
 120         # And they are in the expected order.
 121         size = len(sc.sub.packages)
 122         self.assertEqual(4, size)
 123
 124         (pos, package) = get_package(sc, "Primary:Kerberos")
 125         self.assertEqual(1, pos)
 126         self.assertEqual("Primary:Kerberos", package.name)
 127
 128         (pos, wd_package) = get_package(sc, "Primary:WDigest")
 129         self.assertEqual(2, pos)
 130         self.assertEqual("Primary:WDigest", wd_package.name)
 131
 132         (pos, package) = get_package(sc, "Packages")
 133         self.assertEqual(3, pos)
 134         self.assertEqual("Packages", package.name)
 135
 136         (pos, ct_package) = get_package(sc, "Primary:CLEARTEXT")
 137         self.assertEqual(4, pos)
 138         self.assertEqual("Primary:CLEARTEXT", ct_package.name)
 139
 140         # Check that the WDigest values are correct.
 141         #
 142         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
 143                              binascii.a2b_hex(wd_package.data))
 144         self.check_wdigests(digests)
 145
 146         # Check the clear text  value is correct.
 147         ct = ndr_unpack(drsblobs.package_PrimaryCLEARTEXTBlob,
 148                         binascii.a2b_hex(ct_package.data))
 149         self.assertEqual(USER_PASS.encode('utf-16-le'), ct.cleartext)
 150
 151     def test_userPassword_cleartext_sha512(self):
 152         self.add_user(clear_text=True,
 153                       options=[("password hash userPassword schemes",
 154                                 "CryptSHA512:rounds=10000")])
 155
 156         sc = self.get_supplemental_creds()
 157
 158         # Check that we got all the expected supplemental credentials
 159         # And they are in the expected order.
 160         size = len(sc.sub.packages)
 161         self.assertEqual(5, size)
 162
 163         (pos, package) = get_package(sc, "Primary:Kerberos")
 164         self.assertEqual(1, pos)
 165         self.assertEqual("Primary:Kerberos", package.name)
 166
 167         (pos, wd_package) = get_package(sc, "Primary:WDigest")
 168         self.assertEqual(2, pos)
 169         self.assertEqual("Primary:WDigest", wd_package.name)
 170
 171         (pos, ct_package) = get_package(sc, "Primary:CLEARTEXT")
 172         self.assertEqual(3, pos)
 173         self.assertEqual("Primary:CLEARTEXT", ct_package.name)
 174
 175         (pos, package) = get_package(sc, "Packages")
 176         self.assertEqual(4, pos)
 177         self.assertEqual("Packages", package.name)
 178
 179         (pos, up_package) = get_package(sc, "Primary:userPassword")
 180         self.assertEqual(5, pos)
 181         self.assertEqual("Primary:userPassword", up_package.name)
 182
 183         # Check that the WDigest values are correct.
 184         #
 185         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
 186                              binascii.a2b_hex(wd_package.data))
 187         self.check_wdigests(digests)
 188
 189         # Check the clear text  value is correct.
 190         ct = ndr_unpack(drsblobs.package_PrimaryCLEARTEXTBlob,
 191                         binascii.a2b_hex(ct_package.data))
 192         self.assertEqual(USER_PASS.encode('utf-16-le'), ct.cleartext)
 193
 194         # Check that the userPassword hashes are computed correctly
 195         #
 196         up = ndr_unpack(drsblobs.package_PrimaryUserPasswordBlob,
 197                         binascii.a2b_hex(up_package.data))
 198         self.checkUserPassword(up, [("{CRYPT}", "6", 10000)])
 199         self.checkNtHash(USER_PASS, up.current_nt_hash.hash)