python/samba/tests/password_hash_gpgme.py

   1 # Tests for Tests for source4/dsdb/samdb/ldb_modules/password_hash.c
   2 #
   3 # Copyright (C) Catalyst IT Ltd. 2017
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """
  20 Tests for source4/dsdb/samdb/ldb_modules/password_hash.c
  21 These tests need to be run in an environment in which
  22 io->ac->gpg_key_ids != NULL, so that the gpg supplemental credentials
  23 are generated. The functional level needs to be >= 2008 so that the
  24 kerberos newer keys are generated.
  25 """
  26
  27
  28 from samba.tests.password_hash import (
  29     PassWordHashTests,
  30     get_package,
  31     USER_PASS,
  32     USER_NAME
  33 )
  34 from samba.ndr import ndr_unpack
  35 from samba.dcerpc import drsblobs
  36 import binascii
  37 from samba.tests.pso import PasswordSettings
  38 import samba
  39
  40 class PassWordHashGpgmeTests(PassWordHashTests):
  41
  42     def setUp(self):
  43         super(PassWordHashGpgmeTests, self).setUp()
  44
  45     def test_default_supplementalCredentials(self):
  46         self.add_user()
  47         if not self.lp.get("password hash gpg key ids"):
  48             self.skipTest("No password hash gpg key ids, " +
  49                           "Primary:SambaGPG will not be generated");
  50
  51         sc = self.get_supplemental_creds()
  52
  53         # Check that we got all the expected supplemental credentials
  54         # And they are in the expected order.
  55         size = len(sc.sub.packages)
  56         self.assertEquals(5, size)
  57         (pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
  58         self.assertEquals(1, pos)
  59         self.assertEquals("Primary:Kerberos-Newer-Keys", package.name)
  60
  61         (pos, package) = get_package(sc, "Primary:Kerberos")
  62         self.assertEquals(2, pos)
  63         self.assertEquals("Primary:Kerberos", package.name)
  64
  65         (pos, wd_package) = get_package(sc, "Primary:WDigest")
  66         self.assertEquals(3, pos)
  67         self.assertEquals("Primary:WDigest", wd_package.name)
  68
  69         (pos, package) = get_package(sc, "Packages")
  70         self.assertEquals(4, pos)
  71         self.assertEquals("Packages", package.name)
  72
  73         (pos, package) = get_package(sc, "Primary:SambaGPG")
  74         self.assertEquals(5, pos)
  75         self.assertEquals("Primary:SambaGPG", package.name)
  76
  77         # Check that the WDigest values are correct.
  78         #
  79         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
  80                              binascii.a2b_hex(wd_package.data))
  81         self.check_wdigests(digests)
  82
  83     def test_supplementalCredentials_cleartext(self):
  84         self.add_user(clear_text=True)
  85         if not self.lp.get("password hash gpg key ids"):
  86             self.skipTest("No password hash gpg key ids, " +
  87                           "Primary:SambaGPG will not be generated");
  88
  89         sc = self.get_supplemental_creds()
  90
  91         # Check that we got all the expected supplemental credentials
  92         # And they are in the expected order.
  93         size = len(sc.sub.packages)
  94         self.assertEquals(6, size)
  95         (pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
  96         self.assertEquals(1, pos)
  97         self.assertEquals("Primary:Kerberos-Newer-Keys", package.name)
  98
  99         (pos, package) = get_package(sc, "Primary:Kerberos")
 100         self.assertEquals(2, pos)
 101         self.assertEquals("Primary:Kerberos", package.name)
 102
 103         (pos, wd_package) = get_package(sc, "Primary:WDigest")
 104         self.assertEquals(3, pos)
 105         self.assertEquals("Primary:WDigest", wd_package.name)
 106
 107         (pos, ct_package) = get_package(sc, "Primary:CLEARTEXT")
 108         self.assertEquals(4, pos)
 109         self.assertEquals("Primary:CLEARTEXT", ct_package.name)
 110
 111         (pos, package) = get_package(sc, "Packages")
 112         self.assertEquals(5, pos)
 113         self.assertEquals("Packages", package.name)
 114
 115         (pos, package) = get_package(sc, "Primary:SambaGPG")
 116         self.assertEquals(6, pos)
 117         self.assertEquals("Primary:SambaGPG", package.name)
 118
 119         # Check that the WDigest values are correct.
 120         #
 121         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
 122                              binascii.a2b_hex(wd_package.data))
 123         self.check_wdigests(digests)
 124
 125         # Check the clear text  value is correct.
 126         ct = ndr_unpack(drsblobs.package_PrimaryCLEARTEXTBlob,
 127                         binascii.a2b_hex(ct_package.data))
 128         self.assertEquals(USER_PASS.encode('utf-16-le'), ct.cleartext)
 129
 130     def assert_cleartext(self, expect_cleartext, password=None):
 131         """Checks cleartext is (or isn't) returned as expected"""
 132         sc = self.get_supplemental_creds()
 133         if expect_cleartext:
 134             (pos, ct_package) = get_package(sc, "Primary:CLEARTEXT")
 135             self.assertTrue(ct_package != None, "Failed to retrieve cleartext")
 136
 137             # Check the clear-text value is correct.
 138             ct = ndr_unpack(drsblobs.package_PrimaryCLEARTEXTBlob,
 139                             binascii.a2b_hex(ct_package.data))
 140             self.assertEquals(password.encode('utf-16-le'), ct.cleartext)
 141         else:
 142             ct_package = get_package(sc, "Primary:CLEARTEXT")
 143             self.assertTrue(ct_package == None,
 144                             "Got cleartext when we shouldn't have")
 145
 146     def test_supplementalCredentials_cleartext_pso(self):
 147         """Checks that a PSO's cleartext setting can override the domain's"""
 148
 149         # create a user that stores plain-text passwords
 150         self.add_user(clear_text=True)
 151
 152         # check that clear-text is present in the supplementary-credentials
 153         self.assert_cleartext(expect_cleartext=True, password=USER_PASS)
 154
 155         # create a PSO overriding the plain-text setting & apply it to the user
 156         no_plaintext_pso = PasswordSettings("no-plaintext-PSO", self.ldb,
 157                                             precedence=200,
 158                                             store_plaintext=False)
 159         self.addCleanup(self.ldb.delete, no_plaintext_pso.dn)
 160         userdn = "cn=" + USER_NAME + ",cn=users," + self.base_dn
 161         no_plaintext_pso.apply_to(userdn)
 162
 163         # set the password to update the cleartext password stored
 164         new_password = samba.generate_random_password(32, 32)
 165         self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
 166
 167         # this time cleartext shouldn't be in the supplementary creds
 168         self.assert_cleartext(expect_cleartext=False)
 169
 170         # unapply PSO, update password, and check we get the cleartext again
 171         no_plaintext_pso.unapply(userdn)
 172         new_password = samba.generate_random_password(32, 32)
 173         self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
 174         self.assert_cleartext(expect_cleartext=True, password=new_password)
 175
 176         # Now update the domain setting and check we no longer get cleartext
 177         self.set_store_cleartext(False)
 178         new_password = samba.generate_random_password(32, 32)
 179         self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
 180         self.assert_cleartext(expect_cleartext=False)
 181
 182         # create a PSO overriding the domain setting & apply it to the user
 183         plaintext_pso = PasswordSettings("plaintext-PSO", self.ldb,
 184                                          precedence=100, store_plaintext=True)
 185         self.addCleanup(self.ldb.delete, plaintext_pso.dn)
 186         plaintext_pso.apply_to(userdn)
 187         new_password = samba.generate_random_password(32, 32)
 188         self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
 189         self.assert_cleartext(expect_cleartext=True, password=new_password)
 190
 191     def test_userPassword_multiple_hashes(self):
 192         self.add_user(options=[(
 193             "password hash userPassword schemes",
 194             "CryptSHA512 CryptSHA256 CryptSHA512")])
 195
 196         sc = self.get_supplemental_creds()
 197
 198         # Check that we got all the expected supplemental credentials
 199         # And they are in the expected order.
 200         size = len(sc.sub.packages)
 201         self.assertEquals(6, size)
 202
 203         (pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
 204         self.assertEquals(1, pos)
 205         self.assertEquals("Primary:Kerberos-Newer-Keys", package.name)
 206
 207         (pos, package) = get_package(sc, "Primary:Kerberos")
 208         self.assertEquals(2, pos)
 209         self.assertEquals("Primary:Kerberos", package.name)
 210
 211         (pos, wp_package) = get_package(sc, "Primary:WDigest")
 212         self.assertEquals(3, pos)
 213         self.assertEquals("Primary:WDigest", wp_package.name)
 214
 215         (pos, up_package) = get_package(sc, "Primary:userPassword")
 216         self.assertEquals(4, pos)
 217         self.assertEquals("Primary:userPassword", up_package.name)
 218
 219         (pos, package) = get_package(sc, "Packages")
 220         self.assertEquals(5, pos)
 221         self.assertEquals("Packages", package.name)
 222
 223         (pos, package) = get_package(sc, "Primary:SambaGPG")
 224         self.assertEquals(6, pos)
 225         self.assertEquals("Primary:SambaGPG", package.name)
 226
 227         # Check that the WDigest values are correct.
 228         #
 229         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
 230                              binascii.a2b_hex(wp_package.data))
 231         self.check_wdigests(digests)
 232
 233         # Check that the userPassword hashes are computed correctly
 234         # Expect three hashes to be calculated
 235         up = ndr_unpack(drsblobs.package_PrimaryUserPasswordBlob,
 236                         binascii.a2b_hex(up_package.data))
 237         self.checkUserPassword(up, [
 238             ("{CRYPT}", "6", None),
 239             ("{CRYPT}", "5", None),
 240             ("{CRYPT}", "6", None)
 241         ])
 242         self.checkNtHash(USER_PASS, up.current_nt_hash.hash)
 243
 244     def test_userPassword_multiple_hashes_rounds_specified(self):
 245         self.add_user(options=[(
 246             "password hash userPassword schemes",
 247             "CryptSHA512:rounds=5120 CryptSHA256:rounds=2560 CryptSHA512:rounds=5122")])
 248
 249         sc = self.get_supplemental_creds()
 250
 251         # Check that we got all the expected supplemental credentials
 252         # And they are in the expected order.
 253         size = len(sc.sub.packages)
 254         self.assertEquals(6, size)
 255
 256         (pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
 257         self.assertEquals(1, pos)
 258         self.assertEquals("Primary:Kerberos-Newer-Keys", package.name)
 259
 260         (pos, package) = get_package(sc, "Primary:Kerberos")
 261         self.assertEquals(2, pos)
 262         self.assertEquals("Primary:Kerberos", package.name)
 263
 264         (pos, wp_package) = get_package(sc, "Primary:WDigest")
 265         self.assertEquals(3, pos)
 266         self.assertEquals("Primary:WDigest", wp_package.name)
 267
 268         (pos, up_package) = get_package(sc, "Primary:userPassword")
 269         self.assertEquals(4, pos)
 270         self.assertEquals("Primary:userPassword", up_package.name)
 271
 272         (pos, package) = get_package(sc, "Packages")
 273         self.assertEquals(5, pos)
 274         self.assertEquals("Packages", package.name)
 275
 276         (pos, package) = get_package(sc, "Primary:SambaGPG")
 277         self.assertEquals(6, pos)
 278         self.assertEquals("Primary:SambaGPG", package.name)
 279
 280         # Check that the WDigest values are correct.
 281         #
 282         digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
 283                              binascii.a2b_hex(wp_package.data))
 284         self.check_wdigests(digests)
 285
 286         # Check that the userPassword hashes are computed correctly
 287         # Expect three hashes to be calculated
 288         up = ndr_unpack(drsblobs.package_PrimaryUserPasswordBlob,
 289                         binascii.a2b_hex(up_package.data))
 290         self.checkUserPassword(up, [
 291             ("{CRYPT}", "6", 5120),
 292             ("{CRYPT}", "5", 2560),
 293             ("{CRYPT}", "6", 5122)
 294         ])
 295         self.checkNtHash(USER_PASS, up.current_nt_hash.hash)