Line data Source code
1 : /*
2 : * Unix SMB/CIFS implementation.
3 : *
4 : * Copyright (C) Catalyst.Net Ltd 2024
5 : *
6 : * This program is free software: you can redistribute it and/or modify
7 : * it under the terms of the GNU General Public License as published by
8 : * the Free Software Foundation, either version 3 of the License, or
9 : * (at your option) any later version.
10 : *
11 : * This program is distributed in the hope that it will be useful,
12 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : * GNU General Public License for more details.
15 : *
16 : * You should have received a copy of the GNU General Public License
17 : * along with this program. If not, see <https://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include <stdarg.h>
21 : #include <stddef.h>
22 : #include <stdint.h>
23 : #include <setjmp.h>
24 : #include <cmocka.h>
25 :
26 : #include "replace.h"
27 : #include <talloc.h>
28 : #include "libcli/util/ntstatus.h"
29 : #include "lib/crypto/gkdi.h"
30 : #include "lib/crypto/gmsa.h"
31 :
32 : #include "librpc/ndr/libndr.h"
33 : #include "librpc/gen_ndr/gmsa.h"
34 : #include "librpc/gen_ndr/ndr_gmsa.h"
35 : #include "lib/util/time.h"
36 : #include "libcli/security/dom_sid.h"
37 :
38 1 : static void test_password_based_on_key_id(void **state)
39 : {
40 1 : static const uint8_t root_key_data[] = {
41 : 152, 203, 215, 84, 113, 216, 118, 177, 81, 128, 50, 160, 148,
42 : 132, 82, 244, 65, 179, 164, 219, 209, 14, 33, 131, 178, 193,
43 : 80, 248, 126, 23, 66, 227, 45, 221, 171, 12, 247, 15, 62,
44 : 179, 164, 217, 123, 179, 106, 118, 228, 74, 12, 2, 241, 229,
45 : 139, 55, 237, 155, 220, 122, 200, 245, 129, 222, 37, 15};
46 1 : static const struct ProvRootKey root_key = {
47 : .version = root_key_version_1,
48 : .id = {.time_low = 0x170e972,
49 : .time_mid = 0xa035,
50 : .time_hi_and_version = 0xaf4c,
51 : .clock_seq = {0x99, 0x3b},
52 : .node = {0xe0, 0x52, 0xd5, 0xbd, 0x12, 0x16}},
53 : .data =
54 : {
55 : .data = discard_const_p(uint8_t, root_key_data),
56 : .length = sizeof root_key_data,
57 : },
58 : .create_time = 0,
59 : .use_start_time = 0,
60 : .domain_id = "example.com",
61 : .kdf_algorithm = {
62 : .id = KDF_ALGORITHM_SP800_108_CTR_HMAC,
63 : .param.sp800_108 = KDF_PARAM_SHA512,
64 : }};
65 1 : static const uint8_t expected[GMSA_PASSWORD_LEN] = {
66 : 114, 92, 31, 204, 138, 249, 1, 76, 192, 65, 52, 248, 247,
67 : 191, 30, 213, 25, 38, 81, 21, 183, 167, 154, 102, 190, 234,
68 : 234, 116, 114, 18, 141, 208, 143, 38, 178, 115, 195, 26, 199,
69 : 214, 176, 229, 128, 160, 147, 249, 245, 67, 165, 191, 192, 78,
70 : 224, 50, 115, 8, 207, 124, 178, 121, 67, 135, 125, 113, 79,
71 : 0, 131, 43, 74, 48, 171, 239, 183, 228, 50, 212, 202, 215,
72 : 188, 182, 94, 127, 117, 217, 91, 17, 90, 80, 158, 176, 204,
73 : 151, 244, 107, 139, 65, 94, 148, 216, 212, 97, 53, 54, 253,
74 : 6, 201, 94, 93, 250, 213, 12, 82, 162, 246, 197, 254, 205,
75 : 8, 19, 153, 66, 72, 60, 167, 28, 65, 39, 218, 147, 82,
76 : 162, 11, 177, 78, 231, 200, 66, 121, 9, 196, 240, 7, 148,
77 : 190, 151, 96, 214, 246, 7, 110, 85, 0, 246, 28, 121, 3,
78 : 61, 212, 204, 101, 153, 121, 100, 91, 65, 28, 225, 241, 123,
79 : 115, 105, 138, 74, 187, 74, 188, 59, 17, 201, 229, 158, 170,
80 : 184, 141, 237, 179, 246, 135, 104, 204, 56, 228, 156, 182, 26,
81 : 90, 151, 147, 25, 142, 47, 172, 183, 165, 222, 240, 95, 63,
82 : 79, 88, 35, 205, 76, 26, 229, 107, 46, 16, 202, 102, 196,
83 : 18, 140, 211, 242, 226, 198, 154, 97, 199, 44, 220, 186, 76,
84 : 215, 54, 196, 44, 140, 145, 252, 99, 229, 179, 74, 150, 154,
85 : 70, 226, 45, 122, 156, 156, 75, 83, 24};
86 1 : uint8_t out[GMSA_PASSWORD_NULL_TERMINATED_LEN];
87 1 : TALLOC_CTX *mem_ctx = NULL;
88 :
89 1 : mem_ctx = talloc_new(NULL);
90 1 : assert_non_null(mem_ctx);
91 :
92 : {
93 : /* An arbitrary GKID. */
94 1 : const struct Gkid gkid = {362, 0, 23};
95 : /* An arbitrary time in the past. */
96 1 : const NTTIME current_nt_time = 133524411756072082;
97 1 : struct dom_sid account_sid;
98 1 : NTSTATUS status;
99 1 : bool ok;
100 :
101 1 : ok = dom_sid_parse(
102 : "S-1-5-21-4119591868-3001629103-3445594911-48026",
103 : &account_sid);
104 1 : assert_true(ok);
105 :
106 : /* Derive a password from the root key. */
107 1 : status = gmsa_password_based_on_key_id(mem_ctx,
108 : gkid,
109 : current_nt_time,
110 : &root_key,
111 : &account_sid,
112 : out);
113 1 : assert_true(NT_STATUS_IS_OK(status));
114 1 : assert_memory_equal(expected, out, GMSA_PASSWORD_LEN);
115 : }
116 :
117 : {
118 1 : uint64_t query_interval = 0;
119 1 : uint64_t unchanged_interval = 0;
120 1 : const struct MANAGEDPASSWORD_BLOB managed_pwd = {
121 : .passwords = {
122 : .current = out,
123 : .query_interval = &query_interval,
124 : .unchanged_interval = &unchanged_interval}};
125 1 : DATA_BLOB packed_blob = {};
126 1 : enum ndr_err_code err;
127 :
128 1 : err = ndr_push_struct_blob(
129 : &packed_blob,
130 : mem_ctx,
131 : &managed_pwd,
132 : (ndr_push_flags_fn_t)ndr_push_MANAGEDPASSWORD_BLOB);
133 1 : assert_int_equal(NDR_ERR_SUCCESS, err);
134 : }
135 :
136 1 : talloc_free(mem_ctx);
137 1 : }
138 :
139 1 : int main(int argc, char *argv[])
140 : {
141 1 : const struct CMUnitTest tests[] = {
142 : cmocka_unit_test(test_password_based_on_key_id),
143 : };
144 :
145 1 : if (argc == 2) {
146 0 : cmocka_set_test_filter(argv[1]);
147 : }
148 1 : cmocka_set_message_output(CM_OUTPUT_SUBUNIT);
149 1 : return cmocka_run_group_tests(tests, NULL, NULL);
150 : }
|
