OLD | NEW |
1 // Copyright 2017 The Chromium Authors. All rights reserved. | 1 // Copyright 2017 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Tests on exact results from cryptographic operations are based on test data | 5 // Tests on exact results from cryptographic operations are based on test data |
6 // provided in [MS-NLMP] Version 28.0 [1] Section 4.2. | 6 // provided in [MS-NLMP] Version 28.0 [1] Section 4.2. |
7 // | 7 // |
8 // Additional sanity checks on the low level hashing operations test for | 8 // Additional sanity checks on the low level hashing operations test for |
9 // properties of the outputs, such as whether the hashes change, whether they | 9 // properties of the outputs, such as whether the hashes change, whether they |
10 // should be zeroed out, or whether they should be the same or different. | 10 // should be zeroed out, or whether they should be the same or different. |
11 // | 11 // |
12 // [1] https://msdn.microsoft.com/en-us/library/cc236621.aspx | 12 // [1] https://msdn.microsoft.com/en-us/library/cc236621.aspx |
13 | 13 |
14 #include "net/ntlm/ntlm.h" | 14 #include "net/ntlm/ntlm.h" |
15 | 15 |
| 16 #include <string> |
| 17 |
| 18 #include "base/strings/string_util.h" |
16 #include "base/strings/utf_string_conversions.h" | 19 #include "base/strings/utf_string_conversions.h" |
| 20 #include "build/build_config.h" |
| 21 #include "net/ntlm/ntlm.h" |
| 22 #include "net/ntlm/ntlm_buffer_reader.h" |
| 23 #include "net/ntlm/ntlm_buffer_writer.h" |
17 #include "net/ntlm/ntlm_test_data.h" | 24 #include "net/ntlm/ntlm_test_data.h" |
18 #include "testing/gtest/include/gtest/gtest.h" | 25 #include "testing/platform_test.h" |
19 | 26 |
20 namespace net { | 27 namespace net { |
21 namespace ntlm { | 28 namespace ntlm { |
22 | 29 |
23 TEST(NtlmClientTest, GenerateNtlmHashV1PasswordSpecTests) { | 30 TEST(NtlmTest, GenerateNtlmHashV1PasswordSpecTests) { |
24 uint8_t hash[NTLM_HASH_LEN]; | 31 uint8_t hash[NTLM_HASH_LEN]; |
25 GenerateNtlmHashV1(NTLM_PASSWORD, hash); | 32 GenerateNtlmHashV1(NTLM_PASSWORD, hash); |
26 ASSERT_EQ(0, memcmp(hash, EXPECTED_V1_HASH, NTLM_HASH_LEN)); | 33 ASSERT_EQ(0, memcmp(hash, EXPECTED_V1_HASH, NTLM_HASH_LEN)); |
27 } | 34 } |
28 | 35 |
29 TEST(NtlmClientTest, GenerateNtlmHashV1PasswordChangesHash) { | 36 TEST(NtlmTest, GenerateNtlmHashV1PasswordChangesHash) { |
30 base::string16 password1 = base::UTF8ToUTF16("pwd01"); | 37 base::string16 password1 = base::UTF8ToUTF16("pwd01"); |
31 base::string16 password2 = base::UTF8ToUTF16("pwd02"); | 38 base::string16 password2 = base::UTF8ToUTF16("pwd02"); |
32 uint8_t hash1[NTLM_HASH_LEN]; | 39 uint8_t hash1[NTLM_HASH_LEN]; |
33 uint8_t hash2[NTLM_HASH_LEN]; | 40 uint8_t hash2[NTLM_HASH_LEN]; |
34 | 41 |
35 GenerateNtlmHashV1(password1, hash1); | 42 GenerateNtlmHashV1(password1, hash1); |
36 GenerateNtlmHashV1(password2, hash2); | 43 GenerateNtlmHashV1(password2, hash2); |
37 | 44 |
38 // Verify that the hash is different with a different password. | 45 // Verify that the hash is different with a different password. |
39 ASSERT_NE(0, memcmp(hash1, hash2, NTLM_HASH_LEN)); | 46 ASSERT_NE(0, memcmp(hash1, hash2, NTLM_HASH_LEN)); |
40 } | 47 } |
41 | 48 |
42 TEST(NtlmClientTest, GenerateResponsesV1SpecTests) { | 49 TEST(NtlmTest, GenerateResponsesV1SpecTests) { |
43 uint8_t lm_response[RESPONSE_V1_LEN]; | 50 uint8_t lm_response[RESPONSE_V1_LEN]; |
44 uint8_t ntlm_response[RESPONSE_V1_LEN]; | 51 uint8_t ntlm_response[RESPONSE_V1_LEN]; |
45 GenerateResponsesV1(NTLM_PASSWORD, SERVER_CHALLENGE, lm_response, | 52 GenerateResponsesV1(NTLM_PASSWORD, SERVER_CHALLENGE, lm_response, |
46 ntlm_response); | 53 ntlm_response); |
47 | 54 |
48 ASSERT_EQ(0, | 55 ASSERT_EQ(0, |
49 memcmp(EXPECTED_V1_NTLM_RESPONSE, ntlm_response, RESPONSE_V1_LEN)); | 56 memcmp(EXPECTED_V1_NTLM_RESPONSE, ntlm_response, RESPONSE_V1_LEN)); |
50 | 57 |
51 // This implementation never sends an LMv1 response (spec equivalent of the | 58 // This implementation never sends an LMv1 response (spec equivalent of the |
52 // client variable NoLMResponseNTLMv1 being false) so the LM response is | 59 // client variable NoLMResponseNTLMv1 being false) so the LM response is |
53 // equal to the NTLM response when | 60 // equal to the NTLM response when |
54 // NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY is not negotiated. See | 61 // NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY is not negotiated. See |
55 // [MS-NLMP] Section 3.3.1. | 62 // [MS-NLMP] Section 3.3.1. |
56 ASSERT_EQ(0, memcmp(EXPECTED_V1_NTLM_RESPONSE, lm_response, RESPONSE_V1_LEN)); | 63 ASSERT_EQ(0, memcmp(EXPECTED_V1_NTLM_RESPONSE, lm_response, RESPONSE_V1_LEN)); |
57 } | 64 } |
58 | 65 |
59 TEST(NtlmClientTest, GenerateResponsesV1WithSSSpecTests) { | 66 TEST(NtlmTest, GenerateResponsesV1WithSSSpecTests) { |
60 uint8_t lm_response[RESPONSE_V1_LEN]; | 67 uint8_t lm_response[RESPONSE_V1_LEN]; |
61 uint8_t ntlm_response[RESPONSE_V1_LEN]; | 68 uint8_t ntlm_response[RESPONSE_V1_LEN]; |
62 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, CLIENT_CHALLENGE, | 69 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, CLIENT_CHALLENGE, |
63 lm_response, ntlm_response); | 70 lm_response, ntlm_response); |
64 | 71 |
65 ASSERT_EQ( | 72 ASSERT_EQ( |
66 0, memcmp(EXPECTED_V1_WITH_SS_LM_RESPONSE, lm_response, RESPONSE_V1_LEN)); | 73 0, memcmp(EXPECTED_V1_WITH_SS_LM_RESPONSE, lm_response, RESPONSE_V1_LEN)); |
67 ASSERT_EQ(0, memcmp(EXPECTED_V1_WITH_SS_NTLM_RESPONSE, ntlm_response, | 74 ASSERT_EQ(0, memcmp(EXPECTED_V1_WITH_SS_NTLM_RESPONSE, ntlm_response, |
68 RESPONSE_V1_LEN)); | 75 RESPONSE_V1_LEN)); |
69 } | 76 } |
70 | 77 |
71 TEST(NtlmClientTest, GenerateResponsesV1WithSSClientChallengeUsed) { | 78 TEST(NtlmTest, GenerateResponsesV1WithSSClientChallengeUsed) { |
72 uint8_t lm_response1[RESPONSE_V1_LEN]; | 79 uint8_t lm_response1[RESPONSE_V1_LEN]; |
73 uint8_t lm_response2[RESPONSE_V1_LEN]; | 80 uint8_t lm_response2[RESPONSE_V1_LEN]; |
74 uint8_t ntlm_response1[RESPONSE_V1_LEN]; | 81 uint8_t ntlm_response1[RESPONSE_V1_LEN]; |
75 uint8_t ntlm_response2[RESPONSE_V1_LEN]; | 82 uint8_t ntlm_response2[RESPONSE_V1_LEN]; |
76 uint8_t client_challenge1[CHALLENGE_LEN]; | 83 uint8_t client_challenge1[CHALLENGE_LEN]; |
77 uint8_t client_challenge2[CHALLENGE_LEN]; | 84 uint8_t client_challenge2[CHALLENGE_LEN]; |
78 | 85 |
79 memset(client_challenge1, 0x01, CHALLENGE_LEN); | 86 memset(client_challenge1, 0x01, CHALLENGE_LEN); |
80 memset(client_challenge2, 0x02, CHALLENGE_LEN); | 87 memset(client_challenge2, 0x02, CHALLENGE_LEN); |
81 | 88 |
82 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, client_challenge1, | 89 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, client_challenge1, |
83 lm_response1, ntlm_response1); | 90 lm_response1, ntlm_response1); |
84 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, client_challenge2, | 91 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, client_challenge2, |
85 lm_response2, ntlm_response2); | 92 lm_response2, ntlm_response2); |
86 | 93 |
87 // The point of session security is that the client can introduce some | 94 // The point of session security is that the client can introduce some |
88 // randomness, so verify different client_challenge gives a different result. | 95 // randomness, so verify different client_challenge gives a different result. |
89 ASSERT_NE(0, memcmp(lm_response1, lm_response2, RESPONSE_V1_LEN)); | 96 ASSERT_NE(0, memcmp(lm_response1, lm_response2, RESPONSE_V1_LEN)); |
90 ASSERT_NE(0, memcmp(ntlm_response1, ntlm_response2, RESPONSE_V1_LEN)); | 97 ASSERT_NE(0, memcmp(ntlm_response1, ntlm_response2, RESPONSE_V1_LEN)); |
91 | 98 |
92 // With session security the lm and ntlm hash should be different. | 99 // With session security the lm and ntlm hash should be different. |
93 ASSERT_NE(0, memcmp(lm_response1, ntlm_response1, RESPONSE_V1_LEN)); | 100 ASSERT_NE(0, memcmp(lm_response1, ntlm_response1, RESPONSE_V1_LEN)); |
94 ASSERT_NE(0, memcmp(lm_response2, ntlm_response2, RESPONSE_V1_LEN)); | 101 ASSERT_NE(0, memcmp(lm_response2, ntlm_response2, RESPONSE_V1_LEN)); |
95 } | 102 } |
96 | 103 |
97 TEST(NtlmClientTest, GenerateResponsesV1WithSSVerifySSUsed) { | 104 TEST(NtlmTest, GenerateResponsesV1WithSSVerifySSUsed) { |
98 uint8_t lm_response1[RESPONSE_V1_LEN]; | 105 uint8_t lm_response1[RESPONSE_V1_LEN]; |
99 uint8_t lm_response2[RESPONSE_V1_LEN]; | 106 uint8_t lm_response2[RESPONSE_V1_LEN]; |
100 uint8_t ntlm_response1[RESPONSE_V1_LEN]; | 107 uint8_t ntlm_response1[RESPONSE_V1_LEN]; |
101 uint8_t ntlm_response2[RESPONSE_V1_LEN]; | 108 uint8_t ntlm_response2[RESPONSE_V1_LEN]; |
102 | 109 |
103 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, CLIENT_CHALLENGE, | 110 GenerateResponsesV1WithSS(NTLM_PASSWORD, SERVER_CHALLENGE, CLIENT_CHALLENGE, |
104 lm_response1, ntlm_response1); | 111 lm_response1, ntlm_response1); |
105 GenerateResponsesV1(NTLM_PASSWORD, SERVER_CHALLENGE, lm_response2, | 112 GenerateResponsesV1(NTLM_PASSWORD, SERVER_CHALLENGE, lm_response2, |
106 ntlm_response2); | 113 ntlm_response2); |
107 | 114 |
108 // Verify that the responses with session security are not the | 115 // Verify that the responses with session security are not the |
109 // same as without it. | 116 // same as without it. |
110 ASSERT_NE(0, memcmp(lm_response1, lm_response2, RESPONSE_V1_LEN)); | 117 ASSERT_NE(0, memcmp(lm_response1, lm_response2, RESPONSE_V1_LEN)); |
111 ASSERT_NE(0, memcmp(ntlm_response1, ntlm_response2, RESPONSE_V1_LEN)); | 118 ASSERT_NE(0, memcmp(ntlm_response1, ntlm_response2, RESPONSE_V1_LEN)); |
112 } | 119 } |
113 | 120 |
114 } // namespace ntlm | 121 } // namespace ntlm |
115 } // namespace net | 122 } // namespace net |
OLD | NEW |