From: Piotr Caban piotr@codeweavers.com
--- dlls/secur32/tests/ntlm.c | 128 +++++++++++++++++++++++++++----------- 1 file changed, 93 insertions(+), 35 deletions(-)
diff --git a/dlls/secur32/tests/ntlm.c b/dlls/secur32/tests/ntlm.c index 72872b5f9e4..ac84ebc8ebd 100644 --- a/dlls/secur32/tests/ntlm.c +++ b/dlls/secur32/tests/ntlm.c @@ -69,39 +69,97 @@ typedef struct _SspiData { ULONG max_token, req_attr; } SspiData;
-static BYTE network_challenge[] = - {0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x02, 0x00, - 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x30, 0x00, 0x00, 0x00, - 0x05, 0x82, 0x82, 0xa0, 0xe9, 0x58, 0x7f, 0x14, 0xa2, 0x86, - 0x3b, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x54, 0x00, 0x54, 0x00, 0x40, 0x00, 0x00, 0x00, 0x43, 0x00, - 0x41, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x4f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x02, 0x00, 0x10, 0x00, 0x43, 0x00, - 0x41, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x4f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x01, 0x00, 0x10, 0x00, 0x43, 0x00, - 0x41, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x4f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x04, 0x00, 0x10, 0x00, 0x63, 0x00, - 0x61, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x6f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x03, 0x00, 0x10, 0x00, 0x63, 0x00, - 0x61, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x6f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00}; - -static BYTE native_challenge[] = - {0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x02, 0x00, - 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x30, 0x00, 0x00, 0x00, - 0x05, 0x82, 0x82, 0xa0, 0xb5, 0x60, 0x8e, 0x95, 0xb5, 0x3c, - 0xee, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x54, 0x00, 0x54, 0x00, 0x40, 0x00, 0x00, 0x00, 0x43, 0x00, - 0x41, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x4f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x02, 0x00, 0x10, 0x00, 0x43, 0x00, - 0x41, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x4f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x01, 0x00, 0x10, 0x00, 0x43, 0x00, - 0x41, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x4f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x04, 0x00, 0x10, 0x00, 0x63, 0x00, - 0x61, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x6f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x03, 0x00, 0x10, 0x00, 0x63, 0x00, - 0x61, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x6f, 0x00, - 0x30, 0x00, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00}; +enum negotiate_flags +{ + NTLMSSP_NEGOTIATE_UNICODE = 0x00000001, + NTLM_NEGOTIATE_OEM = 0x00000002, + NTLMSSP_REQUEST_TARGET = 0x00000004, + NTLMSSP_NEGOTIATE_SIGN = 0x00000010, + NTLMSSP_NEGOTIATE_SEAL = 0x00000020, + NTLMSSP_NEGOTIATE_DATAGRAM = 0x00000040, + NTLMSSP_NEGOTIATE_LM_KEY = 0x00000080, + NTLMSSP_NEGOTIATE_NETWARE = 0x00000100, + NTLMSSP_NEGOTIATE_NTLM = 0x00000200, + NTLMSSP_NEGOTIATE_ANONYMOUS = 0x00000800, + NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED = 0x00001000, + NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED = 0x00002000, + NTLMSSP_NEGOTIATE_LOCAL_CALL = 0x00004000, + NTLMSSP_NEGOTIATE_ALWAYS_SIGN = 0x00008000, + NTLMSSP_TARGET_TYPE_DOMAIN = 0x00010000, + NTLMSSP_TARGET_TYPE_SERVER = 0x00020000, + NTLMSSP_TARGET_TYPE_SHARE = 0x00040000, + NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY = 0x00080000, + NTLMSSP_NEGOTIATE_IDENTIFY = 0x00100000, + NTLMSSP_REQUEST_NON_NT_SESSION_KEY = 0x00400000, + NTLMSSP_NEGOTIATE_TARGET_INFO = 0x00800000, + NTLMSSP_NEGOTIATE_VERSION = 0x02000000, + NTLMSSP_NEGOTIATE_128 = 0x20000000, + NTLMSSP_NEGOTIATE_KEY_EXCH = 0x40000000, + NTLMSSP_NEGOTIATE_56 = 0x80000000, +}; + +struct ntlm_server_challenge +{ + char signature[8]; + int message_type; + unsigned short target_name_len; + unsigned short target_name_max_len; + unsigned int target_name_off; + enum negotiate_flags negotiate_flags; + BYTE challenge[8]; + BYTE reserved[8]; + unsigned short target_info_len; + unsigned short target_info_max_len; + unsigned int target_info_off; +}; + +struct network_challenge +{ + struct ntlm_server_challenge challenge; + WCHAR name[8]; + WCHAR info[42]; + +} network_challenge = +{ + { + "NTLMSSP", 2, + sizeof(network_challenge.name), sizeof(network_challenge.name), + offsetof(struct network_challenge, name), + NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM | + NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_TARGET_TYPE_SERVER | + NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_56, + { 0xe9, 0x58, 0x7f, 0x14, 0xa2, 0x86, 0x3b, 0x63 }, + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, + sizeof(network_challenge.info), sizeof(network_challenge.info), + offsetof(struct network_challenge, info) + }, + L"CASINO01", + L"\002\020CASINO01\001\020CASINO01\004\020casino01\003\020casino01\0" +}; + +struct native_challenge +{ + struct ntlm_server_challenge challenge; + WCHAR name[8]; + WCHAR info[42]; + +} native_challenge = +{ + { + "NTLMSSP", 2, + sizeof(native_challenge.name), sizeof(native_challenge.name), + offsetof(struct native_challenge, name), + NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM | + NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_TARGET_TYPE_SERVER | + NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_56, + { 0xb5, 0x60, 0x8e, 0x95, 0xb5, 0x3c, 0xee, 0x03 }, + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, + sizeof(native_challenge.info), sizeof(native_challenge.info), + offsetof(struct native_challenge, info) + }, + L"CASINO01", + L"\002\020CASINO01\001\020CASINO01\004\020casino01\003\020casino01\0" +};
static BYTE message_signature[] = {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, @@ -467,13 +525,13 @@ static SECURITY_STATUS runFakeServer(SspiData *sspi_data, BOOL first, ULONG data if(data_rep == SECURITY_NATIVE_DREP) { sspi_data->out_buf->pBuffers[0].cbBuffer = sizeof(native_challenge); - memcpy(sspi_data->out_buf->pBuffers[0].pvBuffer, native_challenge, + memcpy(sspi_data->out_buf->pBuffers[0].pvBuffer, &native_challenge, sspi_data->out_buf->pBuffers[0].cbBuffer); } else { sspi_data->out_buf->pBuffers[0].cbBuffer = sizeof(network_challenge); - memcpy(sspi_data->out_buf->pBuffers[0].pvBuffer, network_challenge, + memcpy(sspi_data->out_buf->pBuffers[0].pvBuffer, &network_challenge, sspi_data->out_buf->pBuffers[0].cbBuffer); }