def __init__(self, negotiate_flags, exported_session_key, source="client"):
"""
Initialises a security session context that can be used by libraries
that call ntlm-auth to sign and seal messages send to the server as
well as verify and unseal messages that have been received from the
server. This is similar to the GSS_Wrap functions specified in the
MS-NLMP document which does the same task.
:param negotiate_flags: The negotiate flag structure that has been
negotiated with the server
:param exported_session_key: A 128-bit session key used to derive
signing and sealing keys
:param source: The source of the message, only used in test scenarios
when testing out a server sealing and unsealing
"""
self.negotiate_flags = negotiate_flags
self.exported_session_key = exported_session_key
self.outgoing_seq_num = 0
self.incoming_seq_num = 0
client_sealing_key = \
compkeys.get_seal_key(self.negotiate_flags, exported_session_key,
SignSealConstants.CLIENT_SEALING)
server_sealing_key = \
compkeys.get_seal_key(self.negotiate_flags, exported_session_key,
SignSealConstants.SERVER_SEALING)
if source == "client":
self.outgoing_signing_key = \
compkeys.get_sign_key(exported_session_key,
SignSealConstants.CLIENT_SIGNING)
self.incoming_signing_key = \
compkeys.get_sign_key(exported_session_key,
SignSealConstants.SERVER_SIGNING)
self.outgoing_handle = ARC4(client_sealing_key)
self.incoming_handle = ARC4(server_sealing_key)
elif source == "server":
self.outgoing_signing_key = \
compkeys.get_sign_key(exported_session_key,
SignSealConstants.SERVER_SIGNING)
self.incoming_signing_key = \
compkeys.get_sign_key(exported_session_key,
SignSealConstants.CLIENT_SIGNING)
self.outgoing_handle = ARC4(server_sealing_key)
self.incoming_handle = ARC4(client_sealing_key)
else:
raise ValueError("Invalid source parameter %s, must be client "
"or server" % source)
def test_get_sign_key(self):
# No need to test multiple version as signing is only available in one instance, when ess is used
expected = ntlmv2_sign_key
actual = compkeys.get_sign_key(session_base_key,
SignSealConstants.CLIENT_SIGNING)
assert actual == expected
def test_get_sign_key(self):
# No need to test multiple version as signing is only available in one
# scenario, when ess is used
expected = b"\x47\x88\xdc\x86\x1b\x47\x82\xf3" \
b"\x5d\x43\xfd\x98\xfe\x1a\x2d\x39"
session_base_key = b"\x55" * 16
actual = compute_keys.get_sign_key(session_base_key,
SignSealConstants.CLIENT_SIGNING)
assert actual == expected
def __init__(self, negotiate_flags, exported_session_key, source="client"):
self.negotiate_flags = negotiate_flags
self.outgoing_seq_num = 0
self.incoming_seq_num = 0
client_sealing_key = compkeys.get_seal_key(self.negotiate_flags, exported_session_key, SignSealConstants.CLIENT_SEALING)
server_sealing_key = compkeys.get_seal_key(self.negotiate_flags, exported_session_key, SignSealConstants.SERVER_SEALING)
if source == "client":
self.outgoing_signing_key = compkeys.get_sign_key(exported_session_key, SignSealConstants.CLIENT_SIGNING)
self.incoming_signing_key = compkeys.get_sign_key(exported_session_key, SignSealConstants.SERVER_SIGNING)
self.outgoing_handle = ARC4(client_sealing_key)
self.incoming_handle = ARC4(server_sealing_key)
elif source == "server":
self.outgoing_signing_key = compkeys.get_sign_key(exported_session_key, SignSealConstants.SERVER_SIGNING)
self.incoming_signing_key = compkeys.get_sign_key(exported_session_key, SignSealConstants.CLIENT_SIGNING)
self.outgoing_handle = ARC4(server_sealing_key)
self.incoming_handle = ARC4(client_sealing_key)
else:
raise Exception("Invalid source parameter %s, must be client or server" % source)