source: heimdal/trunk/kdc/digest-service.c

Last change on this file was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 7.2 KB
Line 
1/*
2 * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36#define HC_DEPRECATED_CRYPTO
37
38#include "headers.h"
39#include <digest_asn1.h>
40#include <heimntlm.h>
41#include <heim-ipc.h>
42#include <getarg.h>
43
44typedef struct pk_client_params pk_client_params;
45struct DigestREQ;
46struct Kx509Request;
47#include <kdc-private.h>
48
49krb5_kdc_configuration *config;
50
51static void
52ntlm_service(void *ctx, const heim_idata *req,
53 const heim_icred cred,
54 heim_ipc_complete complete,
55 heim_sipc_call cctx)
56{
57 NTLMRequest2 ntq;
58 unsigned char sessionkey[16];
59 heim_idata rep = { 0, NULL };
60 krb5_context context = ctx;
61 hdb_entry_ex *user = NULL;
62 Key *key = NULL;
63 NTLMReply ntp;
64 size_t size;
65 int ret;
66 const char *domain;
67
68 kdc_log(context, config, 1, "digest-request: uid=%d",
69 (int)heim_ipc_cred_get_uid(cred));
70
71 if (heim_ipc_cred_get_uid(cred) != 0) {
72 (*complete)(cctx, EPERM, NULL);
73 return;
74 }
75
76 ntp.success = 0;
77 ntp.flags = 0;
78 ntp.sessionkey = NULL;
79
80 ret = decode_NTLMRequest2(req->data, req->length, &ntq, NULL);
81 if (ret)
82 goto failed;
83
84 /* XXX forward to NetrLogonSamLogonEx() if not a local domain */
85 if (strcmp(ntq.loginDomainName, "BUILTIN") == 0) {
86 domain = ntq.loginDomainName;
87 } else if (strcmp(ntq.loginDomainName, "") == 0) {
88 domain = "BUILTIN";
89 } else {
90 ret = EINVAL;
91 goto failed;
92 }
93
94 kdc_log(context, config, 1, "digest-request: user=%s/%s",
95 ntq.loginUserName, domain);
96
97 if (ntq.lmchallenge.length != 8)
98 goto failed;
99
100 if (ntq.ntChallengeResponce.length == 0)
101 goto failed;
102
103 {
104 krb5_principal client;
105
106 ret = krb5_make_principal(context, &client, domain,
107 ntq.loginUserName, NULL);
108 if (ret)
109 goto failed;
110
111 krb5_principal_set_type(context, client, KRB5_NT_NTLM);
112
113 ret = _kdc_db_fetch(context, config, client,
114 HDB_F_GET_CLIENT, NULL, NULL, &user);
115 krb5_free_principal(context, client);
116 if (ret)
117 goto failed;
118
119 ret = hdb_enctype2key(context, &user->entry,
120 ETYPE_ARCFOUR_HMAC_MD5, &key);
121 if (ret) {
122 krb5_set_error_message(context, ret, "NTLM missing arcfour key");
123 goto failed;
124 }
125 }
126
127 kdc_log(context, config, 2,
128 "digest-request: found user, processing ntlm request", ret);
129
130 if (ntq.ntChallengeResponce.length != 24) {
131 struct ntlm_buf infotarget, answer;
132
133 answer.length = ntq.ntChallengeResponce.length;
134 answer.data = ntq.ntChallengeResponce.data;
135
136 ret = heim_ntlm_verify_ntlm2(key->key.keyvalue.data,
137 key->key.keyvalue.length,
138 ntq.loginUserName,
139 ntq.loginDomainName,
140 0,
141 ntq.lmchallenge.data,
142 &answer,
143 &infotarget,
144 sessionkey);
145 if (ret) {
146 goto failed;
147 }
148
149 free(infotarget.data);
150 /* XXX verify info target */
151
152 } else {
153 struct ntlm_buf answer;
154
155 if (ntq.flags & NTLM_NEG_NTLM2_SESSION) {
156 unsigned char sessionhash[MD5_DIGEST_LENGTH];
157 EVP_MD_CTX *md5ctx;
158
159 /* the first first 8 bytes is the challenge, what is the other 16 bytes ? */
160 if (ntq.lmChallengeResponce.length != 24)
161 goto failed;
162
163 md5ctx = EVP_MD_CTX_create();
164 EVP_DigestInit_ex(md5ctx, EVP_md5(), NULL);
165 EVP_DigestUpdate(md5ctx, ntq.lmchallenge.data, 8);
166 EVP_DigestUpdate(md5ctx, ntq.lmChallengeResponce.data, 8);
167 EVP_DigestFinal_ex(md5ctx, sessionhash, NULL);
168 EVP_MD_CTX_destroy(md5ctx);
169 memcpy(ntq.lmchallenge.data, sessionhash, ntq.lmchallenge.length);
170 }
171
172 ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
173 key->key.keyvalue.length,
174 ntq.lmchallenge.data, &answer);
175 if (ret)
176 goto failed;
177
178 if (ntq.ntChallengeResponce.length != answer.length ||
179 memcmp(ntq.ntChallengeResponce.data, answer.data, answer.length) != 0) {
180 free(answer.data);
181 ret = EINVAL;
182 goto failed;
183 }
184 free(answer.data);
185
186 {
187 EVP_MD_CTX *ctxp;
188
189 ctxp = EVP_MD_CTX_create();
190 EVP_DigestInit_ex(ctxp, EVP_md4(), NULL);
191 EVP_DigestUpdate(ctxp, key->key.keyvalue.data, key->key.keyvalue.length);
192 EVP_DigestFinal_ex(ctxp, sessionkey, NULL);
193 EVP_MD_CTX_destroy(ctxp);
194 }
195 }
196
197 ntp.success = 1;
198
199 ASN1_MALLOC_ENCODE(NTLMReply, rep.data, rep.length, &ntp, &size, ret);
200 if (ret)
201 goto failed;
202 if (rep.length != size)
203 abort();
204
205 failed:
206 kdc_log(context, config, 1, "digest-request: %d", ret);
207
208 (*complete)(cctx, ret, &rep);
209
210 free(rep.data);
211
212 free_NTLMRequest2(&ntq);
213 if (user)
214 _kdc_free_ent (context, user);
215}
216
217static int help_flag;
218static int version_flag;
219
220static struct getargs args[] = {
221 { "help", 'h', arg_flag, &help_flag, NULL, NULL },
222 { "version", 'v', arg_flag, &version_flag, NULL, NULL }
223};
224
225static int num_args = sizeof(args) / sizeof(args[0]);
226
227static void
228usage(int ret)
229{
230 arg_printusage (args, num_args, NULL, "");
231 exit (ret);
232}
233
234int
235main(int argc, char **argv)
236{
237 krb5_context context;
238 int ret, optidx = 0;
239
240 setprogname(argv[0]);
241
242 if (getarg(args, num_args, argc, argv, &optidx))
243 usage(1);
244
245 if (help_flag)
246 usage(0);
247
248 if (version_flag) {
249 print_version(NULL);
250 exit(0);
251 }
252
253 ret = krb5_init_context(&context);
254 if (ret)
255 krb5_errx(context, 1, "krb5_init_context");
256
257 ret = krb5_kdc_get_config(context, &config);
258 if (ret)
259 krb5_err(context, 1, ret, "krb5_kdc_default_config");
260
261 kdc_openlog(context, "digest-service", config);
262
263 ret = krb5_kdc_set_dbinfo(context, config);
264 if (ret)
265 krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo");
266
267#if __APPLE__
268 {
269 heim_sipc mach;
270 heim_sipc_launchd_mach_init("org.h5l.ntlm-service",
271 ntlm_service, context, &mach);
272 heim_sipc_timeout(60);
273 }
274#endif
275 {
276 heim_sipc un;
277 heim_sipc_service_unix("org.h5l.ntlm-service", ntlm_service, NULL, &un);
278 }
279
280 heim_ipc_main();
281 return 0;
282}
Note: See TracBrowser for help on using the repository browser.