2 * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #define HC_DEPRECATED_CRYPTO
39 #include <digest_asn1.h>
44 typedef struct pk_client_params pk_client_params
;
47 typedef struct kdc_request_desc
*kdc_request_t
;
49 #include <kdc-private.h>
51 krb5_kdc_configuration
*config
;
54 ntlm_service(void *ctx
, const heim_idata
*req
,
55 const heim_icred cred
,
56 heim_ipc_complete complete
,
60 unsigned char sessionkey
[16];
61 heim_idata rep
= { 0, NULL
};
62 krb5_context context
= ctx
;
63 hdb_entry_ex
*user
= NULL
;
70 kdc_log(context
, config
, 1, "digest-request: uid=%d",
71 (int)heim_ipc_cred_get_uid(cred
));
73 if (heim_ipc_cred_get_uid(cred
) != 0) {
74 (*complete
)(cctx
, EPERM
, NULL
);
80 ntp
.sessionkey
= NULL
;
82 ret
= decode_NTLMRequest2(req
->data
, req
->length
, &ntq
, NULL
);
86 /* XXX forward to NetrLogonSamLogonEx() if not a local domain */
87 if (strcmp(ntq
.loginDomainName
, "BUILTIN") == 0) {
88 domain
= ntq
.loginDomainName
;
89 } else if (strcmp(ntq
.loginDomainName
, "") == 0) {
96 kdc_log(context
, config
, 1, "digest-request: user=%s/%s",
97 ntq
.loginUserName
, domain
);
99 if (ntq
.lmchallenge
.length
!= 8)
102 if (ntq
.ntChallengeResponce
.length
== 0)
106 krb5_principal client
;
108 ret
= krb5_make_principal(context
, &client
, domain
,
109 ntq
.loginUserName
, NULL
);
113 krb5_principal_set_type(context
, client
, KRB5_NT_NTLM
);
115 ret
= _kdc_db_fetch(context
, config
, client
,
116 HDB_F_GET_CLIENT
, NULL
, NULL
, &user
);
117 krb5_free_principal(context
, client
);
121 ret
= hdb_enctype2key(context
, &user
->entry
,
122 ETYPE_ARCFOUR_HMAC_MD5
, &key
);
124 krb5_set_error_message(context
, ret
, "NTLM missing arcfour key");
129 kdc_log(context
, config
, 2,
130 "digest-request: found user, processing ntlm request", ret
);
132 if (ntq
.ntChallengeResponce
.length
!= 24) {
133 struct ntlm_buf infotarget
, answer
;
135 answer
.length
= ntq
.ntChallengeResponce
.length
;
136 answer
.data
= ntq
.ntChallengeResponce
.data
;
138 ret
= heim_ntlm_verify_ntlm2(key
->key
.keyvalue
.data
,
139 key
->key
.keyvalue
.length
,
143 ntq
.lmchallenge
.data
,
151 free(infotarget
.data
);
152 /* XXX verify info target */
155 struct ntlm_buf answer
;
157 if (ntq
.flags
& NTLM_NEG_NTLM2_SESSION
) {
158 unsigned char sessionhash
[MD5_DIGEST_LENGTH
];
161 /* the first first 8 bytes is the challenge, what is the other 16 bytes ? */
162 if (ntq
.lmChallengeResponce
.length
!= 24)
165 md5ctx
= EVP_MD_CTX_create();
166 EVP_DigestInit_ex(md5ctx
, EVP_md5(), NULL
);
167 EVP_DigestUpdate(md5ctx
, ntq
.lmchallenge
.data
, 8);
168 EVP_DigestUpdate(md5ctx
, ntq
.lmChallengeResponce
.data
, 8);
169 EVP_DigestFinal_ex(md5ctx
, sessionhash
, NULL
);
170 EVP_MD_CTX_destroy(md5ctx
);
171 memcpy(ntq
.lmchallenge
.data
, sessionhash
, ntq
.lmchallenge
.length
);
174 ret
= heim_ntlm_calculate_ntlm1(key
->key
.keyvalue
.data
,
175 key
->key
.keyvalue
.length
,
176 ntq
.lmchallenge
.data
, &answer
);
180 if (ntq
.ntChallengeResponce
.length
!= answer
.length
||
181 memcmp(ntq
.ntChallengeResponce
.data
, answer
.data
, answer
.length
) != 0) {
191 ctxp
= EVP_MD_CTX_create();
192 EVP_DigestInit_ex(ctxp
, EVP_md4(), NULL
);
193 EVP_DigestUpdate(ctxp
, key
->key
.keyvalue
.data
, key
->key
.keyvalue
.length
);
194 EVP_DigestFinal_ex(ctxp
, sessionkey
, NULL
);
195 EVP_MD_CTX_destroy(ctxp
);
201 ASN1_MALLOC_ENCODE(NTLMReply
, rep
.data
, rep
.length
, &ntp
, &size
, ret
);
204 if (rep
.length
!= size
)
208 kdc_log(context
, config
, 1, "digest-request: %d", ret
);
210 (*complete
)(cctx
, ret
, &rep
);
214 free_NTLMRequest2(&ntq
);
216 _kdc_free_ent (context
, user
);
219 static int help_flag
;
220 static int version_flag
;
222 static struct getargs args
[] = {
223 { "help", 'h', arg_flag
, &help_flag
, NULL
, NULL
},
224 { "version", 'v', arg_flag
, &version_flag
, NULL
, NULL
}
227 static int num_args
= sizeof(args
) / sizeof(args
[0]);
232 arg_printusage (args
, num_args
, NULL
, "");
237 main(int argc
, char **argv
)
239 krb5_context context
;
242 setprogname(argv
[0]);
244 if (getarg(args
, num_args
, argc
, argv
, &optidx
))
255 ret
= krb5_init_context(&context
);
257 krb5_errx(context
, 1, "krb5_init_context");
259 ret
= krb5_kdc_get_config(context
, &config
);
261 krb5_err(context
, 1, ret
, "krb5_kdc_default_config");
263 kdc_openlog(context
, "digest-service", config
);
265 ret
= krb5_kdc_set_dbinfo(context
, config
);
267 krb5_err(context
, 1, ret
, "krb5_kdc_set_dbinfo");
272 heim_sipc_launchd_mach_init("org.h5l.ntlm-service",
273 ntlm_service
, context
, &mach
);
274 heim_sipc_timeout(60);
279 heim_sipc_service_unix("org.h5l.ntlm-service", ntlm_service
, NULL
, &un
);