2 * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #define HC_DEPRECATED_CRYPTO
39 #include <digest_asn1.h>
44 typedef struct pk_client_params pk_client_params
;
45 typedef struct gss_client_params gss_client_params
;
49 #include <kdc-private.h>
51 krb5_kdc_configuration
*config
;
54 ntlm_service(void *ctx
, const heim_idata
*req
,
55 const heim_icred cred
,
56 heim_ipc_complete complete
,
60 unsigned char sessionkey
[16];
61 heim_idata rep
= { 0, NULL
};
62 krb5_context context
= ctx
;
63 hdb_entry
*user
= NULL
;
71 kdc_log(context
, config
, 4, "digest-request: uid=%d",
72 (int)heim_ipc_cred_get_uid(cred
));
74 if (heim_ipc_cred_get_uid(cred
) != 0) {
75 (*complete
)(cctx
, EPERM
, NULL
);
81 ntp
.sessionkey
= NULL
;
83 ret
= decode_NTLMRequest2(req
->data
, req
->length
, &ntq
, NULL
);
87 /* XXX forward to NetrLogonSamLogonEx() if not a local domain */
88 if (strcmp(ntq
.loginDomainName
, "BUILTIN") == 0) {
89 domain
= ntq
.loginDomainName
;
90 } else if (strcmp(ntq
.loginDomainName
, "") == 0) {
97 kdc_log(context
, config
, 4, "digest-request: user=%s/%s",
98 ntq
.loginUserName
, domain
);
100 if (ntq
.lmchallenge
.length
!= 8)
103 if (ntq
.ntChallengeResponce
.length
== 0)
107 krb5_principal client
;
109 ret
= krb5_make_principal(context
, &client
, domain
,
110 ntq
.loginUserName
, NULL
);
114 krb5_principal_set_type(context
, client
, KRB5_NT_NTLM
);
116 ret
= _kdc_db_fetch(context
, config
, client
,
117 HDB_F_GET_CLIENT
, NULL
, &db
, &user
);
118 krb5_free_principal(context
, client
);
122 ret
= hdb_enctype2key(context
, user
, NULL
,
123 ETYPE_ARCFOUR_HMAC_MD5
, &key
);
125 krb5_set_error_message(context
, ret
, "NTLM missing arcfour key");
130 kdc_log(context
, config
, 5,
131 "digest-request: found user, processing ntlm request");
133 if (ntq
.ntChallengeResponce
.length
!= 24) {
134 struct ntlm_buf infotarget
, answer
;
136 answer
.length
= ntq
.ntChallengeResponce
.length
;
137 answer
.data
= ntq
.ntChallengeResponce
.data
;
139 ret
= heim_ntlm_verify_ntlm2(key
->key
.keyvalue
.data
,
140 key
->key
.keyvalue
.length
,
144 ntq
.lmchallenge
.data
,
152 free(infotarget
.data
);
153 /* XXX verify info target */
156 struct ntlm_buf answer
;
158 if (ntq
.flags
& NTLM_NEG_NTLM2_SESSION
) {
159 unsigned char sessionhash
[MD5_DIGEST_LENGTH
];
162 /* the first first 8 bytes is the challenge, what is the other 16 bytes ? */
163 if (ntq
.lmChallengeResponce
.length
!= 24)
166 md5ctx
= EVP_MD_CTX_create();
167 EVP_DigestInit_ex(md5ctx
, EVP_md5(), NULL
);
168 EVP_DigestUpdate(md5ctx
, ntq
.lmchallenge
.data
, 8);
169 EVP_DigestUpdate(md5ctx
, ntq
.lmChallengeResponce
.data
, 8);
170 EVP_DigestFinal_ex(md5ctx
, sessionhash
, NULL
);
171 EVP_MD_CTX_destroy(md5ctx
);
172 memcpy(ntq
.lmchallenge
.data
, sessionhash
, ntq
.lmchallenge
.length
);
175 ret
= heim_ntlm_calculate_ntlm1(key
->key
.keyvalue
.data
,
176 key
->key
.keyvalue
.length
,
177 ntq
.lmchallenge
.data
, &answer
);
181 if (ntq
.ntChallengeResponce
.length
!= answer
.length
||
182 memcmp(ntq
.ntChallengeResponce
.data
, answer
.data
, answer
.length
) != 0) {
192 ctxp
= EVP_MD_CTX_create();
193 EVP_DigestInit_ex(ctxp
, EVP_md4(), NULL
);
194 EVP_DigestUpdate(ctxp
, key
->key
.keyvalue
.data
, key
->key
.keyvalue
.length
);
195 EVP_DigestFinal_ex(ctxp
, sessionkey
, NULL
);
196 EVP_MD_CTX_destroy(ctxp
);
202 ASN1_MALLOC_ENCODE(NTLMReply
, rep
.data
, rep
.length
, &ntp
, &size
, ret
);
205 if (rep
.length
!= size
)
209 kdc_log(context
, config
, 4, "digest-request: %d", ret
);
211 (*complete
)(cctx
, ret
, &rep
);
215 free_NTLMRequest2(&ntq
);
217 _kdc_free_ent (context
, db
, user
);
220 static int help_flag
;
221 static int version_flag
;
223 static struct getargs args
[] = {
224 { "help", 'h', arg_flag
, &help_flag
, NULL
, NULL
},
225 { "version", 'v', arg_flag
, &version_flag
, NULL
, NULL
}
228 static int num_args
= sizeof(args
) / sizeof(args
[0]);
233 arg_printusage (args
, num_args
, NULL
, "");
238 main(int argc
, char **argv
)
240 krb5_context context
;
243 setprogname(argv
[0]);
245 if (getarg(args
, num_args
, argc
, argv
, &optidx
))
256 ret
= krb5_init_context(&context
);
258 krb5_errx(context
, 1, "krb5_init_context");
260 ret
= krb5_kdc_get_config(context
, &config
);
262 krb5_err(context
, 1, ret
, "krb5_kdc_default_config");
264 kdc_openlog(context
, "digest-service", config
);
266 ret
= krb5_kdc_set_dbinfo(context
, config
);
268 krb5_err(context
, 1, ret
, "krb5_kdc_set_dbinfo");
273 heim_sipc_launchd_mach_init("org.h5l.ntlm-service",
274 ntlm_service
, context
, &mach
);
275 heim_sipc_timeout(60);
278 #ifdef HAVE_DOOR_CREATE
281 heim_sipc_service_door("org.h5l.ntlm-service", ntlm_service
, NULL
, &door
);
286 heim_sipc_service_unix("org.h5l.ntlm-service", ntlm_service
, NULL
, &un
);