kdc/digest-service.c

   1 /*
   2  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #define HC_DEPRECATED_CRYPTO
  37
  38 #include "headers.h"
  39 #include <digest_asn1.h>
  40 #include <heimntlm.h>
  41 #include <heim-ipc.h>
  42 #include <getarg.h>
  43
  44 typedef struct pk_client_params pk_client_params;
  45 typedef struct gss_client_params gss_client_params;
  46 struct DigestREQ;
  47 struct Kx509Request;
  48
  49 #include <kdc-private.h>
  50
  51 krb5_kdc_configuration *config;
  52
  53 static void
  54 ntlm_service(void *ctx, const heim_idata *req,
  55              const heim_icred cred,
  56              heim_ipc_complete complete,
  57              heim_sipc_call cctx)
  58 {
  59     NTLMRequest2 ntq;
  60     unsigned char sessionkey[16];
  61     heim_idata rep = { 0, NULL };
  62     krb5_context context = ctx;
  63     hdb_entry *user = NULL;
  64     HDB *db = NULL;
  65     Key *key = NULL;
  66     NTLMReply ntp;
  67     size_t size;
  68     int ret;
  69     const char *domain;
  70
  71     kdc_log(context, config, 4, "digest-request: uid=%d",
  72             (int)heim_ipc_cred_get_uid(cred));
  73
  74     if (heim_ipc_cred_get_uid(cred) != 0) {
  75         (*complete)(cctx, EPERM, NULL);
  76         return;
  77     }
  78
  79     ntp.success = 0;
  80     ntp.flags = 0;
  81     ntp.sessionkey = NULL;
  82
  83     ret = decode_NTLMRequest2(req->data, req->length, &ntq, NULL);
  84     if (ret)
  85         goto failed;
  86
  87     /* XXX forward to NetrLogonSamLogonEx() if not a local domain */
  88     if (strcmp(ntq.loginDomainName, "BUILTIN") == 0) {
  89         domain = ntq.loginDomainName;
  90     } else if (strcmp(ntq.loginDomainName, "") == 0) {
  91         domain = "BUILTIN";
  92     } else {
  93         ret = EINVAL;
  94         goto failed;
  95     }
  96
  97     kdc_log(context, config, 4, "digest-request: user=%s/%s",
  98             ntq.loginUserName, domain);
  99
 100     if (ntq.lmchallenge.length != 8)
 101         goto failed;
 102
 103     if (ntq.ntChallengeResponce.length == 0)
 104         goto failed;
 105
 106     {
 107         krb5_principal client;
 108
 109         ret = krb5_make_principal(context, &client, domain,
 110                                   ntq.loginUserName, NULL);
 111         if (ret)
 112             goto failed;
 113
 114         krb5_principal_set_type(context, client, KRB5_NT_NTLM);
 115
 116         ret = _kdc_db_fetch(context, config, client,
 117                             HDB_F_GET_CLIENT, NULL, &db, &user);
 118         krb5_free_principal(context, client);
 119         if (ret)
 120             goto failed;
 121
 122         ret = hdb_enctype2key(context, user, NULL,
 123                               ETYPE_ARCFOUR_HMAC_MD5, &key);
 124         if (ret) {
 125             krb5_set_error_message(context, ret, "NTLM missing arcfour key");
 126             goto failed;
 127         }
 128     }
 129
 130     kdc_log(context, config, 5,
 131             "digest-request: found user, processing ntlm request");
 132
 133     if (ntq.ntChallengeResponce.length != 24) {
 134         struct ntlm_buf infotarget, answer;
 135
 136         answer.length = ntq.ntChallengeResponce.length;
 137         answer.data = ntq.ntChallengeResponce.data;
 138
 139         ret = heim_ntlm_verify_ntlm2(key->key.keyvalue.data,
 140                                      key->key.keyvalue.length,
 141                                      ntq.loginUserName,
 142                                      ntq.loginDomainName,
 143                                      0,
 144                                      ntq.lmchallenge.data,
 145                                      &answer,
 146                                      &infotarget,
 147                                      sessionkey);
 148         if (ret) {
 149             goto failed;
 150         }
 151
 152         free(infotarget.data);
 153         /* XXX verify info target */
 154
 155     } else {
 156         struct ntlm_buf answer;
 157
 158         if (ntq.flags & NTLM_NEG_NTLM2_SESSION) {
 159             unsigned char sessionhash[MD5_DIGEST_LENGTH];
 160             EVP_MD_CTX *md5ctx;
 161
 162             /* the first first 8 bytes is the challenge, what is the other 16 bytes ? */
 163             if (ntq.lmChallengeResponce.length != 24)
 164                 goto failed;
 165
 166             md5ctx = EVP_MD_CTX_create();
 167             EVP_DigestInit_ex(md5ctx, EVP_md5(), NULL);
 168             EVP_DigestUpdate(md5ctx, ntq.lmchallenge.data, 8);
 169             EVP_DigestUpdate(md5ctx, ntq.lmChallengeResponce.data, 8);
 170             EVP_DigestFinal_ex(md5ctx, sessionhash, NULL);
 171             EVP_MD_CTX_destroy(md5ctx);
 172             memcpy(ntq.lmchallenge.data, sessionhash, ntq.lmchallenge.length);
 173         }
 174
 175         ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
 176                                         key->key.keyvalue.length,
 177                                         ntq.lmchallenge.data, &answer);
 178         if (ret)
 179             goto failed;
 180
 181         if (ntq.ntChallengeResponce.length != answer.length ||
 182             ct_memcmp(ntq.ntChallengeResponce.data, answer.data, answer.length) != 0) {
 183             free(answer.data);
 184             ret = EINVAL;
 185             goto failed;
 186         }
 187         free(answer.data);
 188
 189         {
 190             EVP_MD_CTX *ctxp;
 191
 192             ctxp = EVP_MD_CTX_create();
 193             EVP_DigestInit_ex(ctxp, EVP_md4(), NULL);
 194             EVP_DigestUpdate(ctxp, key->key.keyvalue.data, key->key.keyvalue.length);
 195             EVP_DigestFinal_ex(ctxp, sessionkey, NULL);
 196             EVP_MD_CTX_destroy(ctxp);
 197         }
 198     }
 199
 200     ntp.success = 1;
 201
 202     ASN1_MALLOC_ENCODE(NTLMReply, rep.data, rep.length, &ntp, &size, ret);
 203     if (ret)
 204         goto failed;
 205     if (rep.length != size)
 206         abort();
 207
 208   failed:
 209     kdc_log(context, config, 4, "digest-request: %d", ret);
 210
 211     (*complete)(cctx, ret, &rep);
 212
 213     free(rep.data);
 214
 215     free_NTLMRequest2(&ntq);
 216     if (user)
 217         _kdc_free_ent (context, db, user);
 218 }
 219
 220 static int help_flag;
 221 static int version_flag;
 222
 223 static struct getargs args[] = {
 224     {   "help",         'h',    arg_flag,   &help_flag, NULL, NULL },
 225     {   "version",      'v',    arg_flag,   &version_flag, NULL, NULL }
 226 };
 227
 228 static int num_args = sizeof(args) / sizeof(args[0]);
 229
 230 static void
 231 usage(int ret)
 232 {
 233     arg_printusage (args, num_args, NULL, "");
 234     exit (ret);
 235 }
 236
 237 int
 238 main(int argc, char **argv)
 239 {
 240     krb5_context context;
 241     int ret, optidx = 0;
 242
 243     setprogname(argv[0]);
 244
 245     if (getarg(args, num_args, argc, argv, &optidx))
 246         usage(1);
 247
 248     if (help_flag)
 249         usage(0);
 250
 251     if (version_flag) {
 252         print_version(NULL);
 253         exit(0);
 254     }
 255
 256     ret = krb5_init_context(&context);
 257     if (ret)
 258         krb5_errx(context, 1, "krb5_init_context");
 259
 260     ret = krb5_kdc_get_config(context, &config);
 261     if (ret)
 262         krb5_err(context, 1, ret, "krb5_kdc_default_config");
 263
 264     kdc_openlog(context, "digest-service", config);
 265
 266     ret = krb5_kdc_set_dbinfo(context, config);
 267     if (ret)
 268         krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo");
 269
 270 #if __APPLE__
 271     {
 272         heim_sipc mach;
 273         heim_sipc_launchd_mach_init("org.h5l.ntlm-service",
 274                                     ntlm_service, context, &mach);
 275         heim_sipc_timeout(60);
 276     }
 277 #endif
 278 #ifdef HAVE_DOOR_CREATE
 279     {
 280         heim_sipc door;
 281         heim_sipc_service_door("org.h5l.ntlm-service", ntlm_service, NULL, &door);
 282     }
 283 #endif
 284     {
 285         heim_sipc un;
 286         heim_sipc_service_unix("org.h5l.ntlm-service", ntlm_service, NULL, &un);
 287     }
 288
 289     heim_ipc_main();
 290     return 0;
 291 }