2 * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 from_file(const char *fn, const char *target_domain,
38 char **username, struct ntlm_buf *key)
48 while (fgets(buf, sizeof(buf), f) != NULL) {
50 buf[strcspn(buf, "\r\n")] = '\0';
54 d = strtok_r(buf, ":", &str);
57 if (d && strcasecmp(target_domain, d) != 0)
59 u = strtok_r(NULL, ":", &str);
60 p = strtok_r(NULL, ":", &str);
61 if (u == NULL || p == NULL)
64 *username = strdup(u);
66 heim_ntlm_nt_key(p, key);
68 memset(buf, 0, sizeof(buf));
72 memset(buf, 0, sizeof(buf));
78 get_user_file(const ntlm_name target_name,
79 char **username, struct ntlm_buf *key)
86 fn = getenv("NTLM_USER_FILE");
89 if (from_file(fn, target_name->domain, username, key) == 0)
96 * Pick up the ntlm cred from the default krb5 credential cache.
100 get_user_ccache(const ntlm_name name, char **username, struct ntlm_buf *key)
102 krb5_context context = NULL;
103 krb5_principal client;
104 krb5_ccache id = NULL;
110 krb5_data_zero(&data);
114 ret = krb5_init_context(&context);
118 ret = krb5_cc_default(context, &id);
122 ret = krb5_cc_get_principal(context, id, &client);
126 ret = krb5_unparse_name_flags(context, client,
127 KRB5_PRINCIPAL_UNPARSE_NO_REALM,
129 krb5_free_principal(context, client);
133 asprintf(&confname, "ntlm-key-%s", name->domain);
134 if (confname == NULL) {
135 krb5_clear_error_message(context);
140 ret = krb5_cc_get_config(context, id, NULL,
145 key->data = malloc(data.length);
146 if (key->data == NULL) {
150 key->length = data.length;
151 memcpy(key->data, data.data, data.length);
154 krb5_data_free(&data);
156 krb5_cc_close(context, id);
158 krb5_free_context(context);
164 _gss_ntlm_get_user_cred(const ntlm_name target_name,
170 cred = calloc(1, sizeof(*cred));
174 ret = get_user_file(target_name, &cred->username, &cred->key);
176 ret = get_user_ccache(target_name, &cred->username, &cred->key);
182 cred->domain = strdup(target_name->domain);
189 _gss_copy_cred(ntlm_cred from, ntlm_cred *to)
191 *to = calloc(1, sizeof(**to));
194 (*to)->username = strdup(from->username);
195 if ((*to)->username == NULL) {
199 (*to)->domain = strdup(from->domain);
200 if ((*to)->domain == NULL) {
201 free((*to)->username);
205 (*to)->key.data = malloc(from->key.length);
206 if ((*to)->key.data == NULL) {
208 free((*to)->username);
212 memcpy((*to)->key.data, from->key.data, from->key.length);
213 (*to)->key.length = from->key.length;
218 OM_uint32 GSSAPI_CALLCONV
219 _gss_ntlm_init_sec_context
220 (OM_uint32 * minor_status,
221 const gss_cred_id_t initiator_cred_handle,
222 gss_ctx_id_t * context_handle,
223 const gss_name_t target_name,
224 const gss_OID mech_type,
227 const gss_channel_bindings_t input_chan_bindings,
228 const gss_buffer_t input_token,
229 gss_OID * actual_mech_type,
230 gss_buffer_t output_token,
231 OM_uint32 * ret_flags,
236 ntlm_name name = (ntlm_name)target_name;
244 if (actual_mech_type)
245 *actual_mech_type = GSS_C_NO_OID;
247 if (*context_handle == GSS_C_NO_CONTEXT) {
248 struct ntlm_type1 type1;
249 struct ntlm_buf data;
253 ctx = calloc(1, sizeof(*ctx));
255 *minor_status = EINVAL;
256 return GSS_S_FAILURE;
258 *context_handle = (gss_ctx_id_t)ctx;
260 if (initiator_cred_handle != GSS_C_NO_CREDENTIAL) {
261 ntlm_cred cred = (ntlm_cred)initiator_cred_handle;
262 ret = _gss_copy_cred(cred, &ctx->client);
264 ret = _gss_ntlm_get_user_cred(name, &ctx->client);
267 _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
269 return GSS_S_FAILURE;
272 if (req_flags & GSS_C_CONF_FLAG)
273 flags |= NTLM_NEG_SEAL;
274 if (req_flags & GSS_C_INTEG_FLAG)
275 flags |= NTLM_NEG_SIGN;
277 flags |= NTLM_NEG_ALWAYS_SIGN;
279 flags |= NTLM_NEG_UNICODE;
280 flags |= NTLM_NEG_NTLM;
281 flags |= NTLM_NEG_NTLM2_SESSION;
282 flags |= NTLM_NEG_KEYEX;
284 memset(&type1, 0, sizeof(type1));
287 type1.domain = name->domain;
288 type1.hostname = NULL;
292 ret = heim_ntlm_encode_type1(&type1, &data);
294 _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
296 return GSS_S_FAILURE;
299 output_token->value = data.data;
300 output_token->length = data.length;
302 return GSS_S_CONTINUE_NEEDED;
305 struct ntlm_type2 type2;
306 struct ntlm_type3 type3;
307 struct ntlm_buf data;
309 ctx = (ntlm_ctx)*context_handle;
311 data.data = input_token->value;
312 data.length = input_token->length;
314 ret = heim_ntlm_decode_type2(&data, &type2);
316 _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
318 return GSS_S_FAILURE;
321 ctx->flags = type2.flags;
323 /* XXX check that type2.targetinfo matches `target_name´ */
324 /* XXX check verify targetinfo buffer */
326 memset(&type3, 0, sizeof(type3));
328 type3.username = ctx->client->username;
329 type3.flags = type2.flags;
330 type3.targetname = type2.targetname;
331 type3.ws = rk_UNCONST("workstation");
334 * NTLM Version 1 if no targetinfo buffer.
337 if (1 || type2.targetinfo.length == 0) {
338 struct ntlm_buf sessionkey;
340 if (type2.flags & NTLM_NEG_NTLM2_SESSION) {
341 unsigned char nonce[8];
343 if (RAND_bytes(nonce, sizeof(nonce)) != 1) {
344 _gss_ntlm_delete_sec_context(minor_status,
345 context_handle, NULL);
346 *minor_status = EINVAL;
347 return GSS_S_FAILURE;
350 ret = heim_ntlm_calculate_ntlm2_sess(nonce,
352 ctx->client->key.data,
356 ret = heim_ntlm_calculate_ntlm1(ctx->client->key.data,
357 ctx->client->key.length,
363 _gss_ntlm_delete_sec_context(minor_status,context_handle,NULL);
365 return GSS_S_FAILURE;
368 ret = heim_ntlm_build_ntlm1_master(ctx->client->key.data,
369 ctx->client->key.length,
376 free(type3.ntlm.data);
377 _gss_ntlm_delete_sec_context(minor_status,context_handle,NULL);
379 return GSS_S_FAILURE;
382 ret = krb5_data_copy(&ctx->sessionkey,
383 sessionkey.data, sessionkey.length);
384 free(sessionkey.data);
389 free(type3.ntlm.data);
390 _gss_ntlm_delete_sec_context(minor_status,context_handle,NULL);
392 return GSS_S_FAILURE;
394 ctx->status |= STATUS_SESSIONKEY;
397 struct ntlm_buf sessionkey;
398 unsigned char ntlmv2[16];
399 struct ntlm_targetinfo ti;
401 /* verify infotarget */
403 ret = heim_ntlm_decode_targetinfo(&type2.targetinfo, 1, &ti);
405 _gss_ntlm_delete_sec_context(minor_status,
406 context_handle, NULL);
408 return GSS_S_FAILURE;
411 if (ti.domainname && strcmp(ti.domainname, name->domain) != 0) {
412 _gss_ntlm_delete_sec_context(minor_status,
413 context_handle, NULL);
414 *minor_status = EINVAL;
415 return GSS_S_FAILURE;
418 ret = heim_ntlm_calculate_ntlm2(ctx->client->key.data,
419 ctx->client->key.length,
420 ctx->client->username,
427 _gss_ntlm_delete_sec_context(minor_status,
428 context_handle, NULL);
430 return GSS_S_FAILURE;
433 ret = heim_ntlm_build_ntlm1_master(ntlmv2, sizeof(ntlmv2),
436 memset(ntlmv2, 0, sizeof(ntlmv2));
438 _gss_ntlm_delete_sec_context(minor_status,
439 context_handle, NULL);
441 return GSS_S_FAILURE;
444 ctx->flags |= NTLM_NEG_NTLM2_SESSION;
446 ret = krb5_data_copy(&ctx->sessionkey,
447 sessionkey.data, sessionkey.length);
448 free(sessionkey.data);
450 _gss_ntlm_delete_sec_context(minor_status,
451 context_handle, NULL);
453 return GSS_S_FAILURE;
457 if (ctx->flags & NTLM_NEG_NTLM2_SESSION) {
458 ctx->status |= STATUS_SESSIONKEY;
459 _gss_ntlm_set_key(&ctx->u.v2.send, 0, (ctx->flags & NTLM_NEG_KEYEX),
460 ctx->sessionkey.data,
461 ctx->sessionkey.length);
462 _gss_ntlm_set_key(&ctx->u.v2.recv, 1, (ctx->flags & NTLM_NEG_KEYEX),
463 ctx->sessionkey.data,
464 ctx->sessionkey.length);
466 ctx->status |= STATUS_SESSIONKEY;
467 RC4_set_key(&ctx->u.v1.crypto_recv.key,
468 ctx->sessionkey.length,
469 ctx->sessionkey.data);
470 RC4_set_key(&ctx->u.v1.crypto_send.key,
471 ctx->sessionkey.length,
472 ctx->sessionkey.data);
477 ret = heim_ntlm_encode_type3(&type3, &data);
478 free(type3.sessionkey.data);
482 free(type3.ntlm.data);
484 _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
486 return GSS_S_FAILURE;
489 output_token->length = data.length;
490 output_token->value = data.data;
492 if (actual_mech_type)
493 *actual_mech_type = GSS_NTLM_MECHANISM;
497 *time_rec = GSS_C_INDEFINITE;
499 ctx->status |= STATUS_OPEN;
501 return GSS_S_COMPLETE;