Beispiel #1
0
static krb5_error_code
kcm_op_do_ntlm(krb5_context context,
	       kcm_client *client,
	       kcm_operation opcode,
	       krb5_storage *request,
	       krb5_storage *response)
{
    struct kcm_ntlm_cred *c;
    struct ntlm_type2 type2;
    struct ntlm_type3 type3;
    char *user = NULL, *domain = NULL;
    struct ntlm_buf ndata, sessionkey;
    krb5_data data;
    krb5_error_code ret;
    uint32_t flags = 0;

    memset(&type2, 0, sizeof(type2));
    memset(&type3, 0, sizeof(type3));
    sessionkey.data = NULL;
    sessionkey.length = 0;
    
    ret = krb5_ret_stringz(request, &user);
    if (ret)
	goto error;

    ret = krb5_ret_stringz(request, &domain);
    if (ret)
	goto error;

    if (domain[0] == '\0') {
	free(domain);
	domain = NULL;
    }

    c = find_ntlm_cred(user, domain, client);
    if (c == NULL) {
	ret = EINVAL;
	goto error;
    }

    ret = krb5_ret_data(request, &data);
    if (ret)
	goto error;

    ndata.data = data.data;
    ndata.length = data.length;

    ret = heim_ntlm_decode_type2(&ndata, &type2);
    krb5_data_free(&data);
    if (ret)
	goto error;

    if (domain && strcmp(domain, type2.targetname) == 0) {
	ret = EINVAL;
	goto error;
    }

    type3.username = c->user;
    type3.flags = type2.flags;
    type3.targetname = type2.targetname;
    type3.ws = rk_UNCONST("workstation");
    
    /*
     * NTLM Version 1 if no targetinfo buffer.
     */
    
    if (1 || type2.targetinfo.length == 0) {
	struct ntlm_buf sessionkey;
	
	if (type2.flags & NTLM_NEG_NTLM2_SESSION) {
	    unsigned char nonce[8];
	    
	    if (RAND_bytes(nonce, sizeof(nonce)) != 1) {
		ret = EINVAL;
		goto error;
	    }
	    
	    ret = heim_ntlm_calculate_ntlm2_sess(nonce,
						 type2.challenge,
						 c->nthash.data,
						 &type3.lm,
						 &type3.ntlm);
	} else {
	    ret = heim_ntlm_calculate_ntlm1(c->nthash.data,
					    c->nthash.length,
					    type2.challenge,
					    &type3.ntlm);
	    
	}
	if (ret)
	    goto error;
	
	ret = heim_ntlm_build_ntlm1_master(c->nthash.data,
					   c->nthash.length,
					   &sessionkey,
					   &type3.sessionkey);
	if (ret) {
	    if (type3.lm.data)
		free(type3.lm.data);
	    if (type3.ntlm.data)
		free(type3.ntlm.data);
	    goto error;
	}

	free(sessionkey.data);
	if (ret) {
	    if (type3.lm.data)
		free(type3.lm.data);
	    if (type3.ntlm.data)
		free(type3.ntlm.data);
	    goto error;
	}
	flags |= NTLM_FLAG_SESSIONKEY;
#if 0	
    } else {
	struct ntlm_buf sessionkey;
	unsigned char ntlmv2[16];
	struct ntlm_targetinfo ti;
	
	/* verify infotarget */
	
	ret = heim_ntlm_decode_targetinfo(&type2.targetinfo, 1, &ti);
	if(ret) {
	    _gss_ntlm_delete_sec_context(minor_status,
					 context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}
	
	if (ti.domainname && strcmp(ti.domainname, name->domain) != 0) {
	    _gss_ntlm_delete_sec_context(minor_status,
					 context_handle, NULL);
	    *minor_status = EINVAL;
	    return GSS_S_FAILURE;
	}
	
	ret = heim_ntlm_calculate_ntlm2(ctx->client->key.data,
					ctx->client->key.length,
					type3.username,
					name->domain,
					type2.challenge,
					&type2.targetinfo,
					ntlmv2,
					&type3.ntlm);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status,
					 context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}
	
	ret = heim_ntlm_build_ntlm1_master(ntlmv2, sizeof(ntlmv2),
					   &sessionkey,
					   &type3.sessionkey);
	memset(ntlmv2, 0, sizeof(ntlmv2));
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status,
					 context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}
	
	flags |= NTLM_FLAG_NTLM2_SESSION |
	         NTLM_FLAG_SESSION;
	
	if (type3.flags & NTLM_NEG_KEYEX)
	    flags |= NTLM_FLAG_KEYEX;

	ret = krb5_data_copy(&ctx->sessionkey,
			     sessionkey.data, sessionkey.length);
	free(sessionkey.data);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status,
					 context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}
#endif
    }
    
#if 0
    if (flags & NTLM_FLAG_NTLM2_SESSION) {
	_gss_ntlm_set_key(&ctx->u.v2.send, 0, (ctx->flags & NTLM_NEG_KEYEX),
			  ctx->sessionkey.data,
			  ctx->sessionkey.length);
	_gss_ntlm_set_key(&ctx->u.v2.recv, 1, (ctx->flags & NTLM_NEG_KEYEX),
			  ctx->sessionkey.data,
			  ctx->sessionkey.length);
    } else {
	flags |= NTLM_FLAG_SESSION;
	RC4_set_key(&ctx->u.v1.crypto_recv.key,
		    ctx->sessionkey.length,
		    ctx->sessionkey.data);
	RC4_set_key(&ctx->u.v1.crypto_send.key,
		    ctx->sessionkey.length,
		    ctx->sessionkey.data);
    }
#endif

    ret = heim_ntlm_encode_type3(&type3, &ndata);
    if (ret)
	goto error;
	
    data.data = ndata.data;
    data.length = ndata.length;
    ret = krb5_store_data(response, data);
    heim_ntlm_free_buf(&ndata);
    if (ret) goto error;

    ret = krb5_store_int32(response, flags);
    if (ret) goto error;

    data.data = sessionkey.data;
    data.length = sessionkey.length;

    ret = krb5_store_data(response, data);
    if (ret) goto error;

 error:
    free(type3.username);
    heim_ntlm_free_type2(&type2);
    free(user);
    if (domain)
	free(domain);

    return ret;
}
Beispiel #2
0
OM_uint32 GSSAPI_CALLCONV
_gss_ntlm_init_sec_context
           (OM_uint32 * minor_status,
            gss_const_cred_id_t initiator_cred_handle,
            gss_ctx_id_t * context_handle,
            gss_const_name_t target_name,
            const gss_OID mech_type,
            OM_uint32 req_flags,
            OM_uint32 time_req,
            const gss_channel_bindings_t input_chan_bindings,
            const gss_buffer_t input_token,
            gss_OID * actual_mech_type,
            gss_buffer_t output_token,
            OM_uint32 * ret_flags,
            OM_uint32 * time_rec
	   )
{
    ntlm_ctx ctx;
    ntlm_name name = (ntlm_name)target_name;

    *minor_status = 0;

    if (ret_flags)
	*ret_flags = 0;
    if (time_rec)
	*time_rec = 0;
    if (actual_mech_type)
	*actual_mech_type = GSS_C_NO_OID;

    if (*context_handle == GSS_C_NO_CONTEXT) {
	struct ntlm_type1 type1;
	struct ntlm_buf data;
	uint32_t flags = 0;
	int ret;

	ctx = calloc(1, sizeof(*ctx));
	if (ctx == NULL) {
	    *minor_status = EINVAL;
	    return GSS_S_FAILURE;
	}
	*context_handle = (gss_ctx_id_t)ctx;

	if (initiator_cred_handle != GSS_C_NO_CREDENTIAL) {
	    ntlm_cred cred = (ntlm_cred)initiator_cred_handle;
	    ret = _gss_copy_cred(cred, &ctx->client);
	} else
	    ret = _gss_ntlm_get_user_cred(name, &ctx->client);

	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}

	if (req_flags & GSS_C_CONF_FLAG)
	    flags |= NTLM_NEG_SEAL;
	if (req_flags & GSS_C_INTEG_FLAG)
	    flags |= NTLM_NEG_SIGN;
	else
	    flags |= NTLM_NEG_ALWAYS_SIGN;

	flags |= NTLM_NEG_UNICODE;
	flags |= NTLM_NEG_NTLM;
	flags |= NTLM_NEG_NTLM2_SESSION;
	flags |= NTLM_NEG_KEYEX;

	memset(&type1, 0, sizeof(type1));

	type1.flags = flags;
	type1.domain = name->domain;
	type1.hostname = NULL;
	type1.os[0] = 0;
	type1.os[1] = 0;

	ret = heim_ntlm_encode_type1(&type1, &data);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}

	output_token->value = data.data;
	output_token->length = data.length;

	return GSS_S_CONTINUE_NEEDED;
    } else {
	krb5_error_code ret;
	struct ntlm_type2 type2;
	struct ntlm_type3 type3;
	struct ntlm_buf data;

	ctx = (ntlm_ctx)*context_handle;

	data.data = input_token->value;
	data.length = input_token->length;

	ret = heim_ntlm_decode_type2(&data, &type2);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}

	ctx->flags = type2.flags;

	/* XXX check that type2.targetinfo matches `target_name´ */
	/* XXX check verify targetinfo buffer */

	memset(&type3, 0, sizeof(type3));

	type3.username = ctx->client->username;
	type3.flags = type2.flags;
	type3.targetname = type2.targetname;
	type3.ws = rk_UNCONST("workstation");

	/*
	 * NTLM Version 1 if no targetinfo buffer.
	 */

	if (1 || type2.targetinfo.length == 0) {
	    struct ntlm_buf sessionkey;

	    if (type2.flags & NTLM_NEG_NTLM2_SESSION) {
		unsigned char nonce[8];

		if (RAND_bytes(nonce, sizeof(nonce)) != 1) {
		    _gss_ntlm_delete_sec_context(minor_status,
						 context_handle, NULL);
		    *minor_status = EINVAL;
		    return GSS_S_FAILURE;
		}

		ret = heim_ntlm_calculate_ntlm2_sess(nonce,
						     type2.challenge,
						     ctx->client->key.data,
						     &type3.lm,
						     &type3.ntlm);
	    } else {
		ret = heim_ntlm_calculate_ntlm1(ctx->client->key.data,
						ctx->client->key.length,
						type2.challenge,
						&type3.ntlm);

	    }
	    if (ret) {
		_gss_ntlm_delete_sec_context(minor_status,context_handle,NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }

	    ret = heim_ntlm_build_ntlm1_master(ctx->client->key.data,
					       ctx->client->key.length,
					       &sessionkey,
					       &type3.sessionkey);
	    if (ret) {
		if (type3.lm.data)
		    free(type3.lm.data);
		if (type3.ntlm.data)
		    free(type3.ntlm.data);
		_gss_ntlm_delete_sec_context(minor_status,context_handle,NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }

	    ret = krb5_data_copy(&ctx->sessionkey,
				 sessionkey.data, sessionkey.length);
	    free(sessionkey.data);
	    if (ret) {
		if (type3.lm.data)
		    free(type3.lm.data);
		if (type3.ntlm.data)
		    free(type3.ntlm.data);
		_gss_ntlm_delete_sec_context(minor_status,context_handle,NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }
	    ctx->status |= STATUS_SESSIONKEY;

	} else {
	    struct ntlm_buf sessionkey;
	    unsigned char ntlmv2[16];
	    struct ntlm_targetinfo ti;

	    /* verify infotarget */

	    ret = heim_ntlm_decode_targetinfo(&type2.targetinfo, 1, &ti);
	    if(ret) {
		_gss_ntlm_delete_sec_context(minor_status,
					     context_handle, NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }

	    if (ti.domainname && strcmp(ti.domainname, name->domain) != 0) {
		_gss_ntlm_delete_sec_context(minor_status,
					     context_handle, NULL);
		*minor_status = EINVAL;
		return GSS_S_FAILURE;
	    }

	    ret = heim_ntlm_calculate_ntlm2(ctx->client->key.data,
					    ctx->client->key.length,
					    ctx->client->username,
					    name->domain,
					    type2.challenge,
					    &type2.targetinfo,
					    ntlmv2,
					    &type3.ntlm);
	    if (ret) {
		_gss_ntlm_delete_sec_context(minor_status,
					     context_handle, NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }

	    ret = heim_ntlm_build_ntlm1_master(ntlmv2, sizeof(ntlmv2),
					       &sessionkey,
					       &type3.sessionkey);
	    memset(ntlmv2, 0, sizeof(ntlmv2));
	    if (ret) {
		_gss_ntlm_delete_sec_context(minor_status,
					     context_handle, NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }

	    ctx->flags |= NTLM_NEG_NTLM2_SESSION;

	    ret = krb5_data_copy(&ctx->sessionkey,
				 sessionkey.data, sessionkey.length);
	    free(sessionkey.data);
	    if (ret) {
		_gss_ntlm_delete_sec_context(minor_status,
					     context_handle, NULL);
		*minor_status = ret;
		return GSS_S_FAILURE;
	    }
	}

	if (ctx->flags & NTLM_NEG_NTLM2_SESSION) {
	    ctx->status |= STATUS_SESSIONKEY;
	    _gss_ntlm_set_key(&ctx->u.v2.send, 0, (ctx->flags & NTLM_NEG_KEYEX),
			      ctx->sessionkey.data,
			      ctx->sessionkey.length);
	    _gss_ntlm_set_key(&ctx->u.v2.recv, 1, (ctx->flags & NTLM_NEG_KEYEX),
			      ctx->sessionkey.data,
			      ctx->sessionkey.length);
	} else {
	    ctx->status |= STATUS_SESSIONKEY;
	    RC4_set_key(&ctx->u.v1.crypto_recv.key,
			ctx->sessionkey.length,
			ctx->sessionkey.data);
	    RC4_set_key(&ctx->u.v1.crypto_send.key,
			ctx->sessionkey.length,
			ctx->sessionkey.data);
	}



	ret = heim_ntlm_encode_type3(&type3, &data, NULL);
	free(type3.sessionkey.data);
	if (type3.lm.data)
	    free(type3.lm.data);
	if (type3.ntlm.data)
	    free(type3.ntlm.data);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}

	output_token->length = data.length;
	output_token->value = data.data;

	if (actual_mech_type)
	    *actual_mech_type = GSS_NTLM_MECHANISM;
	if (ret_flags)
	    *ret_flags = 0;
	if (time_rec)
	    *time_rec = GSS_C_INDEFINITE;

	ctx->status |= STATUS_OPEN;

	return GSS_S_COMPLETE;
    }
}
OM_uint32 GSSAPI_CALLCONV
_gss_ntlm_accept_sec_context
(OM_uint32 * minor_status,
 gss_ctx_id_t * context_handle,
 const gss_cred_id_t acceptor_cred_handle,
 const gss_buffer_t input_token_buffer,
 const gss_channel_bindings_t input_chan_bindings,
 gss_name_t * src_name,
 gss_OID * mech_type,
 gss_buffer_t output_token,
 OM_uint32 * ret_flags,
 OM_uint32 * time_rec,
 gss_cred_id_t * delegated_cred_handle
    )
{
    krb5_error_code ret;
    struct ntlm_buf data;
    OM_uint32 junk;
    ntlm_ctx ctx;

    output_token->value = NULL;
    output_token->length = 0;

    *minor_status = 0;

    if (context_handle == NULL)
	return GSS_S_FAILURE;
	
    if (input_token_buffer == GSS_C_NO_BUFFER)
	return GSS_S_FAILURE;

    if (src_name)
	*src_name = GSS_C_NO_NAME;
    if (mech_type)
	*mech_type = GSS_C_NO_OID;
    if (ret_flags)
	*ret_flags = 0;
    if (time_rec)
	*time_rec = 0;
    if (delegated_cred_handle)
	*delegated_cred_handle = GSS_C_NO_CREDENTIAL;

    if (*context_handle == GSS_C_NO_CONTEXT) {
	struct ntlm_type1 type1;
	OM_uint32 major_status;
	OM_uint32 retflags;
	struct ntlm_buf out;

	major_status = _gss_ntlm_allocate_ctx(minor_status, &ctx);
	if (major_status)
	    return major_status;
	*context_handle = (gss_ctx_id_t)ctx;
	
	/* check if the mechs is allowed by remote service */
	major_status = (*ctx->server->nsi_probe)(minor_status, ctx->ictx, NULL);
	if (major_status) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    return major_status;
	}

	data.data = input_token_buffer->value;
	data.length = input_token_buffer->length;
	
	ret = heim_ntlm_decode_type1(&data, &type1);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}

	if ((type1.flags & NTLM_NEG_UNICODE) == 0) {
	    heim_ntlm_free_type1(&type1);
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = EINVAL;
	    return GSS_S_FAILURE;
	}

	if (type1.flags & NTLM_NEG_SIGN)
	    ctx->gssflags |= GSS_C_CONF_FLAG;
	if (type1.flags & NTLM_NEG_SIGN)
	    ctx->gssflags |= GSS_C_INTEG_FLAG;

	major_status = (*ctx->server->nsi_type2)(minor_status,
						 ctx->ictx,
						 type1.flags,
						 type1.hostname,
						 type1.domain,
						 &retflags,
						 &out);
	heim_ntlm_free_type1(&type1);
	if (major_status != GSS_S_COMPLETE) {
	    OM_uint32 junk;
	    _gss_ntlm_delete_sec_context(&junk, context_handle, NULL);
	    return major_status;
	}

	output_token->value = malloc(out.length);
	if (output_token->value == NULL && out.length != 0) {
	    OM_uint32 junk;
	    _gss_ntlm_delete_sec_context(&junk, context_handle, NULL);
	    *minor_status = ENOMEM;
	    return GSS_S_FAILURE;
	}
	memcpy(output_token->value, out.data, out.length);
	output_token->length = out.length;

	ctx->flags = retflags;

	return GSS_S_CONTINUE_NEEDED;
    } else {
	OM_uint32 maj_stat;
	struct ntlm_type3 type3;
	struct ntlm_buf session;

	ctx = (ntlm_ctx)*context_handle;

	data.data = input_token_buffer->value;
	data.length = input_token_buffer->length;

	ret = heim_ntlm_decode_type3(&data, 1, &type3);
	if (ret) {
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}

	maj_stat = (*ctx->server->nsi_type3)(minor_status,
					     ctx->ictx,
					     &type3,
					     &session);
	if (maj_stat) {
	    heim_ntlm_free_type3(&type3);
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    return maj_stat;
	}

	if (src_name) {
	    ntlm_name n = calloc(1, sizeof(*n));
	    if (n) {
		n->user = strdup(type3.username);
		n->domain = strdup(type3.targetname);
	    }
	    if (n == NULL || n->user == NULL || n->domain == NULL) {
		gss_name_t tempn =  (gss_name_t)n;
		_gss_ntlm_release_name(&junk, &tempn);
		heim_ntlm_free_type3(&type3);
		_gss_ntlm_delete_sec_context(minor_status,
					     context_handle, NULL);
		return maj_stat;
	    }
	    *src_name = (gss_name_t)n;
	}	

	heim_ntlm_free_type3(&type3);

	ret = krb5_data_copy(&ctx->sessionkey,
			     session.data, session.length);
	if (ret) {	
	    if (src_name)
		_gss_ntlm_release_name(&junk, src_name);
	    _gss_ntlm_delete_sec_context(minor_status, context_handle, NULL);
	    *minor_status = ret;
	    return GSS_S_FAILURE;
	}
	
	if (session.length != 0) {

	    ctx->status |= STATUS_SESSIONKEY;

	    if (ctx->flags & NTLM_NEG_NTLM2_SESSION) {
		_gss_ntlm_set_key(&ctx->u.v2.send, 1,
				  (ctx->flags & NTLM_NEG_KEYEX),
				  ctx->sessionkey.data,
				  ctx->sessionkey.length);
		_gss_ntlm_set_key(&ctx->u.v2.recv, 0,
				  (ctx->flags & NTLM_NEG_KEYEX),
				  ctx->sessionkey.data,
				  ctx->sessionkey.length);
	    } else {
		RC4_set_key(&ctx->u.v1.crypto_send.key,
			    ctx->sessionkey.length,
			    ctx->sessionkey.data);
		RC4_set_key(&ctx->u.v1.crypto_recv.key,
			    ctx->sessionkey.length,
			    ctx->sessionkey.data);
	    }
	}

	if (mech_type)
	    *mech_type = GSS_NTLM_MECHANISM;
	if (time_rec)
	    *time_rec = GSS_C_INDEFINITE;

	ctx->status |= STATUS_OPEN;

	if (ret_flags)
	    *ret_flags = ctx->gssflags;

	return GSS_S_COMPLETE;
    }
}