demoserver.c

/*
 
 File: demoserver.c
 
 Abstract: Demonstration of various authentication from a server perspective
 
 Version: <1.0>
 
 Disclaimer: IMPORTANT:  This Apple software is supplied to you by Apple
 Computer, Inc. ("Apple") in consideration of your agreement to the
 following terms, and your use, installation, modification or
 redistribution of this Apple software constitutes acceptance of these
 terms.  If you do not agree with these terms, please do not use,
 install, modify or redistribute this Apple software.
 
 In consideration of your agreement to abide by the following terms, and
 subject to these terms, Apple grants you a personal, non-exclusive
 license, under Apple's copyrights in this original Apple software (the
 "Apple Software"), to use, reproduce, modify and redistribute the Apple
 Software, with or without modifications, in source and/or binary forms;
 provided that if you redistribute the Apple Software in its entirety and
 without modifications, you must retain this notice and the following
 text and disclaimers in all such redistributions of the Apple Software. 
 Neither the name, trademarks, service marks or logos of Apple Computer,
 Inc. may be used to endorse or promote products derived from the Apple
 Software without specific prior written permission from Apple.  Except
 as expressly stated in this notice, no other rights or licenses, express
 or implied, are granted by Apple herein, including but not limited to
 any patent rights that may be infringed by your derivative works or by
 other works in which the Apple Software may be incorporated.
 
 The Apple Software is provided by Apple on an "AS IS" basis.  APPLE
 MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
 THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS
 FOR A PARTICULAR PURPOSE, REGARDING THE APPLE SOFTWARE OR ITS USE AND
 OPERATION ALONE OR IN COMBINATION WITH YOUR PRODUCTS.
 
 IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL
 OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE, REPRODUCTION,
 MODIFICATION AND/OR DISTRIBUTION OF THE APPLE SOFTWARE, HOWEVER CAUSED
 AND WHETHER UNDER THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE),
 STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.
 
 Copyright © 2005 Apple Computer, Inc., All Rights Reserved
 
 */

#include <Kerberos/Kerberos.h>
#include <DirectoryService/DirectoryService.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>

#include "GSSauthenticate.h"
#include "NetworkHelper.h"
#include "DSUtility.h"

#pragma mark Prototypes

int		AuthCleartext( char *inUsername, char *inPassword );
int		AuthCRAMMD5( char *inUsername, char *inChallenge, char *inResponse );
int		AuthGSSAPI( int inSocket );

int		HandleNewConnection( int inSocket );
int		HandleCleartext( int inSocket );
int		HandleCRAMMD5( int inSocket );

char	*FindUserFromPrincipal( char *inPrincipal );

#pragma mark -
#pragma mark Authentication Routines

int AuthCleartext( char *inUsername, char *inPassword )
{
	tDirReference		dsRef			= 0;
	tDirNodeReference	dsSearchNodeRef	= 0;
	tDirNodeReference	dsUserNodeRef	= 0;
	tDirStatus			dsStatus;
	char				*pRecordName	= NULL;
	char				*pNodeName		= NULL;
	
	// Key steps to Authenticating a user:
	//	- First locate the user in the directory
	//	- Open Directory Service reference
	//	- Locate and open the Search Node
	//	- Locate the user's official RecordName and Directory Node based on the username provided
	//	- Then use authentication appropriate for the type of method
	
	// Open Directory Services reference
	dsStatus = dsOpenDirService( &dsRef );
	if( dsStatus == eDSNoErr ) {
		
		// use utility function in DSUtility.h to open the search node
		dsStatus = OpenSearchNode( dsRef, &dsSearchNodeRef );
		if( dsStatus == eDSNoErr ) {
			
			// use utility function in DSUtility.h to locate the user information
			dsStatus = LocateUserRecordNameAndNode( dsRef, dsSearchNodeRef, inUsername, &pRecordName, &pNodeName );
			if( dsStatus == eDSNoErr ) {
				
				// we should have values available, but let's check to be sure
				if( pNodeName != NULL && pNodeName[0] != '\0' && 
					pRecordName != NULL && pRecordName[0] != '\0' )
				{
					// need to create a tDataListPtr from the "/plugin/node" path, using "/" as the separator
					tDataListPtr dsUserNodePath = dsBuildFromPath( dsRef, pNodeName, "/" );
					
					dsStatus = dsOpenDirNode( dsRef, dsUserNodePath, &dsUserNodeRef );
					
					if( dsStatus == eDSNoErr ) {
						
						// Use our Utility routine to do the authentication
						dsStatus = DoPasswordAuth( dsRef, dsUserNodeRef, kDSStdAuthNodeNativeClearTextOK, 
												   pRecordName, inPassword );
						
						// Determine if successful.  There are cases where you may receive other errors
						// such as eDSAuthPasswordExpired.
						if( dsStatus == eDSNoErr ) {
							printf( "Successful:  Authentication successful for user '%s'\n", pRecordName );
						} else {
							printf( "Failure:  Authentication for user '%s' - %d\n", pRecordName, dsStatus );
						}
					}
					
					// free the data list as it is no longer needed
					dsDataListDeallocate( dsRef, dsUserNodePath );
					free( dsUserNodePath );
					dsUserNodePath = NULL;
				}
				
				// need to free any node name that may have been returned
				if( pNodeName != NULL ) {
					free( pNodeName );
					pNodeName = NULL;
				}
				
				// need to free any record name that may have been returned
				if( pRecordName != NULL ) {
					free( pRecordName );
					pRecordName = NULL;
				}
			}
			
			// close the search node cause we are done here
			dsCloseDirNode( dsSearchNodeRef );
			dsSearchNodeRef = 0;
			
		} else {
			printf( "Unable to locate and open the Search node\n" );
			return 1;
		}
		
		// need to close Directory Services at this point
		dsCloseDirService( dsRef );
		dsRef = 0;
	}
	
    return dsStatus;
}

int AuthCRAMMD5( char *inUsername, char *inChallenge, char *inResponse )
{
	tDirReference		dsRef			= 0;
	tDirNodeReference	dsSearchNodeRef	= 0;
	tDirNodeReference	dsUserNodeRef	= 0;
	tDirStatus			dsStatus;
	char				*pRecordName	= NULL;
	char				*pNodeName		= NULL;
	
	// Key steps to Authenticating a user:
	//	- First locate the user in the directory
	//	- Open Directory Service reference
	//	- Locate and open the Search Node
	//	- Locate the user's official RecordName and Directory Node based on the username provided
	//	- Then use authentication appropriate for the type of method
	
	// Open Directory Services reference
	dsStatus = dsOpenDirService( &dsRef );
	if( dsStatus == eDSNoErr ) {
		
		// use utility function to open the search node
		dsStatus = OpenSearchNode( dsRef, &dsSearchNodeRef );
		if( dsStatus == eDSNoErr ) {
			
			// use utility function to locate the user information
			dsStatus = LocateUserRecordNameAndNode( dsRef, dsSearchNodeRef, inUsername, &pRecordName, &pNodeName );
			if( dsStatus == eDSNoErr ) {
				
				// we should have values available, but let's check to be sure
				if( pNodeName != NULL && pNodeName[0] != '\0' && 
					pRecordName != NULL && pRecordName[0] != '\0' )
				{
					// need to create a tDataListPtr from the "/plugin/node" path, using "/" as the separator
					tDataListPtr dsUserNodePath = dsBuildFromPath( dsRef, pNodeName, "/" );
					
					// attempt to open the node provided
					dsStatus = dsOpenDirNode( dsRef, dsUserNodePath, &dsUserNodeRef );
					if( dsStatus == eDSNoErr ) {
						
						// Here is the Utility function that will do the authentication for us
						dsStatus = DoChallengeResponseAuth( dsRef, dsUserNodeRef, kDSStdAuthCRAM_MD5, pRecordName, 
															inChallenge, strlen(inChallenge), 
															inResponse, strlen(inResponse) );
						
						// Determine if successful.  There are cases where you may receive other errors
						// such as eDSAuthPasswordExpired.
						if( dsStatus == eDSNoErr ) {
							printf( "Successful:  CRAM-MD5 Authentication successful for user '%s'\n", pRecordName );
						} else {
							printf( "Failure:  CRAM-MD5 Authentication for user '%s' - %d\n", pRecordName, dsStatus );
						}
					}
					
					// free the data list as it is no longer needed
					dsDataListDeallocate( dsRef, dsUserNodePath );
					free( dsUserNodePath );
					dsUserNodePath = NULL;
				}
				
				// need to free any node name that may have been returned
				if( pNodeName != NULL ) {
					free( pNodeName );
					pNodeName = NULL;
				}
				
				// need to free any record name that may have been returned
				if( pRecordName != NULL ) {
					free( pRecordName );
					pRecordName = NULL;
				}
			}
			
			// close the search node cause we are done here
			dsCloseDirNode( dsSearchNodeRef );
			dsSearchNodeRef = 0;
			
		} else {
			printf( "Unable to locate and open the Search node\n" );
			return 1;
		}
		
		// need to close Directory Services at this point
		dsCloseDirService( dsRef );
		dsRef = 0;
	}
	
    return dsStatus;
}

int AuthGSSAPI( int inSocket )
{
	char			*pRecvToken		= NULL;
	int				iRecvTokenLen	= 0;
	char			*pSendToken		= NULL;
	int				iSendTokenLen	= 0;
	char			*pUserPrinc		= NULL;
	char			*pServiceName	= NULL;
	gss_ctx_id_t	gssContext		= GSS_C_NO_CONTEXT;
	gss_cred_id_t	gssCreds		= GSS_C_NO_CREDENTIAL;
	OM_uint32		iResult			= GSS_S_DEFECTIVE_CREDENTIAL;
	OM_uint32		iMinorStatus;

	// Key steps to authenticating a user with GSSAPI:
	//
	// GSSAPI is a request-response loop until finished.  For every token received
	// there may is a token sent back.  This loop is done until an error occurs or
	// we recieve a GSS_S_COMPLETE.  All tokens generated must be sent back to 
	// complete the process.
	
	// After successfully verifying the GSSAPI succeeded, we need to also verify
	// the user is a valid user on the system.  GSSAPI validates the user's credentials
	// not whether or not the user is allowed on this system.
	
	do {
		// read token data from the socket
		iRecvTokenLen = ReadToken( inSocket, &pRecvToken );
		
		printf( "Received a token with length of %d\n", iRecvTokenLen );
		
		if( iRecvTokenLen > 0 ) {
			// let's read and write data sending to and from the GSSauthenticate
			iResult = AuthenticateGSS( pRecvToken, iRecvTokenLen, &pSendToken, &iSendTokenLen, 
									   &pServiceName, &pUserPrinc, &gssContext, &gssCreds );
		}
		
		// if we have a token to send, let's send it to the client
		if( iSendTokenLen != 0 ) {
			
			printf( "Sending a token length of %d\n", iSendTokenLen );
			
			int iSent = SendToken(inSocket, pSendToken, iSendTokenLen);
			
			if( iSent == -1 || iSent != iSendTokenLen ) {
				// we had a problem, set failure state
				printf( "Failed to send packet.. bailing\n" );
				iResult = GSS_S_FAILURE;
			}
		}
		
		// free up our token if we have one
		if( pRecvToken != NULL ) {
			free( pRecvToken );
			pRecvToken = NULL;
		}
		
		// free up our send token if we have one
		if( pSendToken != NULL ) {
			free( pSendToken );
			pSendToken = NULL;
		}
		
	} while( iResult == GSS_S_CONTINUE_NEEDED );
	
	printf( "\n" ); // just print a line feed for visuals
	
	// if we completed successfully print out the userPrincipal if we had one
	if( iResult == GSS_S_COMPLETE && pUserPrinc != NULL && pServiceName != NULL ) {
		
		char	*pRecordName;
		
		printf( "Success:  Valid credentials provided by '%s' service '%s'\n", pUserPrinc, pServiceName );
	
// here you would compare the service to ensure it was the service you expected
//		if( strcasecmp( pServiceName, #expected service#) == 0 ) {
//				
//		}
		
		if( pRecordName = FindUserFromPrincipal( pUserPrinc ) ) {
			printf( "Success:  Found a user record for user - %s\n", pRecordName );
			
			// send a response
			SendToken( inSocket, "Accepted", sizeof("Accepted") );
			
			// need to free pRecordName cause it is returned
			free( pRecordName );
			pRecordName = NULL;
			
		} else {
			// send response
			SendToken( inSocket, "Rejected", sizeof("Rejected") );
			printf( "Failure:  No matching user record found for user\n" );
		}

	} else {
		if( pUserPrinc != NULL ) {
			printf( "Error:  Unable to authenticate user %s\n", pUserPrinc );
		}
		if( pServiceName != NULL ) {
			printf( "Error:  Unable to verify service %s\n", pServiceName );
		}
	}
	
	// clean up any context
	if( gssContext != GSS_C_NO_CONTEXT ) {
		gss_delete_sec_context( &iMinorStatus, gssContext, GSS_C_NO_BUFFER );
		gssContext = GSS_C_NO_CONTEXT;
	}
	
	// clean up any credentials
	if( gssCreds != GSS_C_NO_CREDENTIAL ) {
		gss_release_cred( &iMinorStatus, &gssCreds );
		gssCreds = GSS_C_NO_CREDENTIAL;
	}
	
	return 0;
}

#pragma mark -
#pragma mark Connection Negotiation

int HandleNewConnection( int inSocket )
{
	char	*pRecvToken		= NULL;
	int		iRecvTokenLen	= 0;
	int		iResult			= -1;
	
	// use ReadToken to get the first packet to identify the type of authentication
	iRecvTokenLen = ReadToken( inSocket, &pRecvToken );
	
	if( pRecvToken != NULL ) {

		if( strcasecmp(pRecvToken, "GSSAPI") == 0 ) {
			
			printf( "Attempt to authenticate with method GSSAPI received\n" );
			iResult = AuthGSSAPI( inSocket );
			
		} else if( strcasecmp(pRecvToken, "CRAM-MD5") == 0 ) {
			
			printf( "Attempt to authenticate with method CRAM-MD5 received\n" );
			iResult = HandleCRAMMD5( inSocket );
			
		} else if( strcasecmp(pRecvToken, "cleartext") == 0 ) {
			
			printf( "Attempt to authenticate with method cleartext received\n" );
			iResult = HandleCleartext( inSocket );
			
		} else {
			printf( "Unknown method received for authentication\n" );
		}
		
		// just print a blank line
		printf( "\n" );
		
		// free our token
		free( pRecvToken );
		pRecvToken = NULL;
	}
	
	return iResult;
}

int HandleCleartext( int inSocket )
{
	char	*pUsername		= NULL;
	char	*pPassword		= NULL;
	char	*pRecordname	= NULL;
	int		iResult			= -1;
	
	// we will be using ReadToken and WriteToken to send data back and forth for this
	// example, though not necessarily the most efficient, it is simplistic for this 
	// demonstration.
	
	// we expect 2 tokens, username then password
	
	// read the username from the network stream
	if( ReadToken(inSocket, &pUsername) > 0 ) {
		
		// read the password from the network stream
		if( ReadToken(inSocket, &pPassword) > 0 ) {
			
			iResult = AuthCleartext( pUsername, pPassword );
			
			// send a response
			if( iResult == eDSNoErr ) {
				SendToken( inSocket, "Accepted", sizeof("Accepted") );
			} else {
				SendToken( inSocket, "Rejected", sizeof("Rejected") );
			}
		}
	}
	
	// free any allocated strings
	if( pUsername != NULL ) {
		free( pUsername );
		pUsername = NULL;
	}
	
	if( pPassword != NULL ) {
		free( pPassword );
		pPassword = NULL;
	}

	if( pRecordname != NULL ) {
		free( pRecordname );
		pRecordname = NULL;
	}
	
	return iResult;
}

int HandleCRAMMD5( int inSocket )
{
	unsigned char	pChallenge[255]	= { 0, };
	char			pHostname[128]	= { 0, };
	char			*pResponse		= NULL;
	char			*pUsername		= NULL;
	struct timeval	stCurrentTime;
	int				iResult			= -1;

	// we will be using ReadToken and WriteToken to send data back and forth for this
	// example, though not necessarily the most efficient, it is simplistic for this 
	// demonstration.
	
	// Since CRAM-MD5 was requested, let's generate a challenge and send it to the client
	// using example method in RFC 1460, page 12.
	gethostname( pHostname, 127 );
	gettimeofday( &stCurrentTime, NULL ); // assume no error occurred
	snprintf( pChallenge, 255, "<%ld.%ld@%s>", (long) getpid(), stCurrentTime.tv_sec, pHostname );
	
	printf( "Sending challenge %s\n", pChallenge );
	
	// send our challenge to the client
	if( SendToken(inSocket, pChallenge, strlen(pChallenge)) > 0 ) {
		
		// now wait for username and response to return
		if( ReadToken(inSocket, &pUsername) > 0 ) {
			
			if( ReadToken(inSocket, &pResponse) > 0 ) {

				// here is where we authenticate the user using Open Directory
				iResult = AuthCRAMMD5( pUsername, pChallenge, pResponse );
				
				// send a response
				if( iResult == eDSNoErr ) {
					SendToken( inSocket, "Accepted", sizeof("Accepted") );
				} else {
					SendToken( inSocket, "Rejected", sizeof("Rejected") );
				}
			}
		}
	}
	
	// free up any strings we allocated
	if( pUsername != NULL ) {
		free( pUsername );
		pUsername = NULL;
	}

	if( pResponse != NULL ) {
		free( pResponse );
		pResponse = NULL;
	}

	return iResult;
}

#pragma mark -
#pragma mark Main Entry

// this demostration application will receive a authentication method type and some value following
// it to attempt to authenticate a user. 

int main( int argc, char *argv[] )
{
	int				iPort;
	int				iSocket;
	
	if( argc != 2 ) {
		printf( "Usage:  demoserver <port #>\n" );
		return 1;
	}
	
	if( geteuid() != 0 ) {
		printf( "Warning:  Tool must be run as EUID = 0 to use Kerberos/GSSAPI\n" );
	}
	
	// if we were relying on Kerberos for this service, we could pre-flight our 
	// service principal before we start the service, or just let GSSAPI determine 
	// at the time of connection
	//
	// we have opted for at time of connection, because we don't know what we
	// are using uses for service principal

	// let's convert the string provided for the port into a number
	iPort = strtol( argv[1], NULL, 10 );
	
	// don't allow privileged ports for this test
	if( iPort < 1024 ) {
		printf( "Error:  Port value must be greater than 1024\n" );
	}
	
	// this demonstration code will wait for an authentication identification code
	//    GSSAPI
	//    CRAM-MD5
	//    cleartext
	// Once method is determined, it will attempt to authenticate the user
	
	iSocket = BindSocket( iPort );
	if( iSocket > 0 ) {
		
		// just informative
		printf( "Listening on port %d\n", iPort );

		// go into a loop until we are killed
		while( 1 ) {

			int	iAccept;
			
			// Accept a TCP connection
			if( (iAccept = accept(iSocket, NULL, 0)) < 0) {
				printf("Error:  Couldn't accept connection");
				continue;
			}
			
			// once we have a connection, go to our request-response loop
			if( HandleNewConnection( iAccept ) == 0 ) {
				
				// if we had no error we could go do something, but in this case we will
				// just close the connection

				close( iAccept );
				iAccept = 0;
				
			} else {

				// close our socket
				close( iAccept );
				iAccept = 0;
			}
		}
		
		// close our socket
		close( iSocket );
		iSocket = 0;

	} else {
		printf( "Error:  Unable to listen on port %d\n", iPort );
		return 1;
	}

	return 0;
}

#pragma mark -
#pragma mark Support Functions

// helper routine to fine a user's official RecordName
//
char *FindUserFromPrincipal( char *inPrincipal )
{
	// now let's parse the name and see if we can find a valid user..
	tDirReference		dsRef			= 0;
	tDirNodeReference	dsSearchNodeRef	= 0;
	tDirStatus			dsStatus;
	char				*pRecordName	= NULL;
	char				*pNodeName		= NULL;
	char				*pUsername		= strdup( inPrincipal );
	char				*pAtSymbol		= strchr( pUsername, '@' );
	
	// need to parse just the name of the user, since principal is user@REALM
	if( pAtSymbol != NULL ) {
		*pAtSymbol = '\0';
	}
	
	// Open Directory Services reference
	dsStatus = dsOpenDirService( &dsRef );
	if( dsStatus == eDSNoErr ) {
		
		// use utility function in DSUtility.h to open the search node
		dsStatus = OpenSearchNode( dsRef, &dsSearchNodeRef );
		if( dsStatus == eDSNoErr ) {
			
			// use utility function in DSUtility.h to locate the user information
			dsStatus = LocateUserRecordNameAndNode( dsRef, dsSearchNodeRef, pUsername, &pRecordName, &pNodeName );
			if( dsStatus == eDSNoErr ) {
				
				// need to free any node name that may have been returned
				if( pNodeName != NULL ) {
					free( pNodeName );
					pNodeName = NULL;
				}
			}
			
			// close the search node cause we are done here
			dsCloseDirNode( dsSearchNodeRef );
			dsSearchNodeRef = 0;
			
		} else {
			printf( "Unable to locate and open the Search node to verify user\n" );
		}
		
		// need to close Directory Services at this point
		dsCloseDirService( dsRef );
		dsRef = 0;
	}
	
	if( pUsername != NULL ) {
		free( pUsername );
		pUsername = NULL;
	}
	
	return pRecordName;
}