/*- * Copyright (c) 2013 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * * Portions Copyright (c) 2013 Apple Inc. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #import <TargetConditionals.h> #import <Foundation/Foundation.h> #import <CoreFoundation/CoreFoundation.h> #import <CoreFoundation/CFRuntime.h> #import "heimcred.h" #import "heimbase.h" #import "config.h" #if ENABLE_NTLM #if 0 static CFTypeRef DictionaryGetTypedValue(CFDictionaryRef dict, CFStringRef key, CFTypeID reqType) { CFTypeRef value = CFDictionaryGetValue(dict, key); if (value == NULL || CFGetTypeID(value) != reqType) return NULL; return value; } /* * */ static int ntlm_domain_is_hostname(CFStringRef name) { return CFStringHasPrefix(name, CFSTR("\\")); } #endif static CFDictionaryRef NTLMAuthCallback(HeimCredRef cred, CFDictionaryRef input) { #if 0 CFMutableDictionaryRef output = NULL; CFDataRef type2data = NULL, cb = NULL, type1data = NULL; CFStringRef targetname = NULL; CFNumberRef _type1flags = NULL; CFStringRef userdomain; struct ntlm_type2 type2; struct ntlm_type3 type3; char *user = NULL, *domain = NULL, *targetname = NULL; struct ntlm_buf ndata, sessionkey, tidata; krb5_data cb, type1data, tempdata; krb5_error_code ret; uint32_t type1flags, flags = 0; const char *type = "unknown"; char flagname[256]; size_t mic_offset = 0; KCM_LOG_REQUEST(context, client, opcode); memset(&tidata, 0, sizeof(tidata)); memset(&type2, 0, sizeof(type2)); memset(&type3, 0, sizeof(type3)); sessionkey.data = NULL; sessionkey.length = 0; // kcm_log(10, "NTLM AUTH with cred %s\\%s", domain, user); type2data = DictionaryGetTypedValue(input, CFSTR("type2data"), CFDataGetTypeID()); type1data = DictionaryGetTypedValue(input, CFSTR("type1data"), CFDataGetTypeID()); cb = DictionaryGetTypedValue(input, CFSTR("cb"), CFDataGetTypeID()); targetname = DictionaryGetValue(input, CFSTR("targetname"), CFStringGetTypeID()); type1flags = DictionaryGetValue(input, CFSTR("type1flags"), CFNumberGetTypeID()); /* * */ username = CFDictionaryGetValue(cred->attributes, kHEIMAttrNTLMUsername); userdomain = CFDictionaryGetValue(cred->attributes, kHEIMAttrNTLMDomain); /* * */ ndata.data = CFDataGetBytePtr(type2data); ndata.length = CFDataGetLength(type2data); ret = heim_ntlm_decode_type2(&ndata, &type2); if (ret) goto error; #if 0 /* XXX */ kcm_log(10, "checking for ntlm mirror attack"); ret = check_ntlm_challage(type2.challenge); if (ret) { kcm_log(0, "ntlm mirror attack detected"); goto error; } #endif /* if service name or case matching with domain, let pick the domain */ if (ntlm_domain_is_hostname(userdomain) || strcasecmp(domain, type2.targetname) == 0) { domain = type2.targetname; } else { domain = c->domain; } type3.username = c->user; type3.flags = type2.flags; /* only allow what we negotiated ourself */ type3.flags &= type1flags; type3.targetname = domain; type3.ws = rk_UNCONST("workstation"); /* * Only do NTLM Version 1 if they force us */ if (gss_mo_get(GSS_NTLM_MECHANISM, GSS_C_NTLM_FORCE_V1, NULL)) { type = "v1"; if (type2.flags & NTLM_NEG_NTLM2_SESSION) { unsigned char nonce[8]; if (CCRandomCopyBytes(kCCRandomDefault, nonce, sizeof(nonce))) { ret = EINVAL; goto error; } ret = heim_ntlm_calculate_ntlm2_sess(nonce, type2.challenge, c->nthash.data, &type3.lm, &type3.ntlm); } else { ret = heim_ntlm_calculate_ntlm1(c->nthash.data, c->nthash.length, type2.challenge, &type3.ntlm); } if (ret) goto error; if (type3.flags & NTLM_NEG_KEYEX) { ret = heim_ntlm_build_ntlm1_master(c->nthash.data, c->nthash.length, &sessionkey, &type3.sessionkey); } else { ret = heim_ntlm_v1_base_session(c->nthash.data, c->nthash.length, &sessionkey); } if (ret) goto error; } else { unsigned char ntlmv2[16]; struct ntlm_targetinfo ti; static uint8_t zeros[16] = { 0 }; type = "v2"; /* verify infotarget */ ret = heim_ntlm_decode_targetinfo(&type2.targetinfo, 1, &ti); if (ret) goto error; if (ti.avflags & NTLM_TI_AV_FLAG_GUEST) flags |= KCM_NTLM_FLAG_AV_GUEST; if (ti.channel_bindings.data) free(ti.channel_bindings.data); if (ti.targetname) free(ti.targetname); /* * We are going to use MIC, tell server so it can reject the * authenticate if the mic is missing. */ ti.avflags |= NTLM_TI_AV_FLAG_MIC; ti.targetname = targetname; if (cb.length == 0) { ti.channel_bindings.data = zeros; ti.channel_bindings.length = sizeof(zeros); } else { kcm_log(10, "using channelbindings of size %lu", (unsigned long)cb.length); ti.channel_bindings.data = cb.data; ti.channel_bindings.length = cb.length; } ret = heim_ntlm_encode_targetinfo(&ti, TRUE, &tidata); ti.targetname = NULL; ti.channel_bindings.data = NULL; ti.channel_bindings.length = 0; heim_ntlm_free_targetinfo(&ti); if (ret) goto error; /* * Prefer NTLM_NEG_EXTENDED_SESSION over NTLM_NEG_LM_KEY as * decribed in 2.2.2.5. */ if (type3.flags & NTLM_NEG_NTLM2_SESSION) type3.flags &= ~NTLM_NEG_LM_KEY; if ((type3.flags & NTLM_NEG_LM_KEY) && gss_mo_get(GSS_NTLM_MECHANISM, GSS_C_NTLM_SUPPORT_LM2, NULL)) { ret = heim_ntlm_calculate_lm2(c->nthash.data, c->nthash.length, type3.username, domain, type2.challenge, ntlmv2, &type3.lm); } else { type3.lm.data = malloc(24); if (type3.lm.data == NULL) { ret = ENOMEM; } else { type3.lm.length = 24; memset(type3.lm.data, 0, type3.lm.length); } } if (ret) goto error; ret = heim_ntlm_calculate_ntlm2(c->nthash.data, c->nthash.length, type3.username, domain, type2.challenge, &tidata, ntlmv2, &type3.ntlm); if (ret) goto error; if (type3.flags & NTLM_NEG_KEYEX) { ret = heim_ntlm_build_ntlm2_master(ntlmv2, sizeof(ntlmv2), &type3.ntlm, &sessionkey, &type3.sessionkey); } else { ret = heim_ntlm_v2_base_session(ntlmv2, sizeof(ntlmv2), &type3.ntlm, &sessionkey); } memset(ntlmv2, 0, sizeof(ntlmv2)); if (ret) goto error; } ret = heim_ntlm_encode_type3(&type3, &ndata, &mic_offset); if (ret) goto error; if (ndata.length < CC_MD5_DIGEST_LENGTH) { ret = EINVAL; goto error; } if (mic_offset && mic_offset < ndata.length - CC_MD5_DIGEST_LENGTH) { CCHmacContext mic; uint8_t *p = (uint8_t *)ndata.data + mic_offset; CCHmacInit(&mic, kCCHmacAlgMD5, sessionkey.data, sessionkey.length); CCHmacUpdate(&mic, type1data.data, type1data.length); CCHmacUpdate(&mic, type2data.data, type2data.length); CCHmacUpdate(&mic, ndata.data, ndata.length); CCHmacFinal(&mic, p); } tempdata.data = ndata.data; tempdata.length = ndata.length; ret = krb5_store_data(response, tempdata); heim_ntlm_free_buf(&ndata); if (ret) goto error; output = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); ret = krb5_store_int32(response, flags); if (ret) goto error; tempdata.data = sessionkey.data; tempdata.length = sessionkey.length; ret = krb5_store_data(response, tempdata); if (ret) goto error; ret = krb5_store_string(response, c->user); if (ret) goto error; ret = krb5_store_string(response, domain); if (ret) goto error; ret = krb5_store_uint32(response, type3.flags); if (ret) goto error; heim_ntlm_unparse_flags(type3.flags, flagname, sizeof(flagname)); kcm_log(0, "ntlm %s request processed for %s\\%s flags: %s", type, domain, c->user, flagname); error: HEIMDAL_MUTEX_unlock(&cred_mutex); krb5_data_free(&cb); krb5_data_free(&type1data); krb5_data_free(&type2data); if (type3.lm.data) free(type3.lm.data); if (type3.ntlm.data) free(type3.ntlm.data); if (type3.sessionkey.data) free(type3.sessionkey.data); if (targetname) free(targetname); heim_ntlm_free_type2(&type2); heim_ntlm_free_buf(&sessionkey); heim_ntlm_free_buf(&tidata); free(user); return output; #else return NULL; #endif } #endif /* ENABLE_NTLM */ /* * */ void _HeimCredRegisterNTLM(void) { #if ENABLE_NTLM CFMutableSetRef set = CFSetCreateMutable(NULL, 0, &kCFTypeSetCallBacks); CFMutableDictionaryRef schema; schema = _HeimCredCreateBaseSchema(kHEIMObjectNTLM); CFDictionarySetValue(schema, kHEIMAttrData, CFSTR("d")); CFDictionarySetValue(schema, kHEIMAttrNTLMUsername, CFSTR("Rs")); CFDictionarySetValue(schema, kHEIMAttrNTLMDomain, CFSTR("Rs")); CFDictionarySetValue(schema, kHEIMAttrTransient, CFSTR("b")); CFDictionarySetValue(schema, kHEIMAttrAllowedDomain, CFSTR("as")); CFDictionarySetValue(schema, kHEIMAttrStatus, CFSTR("n")); CFSetAddValue(set, schema); CFRelease(schema); _HeimCredRegisterMech(kHEIMTypeNTLM, set, NULL, NTLMAuthCallback); CFRelease(set); #endif /* ENABLE_NTLM */ }