ref: dae5a44111dfb21a714824a5cec2abee4f9f9080
dir: /sys/src/cmd/auth/authsrv.c/
#include <u.h>
#include <libc.h>
#include <bio.h>
#include <ndb.h>
#include <regexp.h>
#include <libsec.h>
#include <authsrv.h>
#include "authcmdlib.h"
Ndb *db;
char raddr[128];
uchar zeros[32];
typedef struct Keyslot Keyslot;
struct Keyslot
{
Authkey;
char id[ANAMELEN];
};
Keyslot hkey, akey, ukey;
uchar keyseed[SHA2_256dlen];
char ticketform;
/* Microsoft auth constants */
enum {
MShashlen = 16,
MSchallen = 8,
MSresplen = 24,
MSchallenv2 = 16,
};
void pak(Ticketreq*);
void ticketrequest(Ticketreq*);
void challengebox(Ticketreq*);
void changepasswd(Ticketreq*);
void apop(Ticketreq*, int);
void chap(Ticketreq*);
void ntlm(Ticketreq*);
void mschap(Ticketreq*, int);
void vnc(Ticketreq*);
int speaksfor(char*, char*);
void replyerror(char*, ...);
void getraddr(char*);
void initkeyseed(void);
void mkkey(char*, Authkey*);
void mkticket(Ticketreq*, Ticket*);
void nthash(uchar hash[MShashlen], char *passwd);
void lmhash(uchar hash[MShashlen], char *passwd);
void ntv2hash(uchar hash[MShashlen], char *passwd, char *user, char *dom);
void mschalresp(uchar resp[MSresplen], uchar hash[MShashlen], uchar chal[MSchallen]);
void desencrypt(uchar data[8], uchar key[7]);
void tickauthreply(Ticketreq*, Authkey*);
void tickauthreply2(Ticketreq*, Authkey*, uchar *, int, uchar *, int);
void safecpy(char*, char*, int);
void catch(void*, char*);
void
main(int argc, char *argv[])
{
char buf[TICKREQLEN];
Ticketreq tr;
int n;
ARGBEGIN{
case 'N':
ticketform = 1;
break;
}ARGEND
strcpy(raddr, "unknown");
if(argc >= 1)
getraddr(argv[argc-1]);
alarm(10*60*1000); /* kill a connection after 10 minutes */
private();
initkeyseed();
db = ndbopen("/lib/ndb/auth");
if(db == 0)
syslog(0, AUTHLOG, "no /lib/ndb/auth");
for(;;){
n = readn(0, buf, sizeof(buf));
if(n <= 0 || convM2TR(buf, n, &tr) <= 0)
exits(0);
switch(tr.type){
case AuthTreq:
ticketrequest(&tr);
break;
case AuthChal:
challengebox(&tr);
break;
case AuthPass:
changepasswd(&tr);
break;
case AuthApop:
apop(&tr, AuthApop);
break;
case AuthChap:
chap(&tr);
break;
case AuthMSchap:
mschap(&tr, MSchallen);
break;
case AuthMSchapv2:
mschap(&tr, MSchallenv2);
break;
case AuthNTLM:
ntlm(&tr);
break;
case AuthCram:
apop(&tr, AuthCram);
break;
case AuthVNC:
vnc(&tr);
break;
case AuthPAK:
pak(&tr);
continue;
default:
syslog(0, AUTHLOG, "unknown ticket request type: %d", tr.type);
exits(0);
}
/* invalidate pak keys */
akey.id[0] = 0;
hkey.id[0] = 0;
ukey.id[0] = 0;
}
/* not reached */
}
void
pak1(char *u, Keyslot *k)
{
uchar y[PAKYLEN];
PAKpriv p;
safecpy(k->id, u, sizeof(k->id));
if(!findkey(KEYDB, k->id, k) || tsmemcmp(k->aes, zeros, AESKEYLEN) == 0) {
syslog(0, AUTHLOG, "pak-fail no AES key for id %s", k->id);
/* make one up so caller doesn't know it was wrong */
mkkey(k->id, k);
authpak_hash(k, k->id);
}
authpak_new(&p, k, y, 0);
if(write(1, y, PAKYLEN) != PAKYLEN)
exits(0);
if(readn(0, y, PAKYLEN) != PAKYLEN)
exits(0);
if(authpak_finish(&p, k, y))
exits(0);
}
void
pak(Ticketreq *tr)
{
static uchar ok[1] = {AuthOK};
if(write(1, ok, 1) != 1)
exits(0);
/* invalidate pak keys */
akey.id[0] = 0;
hkey.id[0] = 0;
ukey.id[0] = 0;
if(tr->hostid[0]) {
if(tr->authid[0])
pak1(tr->authid, &akey);
pak1(tr->hostid, &hkey);
} else if(tr->uid[0]) {
pak1(tr->uid, &ukey);
}
ticketform = 1;
}
int
getkey(char *u, Keyslot *k)
{
/* empty user id is an error */
if(*u == 0)
exits(0);
if(k == &hkey && strcmp(u, k->id) == 0)
return 1;
if(k == &akey && strcmp(u, k->id) == 0)
return 1;
if(k == &ukey && strcmp(u, k->id) == 0)
return 1;
if(ticketform != 0){
syslog(0, AUTHLOG, "need DES key for %s, but DES is disabled", u);
replyerror("DES is disabled");
exits(0);
}
return findkey(KEYDB, u, k);
}
void
ticketrequest(Ticketreq *tr)
{
char tbuf[2*MAXTICKETLEN+1];
Ticket t;
int n;
if(tr->uid[0] == 0)
exits(0);
if(!getkey(tr->authid, &akey)){
/* make one up so caller doesn't know it was wrong */
mkkey(tr->authid, &akey);
syslog(0, AUTHLOG, "tr-fail authid %s", tr->authid);
}
if(!getkey(tr->hostid, &hkey)){
/* make one up so caller doesn't know it was wrong */
mkkey(tr->hostid, &hkey);
syslog(0, AUTHLOG, "tr-fail hostid %s(%s)", tr->hostid, raddr);
}
mkticket(tr, &t);
if(!speaksfor(tr->hostid, tr->uid)){
mkkey(tr->authid, &akey);
mkkey(tr->hostid, &hkey);
syslog(0, AUTHLOG, "tr-fail %s@%s(%s) -> %s@%s no speaks for",
tr->uid, tr->hostid, raddr, tr->uid, tr->authid);
}
n = 0;
tbuf[n++] = AuthOK;
t.num = AuthTc;
n += convT2M(&t, tbuf+n, sizeof(tbuf)-n, &hkey);
t.num = AuthTs;
n += convT2M(&t, tbuf+n, sizeof(tbuf)-n, &akey);
if(write(1, tbuf, n) != n)
exits(0);
syslog(0, AUTHLOG, "tr-ok %s@%s(%s) -> %s@%s", tr->uid, tr->hostid, raddr, tr->uid, tr->authid);
}
void
challengebox(Ticketreq *tr)
{
char kbuf[DESKEYLEN], nkbuf[DESKEYLEN], buf[NETCHLEN+1];
char *key, *netkey, *err;
long chal;
if(tr->uid[0] == 0)
exits(0);
key = finddeskey(KEYDB, tr->uid, kbuf);
netkey = finddeskey(NETKEYDB, tr->uid, nkbuf);
if(key == nil && netkey == nil){
/* make one up so caller doesn't know it was wrong */
genrandom((uchar*)nkbuf, DESKEYLEN);
netkey = nkbuf;
syslog(0, AUTHLOG, "cr-fail uid %s@%s", tr->uid, raddr);
}
if(!getkey(tr->hostid, &hkey)){
/* make one up so caller doesn't know it was wrong */
mkkey(tr->hostid, &hkey);
syslog(0, AUTHLOG, "cr-fail hostid %s %s@%s", tr->hostid, tr->uid, raddr);
}
/*
* challenge-response
*/
memset(buf, 0, sizeof(buf));
buf[0] = AuthOK;
chal = nfastrand(MAXNETCHAL);
sprint(buf+1, "%lud", chal);
if(write(1, buf, NETCHLEN+1) != NETCHLEN+1)
exits(0);
if(readn(0, buf, NETCHLEN) != NETCHLEN)
exits(0);
if(!(key != nil && netcheck(key, chal, buf))
&& !(netkey != nil && netcheck(netkey, chal, buf))
&& (err = secureidcheck(tr->uid, buf)) != nil){
replyerror("cr-fail %s %s %s", err, tr->uid, raddr);
logfail(tr->uid);
return;
}
succeed(tr->uid);
/*
* reply with ticket & authenticator
*/
tickauthreply(tr, &hkey);
syslog(0, AUTHLOG, "cr-ok %s@%s(%s)", tr->uid, tr->hostid, raddr);
}
void
changepasswd(Ticketreq *tr)
{
char tbuf[MAXTICKETLEN+1], prbuf[MAXPASSREQLEN], *err;
Passwordreq pr;
Authkey nkey;
Ticket t;
int n, m;
if(!getkey(tr->uid, &ukey)){
/* make one up so caller doesn't know it was wrong */
mkkey(tr->uid, &ukey);
syslog(0, AUTHLOG, "cp-fail uid %s@%s", tr->uid, raddr);
}
/* send back a ticket with a new key */
mkticket(tr, &t);
t.num = AuthTp;
n = 0;
tbuf[n++] = AuthOK;
n += convT2M(&t, tbuf+n, sizeof(tbuf)-n, &ukey);
if(write(1, tbuf, n) != n)
exits(0);
/* loop trying passwords out */
for(;;){
for(n=0; (m = convM2PR(prbuf, n, &pr, &t)) <= 0; n += m){
m = -m;
if(m <= n || m > sizeof(prbuf))
exits(0);
m -= n;
if(readn(0, prbuf+n, m) != m)
exits(0);
}
if(pr.num != AuthPass){
replyerror("protocol botch1: %s", raddr);
exits(0);
}
passtokey(&nkey, pr.old);
if(tsmemcmp(ukey.des, nkey.des, DESKEYLEN) != 0){
replyerror("protocol botch2: %s", raddr);
continue;
}
if(tsmemcmp(ukey.aes, zeros, AESKEYLEN) != 0 && tsmemcmp(ukey.aes, nkey.aes, AESKEYLEN) != 0){
replyerror("protocol botch3: %s", raddr);
continue;
}
if(*pr.new){
err = okpasswd(pr.new);
if(err){
replyerror("%s %s", err, raddr);
continue;
}
passtokey(&nkey, pr.new);
}
if(pr.changesecret && setsecret(KEYDB, tr->uid, pr.secret) == 0){
replyerror("can't write secret %s", raddr);
continue;
}
if(*pr.new && setkey(KEYDB, tr->uid, &nkey) == 0){
replyerror("can't write key %s", raddr);
continue;
}
memmove(ukey.des, nkey.des, DESKEYLEN);
memmove(ukey.aes, nkey.aes, AESKEYLEN);
break;
}
succeed(tr->uid);
prbuf[0] = AuthOK;
if(write(1, prbuf, 1) != 1)
exits(0);
}
static char*
domainname(void)
{
static char sysname[Maxpath];
static char *domain;
int n;
if(domain != nil)
return domain;
if(*sysname)
return sysname;
domain = csgetvalue(0, "sys", sysname, "dom", nil);
if(domain != nil)
return domain;
n = readfile("/dev/sysname", sysname, sizeof(sysname)-1);
if(n < 0){
strcpy(sysname, "kremvax");
return sysname;
}
sysname[n] = 0;
return sysname;
}
static int
h2b(char c)
{
if(c >= '0' && c <= '9')
return c - '0';
if(c >= 'A' && c <= 'F')
return c - 'A' + 10;
if(c >= 'a' && c <= 'f')
return c - 'a' + 10;
return 0;
}
void
apop(Ticketreq *tr, int type)
{
int challen, i, n, tries;
char *secret, *p;
Ticketreq treq;
DigestState *s;
char sbuf[SECRETLEN];
char trbuf[TICKREQLEN];
char buf[MD5dlen*2];
uchar digest[MD5dlen], resp[MD5dlen];
ulong rb[4];
char chal[256];
USED(tr);
/*
* Create a challenge and send it.
*/
genrandom((uchar*)rb, sizeof(rb));
p = chal;
p += snprint(p, sizeof(chal), "<%lux%lux.%lux%lux@%s>",
rb[0], rb[1], rb[2], rb[3], domainname());
challen = p - chal;
print("%c%-5d%s", AuthOKvar, challen, chal);
tries = 5;
Retry:
if(--tries < 0)
exits(0);
/*
* get ticket request
*/
n = readn(0, trbuf, sizeof(trbuf));
if(n <= 0 || convM2TR(trbuf, n, &treq) <= 0)
exits(0);
tr = &treq;
if(tr->type != type || tr->uid[0] == 0)
exits(0);
/*
* read response
*/
if(readn(0, buf, MD5dlen*2) != MD5dlen*2)
exits(0);
for(i = 0; i < MD5dlen; i++)
resp[i] = (h2b(buf[2*i])<<4)|h2b(buf[2*i+1]);
/*
* lookup
*/
secret = findsecret(KEYDB, tr->uid, sbuf);
if(!getkey(tr->hostid, &hkey) || secret == nil){
replyerror("apop-fail bad response %s", raddr);
goto Retry;
}
/*
* check for match
*/
if(type == AuthCram){
hmac_md5((uchar*)chal, challen,
(uchar*)secret, strlen(secret),
digest, nil);
} else {
s = md5((uchar*)chal, challen, 0, 0);
md5((uchar*)secret, strlen(secret), digest, s);
}
if(tsmemcmp(digest, resp, MD5dlen) != 0){
replyerror("apop-fail bad response %s", raddr);
logfail(tr->uid);
goto Retry;
}
succeed(tr->uid);
/*
* reply with ticket & authenticator
*/
tickauthreply(tr, &hkey);
if(type == AuthCram)
syslog(0, AUTHLOG, "cram-ok %s %s", tr->uid, raddr);
else
syslog(0, AUTHLOG, "apop-ok %s %s", tr->uid, raddr);
}
enum {
VNCchallen= 16,
};
/* VNC reverses the bits of each byte before using as a des key */
uchar swizzletab[256] = {
0x0, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0, 0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
0x8, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8, 0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
0x4, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4, 0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
0xc, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec, 0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
0x2, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2, 0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
0xa, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea, 0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
0x6, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6, 0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
0xe, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee, 0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
0x1, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1, 0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
0x9, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9, 0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
0x5, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5, 0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
0xd, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed, 0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
0x3, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3, 0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
0xb, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb, 0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
0x7, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7, 0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
0xf, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef, 0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff,
};
void
vnc(Ticketreq *tr)
{
uchar chal[VNCchallen+6];
uchar reply[VNCchallen];
char sbuf[SECRETLEN];
char *secret;
DESstate s;
int i;
if(tr->uid[0] == 0)
exits(0);
/*
* Create a challenge and send it.
*/
genrandom(chal+6, VNCchallen);
chal[0] = AuthOKvar;
sprint((char*)chal+1, "%-5d", VNCchallen);
if(write(1, chal, sizeof(chal)) != sizeof(chal))
exits(0);
/*
* get response
*/
if(readn(0, reply, sizeof(reply)) != sizeof(reply))
exits(0);
/*
* lookup keys (and swizzle bits)
*/
memset(sbuf, 0, sizeof(sbuf));
secret = findsecret(KEYDB, tr->uid, sbuf);
if(!getkey(tr->hostid, &hkey) || secret == nil){
mkkey(tr->hostid, &hkey);
genrandom((uchar*)sbuf, sizeof(sbuf));
secret = sbuf;
}
for(i = 0; i < 8; i++)
secret[i] = swizzletab[(uchar)secret[i]];
/*
* decrypt response and compare
*/
setupDESstate(&s, (uchar*)secret, nil);
desECBdecrypt(reply, sizeof(reply), &s);
if(tsmemcmp(reply, chal+6, VNCchallen) != 0){
replyerror("vnc-fail bad response %s", raddr);
logfail(tr->uid);
return;
}
succeed(tr->uid);
/*
* reply with ticket & authenticator
*/
tickauthreply(tr, &hkey);
syslog(0, AUTHLOG, "vnc-ok %s %s", tr->uid, raddr);
}
void
chap(Ticketreq *tr)
{
char *secret;
DigestState *s;
char sbuf[SECRETLEN];
uchar digest[MD5dlen];
char chal[CHALLEN];
OChapreply reply;
int tries;
/*
* Create a challenge and send it.
*/
genrandom((uchar*)chal, sizeof(chal));
if(write(1, chal, sizeof(chal)) != sizeof(chal))
exits(0);
tries = 5;
Retry:
if(--tries < 0)
exits(0);
/*
* get chap reply
*/
if(readn(0, &reply, OCHAPREPLYLEN) < 0)
exits(0);
safecpy(tr->uid, reply.uid, sizeof(tr->uid));
if(tr->uid[0] == 0)
exits(0);
/*
* lookup
*/
secret = findsecret(KEYDB, tr->uid, sbuf);
if(!getkey(tr->hostid, &hkey) || secret == nil){
replyerror("chap-fail bad response %s", raddr);
goto Retry;
}
/*
* check for match
*/
s = md5(&reply.id, 1, 0, 0);
md5((uchar*)secret, strlen(secret), 0, s);
md5((uchar*)chal, sizeof(chal), digest, s);
if(tsmemcmp(digest, reply.resp, MD5dlen) != 0){
replyerror("chap-fail bad response %s", raddr);
logfail(tr->uid);
goto Retry;
}
succeed(tr->uid);
/*
* reply with ticket & authenticator
*/
tickauthreply(tr, &hkey);
syslog(0, AUTHLOG, "chap-ok %s %s", tr->uid, raddr);
/* no secret after ticket */
exits(0);
}
static uchar ntblobsig[] = {0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
void
ntlm(Ticketreq *tr)
{
char *secret;
char sbuf[SECRETLEN], windom[DOMLEN];
uchar chal[MSchallen], ntblob[1024];
uchar hash[MShashlen];
uchar resp[MSresplen];
NTLMreply reply;
int dupe, lmok, ntok, ntbloblen;
DigestState *s;
int tries;
/*
* Create a challenge and send it.
*/
genrandom(chal, sizeof(chal));
if(write(1, chal, MSchallen) != MSchallen)
exits(0);
tries = 5;
Retry:
if(--tries < 0)
exits(0);
/*
* get NTLM reply
*/
if(readn(0, &reply, NTLMREPLYLEN) < 0)
exits(0);
ntbloblen = 0;
if(memcmp(reply.NTresp+16, ntblobsig, sizeof(ntblobsig)) == 0){
ntbloblen = reply.len[0] | reply.len[1]<<8;
ntbloblen -= NTLMREPLYLEN;
if(ntbloblen < 0 || ntbloblen > sizeof(ntblob)-8)
exits(0);
if(readn(0, ntblob+8, ntbloblen) < 0)
exits(0);
memmove(ntblob, reply.NTresp+16, 8);
ntbloblen += 8;
}
safecpy(tr->uid, reply.uid, sizeof(tr->uid));
if(tr->uid[0] == 0)
exits(0);
safecpy(windom, reply.dom, sizeof(windom));
/*
* lookup
*/
secret = findsecret(KEYDB, tr->uid, sbuf);
if(!getkey(tr->hostid, &hkey) || secret == nil){
replyerror("ntlm-fail bad response %s@%s/%s(%s)", tr->uid, windom, tr->hostid, raddr);
goto Retry;
}
if(ntbloblen > 0){
/* NTLMv2 */
ntv2hash(hash, secret, tr->uid, windom);
/*
* LmResponse = Cat(HMAC_MD5(LmHash, Cat(SC, CC)), CC)
*/
s = hmac_md5(chal, MSchallen, hash, MShashlen, nil, nil);
hmac_md5((uchar*)reply.LMresp+16, MSchallen, hash, MShashlen, resp, s);
lmok = tsmemcmp(resp, reply.LMresp, 16) == 0;
/*
* NtResponse = Cat(HMAC_MD5(NtHash, Cat(SC, NtBlob)), NtBlob)
*/
s = hmac_md5(chal, MSchallen, hash, MShashlen, nil, nil);
hmac_md5(ntblob, ntbloblen, hash, MShashlen, resp, s);
ntok = tsmemcmp(resp, reply.NTresp, 16) == 0;
/*
* LM response can be all zeros or signature key,
* so make it valid when the NT respone matches.
*/
lmok |= ntok;
dupe = 0;
} else if(memcmp(reply.NTresp, zeros, MSresplen) == 0){
/* LMv2 */
ntv2hash(hash, secret, tr->uid, windom);
/*
* LmResponse = Cat(HMAC_MD5(LmHash, Cat(SC, CC)), CC)
*/
s = hmac_md5(chal, MSchallen, hash, MShashlen, nil, nil);
hmac_md5((uchar*)reply.LMresp+16, MSchallen, hash, MShashlen, resp, s);
lmok = ntok = tsmemcmp(resp, reply.LMresp, 16) == 0;
dupe = 0;
} else {
/* LM+NTLM */
lmhash(hash, secret);
mschalresp(resp, hash, chal);
lmok = tsmemcmp(resp, reply.LMresp, MSresplen) == 0;
nthash(hash, secret);
mschalresp(resp, hash, chal);
ntok = tsmemcmp(resp, reply.NTresp, MSresplen) == 0;
dupe = tsmemcmp(reply.LMresp, reply.NTresp, MSresplen) == 0;
}
/*
* It is valid to send the same response in both the LM and NTLM
* fields provided one of them is correct, if neither matches,
* or the two fields are different and either fails to match,
* the whole sha-bang fails.
*
* This is an improvement in security as it allows clients who
* wish to do NTLM auth (which is insecure) not to send
* LM tokens (which is very insecure).
*
* Windows servers supports clients doing this also though
* windows clients don't seem to use the feature.
*/
if((!ntok && !lmok) || ((!ntok || !lmok) && !dupe)){
replyerror("ntlm-fail bad response %s@%s/%s(%s)", tr->uid, windom, tr->hostid, raddr);
logfail(tr->uid);
goto Retry;
}
succeed(tr->uid);
/*
* reply with ticket & authenticator
*/
tickauthreply(tr, &hkey);
syslog(0, AUTHLOG, "ntlm-ok %s@%s/%s(%s)", tr->uid, windom, tr->hostid, raddr);
exits(0);
}
void
mschap(Ticketreq *tr, int nchal)
{
char *secret;
char sbuf[SECRETLEN];
uchar chal[16];
uchar hash[MShashlen];
uchar resp[MSresplen];
OMSchapreply reply;
int dupe, lmok, ntok;
uchar phash[SHA1dlen], chash[SHA1dlen], ahash[SHA1dlen];
DigestState *s;
int tries;
/*
* Create a challenge and send it.
*/
genrandom(chal, sizeof(chal));
if(write(1, chal, nchal) != nchal)
exits(0);
tries = 5;
Retry:
if(--tries < 0)
exits(0);
/*
* get chap reply
*/
if(readn(0, &reply, OMSCHAPREPLYLEN) < 0)
exits(0);
safecpy(tr->uid, reply.uid, sizeof(tr->uid));
if(tr->uid[0] == 0)
exits(0);
/*
* lookup
*/
secret = findsecret(KEYDB, tr->uid, sbuf);
if(!getkey(tr->hostid, &hkey) || secret == nil){
replyerror("mschap-fail bad response %s/%s(%s)", tr->uid, tr->hostid, raddr);
goto Retry;
}
if(nchal == MSchallenv2){
/* MSCHAPv2 */
s = sha1((uchar*)reply.LMresp, nchal, nil, nil);
s = sha1(chal, nchal, nil, s);
sha1((uchar*)tr->uid, strlen(tr->uid), chash, s);
nthash(hash, secret);
mschalresp(resp, hash, chash);
ntok = lmok = tsmemcmp(resp, reply.NTresp, MSresplen) == 0;
dupe = 0;
} else {
/* MSCHAP (LM+NTLM) */
lmhash(hash, secret);
mschalresp(resp, hash, chal);
lmok = tsmemcmp(resp, reply.LMresp, MSresplen) == 0;
nthash(hash, secret);
mschalresp(resp, hash, chal);
ntok = tsmemcmp(resp, reply.NTresp, MSresplen) == 0;
dupe = tsmemcmp(reply.LMresp, reply.NTresp, MSresplen) == 0;
}
/*
* It is valid to send the same response in both the LM and NTLM
* fields provided one of them is correct, if neither matches,
* or the two fields are different and either fails to match,
* the whole sha-bang fails.
*
* This is an improvement in security as it allows clients who
* wish to do NTLM auth (which is insecure) not to send
* LM tokens (which is very insecure).
*
* Windows servers supports clients doing this also though
* windows clients don't seem to use the feature.
*/
if((!ntok && !lmok) || ((!ntok || !lmok) && !dupe)){
replyerror("mschap-fail bad response %s/%s(%s)", tr->uid, tr->hostid, raddr);
logfail(tr->uid);
goto Retry;
}
succeed(tr->uid);
nthash(hash, secret);
md4(hash, 16, hash, nil);
/*
* reply with ticket & authenticator
*/
if(nchal == MSchallenv2){
s = sha1(hash, 16, nil, nil);
sha1((uchar*)reply.NTresp, MSresplen, nil, s);
sha1((uchar*)"This is the MPPE Master Key", 27, phash, s);
s = sha1(hash, 16, nil, nil);
sha1((uchar*)reply.NTresp, MSresplen, nil, s);
sha1((uchar*)"Magic server to client signing constant", 39, ahash, s);
s = sha1(ahash, 20, nil, nil);
sha1(chash, 8, nil, s);
sha1((uchar*)"Pad to make it do more than one iteration", 41, ahash, s);
tickauthreply2(tr, &hkey, phash, 16, ahash, 20);
} else {
s = sha1(hash, 16, nil, nil);
sha1(hash, 16, nil, s);
sha1(chal, 8, phash, s);
tickauthreply2(tr, &hkey, phash, 16, nil, 0);
}
syslog(0, AUTHLOG, "mschap-ok %s/%s(%s)", tr->uid, tr->hostid, raddr);
exits(0);
}
void
nthash(uchar hash[MShashlen], char *passwd)
{
DigestState *ds;
uchar b[2];
Rune r;
ds = md4(nil, 0, nil, nil);
while(*passwd){
passwd += chartorune(&r, passwd);
b[0] = r & 0xff;
b[1] = r >> 8;
md4(b, 2, nil, ds);
}
md4(nil, 0, hash, ds);
}
void
ntv2hash(uchar hash[MShashlen], char *passwd, char *user, char *dom)
{
uchar v1hash[MShashlen];
DigestState *ds;
uchar b[2];
Rune r;
nthash(v1hash, passwd);
/*
* Some documentation insists that the username must be forced to
* uppercase, but the domain name should not be. Other shows both
* being forced to uppercase. I am pretty sure this is irrevevant as the
* domain name passed from the remote server always seems to be in
* uppercase already.
*/
ds = hmac_md5(nil, 0, v1hash, sizeof(v1hash), nil, nil);
while(*user){
user += chartorune(&r, user);
r = toupperrune(r);
b[0] = r & 0xff;
b[1] = r >> 8;
hmac_md5(b, 2, v1hash, sizeof(v1hash), nil, ds);
}
while(*dom){
dom += chartorune(&r, dom);
b[0] = r & 0xff;
b[1] = r >> 8;
hmac_md5(b, 2, v1hash, sizeof(v1hash), nil, ds);
}
hmac_md5(nil, 0, v1hash, sizeof(v1hash), hash, ds);
}
void
lmhash(uchar hash[MShashlen], char *passwd)
{
uchar buf[14];
char *stdtext = "KGS!@#$%";
int i;
memset(buf, 0, sizeof(buf));
strncpy((char*)buf, passwd, sizeof(buf));
for(i=0; i<sizeof(buf); i++)
if(buf[i] >= 'a' && buf[i] <= 'z')
buf[i] += 'A' - 'a';
memcpy(hash, stdtext, 8);
memcpy(hash+8, stdtext, 8);
desencrypt(hash, buf);
desencrypt(hash+8, buf+7);
}
void
mschalresp(uchar resp[MSresplen], uchar hash[MShashlen], uchar chal[MSchallen])
{
int i;
uchar buf[21];
memset(buf, 0, sizeof(buf));
memcpy(buf, hash, MShashlen);
for(i=0; i<3; i++) {
memmove(resp+i*MSchallen, chal, MSchallen);
desencrypt(resp+i*MSchallen, buf+i*7);
}
}
void
desencrypt(uchar data[8], uchar key[7])
{
ulong ekey[32];
key_setup(key, ekey);
block_cipher(ekey, data, 0);
}
/*
* return true of the speaker may speak for the user
*
* a speaker may always speak for himself/herself
*/
int
speaksfor(char *speaker, char *user)
{
Ndbtuple *tp, *ntp;
Ndbs s;
int ok;
char notuser[Maxpath];
if(strcmp(speaker, user) == 0)
return 1;
if(db == nil)
return 0;
tp = ndbsearch(db, &s, "hostid", speaker);
if(tp == nil)
return 0;
ok = 0;
snprint(notuser, sizeof notuser, "!%s", user);
for(ntp = tp; ntp != nil; ntp = ntp->entry)
if(strcmp(ntp->attr, "uid") == 0){
if(strcmp(ntp->val, notuser) == 0){
ok = 0;
break;
}
if(*ntp->val == '*' || strcmp(ntp->val, user) == 0)
ok = 1;
}
ndbfree(tp);
return ok;
}
/*
* return an error reply
*/
void
replyerror(char *fmt, ...)
{
char buf[AERRLEN+1];
va_list arg;
memset(buf, 0, sizeof(buf));
va_start(arg, fmt);
vseprint(buf + 1, buf + sizeof(buf), fmt, arg);
va_end(arg);
buf[AERRLEN] = 0;
buf[0] = AuthErr;
write(1, buf, AERRLEN+1);
syslog(0, AUTHLOG, buf+1);
}
void
getraddr(char *dir)
{
int n;
char *cp;
char file[Maxpath];
raddr[0] = 0;
snprint(file, sizeof(file), "%s/remote", dir);
n = readfile(file, raddr, sizeof(raddr)-1);
if(n < 0)
return;
raddr[n] = 0;
cp = strchr(raddr, '\n');
if(cp)
*cp = 0;
cp = strchr(raddr, '!');
if(cp)
*cp = 0;
}
void
initkeyseed(void)
{
int fd;
genrandom(keyseed, sizeof(keyseed));
if((fd = open("/adm/keyseed", OREAD)) >= 0){
werrstr("file truncated");
if(read(fd, keyseed, sizeof(keyseed)) == sizeof(keyseed)){
close(fd);
return;
}
close(fd);
}
syslog(0, AUTHLOG, "initkeyseed: no keyseed: %r");
if((fd = create("/adm/keyseed", OWRITE, 0600)) < 0){
syslog(0, AUTHLOG, "initkeyseed: can't create: %r");
return;
}
write(fd, keyseed, sizeof(keyseed));
close(fd);
}
void
mkkey(char *id, Authkey *a)
{
uchar h[SHA2_256dlen];
genrandom((uchar*)a, sizeof(Authkey));
/*
* the DES key has to be constant for a user in each response,
* so we make one up pseudo randomly from a keyseed and user name.
*/
hmac_sha2_256((uchar*)id, strlen(id), keyseed, sizeof(keyseed), h, nil);
memmove(a->des, h, DESKEYLEN);
memset(h, 0, sizeof(h));
}
void
mkticket(Ticketreq *tr, Ticket *t)
{
memset(t, 0, sizeof(Ticket));
memmove(t->chal, tr->chal, CHALLEN);
safecpy(t->cuid, tr->uid, ANAMELEN);
safecpy(t->suid, tr->uid, ANAMELEN);
genrandom(t->key, NONCELEN);
t->form = ticketform;
}
/*
* reply with ticket and authenticator
*/
/*
* reply with ticket and authenticator
*/
void
tickauthreply(Ticketreq *tr, Authkey *key)
{
tickauthreply2(tr, key, nil, 0, nil, 0);
}
/*
* reply with ticket and authenticator with
* secret s[ns] and authenticator data a[na].
*/
void
tickauthreply2(Ticketreq *tr, Authkey *key, uchar *ps, int ns, uchar *pa, int na)
{
Ticket t;
Authenticator a;
char buf[MAXTICKETLEN+MAXAUTHENTLEN+1];
int n;
mkticket(tr, &t);
if(t.form != 0 && ns > 0){
assert(ns <= NONCELEN);
memmove(t.key, ps, ns);
}
t.num = AuthTs;
n = 0;
buf[n++] = AuthOK;
n += convT2M(&t, buf+n, sizeof(buf)-n, key);
memset(&a, 0, sizeof(a));
memmove(a.chal, t.chal, CHALLEN);
genrandom(a.rand, NONCELEN);
if(t.form != 0 && na > 0){
assert(na <= NONCELEN);
memmove(a.rand, pa, na);
}
a.num = AuthAc;
n += convA2M(&a, buf+n, sizeof(buf)-n, &t);
if(write(1, buf, n) != n)
exits(0);
}
void
safecpy(char *to, char *from, int len)
{
strncpy(to, from, len);
to[len-1] = 0;
}
void
catch(void*, char *msg)
{
if(strstr(msg, "alarm") != nil)
noted(NCONT);
noted(NDFLT);
}