ntp/ntpd/ntp_signd.c

3    Licenced under the same terms as NTP itself.
25 #include <sys/un.h>
27 /* socket routines by tridge - from junkcode.samba.org */
30   connect to a unix domain socket
35 	int fd;
37 	if (!name) {
45 	fd = socket(AF_UNIX, SOCK_STREAM, 0);
46 	if (fd == -1) {
50 	if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
51 		close(fd);
55 	return fd;
63 write_all(int fd, const void *buf, size_t len)
67 		int n = write(fd, buf, len);
68 		if (n <= 0) return total;
80 read_all(int fd, void *buf, size_t len)
84 		int n = read(fd, buf, len);
85 		if (n <= 0) return total;
94   send a packet in length prefix format
97 send_packet(int fd, const char *buf, uint32_t len)
100 	if (write_all(fd, &net_len, sizeof(net_len)) != sizeof(net_len)) return -1;
101 	if (write_all(fd, buf, len) != len) return -1;
106   receive a packet in length prefix format
109 recv_packet(int fd, char **buf, uint32_t *len)
111 	if (read_all(fd, len, sizeof(*len)) != sizeof(*len)) return -1;
114 	if (read_all(fd, *buf, *len) != *len) {
132 	/* We are here because it was detected that the client
133 	 * sent an all-zero signature, and we therefore know
134 	 * it's windows trying to talk to an AD server
136 	 * Because we don't want to dive into Samba's secrets
137 	 * database just to find the long-term kerberos key
138 	 * that is re-used as the NTP key, we instead hand the
139 	 * packet over to Samba to sign, and return to us.
141 	 * The signing method Samba will use is described by
142 	 * Microsoft in MS-SNTP, found here:
143 	 * http://msdn.microsoft.com/en-us/library/cc212930.aspx
146 	int fd, sendlen;
149 		uint32_t op;
157 		uint32_t op;
168 	samba_pkt.op = 0; /* Sign message */
169 	/* This will be echoed into the reply - a different
175 	/* Swap the byte order back - it's actually little
176 	 * endian on the wire, but it was read above as
183 	fd = ux_socket_connect(full_socket);
184 	/* Only continue with this if we can talk to Samba */
185 	if (fd != -1) {
186 		/* Send old packet to Samba, expect response */
187 		/* Packet to Samba is quite simple:
188 		   All values BIG endian except key ID as noted
189 		   [packet size as BE] - 4 bytes
191 		   [packet ID] - 4 bytes
193 		   [key id] - LITTLE endian (as on wire) - 4 bytes
194 		   [message to sign] - as marshalled, without signature
197 		if (send_packet(fd, (char *)&samba_pkt, offsetof(struct samba_key_in, pkt) + LEN_PKT_NOMAC) != 0) {
198 			/* Huh?  could not talk to Samba... */
199 			close(fd);
203 		if (recv_packet(fd, &reply, &reply_len) != 0) {
204 			if (reply) {
207 			close(fd);
210 		/* Return packet is also simple:
214 		   (optional) [signed message] - as provided before, with signature appended
217 		if (reply_len <= sizeof(samba_reply)) {
219 			if (ntohl(samba_reply.op) == 3 && reply_len >  offsetof(struct samba_key_out, pkt)) {
224 				if (debug)
226 						"transmit ntp_signd packet: at %ld %s->%s mode %d keyid %08x len %d\n",
233 		if (reply) {
236 		close(fd);