heimdal/kdc/digest.c

63     krb5_error_code ret;
67     ret = _kdc_get_preferred_key(context,
73     if (ret)
74 	return ret;
108     krb5_error_code ret;
129     ret = heim_ntlm_encode_targetinfo(&ti, 1, &d);
130     if (ret)
131 	return ret;
170     krb5_error_code ret;
175     ret = krb5_parse_name(context, username, &clientprincipal);
176     if (ret)
177 	return ret;
179     ret = _kdc_db_fetch(context, config, clientprincipal,
182     if (ret)
183 	return ret;
185     ret = hdb_entry_get_password(context, db, &user->entry, password);
186     if (ret || password == NULL) {
187 	if (ret == 0) {
188 	    ret = EINVAL;
189 	    krb5_set_error_message(context, ret, "password missing");
194     return ret;
207     krb5_error_code ret = 0;
241     ret = krb5_kt_resolve(context, "HDB:", &id);
242     if (ret) {
247     ret = krb5_rd_req(context,
254     if (ret)
262 	ret = krb5_ticket_get_server(context, ticket, &principal);
263 	if (ret)
266 	ret = EINVAL;
267 	krb5_set_error_message(context, ret, "Wrong digest server principal used");
294 	ret = _kdc_db_fetch(context, config, principal,
296 	if (ret)
306 	ret = krb5_ticket_get_client(context, ticket, &principal);
307 	if (ret)
310 	ret = krb5_unparse_name(context, principal, &client_name);
311 	if (ret) {
316 	ret = _kdc_db_fetch(context, config, principal,
319 	if (ret)
327 	    ret = KRB5KDC_ERR_POLICY;
328 	    krb5_set_error_message(context, ret,
338 	ret = krb5_auth_con_getremotesubkey(context, ac, &key);
339 	if (ret)
342 	    ret = EINVAL;
343 	    krb5_set_error_message(context, ret, "digest: remote subkey not found");
347 	ret = krb5_crypto_init(context, key, 0, &crypto);
349 	if (ret)
353     ret = krb5_decrypt_EncryptedData(context, crypto, KRB5_KU_DIGEST_ENCRYPT,
357     if (ret)
360     ret = decode_DigestReqInner(buf.data, buf.length, &ireq, NULL);
362     if (ret) {
363 	krb5_set_error_message(context, ret, "Failed to decode digest inner request");
390 	    ret = ENOMEM;
391 	    krb5_set_error_message(context, ret, "Failed to decode server nonce");
397 	    ret = ENOMEM;
398 	    krb5_set_error_message(context, ret, "malloc: out of memory");
401 	ret = krb5_store_stringz(sp, ireq.u.init.type);
402 	if (ret) {
414 		ret = ENOMEM;
415 		krb5_set_error_message(context, ret,
423 	ret = krb5_store_stringz(sp, r.u.initReply.nonce);
424 	if (ret) {
433 		ret = ENOMEM;
434 		krb5_set_error_message(context, ret, "malloc: out of memory");
440 		ret = ENOMEM;
441 		krb5_set_error_message(context, ret, "malloc: out of memory");
449 	    ret = krb5_store_stringz(sp, *ireq.u.init.hostname);
450 	    if (ret) {
456 	ret = krb5_storage_to_data(sp, &buf);
457 	if (ret) {
462 	ret = get_digest_key(context, config, server, &crypto);
463 	if (ret)
466 	ret = krb5_create_checksum(context,
476 	if (ret)
479 	ASN1_MALLOC_ENCODE(Checksum, buf.data, buf.length, &res, &size, ret);
481 	if (ret) {
482 	    krb5_set_error_message(context, ret, "Failed to encode "
494 	    ret = ENOMEM;
506 	    ret = ENOMEM;
507 	    krb5_set_error_message(context, ret, "malloc: out of memory");
510 	ret = krb5_store_stringz(sp, ireq.u.digestRequest.type);
511 	if (ret) {
519 	    ret = krb5_store_stringz(sp, *ireq.u.digestRequest.hostname);
520 	    if (ret) {
529 	    ret = ENOMEM;
530 	    krb5_set_error_message(context, ret, "malloc: out of memory");
534 	ret = hex_decode(ireq.u.digestRequest.opaque, buf.data, buf.length);
535 	if (ret <= 0) {
536 	    ret = ENOMEM;
537 	    krb5_set_error_message(context, ret, "Failed to decode opaque");
540 	buf.length = ret;
542 	ret = decode_Checksum(buf.data, buf.length, &res, NULL);
545 	if (ret) {
546 	    krb5_set_error_message(context, ret,
551 	ret = krb5_storage_to_data(sp, &buf);
552 	if (ret) {
560 	    ret = ENOMEM;
561 	    krb5_set_error_message(context, ret, "malloc: out of memory");
575 		ret = ENOMEM;
576 		krb5_set_error_message(context, ret, "Failed to decode serverNonce");
582 	ret = get_digest_key(context, config, server, &crypto);
583 	if (ret)
586 	ret = krb5_verify_checksum(context, crypto,
593 	if (ret)
602 		ret = EINVAL;
603 		krb5_set_error_message(context, ret, "server nonce too short");
609 		ret = EINVAL;
610 		krb5_set_error_message(context, ret, "time screw in server nonce ");
627 		ret = EINVAL;
628 		krb5_set_error_message(context, ret, "Identifier missing "
634 		ret = EINVAL;
635 		krb5_set_error_message(context, ret, "failed to decode identifier");
639 	    ret = get_password_entry(context, config,
642 	    if (ret)
658 		ret = ENOMEM;
664 	    ret = strcasecmp(mdx, ireq.u.digestRequest.responseData);
666 	    if (ret == 0) {
695 	    ret = get_password_entry(context, config,
698 	    if (ret)
729 		ret = ENOMEM;
730 		krb5_set_error_message(context, ret, "malloc: out of memory");
751 		ret = ENOMEM;
752 		krb5_set_error_message(context, ret, "malloc: out of memory");
784 		ret = ENOMEM;
789 	    ret = strcasecmp(mdx, ireq.u.digestRequest.responseData);
791 	    if (ret == 0) {
815 		ret = EINVAL;
816 		krb5_set_error_message(context, ret,
821 		ret = EINVAL;
822 		krb5_set_error_message(context, ret,
845 		    ret = ENOMEM;
846 		    krb5_set_error_message(context, ret,
855 		    ret = ENOMEM;
856 		    krb5_set_error_message(context, ret,
872 	    ret = krb5_parse_name(context, username, &clientprincipal);
873 	    if (ret)
876 	    ret = _kdc_db_fetch(context, config, clientprincipal,
879 	    if (ret) {
880 		krb5_set_error_message(context, ret,
886 	    ret = hdb_enctype2key(context, &user->entry,
888 	    if (ret) {
889 		krb5_set_error_message(context, ret,
896 	    ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
899 	    if (ret) {
900 		krb5_set_error_message(context, ret, "NTLM missing arcfour key");
908 		ret = ENOMEM;
913 	    ret = strcasecmp(mdx, ireq.u.digestRequest.responseData);
914 	    if (ret == 0) {
959 		    ret = ENOMEM;
968 		    ret = ENOMEM;
988 		    ret = ENOMEM;
992 		ret = krb5_data_copy(r.u.response.session_key, md, 16);
993 		if (ret) {
1004 		ret = ENOMEM;
1005 		krb5_set_error_message(context, ret, "malloc: out of memory");
1058 	    ret = ENOMEM;
1059 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1064 	    ret = ENOMEM;
1065 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1072 		ret = ENOMEM;
1073 		krb5_set_error_message(context, ret, "out of random error");
1079 	    ret = ENOMEM;
1080 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1084 	ret = fill_targetinfo(context,
1088 	if (ret) {
1089 	    ret = ENOMEM;
1090 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1100 	    ret = ENOMEM;
1101 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1105 	ret = krb5_storage_write(sp, r.u.ntlmInitReply.challange.data, 8);
1106 	if (ret != 8) {
1107 	    ret = ENOMEM;
1108 	    krb5_set_error_message(context, ret, "storage write challange");
1111 	ret = krb5_store_uint32(sp, r.u.ntlmInitReply.flags);
1112 	if (ret) {
1117 	ret = krb5_storage_to_data(sp, &buf);
1118 	if (ret) {
1123 	ret = get_digest_key(context, config, server, &crypto);
1124 	if (ret)
1127 	ret = krb5_encrypt(context, crypto, KRB5_KU_DIGEST_OPAQUE,
1132 	if (ret)
1154 	ret = krb5_parse_name(context,
1157 	if (ret)
1160 	ret = _kdc_db_fetch(context, config, clientprincipal,
1163 	if (ret) {
1164 	    krb5_set_error_message(context, ret, "NTLM user %s not in database",
1169 	ret = get_digest_key(context, config, server, &crypto);
1170 	if (ret)
1173 	ret = krb5_decrypt(context, crypto, KRB5_KU_DIGEST_OPAQUE,
1178 	if (ret) {
1186 	    ret = ENOMEM;
1187 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1191 	ret = krb5_storage_read(sp, challange, sizeof(challange));
1192 	if (ret != sizeof(challange)) {
1193 	    ret = ENOMEM;
1194 	    krb5_set_error_message(context, ret, "NTLM storage read challange");
1197 	ret = krb5_ret_uint32(sp, &flags);
1198 	if (ret) {
1199 	    krb5_set_error_message(context, ret, "NTLM storage read flags");
1207 	    ret = EINVAL;
1208 	    krb5_set_error_message(context, ret, "NTLM not negotiated");
1212 	ret = hdb_enctype2key(context, &user->entry,
1214 	if (ret) {
1215 	    krb5_set_error_message(context, ret, "NTLM missing arcfour key");
1233 		ret = ENOMEM;
1234 		krb5_set_error_message(context, ret, "malloc: out of memory");
1241 	    ret = heim_ntlm_verify_ntlm2(key->key.keyvalue.data,
1251 	    if (ret) {
1252 		krb5_set_error_message(context, ret, "NTLM v2 verify failed");
1272 		    ret = EINVAL;
1277 		    ret = EINVAL;
1278 		    krb5_set_error_message(context, ret, "LM hash have wrong length "
1301 	    ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
1304 	    if (ret) {
1305 		krb5_set_error_message(context, ret, "NTLM missing arcfour key");
1313 		    ret = EINVAL;
1314 		    krb5_set_error_message(context, ret, "NTLM hash mismatch");
1340 		ret = EINVAL;
1341 		krb5_set_error_message(context, ret,
1349 		ret = EINVAL;
1350 		krb5_set_error_message(context, ret,
1367 		ret = EINVAL;
1368 		krb5_set_error_message(context, ret, "malloc: out of memory");
1372 	    ret = krb5_data_copy(r.u.ntlmResponse.sessionkey,
1374 	    if (ret) {
1375 		krb5_set_error_message(context, ret, "malloc: out of memory");
1408 	ret = EINVAL;
1409 	krb5_set_error_message(context, ret, "unknown operation to digest");
1413 	s = krb5_get_error_message(context, ret);
1425 	    ret = ENOMEM;
1426 	    krb5_set_error_message(context, ret, "malloc: out of memory");
1434     ASN1_MALLOC_ENCODE(DigestRepInner, buf.data, buf.length, &r, &size, ret);
1435     if (ret) {
1436 	krb5_set_error_message(context, ret, "Failed to encode inner digest reply");
1444     ret = krb5_mk_rep (context, ac, &rep.apRep);
1445     if (ret)
1451 	ret = krb5_auth_con_getlocalsubkey(context, ac, &key);
1452 	if (ret)
1455 	ret = krb5_crypto_init(context, key, 0, &crypto);
1457 	if (ret)
1461     ret = krb5_encrypt_EncryptedData(context, crypto, KRB5_KU_DIGEST_ENCRYPT,
1465     ASN1_MALLOC_ENCODE(DigestREP, reply->data, reply->length, &rep, &size, ret);
1466     if (ret) {
1467 	krb5_set_error_message(context, ret, "Failed to encode digest reply");
1477     if (ret)
1478 	krb5_warn(context, ret, "Digest request from %s failed", from);
1506     return ret;