source3/utils/ntlm_auth.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
   9    Copyright (C) Robert O'Callahan 2006 (added cached credential code).
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 2 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27 #include "utils/ntlm_auth.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_WINBIND
  31
  32 #define SQUID_BUFFER_SIZE 2010
  33
  34 enum stdio_helper_mode {
  35         SQUID_2_4_BASIC,
  36         SQUID_2_5_BASIC,
  37         SQUID_2_5_NTLMSSP,
  38         NTLMSSP_CLIENT_1,
  39         GSS_SPNEGO,
  40         GSS_SPNEGO_CLIENT,
  41         NTLM_SERVER_1,
  42         NTLM_CHANGE_PASSWORD_1,
  43         NUM_HELPER_MODES
  44 };
  45
  46 typedef void (*stdio_helper_function)(enum stdio_helper_mode stdio_helper_mode,
  47                                      char *buf, int length);
  48
  49 static void manage_squid_basic_request (enum stdio_helper_mode stdio_helper_mode,
  50                                         char *buf, int length);
  51
  52 static void manage_squid_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode,
  53                                           char *buf, int length);
  54
  55 static void manage_client_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode,
  56                                            char *buf, int length);
  57
  58 static void manage_gss_spnego_request (enum stdio_helper_mode stdio_helper_mode,
  59                                        char *buf, int length);
  60
  61 static void manage_gss_spnego_client_request (enum stdio_helper_mode stdio_helper_mode,
  62                                               char *buf, int length);
  63
  64 static void manage_ntlm_server_1_request (enum stdio_helper_mode stdio_helper_mode,
  65                                           char *buf, int length);
  66
  67 static void manage_ntlm_change_password_1_request(enum stdio_helper_mode helper_mode, char *buf, int length);
  68
  69 static const struct {
  70         enum stdio_helper_mode mode;
  71         const char *name;
  72         stdio_helper_function fn;
  73 } stdio_helper_protocols[] = {
  74         { SQUID_2_4_BASIC, "squid-2.4-basic", manage_squid_basic_request},
  75         { SQUID_2_5_BASIC, "squid-2.5-basic", manage_squid_basic_request},
  76         { SQUID_2_5_NTLMSSP, "squid-2.5-ntlmssp", manage_squid_ntlmssp_request},
  77         { NTLMSSP_CLIENT_1, "ntlmssp-client-1", manage_client_ntlmssp_request},
  78         { GSS_SPNEGO, "gss-spnego", manage_gss_spnego_request},
  79         { GSS_SPNEGO_CLIENT, "gss-spnego-client", manage_gss_spnego_client_request},
  80         { NTLM_SERVER_1, "ntlm-server-1", manage_ntlm_server_1_request},
  81         { NTLM_CHANGE_PASSWORD_1, "ntlm-change-password-1", manage_ntlm_change_password_1_request},
  82         { NUM_HELPER_MODES, NULL, NULL}
  83 };
  84
  85 extern int winbindd_fd;
  86
  87 const char *opt_username;
  88 const char *opt_domain;
  89 const char *opt_workstation;
  90 const char *opt_password;
  91 static DATA_BLOB opt_challenge;
  92 static DATA_BLOB opt_lm_response;
  93 static DATA_BLOB opt_nt_response;
  94 static int request_lm_key;
  95 static int request_user_session_key;
  96 static int use_cached_creds;
  97
  98 static const char *require_membership_of;
  99 static const char *require_membership_of_sid;
 100
 101 static char winbind_separator(void)
 102 {
 103         struct winbindd_response response;
 104         static BOOL got_sep;
 105         static char sep;
 106
 107         if (got_sep)
 108                 return sep;
 109
 110         ZERO_STRUCT(response);
 111
 112         /* Send off request */
 113
 114         if (winbindd_request_response(WINBINDD_INFO, NULL, &response) !=
 115             NSS_STATUS_SUCCESS) {
 116                 d_printf("could not obtain winbind separator!\n");
 117                 return *lp_winbind_separator();
 118         }
 119
 120         sep = response.data.info.winbind_separator;
 121         got_sep = True;
 122
 123         if (!sep) {
 124                 d_printf("winbind separator was NULL!\n");
 125                 return *lp_winbind_separator();
 126         }
 127
 128         return sep;
 129 }
 130
 131 const char *get_winbind_domain(void)
 132 {
 133         struct winbindd_response response;
 134
 135         static fstring winbind_domain;
 136         if (*winbind_domain) {
 137                 return winbind_domain;
 138         }
 139
 140         ZERO_STRUCT(response);
 141
 142         /* Send off request */
 143
 144         if (winbindd_request_response(WINBINDD_DOMAIN_NAME, NULL, &response) !=
 145             NSS_STATUS_SUCCESS) {
 146                 DEBUG(0, ("could not obtain winbind domain name!\n"));
 147                 return lp_workgroup();
 148         }
 149
 150         fstrcpy(winbind_domain, response.data.domain_name);
 151
 152         return winbind_domain;
 153
 154 }
 155
 156 const char *get_winbind_netbios_name(void)
 157 {
 158         struct winbindd_response response;
 159
 160         static fstring winbind_netbios_name;
 161
 162         if (*winbind_netbios_name) {
 163                 return winbind_netbios_name;
 164         }
 165
 166         ZERO_STRUCT(response);
 167
 168         /* Send off request */
 169
 170         if (winbindd_request_response(WINBINDD_NETBIOS_NAME, NULL, &response) !=
 171             NSS_STATUS_SUCCESS) {
 172                 DEBUG(0, ("could not obtain winbind netbios name!\n"));
 173                 return global_myname();
 174         }
 175
 176         fstrcpy(winbind_netbios_name, response.data.netbios_name);
 177
 178         return winbind_netbios_name;
 179
 180 }
 181
 182 DATA_BLOB get_challenge(void)
 183 {
 184         static DATA_BLOB chal;
 185         if (opt_challenge.length)
 186                 return opt_challenge;
 187
 188         chal = data_blob(NULL, 8);
 189
 190         generate_random_buffer(chal.data, chal.length);
 191         return chal;
 192 }
 193
 194 /* Copy of parse_domain_user from winbindd_util.c.  Parse a string of the
 195    form DOMAIN/user into a domain and a user */
 196
 197 static BOOL parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
 198                                      fstring user)
 199 {
 200
 201         char *p = strchr(domuser,winbind_separator());
 202
 203         if (!p) {
 204                 return False;
 205         }
 206
 207         fstrcpy(user, p+1);
 208         fstrcpy(domain, domuser);
 209         domain[PTR_DIFF(p, domuser)] = 0;
 210         strupper_m(domain);
 211
 212         return True;
 213 }
 214
 215 static BOOL get_require_membership_sid(void) {
 216         struct winbindd_request request;
 217         struct winbindd_response response;
 218
 219         if (!require_membership_of) {
 220                 return True;
 221         }
 222
 223         if (require_membership_of_sid) {
 224                 return True;
 225         }
 226
 227         /* Otherwise, ask winbindd for the name->sid request */
 228
 229         ZERO_STRUCT(request);
 230         ZERO_STRUCT(response);
 231
 232         if (!parse_ntlm_auth_domain_user(require_membership_of,
 233                                          request.data.name.dom_name,
 234                                          request.data.name.name)) {
 235                 DEBUG(0, ("Could not parse %s into seperate domain/name parts!\n",
 236                           require_membership_of));
 237                 return False;
 238         }
 239
 240         if (winbindd_request_response(WINBINDD_LOOKUPNAME, &request, &response) !=
 241             NSS_STATUS_SUCCESS) {
 242                 DEBUG(0, ("Winbindd lookupname failed to resolve %s into a SID!\n",
 243                           require_membership_of));
 244                 return False;
 245         }
 246
 247         require_membership_of_sid = SMB_STRDUP(response.data.sid.sid);
 248
 249         if (require_membership_of_sid)
 250                 return True;
 251
 252         return False;
 253 }
 254 /* Authenticate a user with a plaintext password */
 255
 256 static BOOL check_plaintext_auth(const char *user, const char *pass,
 257                                  BOOL stdout_diagnostics)
 258 {
 259         struct winbindd_request request;
 260         struct winbindd_response response;
 261         NSS_STATUS result;
 262
 263         if (!get_require_membership_sid()) {
 264                 return False;
 265         }
 266
 267         /* Send off request */
 268
 269         ZERO_STRUCT(request);
 270         ZERO_STRUCT(response);
 271
 272         fstrcpy(request.data.auth.user, user);
 273         fstrcpy(request.data.auth.pass, pass);
 274         if (require_membership_of_sid)
 275                 fstrcpy(request.data.auth.require_membership_of_sid, require_membership_of_sid);
 276
 277         result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
 278
 279         /* Display response */
 280
 281         if (stdout_diagnostics) {
 282                 if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 283                         d_printf("Reading winbind reply failed! (0x01)\n");
 284                 }
 285
 286                 d_printf("%s: %s (0x%x)\n",
 287                          response.data.auth.nt_status_string,
 288                          response.data.auth.error_string,
 289                          response.data.auth.nt_status);
 290         } else {
 291                 if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 292                         DEBUG(1, ("Reading winbind reply failed! (0x01)\n"));
 293                 }
 294
 295                 DEBUG(3, ("%s: %s (0x%x)\n",
 296                           response.data.auth.nt_status_string,
 297                           response.data.auth.error_string,
 298                           response.data.auth.nt_status));
 299         }
 300
 301         return (result == NSS_STATUS_SUCCESS);
 302 }
 303
 304 /* authenticate a user with an encrypted username/password */
 305
 306 NTSTATUS contact_winbind_auth_crap(const char *username,
 307                                    const char *domain,
 308                                    const char *workstation,
 309                                    const DATA_BLOB *challenge,
 310                                    const DATA_BLOB *lm_response,
 311                                    const DATA_BLOB *nt_response,
 312                                    uint32 flags,
 313                                    uint8 lm_key[8],
 314                                    uint8 user_session_key[16],
 315                                    char **error_string,
 316                                    char **unix_name)
 317 {
 318         NTSTATUS nt_status;
 319         NSS_STATUS result;
 320         struct winbindd_request request;
 321         struct winbindd_response response;
 322
 323         if (!get_require_membership_sid()) {
 324                 return NT_STATUS_INVALID_PARAMETER;
 325         }
 326
 327         ZERO_STRUCT(request);
 328         ZERO_STRUCT(response);
 329
 330         request.flags = flags;
 331
 332         request.data.auth_crap.logon_parameters = MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
 333
 334         if (require_membership_of_sid)
 335                 fstrcpy(request.data.auth_crap.require_membership_of_sid, require_membership_of_sid);
 336
 337         fstrcpy(request.data.auth_crap.user, username);
 338         fstrcpy(request.data.auth_crap.domain, domain);
 339
 340         fstrcpy(request.data.auth_crap.workstation,
 341                 workstation);
 342
 343         memcpy(request.data.auth_crap.chal, challenge->data, MIN(challenge->length, 8));
 344
 345         if (lm_response && lm_response->length) {
 346                 memcpy(request.data.auth_crap.lm_resp,
 347                        lm_response->data,
 348                        MIN(lm_response->length, sizeof(request.data.auth_crap.lm_resp)));
 349                 request.data.auth_crap.lm_resp_len = lm_response->length;
 350         }
 351
 352         if (nt_response && nt_response->length) {
 353                 memcpy(request.data.auth_crap.nt_resp,
 354                        nt_response->data,
 355                        MIN(nt_response->length, sizeof(request.data.auth_crap.nt_resp)));
 356                 request.data.auth_crap.nt_resp_len = nt_response->length;
 357         }
 358
 359         result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
 360
 361         /* Display response */
 362
 363         if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 364                 nt_status = NT_STATUS_UNSUCCESSFUL;
 365                 if (error_string)
 366                         *error_string = smb_xstrdup("Reading winbind reply failed!");
 367                 free_response(&response);
 368                 return nt_status;
 369         }
 370
 371         nt_status = (NT_STATUS(response.data.auth.nt_status));
 372         if (!NT_STATUS_IS_OK(nt_status)) {
 373                 if (error_string)
 374                         *error_string = smb_xstrdup(response.data.auth.error_string);
 375                 free_response(&response);
 376                 return nt_status;
 377         }
 378
 379         if ((flags & WBFLAG_PAM_LMKEY) && lm_key) {
 380                 memcpy(lm_key, response.data.auth.first_8_lm_hash,
 381                        sizeof(response.data.auth.first_8_lm_hash));
 382         }
 383         if ((flags & WBFLAG_PAM_USER_SESSION_KEY) && user_session_key) {
 384                 memcpy(user_session_key, response.data.auth.user_session_key,
 385                         sizeof(response.data.auth.user_session_key));
 386         }
 387
 388         if (flags & WBFLAG_PAM_UNIX_NAME) {
 389                 *unix_name = SMB_STRDUP((char *)response.extra_data.data);
 390                 if (!*unix_name) {
 391                         free_response(&response);
 392                         return NT_STATUS_NO_MEMORY;
 393                 }
 394         }
 395
 396         free_response(&response);
 397         return nt_status;
 398 }
 399
 400 /* contact server to change user password using auth crap */
 401 static NTSTATUS contact_winbind_change_pswd_auth_crap(const char *username,
 402                                                       const char *domain,
 403                                                       const DATA_BLOB new_nt_pswd,
 404                                                       const DATA_BLOB old_nt_hash_enc,
 405                                                       const DATA_BLOB new_lm_pswd,
 406                                                       const DATA_BLOB old_lm_hash_enc,
 407                                                       char  **error_string)
 408 {
 409         NTSTATUS nt_status;
 410         NSS_STATUS result;
 411         struct winbindd_request request;
 412         struct winbindd_response response;
 413
 414         if (!get_require_membership_sid())
 415         {
 416                 if(error_string)
 417                         *error_string = smb_xstrdup("Can't get membership sid.");
 418                 return NT_STATUS_INVALID_PARAMETER;
 419         }
 420
 421         ZERO_STRUCT(request);
 422         ZERO_STRUCT(response);
 423
 424         if(username != NULL)
 425                 fstrcpy(request.data.chng_pswd_auth_crap.user, username);
 426         if(domain != NULL)
 427                 fstrcpy(request.data.chng_pswd_auth_crap.domain,domain);
 428
 429         if(new_nt_pswd.length)
 430         {
 431                 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd, new_nt_pswd.data, sizeof(request.data.chng_pswd_auth_crap.new_nt_pswd));
 432                 request.data.chng_pswd_auth_crap.new_nt_pswd_len = new_nt_pswd.length;
 433         }
 434
 435         if(old_nt_hash_enc.length)
 436         {
 437                 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc, old_nt_hash_enc.data, sizeof(request.data.chng_pswd_auth_crap.old_nt_hash_enc));
 438                 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len = old_nt_hash_enc.length;
 439         }
 440
 441         if(new_lm_pswd.length)
 442         {
 443                 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd, new_lm_pswd.data, sizeof(request.data.chng_pswd_auth_crap.new_lm_pswd));
 444                 request.data.chng_pswd_auth_crap.new_lm_pswd_len = new_lm_pswd.length;
 445         }
 446
 447         if(old_lm_hash_enc.length)
 448         {
 449                 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc, old_lm_hash_enc.data, sizeof(request.data.chng_pswd_auth_crap.old_lm_hash_enc));
 450                 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len = old_lm_hash_enc.length;
 451         }
 452
 453         result = winbindd_request_response(WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, &request, &response);
 454
 455         /* Display response */
 456
 457         if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0))
 458         {
 459                 nt_status = NT_STATUS_UNSUCCESSFUL;
 460                 if (error_string)
 461                         *error_string = smb_xstrdup("Reading winbind reply failed!");
 462                 free_response(&response);
 463                 return nt_status;
 464         }
 465
 466         nt_status = (NT_STATUS(response.data.auth.nt_status));
 467         if (!NT_STATUS_IS_OK(nt_status))
 468         {
 469                 if (error_string)
 470                         *error_string = smb_xstrdup(response.data.auth.error_string);
 471                 free_response(&response);
 472                 return nt_status;
 473         }
 474
 475         free_response(&response);
 476
 477     return nt_status;
 478 }
 479
 480 static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
 481 {
 482         static const char zeros[16];
 483         NTSTATUS nt_status;
 484         char *error_string;
 485         uint8 lm_key[8];
 486         uint8 user_sess_key[16];
 487         char *unix_name;
 488
 489         nt_status = contact_winbind_auth_crap(ntlmssp_state->user, ntlmssp_state->domain,
 490                                               ntlmssp_state->workstation,
 491                                               &ntlmssp_state->chal,
 492                                               &ntlmssp_state->lm_resp,
 493                                               &ntlmssp_state->nt_resp,
 494                                               WBFLAG_PAM_LMKEY | WBFLAG_PAM_USER_SESSION_KEY | WBFLAG_PAM_UNIX_NAME,
 495                                               lm_key, user_sess_key,
 496                                               &error_string, &unix_name);
 497
 498         if (NT_STATUS_IS_OK(nt_status)) {
 499                 if (memcmp(lm_key, zeros, 8) != 0) {
 500                         *lm_session_key = data_blob(NULL, 16);
 501                         memcpy(lm_session_key->data, lm_key, 8);
 502                         memset(lm_session_key->data+8, '\0', 8);
 503                 }
 504
 505                 if (memcmp(user_sess_key, zeros, 16) != 0) {
 506                         *user_session_key = data_blob(user_sess_key, 16);
 507                 }
 508                 ntlmssp_state->auth_context = talloc_strdup(ntlmssp_state->mem_ctx, unix_name);
 509                 SAFE_FREE(unix_name);
 510         } else {
 511                 DEBUG(NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED) ? 0 : 3,
 512                       ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n",
 513                        ntlmssp_state->domain, ntlmssp_state->user,
 514                        ntlmssp_state->workstation,
 515                        error_string ? error_string : "unknown error (NULL)"));
 516                 ntlmssp_state->auth_context = NULL;
 517         }
 518         return nt_status;
 519 }
 520
 521 static NTSTATUS local_pw_check(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
 522 {
 523         NTSTATUS nt_status;
 524         uint8 lm_pw[16], nt_pw[16];
 525
 526         nt_lm_owf_gen (opt_password, nt_pw, lm_pw);
 527
 528         nt_status = ntlm_password_check(ntlmssp_state->mem_ctx,
 529                                         &ntlmssp_state->chal,
 530                                         &ntlmssp_state->lm_resp,
 531                                         &ntlmssp_state->nt_resp,
 532                                         NULL, NULL,
 533                                         ntlmssp_state->user,
 534                                         ntlmssp_state->user,
 535                                         ntlmssp_state->domain,
 536                                         lm_pw, nt_pw, user_session_key, lm_session_key);
 537
 538         if (NT_STATUS_IS_OK(nt_status)) {
 539                 ntlmssp_state->auth_context = talloc_asprintf(ntlmssp_state->mem_ctx,
 540                                                               "%s%c%s", ntlmssp_state->domain,
 541                                                               *lp_winbind_separator(),
 542                                                               ntlmssp_state->user);
 543         } else {
 544                 DEBUG(3, ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n",
 545                           ntlmssp_state->domain, ntlmssp_state->user, ntlmssp_state->workstation,
 546                           nt_errstr(nt_status)));
 547                 ntlmssp_state->auth_context = NULL;
 548         }
 549         return nt_status;
 550 }
 551
 552 static NTSTATUS ntlm_auth_start_ntlmssp_client(NTLMSSP_STATE **client_ntlmssp_state)
 553 {
 554         NTSTATUS status;
 555         if ( (opt_username == NULL) || (opt_domain == NULL) ) {
 556                 status = NT_STATUS_UNSUCCESSFUL;
 557                 DEBUG(1, ("Need username and domain for NTLMSSP\n"));
 558                 return NT_STATUS_INVALID_PARAMETER;
 559         }
 560
 561         status = ntlmssp_client_start(client_ntlmssp_state);
 562
 563         if (!NT_STATUS_IS_OK(status)) {
 564                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
 565                           nt_errstr(status)));
 566                 ntlmssp_end(client_ntlmssp_state);
 567                 return status;
 568         }
 569
 570         status = ntlmssp_set_username(*client_ntlmssp_state, opt_username);
 571
 572         if (!NT_STATUS_IS_OK(status)) {
 573                 DEBUG(1, ("Could not set username: %s\n",
 574                           nt_errstr(status)));
 575                 ntlmssp_end(client_ntlmssp_state);
 576                 return status;
 577         }
 578
 579         status = ntlmssp_set_domain(*client_ntlmssp_state, opt_domain);
 580
 581         if (!NT_STATUS_IS_OK(status)) {
 582                 DEBUG(1, ("Could not set domain: %s\n",
 583                           nt_errstr(status)));
 584                 ntlmssp_end(client_ntlmssp_state);
 585                 return status;
 586         }
 587
 588         if (opt_password) {
 589                 status = ntlmssp_set_password(*client_ntlmssp_state, opt_password);
 590
 591                 if (!NT_STATUS_IS_OK(status)) {
 592                         DEBUG(1, ("Could not set password: %s\n",
 593                                   nt_errstr(status)));
 594                         ntlmssp_end(client_ntlmssp_state);
 595                         return status;
 596                 }
 597         }
 598
 599         return NT_STATUS_OK;
 600 }
 601
 602 static NTSTATUS ntlm_auth_start_ntlmssp_server(NTLMSSP_STATE **ntlmssp_state)
 603 {
 604         NTSTATUS status = ntlmssp_server_start(ntlmssp_state);
 605
 606         if (!NT_STATUS_IS_OK(status)) {
 607                 DEBUG(1, ("Could not start NTLMSSP server: %s\n",
 608                           nt_errstr(status)));
 609                 return status;
 610         }
 611
 612         /* Have we been given a local password, or should we ask winbind? */
 613         if (opt_password) {
 614                 (*ntlmssp_state)->check_password = local_pw_check;
 615                 (*ntlmssp_state)->get_domain = lp_workgroup;
 616                 (*ntlmssp_state)->get_global_myname = global_myname;
 617         } else {
 618                 (*ntlmssp_state)->check_password = winbind_pw_check;
 619                 (*ntlmssp_state)->get_domain = get_winbind_domain;
 620                 (*ntlmssp_state)->get_global_myname = get_winbind_netbios_name;
 621         }
 622         return NT_STATUS_OK;
 623 }
 624
 625 /*******************************************************************
 626  Used by firefox to drive NTLM auth to IIS servers.
 627 *******************************************************************/
 628
 629 static NTSTATUS do_ccache_ntlm_auth(DATA_BLOB initial_msg, DATA_BLOB challenge_msg,
 630                                 DATA_BLOB *reply)
 631 {
 632         struct winbindd_request wb_request;
 633         struct winbindd_response wb_response;
 634         NSS_STATUS result;
 635
 636         /* get winbindd to do the ntlmssp step on our behalf */
 637         ZERO_STRUCT(wb_request);
 638         ZERO_STRUCT(wb_response);
 639
 640         fstr_sprintf(wb_request.data.ccache_ntlm_auth.user,
 641                 "%s%c%s", opt_domain, winbind_separator(), opt_username);
 642         wb_request.data.ccache_ntlm_auth.uid = geteuid();
 643         wb_request.data.ccache_ntlm_auth.initial_blob_len = initial_msg.length;
 644         wb_request.data.ccache_ntlm_auth.challenge_blob_len = challenge_msg.length;
 645         wb_request.extra_len = initial_msg.length + challenge_msg.length;
 646
 647         if (wb_request.extra_len > 0) {
 648                 wb_request.extra_data.data = SMB_MALLOC_ARRAY(char, wb_request.extra_len);
 649                 if (wb_request.extra_data.data == NULL) {
 650                         return NT_STATUS_NO_MEMORY;
 651                 }
 652
 653                 memcpy(wb_request.extra_data.data, initial_msg.data, initial_msg.length);
 654                 memcpy(wb_request.extra_data.data + initial_msg.length,
 655                         challenge_msg.data, challenge_msg.length);
 656         }
 657
 658         result = winbindd_request_response(WINBINDD_CCACHE_NTLMAUTH, &wb_request, &wb_response);
 659         SAFE_FREE(wb_request.extra_data.data);
 660
 661         if (result != NSS_STATUS_SUCCESS) {
 662                 free_response(&wb_response);
 663                 return NT_STATUS_UNSUCCESSFUL;
 664         }
 665
 666         if (reply) {
 667                 *reply = data_blob(wb_response.extra_data.data,
 668                                 wb_response.data.ccache_ntlm_auth.auth_blob_len);
 669                 if (wb_response.data.ccache_ntlm_auth.auth_blob_len > 0 &&
 670                                 reply->data == NULL) {
 671                         free_response(&wb_response);
 672                         return NT_STATUS_NO_MEMORY;
 673                 }
 674         }
 675
 676         free_response(&wb_response);
 677         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 678 }
 679
 680 static void manage_squid_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode,
 681                                          char *buf, int length)
 682 {
 683         static NTLMSSP_STATE *ntlmssp_state = NULL;
 684         static char* want_feature_list = NULL;
 685         static uint32 neg_flags = 0;
 686         static BOOL have_session_key = False;
 687         static DATA_BLOB session_key;
 688         DATA_BLOB request, reply;
 689         NTSTATUS nt_status;
 690
 691         if (strlen(buf) < 2) {
 692                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 693                 x_fprintf(x_stdout, "BH\n");
 694                 return;
 695         }
 696
 697         if (strlen(buf) > 3) {
 698                 if(strncmp(buf, "SF ", 3) == 0){
 699                         DEBUG(10, ("Setting flags to negotioate\n"));
 700                         SAFE_FREE(want_feature_list);
 701                         want_feature_list = SMB_STRNDUP(buf+3, strlen(buf)-3);
 702                         x_fprintf(x_stdout, "OK\n");
 703                         return;
 704                 }
 705                 request = base64_decode_data_blob(buf + 3);
 706         } else {
 707                 request = data_blob(NULL, 0);
 708         }
 709
 710         if ((strncmp(buf, "PW ", 3) == 0)) {
 711                 /* The calling application wants us to use a local password (rather than winbindd) */
 712
 713                 opt_password = SMB_STRNDUP((const char *)request.data, request.length);
 714
 715                 if (opt_password == NULL) {
 716                         DEBUG(1, ("Out of memory\n"));
 717                         x_fprintf(x_stdout, "BH\n");
 718                         data_blob_free(&request);
 719                         return;
 720                 }
 721
 722                 x_fprintf(x_stdout, "OK\n");
 723                 data_blob_free(&request);
 724                 return;
 725         }
 726
 727         if (strncmp(buf, "YR", 2) == 0) {
 728                 if (ntlmssp_state)
 729                         ntlmssp_end(&ntlmssp_state);
 730         } else if (strncmp(buf, "KK", 2) == 0) {
 731
 732         } else if (strncmp(buf, "GF", 2) == 0) {
 733                 DEBUG(10, ("Requested negotiated NTLMSSP flags\n"));
 734                 x_fprintf(x_stdout, "GF 0x%08lx\n", have_session_key?neg_flags:0l);
 735                 data_blob_free(&request);
 736                 return;
 737         } else if (strncmp(buf, "GK", 2) == 0) {
 738                 DEBUG(10, ("Requested NTLMSSP session key\n"));
 739                 if(have_session_key) {
 740                         char *key64 = base64_encode_data_blob(session_key);
 741                         x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
 742                         SAFE_FREE(key64);
 743                 } else {
 744                         x_fprintf(x_stdout, "BH\n");
 745                 }
 746
 747                 data_blob_free(&request);
 748                 return;
 749         } else {
 750                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 751                 x_fprintf(x_stdout, "BH\n");
 752                 return;
 753         }
 754
 755         if (!ntlmssp_state) {
 756                 if (!NT_STATUS_IS_OK(nt_status = ntlm_auth_start_ntlmssp_server(&ntlmssp_state))) {
 757                         x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 758                         return;
 759                 }
 760                 ntlmssp_want_feature_list(ntlmssp_state, want_feature_list);
 761         }
 762
 763         DEBUG(10, ("got NTLMSSP packet:\n"));
 764         dump_data(10, (const char *)request.data, request.length);
 765
 766         nt_status = ntlmssp_update(ntlmssp_state, request, &reply);
 767
 768         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 769                 char *reply_base64 = base64_encode_data_blob(reply);
 770                 x_fprintf(x_stdout, "TT %s\n", reply_base64);
 771                 SAFE_FREE(reply_base64);
 772                 data_blob_free(&reply);
 773                 DEBUG(10, ("NTLMSSP challenge\n"));
 774         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
 775                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 776                 DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
 777
 778                 ntlmssp_end(&ntlmssp_state);
 779         } else if (!NT_STATUS_IS_OK(nt_status)) {
 780                 x_fprintf(x_stdout, "NA %s\n", nt_errstr(nt_status));
 781                 DEBUG(10, ("NTLMSSP %s\n", nt_errstr(nt_status)));
 782         } else {
 783                 x_fprintf(x_stdout, "AF %s\n", (char *)ntlmssp_state->auth_context);
 784                 DEBUG(10, ("NTLMSSP OK!\n"));
 785
 786                 if(have_session_key)
 787                         data_blob_free(&session_key);
 788                 session_key = data_blob(ntlmssp_state->session_key.data,
 789                                 ntlmssp_state->session_key.length);
 790                 neg_flags = ntlmssp_state->neg_flags;
 791                 have_session_key = True;
 792         }
 793
 794         data_blob_free(&request);
 795 }
 796
 797 static void manage_client_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode,
 798                                          char *buf, int length)
 799 {
 800         /* The statics here are *HORRIBLE* and this entire concept
 801            needs to be rewritten. Essentially it's using these statics
 802            as the state in a state machine. BLEEEGH ! JRA. */
 803
 804         static NTLMSSP_STATE *ntlmssp_state = NULL;
 805         static DATA_BLOB initial_message;
 806         static char* want_feature_list = NULL;
 807         static uint32 neg_flags = 0;
 808         static BOOL have_session_key = False;
 809         static DATA_BLOB session_key;
 810         DATA_BLOB request, reply;
 811         NTSTATUS nt_status;
 812         BOOL first = False;
 813
 814         if (!opt_username || !*opt_username) {
 815                 x_fprintf(x_stderr, "username must be specified!\n\n");
 816                 exit(1);
 817         }
 818
 819         if (strlen(buf) < 2) {
 820                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 821                 x_fprintf(x_stdout, "BH\n");
 822                 return;
 823         }
 824
 825         if (strlen(buf) > 3) {
 826                 if(strncmp(buf, "SF ", 3) == 0) {
 827                         DEBUG(10, ("Looking for flags to negotiate\n"));
 828                         SAFE_FREE(want_feature_list);
 829                         want_feature_list = SMB_STRNDUP(buf+3, strlen(buf)-3);
 830                         x_fprintf(x_stdout, "OK\n");
 831                         return;
 832                 }
 833                 request = base64_decode_data_blob(buf + 3);
 834         } else {
 835                 request = data_blob(NULL, 0);
 836         }
 837
 838         if (strncmp(buf, "PW ", 3) == 0) {
 839                 /* We asked for a password and obviously got it :-) */
 840
 841                 opt_password = SMB_STRNDUP((const char *)request.data, request.length);
 842
 843                 if (opt_password == NULL) {
 844                         DEBUG(1, ("Out of memory\n"));
 845                         x_fprintf(x_stdout, "BH\n");
 846                         data_blob_free(&request);
 847                         return;
 848                 }
 849
 850                 x_fprintf(x_stdout, "OK\n");
 851                 data_blob_free(&request);
 852                 return;
 853         }
 854
 855         if (!ntlmssp_state && use_cached_creds) {
 856                 /* check whether credentials are usable. */
 857                 DATA_BLOB empty_blob = data_blob(NULL, 0);
 858
 859                 nt_status = do_ccache_ntlm_auth(empty_blob, empty_blob, NULL);
 860                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 861                         /* failed to use cached creds */
 862                         use_cached_creds = False;
 863                 }
 864         }
 865
 866         if (opt_password == NULL && !use_cached_creds) {
 867
 868                 /* Request a password from the calling process.  After
 869                    sending it, the calling process should retry asking for the negotiate. */
 870
 871                 DEBUG(10, ("Requesting password\n"));
 872                 x_fprintf(x_stdout, "PW\n");
 873                 return;
 874         }
 875
 876         if (strncmp(buf, "YR", 2) == 0) {
 877                 if (ntlmssp_state)
 878                         ntlmssp_end(&ntlmssp_state);
 879         } else if (strncmp(buf, "TT", 2) == 0) {
 880
 881         } else if (strncmp(buf, "GF", 2) == 0) {
 882                 DEBUG(10, ("Requested negotiated NTLMSSP flags\n"));
 883                 x_fprintf(x_stdout, "GF 0x%08lx\n", have_session_key?neg_flags:0l);
 884                 data_blob_free(&request);
 885                 return;
 886         } else if (strncmp(buf, "GK", 2) == 0 ) {
 887                 DEBUG(10, ("Requested session key\n"));
 888
 889                 if(have_session_key) {
 890                         char *key64 = base64_encode_data_blob(session_key);
 891                         x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
 892                         SAFE_FREE(key64);
 893                 }
 894                 else {
 895                         x_fprintf(x_stdout, "BH\n");
 896                 }
 897
 898                 data_blob_free(&request);
 899                 return;
 900         } else {
 901                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 902                 x_fprintf(x_stdout, "BH\n");
 903                 return;
 904         }
 905
 906         if (!ntlmssp_state) {
 907                 if (!NT_STATUS_IS_OK(nt_status = ntlm_auth_start_ntlmssp_client(&ntlmssp_state))) {
 908                         x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 909                         return;
 910                 }
 911                 ntlmssp_want_feature_list(ntlmssp_state, want_feature_list);
 912                 first = True;
 913                 initial_message = data_blob(NULL, 0);
 914         }
 915
 916         DEBUG(10, ("got NTLMSSP packet:\n"));
 917         dump_data(10, (const char *)request.data, request.length);
 918
 919         if (use_cached_creds && !opt_password && !first) {
 920                 nt_status = do_ccache_ntlm_auth(initial_message, request, &reply);
 921         } else {
 922                 nt_status = ntlmssp_update(ntlmssp_state, request, &reply);
 923         }
 924
 925         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 926                 char *reply_base64 = base64_encode_data_blob(reply);
 927                 if (first) {
 928                         x_fprintf(x_stdout, "YR %s\n", reply_base64);
 929                 } else {
 930                         x_fprintf(x_stdout, "KK %s\n", reply_base64);
 931                 }
 932                 SAFE_FREE(reply_base64);
 933                 if (first) {
 934                         initial_message = reply;
 935                 } else {
 936                         data_blob_free(&reply);
 937                 }
 938                 DEBUG(10, ("NTLMSSP challenge\n"));
 939         } else if (NT_STATUS_IS_OK(nt_status)) {
 940                 char *reply_base64 = base64_encode_data_blob(reply);
 941                 x_fprintf(x_stdout, "AF %s\n", reply_base64);
 942                 SAFE_FREE(reply_base64);
 943
 944                 if(have_session_key)
 945                         data_blob_free(&session_key);
 946
 947                 session_key = data_blob(ntlmssp_state->session_key.data,
 948                                 ntlmssp_state->session_key.length);
 949                 neg_flags = ntlmssp_state->neg_flags;
 950                 have_session_key = True;
 951
 952                 DEBUG(10, ("NTLMSSP OK!\n"));
 953                 if (ntlmssp_state)
 954                         ntlmssp_end(&ntlmssp_state);
 955         } else {
 956                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 957                 DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
 958                 if (ntlmssp_state)
 959                         ntlmssp_end(&ntlmssp_state);
 960         }
 961
 962         data_blob_free(&request);
 963 }
 964
 965 static void manage_squid_basic_request(enum stdio_helper_mode stdio_helper_mode,
 966                                        char *buf, int length)
 967 {
 968         char *user, *pass;
 969         user=buf;
 970
 971         pass=(char *)memchr(buf,' ',length);
 972         if (!pass) {
 973                 DEBUG(2, ("Password not found. Denying access\n"));
 974                 x_fprintf(x_stdout, "ERR\n");
 975                 return;
 976         }
 977         *pass='\0';
 978         pass++;
 979
 980         if (stdio_helper_mode == SQUID_2_5_BASIC) {
 981                 rfc1738_unescape(user);
 982                 rfc1738_unescape(pass);
 983         }
 984
 985         if (check_plaintext_auth(user, pass, False)) {
 986                 x_fprintf(x_stdout, "OK\n");
 987         } else {
 988                 x_fprintf(x_stdout, "ERR\n");
 989         }
 990 }
 991
 992 static void offer_gss_spnego_mechs(void) {
 993
 994         DATA_BLOB token;
 995         SPNEGO_DATA spnego;
 996         ssize_t len;
 997         char *reply_base64;
 998
 999         pstring principal;
1000         pstring myname_lower;
1001
1002         ZERO_STRUCT(spnego);
1003
1004         pstrcpy(myname_lower, global_myname());
1005         strlower_m(myname_lower);
1006
1007         pstr_sprintf(principal, "%s$@%s", myname_lower, lp_realm());
1008
1009         /* Server negTokenInit (mech offerings) */
1010         spnego.type = SPNEGO_NEG_TOKEN_INIT;
1011         spnego.negTokenInit.mechTypes = SMB_XMALLOC_ARRAY(const char *, 2);
1012 #ifdef HAVE_KRB5
1013         spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_KERBEROS5_OLD);
1014         spnego.negTokenInit.mechTypes[1] = smb_xstrdup(OID_NTLMSSP);
1015         spnego.negTokenInit.mechTypes[2] = NULL;
1016 #else
1017         spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_NTLMSSP);
1018         spnego.negTokenInit.mechTypes[1] = NULL;
1019 #endif
1020
1021
1022         spnego.negTokenInit.mechListMIC = data_blob(principal,
1023                                                     strlen(principal));
1024
1025         len = write_spnego_data(&token, &spnego);
1026         free_spnego_data(&spnego);
1027
1028         if (len == -1) {
1029                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1030                 x_fprintf(x_stdout, "BH\n");
1031                 return;
1032         }
1033
1034         reply_base64 = base64_encode_data_blob(token);
1035         x_fprintf(x_stdout, "TT %s *\n", reply_base64);
1036
1037         SAFE_FREE(reply_base64);
1038         data_blob_free(&token);
1039         DEBUG(10, ("sent SPNEGO negTokenInit\n"));
1040         return;
1041 }
1042
1043 static void manage_gss_spnego_request(enum stdio_helper_mode stdio_helper_mode,
1044                                       char *buf, int length)
1045 {
1046         static NTLMSSP_STATE *ntlmssp_state = NULL;
1047         SPNEGO_DATA request, response;
1048         DATA_BLOB token;
1049         NTSTATUS status;
1050         ssize_t len;
1051
1052         char *user = NULL;
1053         char *domain = NULL;
1054
1055         const char *reply_code;
1056         char       *reply_base64;
1057         pstring     reply_argument;
1058
1059         if (strlen(buf) < 2) {
1060                 DEBUG(1, ("SPENGO query [%s] invalid", buf));
1061                 x_fprintf(x_stdout, "BH\n");
1062                 return;
1063         }
1064
1065         if (strncmp(buf, "YR", 2) == 0) {
1066                 if (ntlmssp_state)
1067                         ntlmssp_end(&ntlmssp_state);
1068         } else if (strncmp(buf, "KK", 2) == 0) {
1069
1070         } else {
1071                 DEBUG(1, ("SPENGO query [%s] invalid", buf));
1072                 x_fprintf(x_stdout, "BH\n");
1073                 return;
1074         }
1075
1076         if ( (strlen(buf) == 2)) {
1077
1078                 /* no client data, get the negTokenInit offering
1079                    mechanisms */
1080
1081                 offer_gss_spnego_mechs();
1082                 return;
1083         }
1084
1085         /* All subsequent requests have a blob. This might be negTokenInit or negTokenTarg */
1086
1087         if (strlen(buf) <= 3) {
1088                 DEBUG(1, ("GSS-SPNEGO query [%s] invalid\n", buf));
1089                 x_fprintf(x_stdout, "BH\n");
1090                 return;
1091         }
1092
1093         token = base64_decode_data_blob(buf + 3);
1094         len = read_spnego_data(token, &request);
1095         data_blob_free(&token);
1096
1097         if (len == -1) {
1098                 DEBUG(1, ("GSS-SPNEGO query [%s] invalid", buf));
1099                 x_fprintf(x_stdout, "BH\n");
1100                 return;
1101         }
1102
1103         if (request.type == SPNEGO_NEG_TOKEN_INIT) {
1104
1105                 /* Second request from Client. This is where the
1106                    client offers its mechanism to use. */
1107
1108                 if ( (request.negTokenInit.mechTypes == NULL) ||
1109                      (request.negTokenInit.mechTypes[0] == NULL) ) {
1110                         DEBUG(1, ("Client did not offer any mechanism"));
1111                         x_fprintf(x_stdout, "BH\n");
1112                         return;
1113                 }
1114
1115                 status = NT_STATUS_UNSUCCESSFUL;
1116                 if (strcmp(request.negTokenInit.mechTypes[0], OID_NTLMSSP) == 0) {
1117
1118                         if ( request.negTokenInit.mechToken.data == NULL ) {
1119                                 DEBUG(1, ("Client did not provide  NTLMSSP data\n"));
1120                                 x_fprintf(x_stdout, "BH\n");
1121                                 return;
1122                         }
1123
1124                         if ( ntlmssp_state != NULL ) {
1125                                 DEBUG(1, ("Client wants a new NTLMSSP challenge, but "
1126                                           "already got one\n"));
1127                                 x_fprintf(x_stdout, "BH\n");
1128                                 ntlmssp_end(&ntlmssp_state);
1129                                 return;
1130                         }
1131
1132                         if (!NT_STATUS_IS_OK(status = ntlm_auth_start_ntlmssp_server(&ntlmssp_state))) {
1133                                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(status));
1134                                 return;
1135                         }
1136
1137                         DEBUG(10, ("got NTLMSSP packet:\n"));
1138                         dump_data(10, (const char *)request.negTokenInit.mechToken.data,
1139                                   request.negTokenInit.mechToken.length);
1140
1141                         response.type = SPNEGO_NEG_TOKEN_TARG;
1142                         response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
1143                         response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
1144
1145                         status = ntlmssp_update(ntlmssp_state,
1146                                                        request.negTokenInit.mechToken,
1147                                                        &response.negTokenTarg.responseToken);
1148                 }
1149
1150 #ifdef HAVE_KRB5
1151                 if (strcmp(request.negTokenInit.mechTypes[0], OID_KERBEROS5_OLD) == 0) {
1152
1153                         TALLOC_CTX *mem_ctx = talloc_init("manage_gss_spnego_request");
1154                         char *principal;
1155                         DATA_BLOB ap_rep;
1156                         DATA_BLOB session_key;
1157
1158                         if ( request.negTokenInit.mechToken.data == NULL ) {
1159                                 DEBUG(1, ("Client did not provide Kerberos data\n"));
1160                                 x_fprintf(x_stdout, "BH\n");
1161                                 return;
1162                         }
1163
1164                         response.type = SPNEGO_NEG_TOKEN_TARG;
1165                         response.negTokenTarg.supportedMech = SMB_STRDUP(OID_KERBEROS5_OLD);
1166                         response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
1167                         response.negTokenTarg.responseToken = data_blob(NULL, 0);
1168
1169                         status = ads_verify_ticket(mem_ctx, lp_realm(), 0,
1170                                                    &request.negTokenInit.mechToken,
1171                                                    &principal, NULL, &ap_rep,
1172                                                    &session_key);
1173
1174                         talloc_destroy(mem_ctx);
1175
1176                         /* Now in "principal" we have the name we are
1177                            authenticated as. */
1178
1179                         if (NT_STATUS_IS_OK(status)) {
1180
1181                                 domain = strchr_m(principal, '@');
1182
1183                                 if (domain == NULL) {
1184                                         DEBUG(1, ("Did not get a valid principal "
1185                                                   "from ads_verify_ticket\n"));
1186                                         x_fprintf(x_stdout, "BH\n");
1187                                         return;
1188                                 }
1189
1190                                 *domain++ = '\0';
1191                                 domain = SMB_STRDUP(domain);
1192                                 user = SMB_STRDUP(principal);
1193
1194                                 data_blob_free(&ap_rep);
1195
1196                                 SAFE_FREE(principal);
1197                         }
1198                 }
1199 #endif
1200
1201         } else {
1202
1203                 if ( (request.negTokenTarg.supportedMech == NULL) ||
1204                      ( strcmp(request.negTokenTarg.supportedMech, OID_NTLMSSP) != 0 ) ) {
1205                         /* Kerberos should never send a negTokenTarg, OID_NTLMSSP
1206                            is the only one we support that sends this stuff */
1207                         DEBUG(1, ("Got a negTokenTarg for something non-NTLMSSP: %s\n",
1208                                   request.negTokenTarg.supportedMech));
1209                         x_fprintf(x_stdout, "BH\n");
1210                         return;
1211                 }
1212
1213                 if (request.negTokenTarg.responseToken.data == NULL) {
1214                         DEBUG(1, ("Got a negTokenTarg without a responseToken!\n"));
1215                         x_fprintf(x_stdout, "BH\n");
1216                         return;
1217                 }
1218
1219                 status = ntlmssp_update(ntlmssp_state,
1220                                                request.negTokenTarg.responseToken,
1221                                                &response.negTokenTarg.responseToken);
1222
1223                 response.type = SPNEGO_NEG_TOKEN_TARG;
1224                 response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
1225                 response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
1226
1227                 if (NT_STATUS_IS_OK(status)) {
1228                         user = SMB_STRDUP(ntlmssp_state->user);
1229                         domain = SMB_STRDUP(ntlmssp_state->domain);
1230                         ntlmssp_end(&ntlmssp_state);
1231                 }
1232         }
1233
1234         free_spnego_data(&request);
1235
1236         if (NT_STATUS_IS_OK(status)) {
1237                 response.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
1238                 reply_code = "AF";
1239                 pstr_sprintf(reply_argument, "%s\\%s", domain, user);
1240         } else if (NT_STATUS_EQUAL(status,
1241                                    NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1242                 response.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
1243                 reply_code = "TT";
1244                 pstr_sprintf(reply_argument, "*");
1245         } else {
1246                 response.negTokenTarg.negResult = SPNEGO_REJECT;
1247                 reply_code = "NA";
1248                 pstrcpy(reply_argument, nt_errstr(status));
1249         }
1250
1251         SAFE_FREE(user);
1252         SAFE_FREE(domain);
1253
1254         len = write_spnego_data(&token, &response);
1255         free_spnego_data(&response);
1256
1257         if (len == -1) {
1258                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1259                 x_fprintf(x_stdout, "BH\n");
1260                 return;
1261         }
1262
1263         reply_base64 = base64_encode_data_blob(token);
1264
1265         x_fprintf(x_stdout, "%s %s %s\n",
1266                   reply_code, reply_base64, reply_argument);
1267
1268         SAFE_FREE(reply_base64);
1269         data_blob_free(&token);
1270
1271         return;
1272 }
1273
1274 static NTLMSSP_STATE *client_ntlmssp_state = NULL;
1275
1276 static BOOL manage_client_ntlmssp_init(SPNEGO_DATA spnego)
1277 {
1278         NTSTATUS status;
1279         DATA_BLOB null_blob = data_blob(NULL, 0);
1280         DATA_BLOB to_server;
1281         char *to_server_base64;
1282         const char *my_mechs[] = {OID_NTLMSSP, NULL};
1283
1284         DEBUG(10, ("Got spnego negTokenInit with NTLMSSP\n"));
1285
1286         if (client_ntlmssp_state != NULL) {
1287                 DEBUG(1, ("Request for initial SPNEGO request where "
1288                           "we already have a state\n"));
1289                 return False;
1290         }
1291
1292         if (!client_ntlmssp_state) {
1293                 if (!NT_STATUS_IS_OK(status = ntlm_auth_start_ntlmssp_client(&client_ntlmssp_state))) {
1294                         x_fprintf(x_stdout, "BH %s\n", nt_errstr(status));
1295                         return False;
1296                 }
1297         }
1298
1299
1300         if (opt_password == NULL) {
1301
1302                 /* Request a password from the calling process.  After
1303                    sending it, the calling process should retry with
1304                    the negTokenInit. */
1305
1306                 DEBUG(10, ("Requesting password\n"));
1307                 x_fprintf(x_stdout, "PW\n");
1308                 return True;
1309         }
1310
1311         spnego.type = SPNEGO_NEG_TOKEN_INIT;
1312         spnego.negTokenInit.mechTypes = my_mechs;
1313         spnego.negTokenInit.reqFlags = 0;
1314         spnego.negTokenInit.mechListMIC = null_blob;
1315
1316         status = ntlmssp_update(client_ntlmssp_state, null_blob,
1317                                        &spnego.negTokenInit.mechToken);
1318
1319         if ( !(NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1320                         NT_STATUS_IS_OK(status)) ) {
1321                 DEBUG(1, ("Expected OK or MORE_PROCESSING_REQUIRED, got: %s\n",
1322                           nt_errstr(status)));
1323                 ntlmssp_end(&client_ntlmssp_state);
1324                 return False;
1325         }
1326
1327         write_spnego_data(&to_server, &spnego);
1328         data_blob_free(&spnego.negTokenInit.mechToken);
1329
1330         to_server_base64 = base64_encode_data_blob(to_server);
1331         data_blob_free(&to_server);
1332         x_fprintf(x_stdout, "KK %s\n", to_server_base64);
1333         SAFE_FREE(to_server_base64);
1334         return True;
1335 }
1336
1337 static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego)
1338 {
1339         NTSTATUS status;
1340         DATA_BLOB null_blob = data_blob(NULL, 0);
1341         DATA_BLOB request;
1342         DATA_BLOB to_server;
1343         char *to_server_base64;
1344
1345         DEBUG(10, ("Got spnego negTokenTarg with NTLMSSP\n"));
1346
1347         if (client_ntlmssp_state == NULL) {
1348                 DEBUG(1, ("Got NTLMSSP tArg without a client state\n"));
1349                 x_fprintf(x_stdout, "BH\n");
1350                 return;
1351         }
1352
1353         if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
1354                 x_fprintf(x_stdout, "NA\n");
1355                 ntlmssp_end(&client_ntlmssp_state);
1356                 return;
1357         }
1358
1359         if (spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_COMPLETED) {
1360                 x_fprintf(x_stdout, "AF\n");
1361                 ntlmssp_end(&client_ntlmssp_state);
1362                 return;
1363         }
1364
1365         status = ntlmssp_update(client_ntlmssp_state,
1366                                        spnego.negTokenTarg.responseToken,
1367                                        &request);
1368
1369         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1370                 DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED from "
1371                           "ntlmssp_client_update, got: %s\n",
1372                           nt_errstr(status)));
1373                 x_fprintf(x_stdout, "BH\n");
1374                 data_blob_free(&request);
1375                 ntlmssp_end(&client_ntlmssp_state);
1376                 return;
1377         }
1378
1379         spnego.type = SPNEGO_NEG_TOKEN_TARG;
1380         spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
1381         spnego.negTokenTarg.supportedMech = (char *)OID_NTLMSSP;
1382         spnego.negTokenTarg.responseToken = request;
1383         spnego.negTokenTarg.mechListMIC = null_blob;
1384
1385         write_spnego_data(&to_server, &spnego);
1386         data_blob_free(&request);
1387
1388         to_server_base64 = base64_encode_data_blob(to_server);
1389         data_blob_free(&to_server);
1390         x_fprintf(x_stdout, "KK %s\n", to_server_base64);
1391         SAFE_FREE(to_server_base64);
1392         return;
1393 }
1394
1395 #ifdef HAVE_KRB5
1396
1397 static BOOL manage_client_krb5_init(SPNEGO_DATA spnego)
1398 {
1399         char *principal;
1400         DATA_BLOB tkt, to_server;
1401         DATA_BLOB session_key_krb5 = data_blob(NULL, 0);
1402         SPNEGO_DATA reply;
1403         char *reply_base64;
1404         int retval;
1405
1406         const char *my_mechs[] = {OID_KERBEROS5_OLD, NULL};
1407         ssize_t len;
1408
1409         if ( (spnego.negTokenInit.mechListMIC.data == NULL) ||
1410              (spnego.negTokenInit.mechListMIC.length == 0) ) {
1411                 DEBUG(1, ("Did not get a principal for krb5\n"));
1412                 return False;
1413         }
1414
1415         principal = (char *)SMB_MALLOC(
1416                 spnego.negTokenInit.mechListMIC.length+1);
1417
1418         if (principal == NULL) {
1419                 DEBUG(1, ("Could not malloc principal\n"));
1420                 return False;
1421         }
1422
1423         memcpy(principal, spnego.negTokenInit.mechListMIC.data,
1424                spnego.negTokenInit.mechListMIC.length);
1425         principal[spnego.negTokenInit.mechListMIC.length] = '\0';
1426
1427         retval = cli_krb5_get_ticket(principal, 0, &tkt, &session_key_krb5, 0, NULL);
1428
1429         if (retval) {
1430
1431                 pstring user;
1432
1433                 /* Let's try to first get the TGT, for that we need a
1434                    password. */
1435
1436                 if (opt_password == NULL) {
1437                         DEBUG(10, ("Requesting password\n"));
1438                         x_fprintf(x_stdout, "PW\n");
1439                         return True;
1440                 }
1441
1442                 pstr_sprintf(user, "%s@%s", opt_username, opt_domain);
1443
1444                 if ((retval = kerberos_kinit_password(user, opt_password, 0, NULL))) {
1445                         DEBUG(10, ("Requesting TGT failed: %s\n", error_message(retval)));
1446                         return False;
1447                 }
1448
1449                 retval = cli_krb5_get_ticket(principal, 0, &tkt, &session_key_krb5, 0, NULL);
1450
1451                 if (retval) {
1452                         DEBUG(10, ("Kinit suceeded, but getting a ticket failed: %s\n", error_message(retval)));
1453                         return False;
1454                 }
1455         }
1456
1457         data_blob_free(&session_key_krb5);
1458
1459         ZERO_STRUCT(reply);
1460
1461         reply.type = SPNEGO_NEG_TOKEN_INIT;
1462         reply.negTokenInit.mechTypes = my_mechs;
1463         reply.negTokenInit.reqFlags = 0;
1464         reply.negTokenInit.mechToken = tkt;
1465         reply.negTokenInit.mechListMIC = data_blob(NULL, 0);
1466
1467         len = write_spnego_data(&to_server, &reply);
1468         data_blob_free(&tkt);
1469
1470         if (len == -1) {
1471                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1472                 return False;
1473         }
1474
1475         reply_base64 = base64_encode_data_blob(to_server);
1476         x_fprintf(x_stdout, "KK %s *\n", reply_base64);
1477
1478         SAFE_FREE(reply_base64);
1479         data_blob_free(&to_server);
1480         DEBUG(10, ("sent GSS-SPNEGO KERBEROS5 negTokenInit\n"));
1481         return True;
1482 }
1483
1484 static void manage_client_krb5_targ(SPNEGO_DATA spnego)
1485 {
1486         switch (spnego.negTokenTarg.negResult) {
1487         case SPNEGO_ACCEPT_INCOMPLETE:
1488                 DEBUG(1, ("Got a Kerberos negTokenTarg with ACCEPT_INCOMPLETE\n"));
1489                 x_fprintf(x_stdout, "BH\n");
1490                 break;
1491         case SPNEGO_ACCEPT_COMPLETED:
1492                 DEBUG(10, ("Accept completed\n"));
1493                 x_fprintf(x_stdout, "AF\n");
1494                 break;
1495         case SPNEGO_REJECT:
1496                 DEBUG(10, ("Rejected\n"));
1497                 x_fprintf(x_stdout, "NA\n");
1498                 break;
1499         default:
1500                 DEBUG(1, ("Got an invalid negTokenTarg\n"));
1501                 x_fprintf(x_stdout, "AF\n");
1502         }
1503 }
1504
1505 #endif
1506
1507 static void manage_gss_spnego_client_request(enum stdio_helper_mode stdio_helper_mode,
1508                                              char *buf, int length)
1509 {
1510         DATA_BLOB request;
1511         SPNEGO_DATA spnego;
1512         ssize_t len;
1513
1514         if (!opt_username || !*opt_username) {
1515                 x_fprintf(x_stderr, "username must be specified!\n\n");
1516                 exit(1);
1517         }
1518
1519         if (strlen(buf) <= 3) {
1520                 DEBUG(1, ("SPNEGO query [%s] too short\n", buf));
1521                 x_fprintf(x_stdout, "BH\n");
1522                 return;
1523         }
1524
1525         request = base64_decode_data_blob(buf+3);
1526
1527         if (strncmp(buf, "PW ", 3) == 0) {
1528
1529                 /* We asked for a password and obviously got it :-) */
1530
1531                 opt_password = SMB_STRNDUP((const char *)request.data, request.length);
1532
1533                 if (opt_password == NULL) {
1534                         DEBUG(1, ("Out of memory\n"));
1535                         x_fprintf(x_stdout, "BH\n");
1536                         data_blob_free(&request);
1537                         return;
1538                 }
1539
1540                 x_fprintf(x_stdout, "OK\n");
1541                 data_blob_free(&request);
1542                 return;
1543         }
1544
1545         if ( (strncmp(buf, "TT ", 3) != 0) &&
1546              (strncmp(buf, "AF ", 3) != 0) &&
1547              (strncmp(buf, "NA ", 3) != 0) ) {
1548                 DEBUG(1, ("SPNEGO request [%s] invalid\n", buf));
1549                 x_fprintf(x_stdout, "BH\n");
1550                 data_blob_free(&request);
1551                 return;
1552         }
1553
1554         /* So we got a server challenge to generate a SPNEGO
1555            client-to-server request... */
1556
1557         len = read_spnego_data(request, &spnego);
1558         data_blob_free(&request);
1559
1560         if (len == -1) {
1561                 DEBUG(1, ("Could not read SPNEGO data for [%s]\n", buf));
1562                 x_fprintf(x_stdout, "BH\n");
1563                 return;
1564         }
1565
1566         if (spnego.type == SPNEGO_NEG_TOKEN_INIT) {
1567
1568                 /* The server offers a list of mechanisms */
1569
1570                 const char **mechType = (const char **)spnego.negTokenInit.mechTypes;
1571
1572                 while (*mechType != NULL) {
1573
1574 #ifdef HAVE_KRB5
1575                         if ( (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) ||
1576                              (strcmp(*mechType, OID_KERBEROS5) == 0) ) {
1577                                 if (manage_client_krb5_init(spnego))
1578                                         goto out;
1579                         }
1580 #endif
1581
1582                         if (strcmp(*mechType, OID_NTLMSSP) == 0) {
1583                                 if (manage_client_ntlmssp_init(spnego))
1584                                         goto out;
1585                         }
1586
1587                         mechType++;
1588                 }
1589
1590                 DEBUG(1, ("Server offered no compatible mechanism\n"));
1591                 x_fprintf(x_stdout, "BH\n");
1592                 return;
1593         }
1594
1595         if (spnego.type == SPNEGO_NEG_TOKEN_TARG) {
1596
1597                 if (spnego.negTokenTarg.supportedMech == NULL) {
1598                         /* On accept/reject Windows does not send the
1599                            mechanism anymore. Handle that here and
1600                            shut down the mechanisms. */
1601
1602                         switch (spnego.negTokenTarg.negResult) {
1603                         case SPNEGO_ACCEPT_COMPLETED:
1604                                 x_fprintf(x_stdout, "AF\n");
1605                                 break;
1606                         case SPNEGO_REJECT:
1607                                 x_fprintf(x_stdout, "NA\n");
1608                                 break;
1609                         default:
1610                                 DEBUG(1, ("Got a negTokenTarg with no mech and an "
1611                                           "unknown negResult: %d\n",
1612                                           spnego.negTokenTarg.negResult));
1613                                 x_fprintf(x_stdout, "BH\n");
1614                         }
1615
1616                         ntlmssp_end(&client_ntlmssp_state);
1617                         goto out;
1618                 }
1619
1620                 if (strcmp(spnego.negTokenTarg.supportedMech,
1621                            OID_NTLMSSP) == 0) {
1622                         manage_client_ntlmssp_targ(spnego);
1623                         goto out;
1624                 }
1625
1626 #if HAVE_KRB5
1627                 if (strcmp(spnego.negTokenTarg.supportedMech,
1628                            OID_KERBEROS5_OLD) == 0) {
1629                         manage_client_krb5_targ(spnego);
1630                         goto out;
1631                 }
1632 #endif
1633
1634         }
1635
1636         DEBUG(1, ("Got an SPNEGO token I could not handle [%s]!\n", buf));
1637         x_fprintf(x_stdout, "BH\n");
1638         return;
1639
1640  out:
1641         free_spnego_data(&spnego);
1642         return;
1643 }
1644
1645 static void manage_ntlm_server_1_request(enum stdio_helper_mode stdio_helper_mode,
1646                                          char *buf, int length)
1647 {
1648         char *request, *parameter;
1649         static DATA_BLOB challenge;
1650         static DATA_BLOB lm_response;
1651         static DATA_BLOB nt_response;
1652         static char *full_username;
1653         static char *username;
1654         static char *domain;
1655         static char *plaintext_password;
1656         static BOOL ntlm_server_1_user_session_key;
1657         static BOOL ntlm_server_1_lm_session_key;
1658
1659         if (strequal(buf, ".")) {
1660                 if (!full_username && !username) {
1661                         x_fprintf(x_stdout, "Error: No username supplied!\n");
1662                 } else if (plaintext_password) {
1663                         /* handle this request as plaintext */
1664                         if (!full_username) {
1665                                 if (asprintf(&full_username, "%s%c%s", domain, winbind_separator(), username) == -1) {
1666                                         x_fprintf(x_stdout, "Error: Out of memory in asprintf!\n.\n");
1667                                         return;
1668                                 }
1669                         }
1670                         if (check_plaintext_auth(full_username, plaintext_password, False)) {
1671                                 x_fprintf(x_stdout, "Authenticated: Yes\n");
1672                         } else {
1673                                 x_fprintf(x_stdout, "Authenticated: No\n");
1674                         }
1675                 } else if (!lm_response.data && !nt_response.data) {
1676                         x_fprintf(x_stdout, "Error: No password supplied!\n");
1677                 } else if (!challenge.data) {
1678                         x_fprintf(x_stdout, "Error: No lanman-challenge supplied!\n");
1679                 } else {
1680                         char *error_string = NULL;
1681                         uchar lm_key[8];
1682                         uchar user_session_key[16];
1683                         uint32 flags = 0;
1684
1685                         if (full_username && !username) {
1686                                 fstring fstr_user;
1687                                 fstring fstr_domain;
1688
1689                                 if (!parse_ntlm_auth_domain_user(full_username, fstr_user, fstr_domain)) {
1690                                         /* username might be 'tainted', don't print into our new-line deleimianted stream */
1691                                         x_fprintf(x_stdout, "Error: Could not parse into domain and username\n");
1692                                 }
1693                                 SAFE_FREE(username);
1694                                 SAFE_FREE(domain);
1695                                 username = smb_xstrdup(fstr_user);
1696                                 domain = smb_xstrdup(fstr_domain);
1697                         }
1698
1699                         if (!domain) {
1700                                 domain = smb_xstrdup(get_winbind_domain());
1701                         }
1702
1703                         if (ntlm_server_1_lm_session_key)
1704                                 flags |= WBFLAG_PAM_LMKEY;
1705
1706                         if (ntlm_server_1_user_session_key)
1707                                 flags |= WBFLAG_PAM_USER_SESSION_KEY;
1708
1709                         if (!NT_STATUS_IS_OK(
1710                                     contact_winbind_auth_crap(username,
1711                                                               domain,
1712                                                               global_myname(),
1713                                                               &challenge,
1714                                                               &lm_response,
1715                                                               &nt_response,
1716                                                               flags,
1717                                                               lm_key,
1718                                                               user_session_key,
1719                                                               &error_string,
1720                                                               NULL))) {
1721
1722                                 x_fprintf(x_stdout, "Authenticated: No\n");
1723                                 x_fprintf(x_stdout, "Authentication-Error: %s\n.\n", error_string);
1724                                 SAFE_FREE(error_string);
1725                         } else {
1726                                 static char zeros[16];
1727                                 char *hex_lm_key;
1728                                 char *hex_user_session_key;
1729
1730                                 x_fprintf(x_stdout, "Authenticated: Yes\n");
1731
1732                                 if (ntlm_server_1_lm_session_key
1733                                     && (memcmp(zeros, lm_key,
1734                                                sizeof(lm_key)) != 0)) {
1735                                         hex_lm_key = hex_encode(NULL,
1736                                                                 (const unsigned char *)lm_key,
1737                                                                 sizeof(lm_key));
1738                                         x_fprintf(x_stdout, "LANMAN-Session-Key: %s\n", hex_lm_key);
1739                                         TALLOC_FREE(hex_lm_key);
1740                                 }
1741
1742                                 if (ntlm_server_1_user_session_key
1743                                     && (memcmp(zeros, user_session_key,
1744                                                sizeof(user_session_key)) != 0)) {
1745                                         hex_user_session_key = hex_encode(NULL,
1746                                                                           (const unsigned char *)user_session_key,
1747                                                                           sizeof(user_session_key));
1748                                         x_fprintf(x_stdout, "User-Session-Key: %s\n", hex_user_session_key);
1749                                         TALLOC_FREE(hex_user_session_key);
1750                                 }
1751                         }
1752                 }
1753                 /* clear out the state */
1754                 challenge = data_blob(NULL, 0);
1755                 nt_response = data_blob(NULL, 0);
1756                 lm_response = data_blob(NULL, 0);
1757                 SAFE_FREE(full_username);
1758                 SAFE_FREE(username);
1759                 SAFE_FREE(domain);
1760                 SAFE_FREE(plaintext_password);
1761                 ntlm_server_1_user_session_key = False;
1762                 ntlm_server_1_lm_session_key = False;
1763                 x_fprintf(x_stdout, ".\n");
1764
1765                 return;
1766         }
1767
1768         request = buf;
1769
1770         /* Indicates a base64 encoded structure */
1771         parameter = strstr_m(request, ":: ");
1772         if (!parameter) {
1773                 parameter = strstr_m(request, ": ");
1774
1775                 if (!parameter) {
1776                         DEBUG(0, ("Parameter not found!\n"));
1777                         x_fprintf(x_stdout, "Error: Parameter not found!\n.\n");
1778                         return;
1779                 }
1780
1781                 parameter[0] ='\0';
1782                 parameter++;
1783                 parameter[0] ='\0';
1784                 parameter++;
1785
1786         } else {
1787                 parameter[0] ='\0';
1788                 parameter++;
1789                 parameter[0] ='\0';
1790                 parameter++;
1791                 parameter[0] ='\0';
1792                 parameter++;
1793
1794                 base64_decode_inplace(parameter);
1795         }
1796
1797         if (strequal(request, "LANMAN-Challenge")) {
1798                 challenge = strhex_to_data_blob(NULL, parameter);
1799                 if (challenge.length != 8) {
1800                         x_fprintf(x_stdout, "Error: hex decode of %s failed! (got %d bytes, expected 8)\n.\n",
1801                                   parameter,
1802                                   (int)challenge.length);
1803                         challenge = data_blob(NULL, 0);
1804                 }
1805         } else if (strequal(request, "NT-Response")) {
1806                 nt_response = strhex_to_data_blob(NULL, parameter);
1807                 if (nt_response.length < 24) {
1808                         x_fprintf(x_stdout, "Error: hex decode of %s failed! (only got %d bytes, needed at least 24)\n.\n",
1809                                   parameter,
1810                                   (int)nt_response.length);
1811                         nt_response = data_blob(NULL, 0);
1812                 }
1813         } else if (strequal(request, "LANMAN-Response")) {
1814                 lm_response = strhex_to_data_blob(NULL, parameter);
1815                 if (lm_response.length != 24) {
1816                         x_fprintf(x_stdout, "Error: hex decode of %s failed! (got %d bytes, expected 24)\n.\n",
1817                                   parameter,
1818                                   (int)lm_response.length);
1819                         lm_response = data_blob(NULL, 0);
1820                 }
1821         } else if (strequal(request, "Password")) {
1822                 plaintext_password = smb_xstrdup(parameter);
1823         } else if (strequal(request, "NT-Domain")) {
1824                 domain = smb_xstrdup(parameter);
1825         } else if (strequal(request, "Username")) {
1826                 username = smb_xstrdup(parameter);
1827         } else if (strequal(request, "Full-Username")) {
1828                 full_username = smb_xstrdup(parameter);
1829         } else if (strequal(request, "Request-User-Session-Key")) {
1830                 ntlm_server_1_user_session_key = strequal(parameter, "Yes");
1831         } else if (strequal(request, "Request-LanMan-Session-Key")) {
1832                 ntlm_server_1_lm_session_key = strequal(parameter, "Yes");
1833         } else {
1834                 x_fprintf(x_stdout, "Error: Unknown request %s\n.\n", request);
1835         }
1836 }
1837
1838 static void manage_ntlm_change_password_1_request(enum stdio_helper_mode helper_mode, char *buf, int length)
1839 {
1840         char *request, *parameter;
1841         static DATA_BLOB new_nt_pswd;
1842         static DATA_BLOB old_nt_hash_enc;
1843         static DATA_BLOB new_lm_pswd;
1844         static DATA_BLOB old_lm_hash_enc;
1845         static char *full_username = NULL;
1846         static char *username = NULL;
1847         static char *domain = NULL;
1848         static char *newpswd =  NULL;
1849         static char *oldpswd = NULL;
1850
1851         if (strequal(buf, ".")) {
1852                 if(newpswd && oldpswd) {
1853                         uchar old_nt_hash[16];
1854                         uchar old_lm_hash[16];
1855                         uchar new_nt_hash[16];
1856                         uchar new_lm_hash[16];
1857
1858                         new_nt_pswd = data_blob(NULL, 516);
1859                         old_nt_hash_enc = data_blob(NULL, 16);
1860
1861                         /* Calculate the MD4 hash (NT compatible) of the
1862                          * password */
1863                         E_md4hash(oldpswd, old_nt_hash);
1864                         E_md4hash(newpswd, new_nt_hash);
1865
1866                         /* E_deshash returns false for 'long'
1867                            passwords (> 14 DOS chars).
1868
1869                            Therefore, don't send a buffer
1870                            encrypted with the truncated hash
1871                            (it could allow an even easier
1872                            attack on the password)
1873
1874                            Likewise, obey the admin's restriction
1875                         */
1876
1877                         if (lp_client_lanman_auth() &&
1878                             E_deshash(newpswd, new_lm_hash) &&
1879                             E_deshash(oldpswd, old_lm_hash)) {
1880                                 new_lm_pswd = data_blob(NULL, 516);
1881                                 old_lm_hash_enc = data_blob(NULL, 16);
1882                                 encode_pw_buffer(new_lm_pswd.data, newpswd,
1883                                                  STR_UNICODE);
1884
1885                                 SamOEMhash(new_lm_pswd.data, old_nt_hash, 516);
1886                                 E_old_pw_hash(new_nt_hash, old_lm_hash,
1887                                               old_lm_hash_enc.data);
1888                         } else {
1889                                 new_lm_pswd.data = NULL;
1890                                 new_lm_pswd.length = 0;
1891                                 old_lm_hash_enc.data = NULL;
1892                                 old_lm_hash_enc.length = 0;
1893                         }
1894
1895                         encode_pw_buffer(new_nt_pswd.data, newpswd,
1896                                          STR_UNICODE);
1897
1898                         SamOEMhash(new_nt_pswd.data, old_nt_hash, 516);
1899                         E_old_pw_hash(new_nt_hash, old_nt_hash,
1900                                       old_nt_hash_enc.data);
1901                 }
1902
1903                 if (!full_username && !username) {
1904                         x_fprintf(x_stdout, "Error: No username supplied!\n");
1905                 } else if ((!new_nt_pswd.data || !old_nt_hash_enc.data) &&
1906                            (!new_lm_pswd.data || old_lm_hash_enc.data) ) {
1907                         x_fprintf(x_stdout, "Error: No NT or LM password "
1908                                   "blobs supplied!\n");
1909                 } else {
1910                         char *error_string = NULL;
1911
1912                         if (full_username && !username) {
1913                                 fstring fstr_user;
1914                                 fstring fstr_domain;
1915
1916                                 if (!parse_ntlm_auth_domain_user(full_username,
1917                                                                  fstr_user,
1918                                                                  fstr_domain)) {
1919                                         /* username might be 'tainted', don't
1920                                          * print into our new-line
1921                                          * deleimianted stream */
1922                                         x_fprintf(x_stdout, "Error: Could not "
1923                                                   "parse into domain and "
1924                                                   "username\n");
1925                                         SAFE_FREE(username);
1926                                         username = smb_xstrdup(full_username);
1927                                 } else {
1928                                         SAFE_FREE(username);
1929                                         SAFE_FREE(domain);
1930                                         username = smb_xstrdup(fstr_user);
1931                                         domain = smb_xstrdup(fstr_domain);
1932                                 }
1933
1934                         }
1935
1936                         if(!NT_STATUS_IS_OK(contact_winbind_change_pswd_auth_crap(
1937                                                     username, domain,
1938                                                     new_nt_pswd,
1939                                                     old_nt_hash_enc,
1940                                                     new_lm_pswd,
1941                                                     old_lm_hash_enc,
1942                                                     &error_string))) {
1943                                 x_fprintf(x_stdout, "Password-Change: No\n");
1944                                 x_fprintf(x_stdout, "Password-Change-Error: "
1945                                           "%s\n.\n", error_string);
1946                         } else {
1947                                 x_fprintf(x_stdout, "Password-Change: Yes\n");
1948                         }
1949
1950                         SAFE_FREE(error_string);
1951                 }
1952                 /* clear out the state */
1953                 new_nt_pswd = data_blob(NULL, 0);
1954                 old_nt_hash_enc = data_blob(NULL, 0);
1955                 new_lm_pswd = data_blob(NULL, 0);
1956                 old_nt_hash_enc = data_blob(NULL, 0);
1957                 SAFE_FREE(full_username);
1958                 SAFE_FREE(username);
1959                 SAFE_FREE(domain);
1960                 SAFE_FREE(newpswd);
1961                 SAFE_FREE(oldpswd);
1962                 x_fprintf(x_stdout, ".\n");
1963
1964                 return;
1965         }
1966
1967         request = buf;
1968
1969         /* Indicates a base64 encoded structure */
1970         parameter = strstr_m(request, ":: ");
1971         if (!parameter) {
1972                 parameter = strstr_m(request, ": ");
1973
1974                 if (!parameter) {
1975                         DEBUG(0, ("Parameter not found!\n"));
1976                         x_fprintf(x_stdout, "Error: Parameter not found!\n.\n");
1977                         return;
1978                 }
1979
1980                 parameter[0] ='\0';
1981                 parameter++;
1982                 parameter[0] ='\0';
1983                 parameter++;
1984         } else {
1985                 parameter[0] ='\0';
1986                 parameter++;
1987                 parameter[0] ='\0';
1988                 parameter++;
1989                 parameter[0] ='\0';
1990                 parameter++;
1991
1992                 base64_decode_inplace(parameter);
1993         }
1994
1995         if (strequal(request, "new-nt-password-blob")) {
1996                 new_nt_pswd = strhex_to_data_blob(NULL, parameter);
1997                 if (new_nt_pswd.length != 516) {
1998                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
1999                                   "(got %d bytes, expected 516)\n.\n",
2000                                   parameter,
2001                                   (int)new_nt_pswd.length);
2002                         new_nt_pswd = data_blob(NULL, 0);
2003                 }
2004         } else if (strequal(request, "old-nt-hash-blob")) {
2005                 old_nt_hash_enc = strhex_to_data_blob(NULL, parameter);
2006                 if (old_nt_hash_enc.length != 16) {
2007                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2008                                   "(got %d bytes, expected 16)\n.\n",
2009                                   parameter,
2010                                   (int)old_nt_hash_enc.length);
2011                         old_nt_hash_enc = data_blob(NULL, 0);
2012                 }
2013         } else if (strequal(request, "new-lm-password-blob")) {
2014                 new_lm_pswd = strhex_to_data_blob(NULL, parameter);
2015                 if (new_lm_pswd.length != 516) {
2016                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2017                                   "(got %d bytes, expected 516)\n.\n",
2018                                   parameter,
2019                                   (int)new_lm_pswd.length);
2020                         new_lm_pswd = data_blob(NULL, 0);
2021                 }
2022         }
2023         else if (strequal(request, "old-lm-hash-blob")) {
2024                 old_lm_hash_enc = strhex_to_data_blob(NULL, parameter);
2025                 if (old_lm_hash_enc.length != 16)
2026                 {
2027                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2028                                   "(got %d bytes, expected 16)\n.\n",
2029                                   parameter,
2030                                   (int)old_lm_hash_enc.length);
2031                         old_lm_hash_enc = data_blob(NULL, 0);
2032                 }
2033         } else if (strequal(request, "nt-domain")) {
2034                 domain = smb_xstrdup(parameter);
2035         } else if(strequal(request, "username")) {
2036                 username = smb_xstrdup(parameter);
2037         } else if(strequal(request, "full-username")) {
2038                 username = smb_xstrdup(parameter);
2039         } else if(strequal(request, "new-password")) {
2040                 newpswd = smb_xstrdup(parameter);
2041         } else if (strequal(request, "old-password")) {
2042                 oldpswd = smb_xstrdup(parameter);
2043         } else {
2044                 x_fprintf(x_stdout, "Error: Unknown request %s\n.\n", request);
2045         }
2046 }
2047
2048 static void manage_squid_request(enum stdio_helper_mode helper_mode, stdio_helper_function fn)
2049 {
2050         char buf[SQUID_BUFFER_SIZE+1];
2051         int length;
2052         char *c;
2053         static BOOL err;
2054
2055         /* this is not a typo - x_fgets doesn't work too well under squid */
2056         if (fgets(buf, sizeof(buf)-1, stdin) == NULL) {
2057                 if (ferror(stdin)) {
2058                         DEBUG(1, ("fgets() failed! dying..... errno=%d (%s)\n", ferror(stdin),
2059                                   strerror(ferror(stdin))));
2060
2061                         exit(1);    /* BIIG buffer */
2062                 }
2063                 exit(0);
2064         }
2065
2066         c=(char *)memchr(buf,'\n',sizeof(buf)-1);
2067         if (c) {
2068                 *c = '\0';
2069                 length = c-buf;
2070         } else {
2071                 err = 1;
2072                 return;
2073         }
2074         if (err) {
2075                 DEBUG(2, ("Oversized message\n"));
2076                 x_fprintf(x_stderr, "ERR\n");
2077                 err = 0;
2078                 return;
2079         }
2080
2081         DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length));
2082
2083         if (buf[0] == '\0') {
2084                 DEBUG(2, ("Invalid Request\n"));
2085                 x_fprintf(x_stderr, "ERR\n");
2086                 return;
2087         }
2088
2089         fn(helper_mode, buf, length);
2090 }
2091
2092
2093 static void squid_stream(enum stdio_helper_mode stdio_mode, stdio_helper_function fn) {
2094         /* initialize FDescs */
2095         x_setbuf(x_stdout, NULL);
2096         x_setbuf(x_stderr, NULL);
2097         while(1) {
2098                 manage_squid_request(stdio_mode, fn);
2099         }
2100 }
2101
2102
2103 /* Authenticate a user with a challenge/response */
2104
2105 static BOOL check_auth_crap(void)
2106 {
2107         NTSTATUS nt_status;
2108         uint32 flags = 0;
2109         char lm_key[8];
2110         char user_session_key[16];
2111         char *hex_lm_key;
2112         char *hex_user_session_key;
2113         char *error_string;
2114         static uint8 zeros[16];
2115
2116         x_setbuf(x_stdout, NULL);
2117
2118         if (request_lm_key)
2119                 flags |= WBFLAG_PAM_LMKEY;
2120
2121         if (request_user_session_key)
2122                 flags |= WBFLAG_PAM_USER_SESSION_KEY;
2123
2124         flags |= WBFLAG_PAM_NT_STATUS_SQUASH;
2125
2126         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
2127                                               opt_workstation,
2128                                               &opt_challenge,
2129                                               &opt_lm_response,
2130                                               &opt_nt_response,
2131                                               flags,
2132                                               (unsigned char *)lm_key,
2133                                               (unsigned char *)user_session_key,
2134                                               &error_string, NULL);
2135
2136         if (!NT_STATUS_IS_OK(nt_status)) {
2137                 x_fprintf(x_stdout, "%s (0x%x)\n",
2138                           error_string,
2139                           NT_STATUS_V(nt_status));
2140                 SAFE_FREE(error_string);
2141                 return False;
2142         }
2143
2144         if (request_lm_key
2145             && (memcmp(zeros, lm_key,
2146                        sizeof(lm_key)) != 0)) {
2147                 hex_lm_key = hex_encode(NULL, (const unsigned char *)lm_key,
2148                                         sizeof(lm_key));
2149                 x_fprintf(x_stdout, "LM_KEY: %s\n", hex_lm_key);
2150                 TALLOC_FREE(hex_lm_key);
2151         }
2152         if (request_user_session_key
2153             && (memcmp(zeros, user_session_key,
2154                        sizeof(user_session_key)) != 0)) {
2155                 hex_user_session_key = hex_encode(NULL, (const unsigned char *)user_session_key,
2156                                                   sizeof(user_session_key));
2157                 x_fprintf(x_stdout, "NT_KEY: %s\n", hex_user_session_key);
2158                 TALLOC_FREE(hex_user_session_key);
2159         }
2160
2161         return True;
2162 }
2163
2164 /* Main program */
2165
2166 enum {
2167         OPT_USERNAME = 1000,
2168         OPT_DOMAIN,
2169         OPT_WORKSTATION,
2170         OPT_CHALLENGE,
2171         OPT_RESPONSE,
2172         OPT_LM,
2173         OPT_NT,
2174         OPT_PASSWORD,
2175         OPT_LM_KEY,
2176         OPT_USER_SESSION_KEY,
2177         OPT_DIAGNOSTICS,
2178         OPT_REQUIRE_MEMBERSHIP,
2179         OPT_USE_CACHED_CREDS
2180 };
2181
2182  int main(int argc, const char **argv)
2183 {
2184         int opt;
2185         static const char *helper_protocol;
2186         static int diagnostics;
2187
2188         static const char *hex_challenge;
2189         static const char *hex_lm_response;
2190         static const char *hex_nt_response;
2191
2192         poptContext pc;
2193
2194         /* NOTE: DO NOT change this interface without considering the implications!
2195            This is an external interface, which other programs will use to interact
2196            with this helper.
2197         */
2198
2199         /* We do not use single-letter command abbreviations, because they harm future
2200            interface stability. */
2201
2202         struct poptOption long_options[] = {
2203                 POPT_AUTOHELP
2204                 { "helper-protocol", 0, POPT_ARG_STRING, &helper_protocol, OPT_DOMAIN, "operate as a stdio-based helper", "helper protocol to use"},
2205                 { "username", 0, POPT_ARG_STRING, &opt_username, OPT_USERNAME, "username"},
2206                 { "domain", 0, POPT_ARG_STRING, &opt_domain, OPT_DOMAIN, "domain name"},
2207                 { "workstation", 0, POPT_ARG_STRING, &opt_workstation, OPT_WORKSTATION, "workstation"},
2208                 { "challenge", 0, POPT_ARG_STRING, &hex_challenge, OPT_CHALLENGE, "challenge (HEX encoded)"},
2209                 { "lm-response", 0, POPT_ARG_STRING, &hex_lm_response, OPT_LM, "LM Response to the challenge (HEX encoded)"},
2210                 { "nt-response", 0, POPT_ARG_STRING, &hex_nt_response, OPT_NT, "NT or NTLMv2 Response to the challenge (HEX encoded)"},
2211                 { "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"},
2212                 { "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retrieve LM session key"},
2213                 { "request-nt-key", 0, POPT_ARG_NONE, &request_user_session_key, OPT_USER_SESSION_KEY, "Retrieve User (NT) session key"},
2214                 { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "Use cached credentials if no password is given"},
2215                 { "diagnostics", 0, POPT_ARG_NONE, &diagnostics, OPT_DIAGNOSTICS, "Perform diagnostics on the authentictaion chain"},
2216                 { "require-membership-of", 0, POPT_ARG_STRING, &require_membership_of, OPT_REQUIRE_MEMBERSHIP, "Require that a user be a member of this group (either name or SID) for authentication to succeed" },
2217                 POPT_COMMON_SAMBA
2218                 POPT_TABLEEND
2219         };
2220
2221         /* Samba client initialisation */
2222         load_case_tables();
2223
2224         dbf = x_stderr;
2225
2226         /* Samba client initialisation */
2227
2228         if (!lp_load(dyn_CONFIGFILE, True, False, False, True)) {
2229                 d_fprintf(stderr, "ntlm_auth: error opening config file %s. Error was %s\n",
2230                         dyn_CONFIGFILE, strerror(errno));
2231                 exit(1);
2232         }
2233
2234         /* Parse options */
2235
2236         pc = poptGetContext("ntlm_auth", argc, argv, long_options, 0);
2237
2238         /* Parse command line options */
2239
2240         if (argc == 1) {
2241                 poptPrintHelp(pc, stderr, 0);
2242                 return 1;
2243         }
2244
2245         pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
2246                             POPT_CONTEXT_KEEP_FIRST);
2247
2248         while((opt = poptGetNextOpt(pc)) != -1) {
2249                 switch (opt) {
2250                 case OPT_CHALLENGE:
2251                         opt_challenge = strhex_to_data_blob(NULL, hex_challenge);
2252                         if (opt_challenge.length != 8) {
2253                                 x_fprintf(x_stderr, "hex decode of %s failed! (only got %d bytes)\n",
2254                                           hex_challenge,
2255                                           (int)opt_challenge.length);
2256                                 exit(1);
2257                         }
2258                         break;
2259                 case OPT_LM:
2260                         opt_lm_response = strhex_to_data_blob(NULL, hex_lm_response);
2261                         if (opt_lm_response.length != 24) {
2262                                 x_fprintf(x_stderr, "hex decode of %s failed! (only got %d bytes)\n",
2263                                           hex_lm_response,
2264                                           (int)opt_lm_response.length);
2265                                 exit(1);
2266                         }
2267                         break;
2268
2269                 case OPT_NT:
2270                         opt_nt_response = strhex_to_data_blob(NULL, hex_nt_response);
2271                         if (opt_nt_response.length < 24) {
2272                                 x_fprintf(x_stderr, "hex decode of %s failed! (only got %d bytes)\n",
2273                                           hex_nt_response,
2274                                           (int)opt_nt_response.length);
2275                                 exit(1);
2276                         }
2277                         break;
2278
2279                 case OPT_REQUIRE_MEMBERSHIP:
2280                         if (StrnCaseCmp("S-", require_membership_of, 2) == 0) {
2281                                 require_membership_of_sid = require_membership_of;
2282                         }
2283                         break;
2284                 }
2285         }
2286
2287         if (opt_username) {
2288                 char *domain = SMB_STRDUP(opt_username);
2289                 char *p = strchr_m(domain, *lp_winbind_separator());
2290                 if (p) {
2291                         opt_username = p+1;
2292                         *p = '\0';
2293                         if (opt_domain && !strequal(opt_domain, domain)) {
2294                                 x_fprintf(x_stderr, "Domain specified in username (%s) "
2295                                         "doesn't match specified domain (%s)!\n\n",
2296                                         domain, opt_domain);
2297                                 poptPrintHelp(pc, stderr, 0);
2298                                 exit(1);
2299                         }
2300                         opt_domain = domain;
2301                 } else {
2302                         SAFE_FREE(domain);
2303                 }
2304         }
2305
2306         if (opt_domain == NULL || !*opt_domain) {
2307                 opt_domain = get_winbind_domain();
2308         }
2309
2310         if (opt_workstation == NULL) {
2311                 opt_workstation = "";
2312         }
2313
2314         if (helper_protocol) {
2315                 int i;
2316                 for (i=0; i<NUM_HELPER_MODES; i++) {
2317                         if (strcmp(helper_protocol, stdio_helper_protocols[i].name) == 0) {
2318                                 squid_stream(stdio_helper_protocols[i].mode, stdio_helper_protocols[i].fn);
2319                                 exit(0);
2320                         }
2321                 }
2322                 x_fprintf(x_stderr, "unknown helper protocol [%s]\n\nValid helper protools:\n\n", helper_protocol);
2323
2324                 for (i=0; i<NUM_HELPER_MODES; i++) {
2325                         x_fprintf(x_stderr, "%s\n", stdio_helper_protocols[i].name);
2326                 }
2327
2328                 exit(1);
2329         }
2330
2331         if (!opt_username || !*opt_username) {
2332                 x_fprintf(x_stderr, "username must be specified!\n\n");
2333                 poptPrintHelp(pc, stderr, 0);
2334                 exit(1);
2335         }
2336
2337         if (opt_challenge.length) {
2338                 if (!check_auth_crap()) {
2339                         exit(1);
2340                 }
2341                 exit(0);
2342         }
2343
2344         if (!opt_password) {
2345                 opt_password = getpass("password: ");
2346         }
2347
2348         if (diagnostics) {
2349                 if (!diagnose_ntlm_auth()) {
2350                         return 1;
2351                 }
2352         } else {
2353                 fstring user;
2354
2355                 fstr_sprintf(user, "%s%c%s", opt_domain, winbind_separator(), opt_username);
2356                 if (!check_plaintext_auth(user, opt_password, True)) {
2357                         return 1;
2358                 }
2359         }
2360
2361         /* Exit code */
2362
2363         poptFreeContext(pc);
2364         return 0;
2365 }