This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
static char winbind_separator(void)
{
struct winbindd_response response;
- static BOOL got_sep;
+ static bool got_sep;
static char sep;
if (got_sep)
/* Copy of parse_domain_user from winbindd_util.c. Parse a string of the
form DOMAIN/user into a domain and a user */
-static BOOL parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
+static bool parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
fstring user)
{
return True;
}
-static BOOL get_require_membership_sid(void) {
+static bool get_require_membership_sid(void) {
struct winbindd_request request;
struct winbindd_response response;
}
/* Authenticate a user with a plaintext password */
-static BOOL check_plaintext_auth(const char *user, const char *pass,
- BOOL stdout_diagnostics)
+static bool check_plaintext_auth(const char *user, const char *pass,
+ bool stdout_diagnostics)
{
struct winbindd_request request;
struct winbindd_response response;
fstrcpy(request.data.auth.user, user);
fstrcpy(request.data.auth.pass, pass);
- if (require_membership_of_sid)
- pstrcpy(request.data.auth.require_membership_of_sid, require_membership_of_sid);
+ if (require_membership_of_sid) {
+ strlcpy(request.data.auth.require_membership_of_sid,
+ require_membership_of_sid,
+ sizeof(request.data.auth.require_membership_of_sid));
+ }
result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
/* Display response */
-
+
if (stdout_diagnostics) {
if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
d_printf("Reading winbind reply failed! (0x01)\n");
}
-
- d_printf("%s: %s (0x%x)\n",
- response.data.auth.nt_status_string,
- response.data.auth.error_string,
+
+ d_printf("%s: %s (0x%x)\n",
+ response.data.auth.nt_status_string,
+ response.data.auth.error_string,
response.data.auth.nt_status);
} else {
if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
DEBUG(1, ("Reading winbind reply failed! (0x01)\n"));
}
-
- DEBUG(3, ("%s: %s (0x%x)\n",
- response.data.auth.nt_status_string,
+
+ DEBUG(3, ("%s: %s (0x%x)\n",
+ response.data.auth.nt_status_string,
response.data.auth.error_string,
- response.data.auth.nt_status));
+ response.data.auth.nt_status));
}
-
+
return (result == NSS_STATUS_SUCCESS);
}
/* authenticate a user with an encrypted username/password */
-NTSTATUS contact_winbind_auth_crap(const char *username,
- const char *domain,
+NTSTATUS contact_winbind_auth_crap(const char *username,
+ const char *domain,
const char *workstation,
- const DATA_BLOB *challenge,
- const DATA_BLOB *lm_response,
- const DATA_BLOB *nt_response,
- uint32 flags,
- uint8 lm_key[8],
- uint8 user_session_key[16],
- char **error_string,
- char **unix_name)
+ const DATA_BLOB *challenge,
+ const DATA_BLOB *lm_response,
+ const DATA_BLOB *nt_response,
+ uint32 flags,
+ uint8 lm_key[8],
+ uint8 user_session_key[16],
+ char **error_string,
+ char **unix_name)
{
NTSTATUS nt_status;
NSS_STATUS result;
nt_status = NT_STATUS_UNSUCCESSFUL;
if (error_string)
*error_string = smb_xstrdup("Reading winbind reply failed!");
- free_response(&response);
+ winbindd_free_response(&response);
return nt_status;
}
if (!NT_STATUS_IS_OK(nt_status)) {
if (error_string)
*error_string = smb_xstrdup(response.data.auth.error_string);
- free_response(&response);
+ winbindd_free_response(&response);
return nt_status;
}
if (flags & WBFLAG_PAM_UNIX_NAME) {
*unix_name = SMB_STRDUP((char *)response.extra_data.data);
if (!*unix_name) {
- free_response(&response);
+ winbindd_free_response(&response);
return NT_STATUS_NO_MEMORY;
}
}
- free_response(&response);
+ winbindd_free_response(&response);
return nt_status;
}
nt_status = NT_STATUS_UNSUCCESSFUL;
if (error_string)
*error_string = smb_xstrdup("Reading winbind reply failed!");
- free_response(&response);
+ winbindd_free_response(&response);
return nt_status;
}
{
if (error_string)
*error_string = smb_xstrdup(response.data.auth.error_string);
- free_response(&response);
+ winbindd_free_response(&response);
return nt_status;
}
- free_response(&response);
+ winbindd_free_response(&response);
return nt_status;
}
SAFE_FREE(wb_request.extra_data.data);
if (result != NSS_STATUS_SUCCESS) {
- free_response(&wb_response);
+ winbindd_free_response(&wb_response);
return NT_STATUS_UNSUCCESSFUL;
}
wb_response.data.ccache_ntlm_auth.auth_blob_len);
if (wb_response.data.ccache_ntlm_auth.auth_blob_len > 0 &&
reply->data == NULL) {
- free_response(&wb_response);
+ winbindd_free_response(&wb_response);
return NT_STATUS_NO_MEMORY;
}
}
- free_response(&wb_response);
+ winbindd_free_response(&wb_response);
return NT_STATUS_MORE_PROCESSING_REQUIRED;
}
static NTLMSSP_STATE *ntlmssp_state = NULL;
static char* want_feature_list = NULL;
static uint32 neg_flags = 0;
- static BOOL have_session_key = False;
+ static bool have_session_key = False;
static DATA_BLOB session_key;
DATA_BLOB request, reply;
NTSTATUS nt_status;
}
request = base64_decode_data_blob(buf + 3);
} else {
- request = data_blob(NULL, 0);
+ request = data_blob_null;
}
if ((strncmp(buf, "PW ", 3) == 0)) {
} else if (strncmp(buf, "GK", 2) == 0) {
DEBUG(10, ("Requested NTLMSSP session key\n"));
if(have_session_key) {
- char *key64 = base64_encode_data_blob(session_key);
+ char *key64 = base64_encode_data_blob(talloc_tos(),
+ session_key);
x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
- SAFE_FREE(key64);
+ TALLOC_FREE(key64);
} else {
x_fprintf(x_stdout, "BH\n");
}
nt_status = ntlmssp_update(ntlmssp_state, request, &reply);
if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- char *reply_base64 = base64_encode_data_blob(reply);
+ char *reply_base64 = base64_encode_data_blob(talloc_tos(),
+ reply);
x_fprintf(x_stdout, "TT %s\n", reply_base64);
- SAFE_FREE(reply_base64);
+ TALLOC_FREE(reply_base64);
data_blob_free(&reply);
DEBUG(10, ("NTLMSSP challenge\n"));
} else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
static DATA_BLOB initial_message;
static char* want_feature_list = NULL;
static uint32 neg_flags = 0;
- static BOOL have_session_key = False;
+ static bool have_session_key = False;
static DATA_BLOB session_key;
DATA_BLOB request, reply;
NTSTATUS nt_status;
- BOOL first = False;
+ bool first = False;
if (!opt_username || !*opt_username) {
x_fprintf(x_stderr, "username must be specified!\n\n");
}
request = base64_decode_data_blob(buf + 3);
} else {
- request = data_blob(NULL, 0);
+ request = data_blob_null;
}
if (strncmp(buf, "PW ", 3) == 0) {
if (!ntlmssp_state && use_cached_creds) {
/* check whether credentials are usable. */
- DATA_BLOB empty_blob = data_blob(NULL, 0);
+ DATA_BLOB empty_blob = data_blob_null;
nt_status = do_ccache_ntlm_auth(empty_blob, empty_blob, NULL);
if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
DEBUG(10, ("Requested session key\n"));
if(have_session_key) {
- char *key64 = base64_encode_data_blob(session_key);
+ char *key64 = base64_encode_data_blob(talloc_tos(),
+ session_key);
x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
- SAFE_FREE(key64);
+ TALLOC_FREE(key64);
}
else {
x_fprintf(x_stdout, "BH\n");
}
ntlmssp_want_feature_list(ntlmssp_state, want_feature_list);
first = True;
- initial_message = data_blob(NULL, 0);
+ initial_message = data_blob_null;
}
DEBUG(10, ("got NTLMSSP packet:\n"));
}
if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- char *reply_base64 = base64_encode_data_blob(reply);
+ char *reply_base64 = base64_encode_data_blob(talloc_tos(),
+ reply);
if (first) {
x_fprintf(x_stdout, "YR %s\n", reply_base64);
} else {
x_fprintf(x_stdout, "KK %s\n", reply_base64);
}
- SAFE_FREE(reply_base64);
+ TALLOC_FREE(reply_base64);
if (first) {
initial_message = reply;
} else {
}
DEBUG(10, ("NTLMSSP challenge\n"));
} else if (NT_STATUS_IS_OK(nt_status)) {
- char *reply_base64 = base64_encode_data_blob(reply);
+ char *reply_base64 = base64_encode_data_blob(talloc_tos(),
+ reply);
x_fprintf(x_stdout, "AF %s\n", reply_base64);
- SAFE_FREE(reply_base64);
+ TALLOC_FREE(reply_base64);
if(have_session_key)
data_blob_free(&session_key);
SPNEGO_DATA spnego;
ssize_t len;
char *reply_base64;
-
- pstring principal;
- pstring myname_lower;
+ TALLOC_CTX *ctx = talloc_tos();
+ char *principal;
+ char *myname_lower;
ZERO_STRUCT(spnego);
- pstrcpy(myname_lower, global_myname());
+ myname_lower = talloc_strdup(ctx, global_myname());
+ if (!myname_lower) {
+ return;
+ }
strlower_m(myname_lower);
- pstr_sprintf(principal, "%s$@%s", myname_lower, lp_realm());
+ principal = talloc_asprintf(ctx, "%s$@%s", myname_lower, lp_realm());
+ if (!principal) {
+ return;
+ }
/* Server negTokenInit (mech offerings) */
spnego.type = SPNEGO_NEG_TOKEN_INIT;
return;
}
- reply_base64 = base64_encode_data_blob(token);
+ reply_base64 = base64_encode_data_blob(talloc_tos(), token);
x_fprintf(x_stdout, "TT %s *\n", reply_base64);
- SAFE_FREE(reply_base64);
+ TALLOC_FREE(reply_base64);
data_blob_free(&token);
DEBUG(10, ("sent SPNEGO negTokenInit\n"));
return;
DATA_BLOB token;
NTSTATUS status;
ssize_t len;
+ TALLOC_CTX *ctx = talloc_tos();
char *user = NULL;
char *domain = NULL;
const char *reply_code;
char *reply_base64;
- pstring reply_argument;
+ char *reply_argument = NULL;
if (strlen(buf) < 2) {
DEBUG(1, ("SPENGO query [%s] invalid", buf));
if (ntlmssp_state)
ntlmssp_end(&ntlmssp_state);
} else if (strncmp(buf, "KK", 2) == 0) {
-
+ ;
} else {
DEBUG(1, ("SPENGO query [%s] invalid", buf));
x_fprintf(x_stdout, "BH\n");
response.type = SPNEGO_NEG_TOKEN_TARG;
response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
- response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
+ response.negTokenTarg.mechListMIC = data_blob_null;
status = ntlmssp_update(ntlmssp_state,
request.negTokenInit.mechToken,
char *principal;
DATA_BLOB ap_rep;
DATA_BLOB session_key;
+ PAC_DATA *pac_data = NULL;
if ( request.negTokenInit.mechToken.data == NULL ) {
DEBUG(1, ("Client did not provide Kerberos data\n"));
response.type = SPNEGO_NEG_TOKEN_TARG;
response.negTokenTarg.supportedMech = SMB_STRDUP(OID_KERBEROS5_OLD);
- response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
- response.negTokenTarg.responseToken = data_blob(NULL, 0);
+ response.negTokenTarg.mechListMIC = data_blob_null;
+ response.negTokenTarg.responseToken = data_blob_null;
status = ads_verify_ticket(mem_ctx, lp_realm(), 0,
&request.negTokenInit.mechToken,
- &principal, NULL, &ap_rep,
- &session_key);
+ &principal, &pac_data, &ap_rep,
+ &session_key, True);
talloc_destroy(mem_ctx);
response.type = SPNEGO_NEG_TOKEN_TARG;
response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
- response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
+ response.negTokenTarg.mechListMIC = data_blob_null;
if (NT_STATUS_IS_OK(status)) {
user = SMB_STRDUP(ntlmssp_state->user);
if (NT_STATUS_IS_OK(status)) {
response.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
reply_code = "AF";
- pstr_sprintf(reply_argument, "%s\\%s", domain, user);
+ reply_argument = talloc_asprintf(ctx, "%s\\%s", domain, user);
} else if (NT_STATUS_EQUAL(status,
NT_STATUS_MORE_PROCESSING_REQUIRED)) {
response.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
reply_code = "TT";
- pstr_sprintf(reply_argument, "*");
+ reply_argument = talloc_strdup(ctx, "*");
} else {
response.negTokenTarg.negResult = SPNEGO_REJECT;
reply_code = "NA";
- pstrcpy(reply_argument, nt_errstr(status));
+ reply_argument = talloc_strdup(ctx, nt_errstr(status));
+ }
+
+ if (!reply_argument) {
+ DEBUG(1, ("Could not write SPNEGO data blob\n"));
+ x_fprintf(x_stdout, "BH\n");
+ return;
}
SAFE_FREE(user);
return;
}
- reply_base64 = base64_encode_data_blob(token);
+ reply_base64 = base64_encode_data_blob(talloc_tos(), token);
x_fprintf(x_stdout, "%s %s %s\n",
reply_code, reply_base64, reply_argument);
- SAFE_FREE(reply_base64);
+ TALLOC_FREE(reply_base64);
data_blob_free(&token);
return;
static NTLMSSP_STATE *client_ntlmssp_state = NULL;
-static BOOL manage_client_ntlmssp_init(SPNEGO_DATA spnego)
+static bool manage_client_ntlmssp_init(SPNEGO_DATA spnego)
{
NTSTATUS status;
- DATA_BLOB null_blob = data_blob(NULL, 0);
+ DATA_BLOB null_blob = data_blob_null;
DATA_BLOB to_server;
char *to_server_base64;
const char *my_mechs[] = {OID_NTLMSSP, NULL};
write_spnego_data(&to_server, &spnego);
data_blob_free(&spnego.negTokenInit.mechToken);
- to_server_base64 = base64_encode_data_blob(to_server);
+ to_server_base64 = base64_encode_data_blob(talloc_tos(), to_server);
data_blob_free(&to_server);
x_fprintf(x_stdout, "KK %s\n", to_server_base64);
- SAFE_FREE(to_server_base64);
+ TALLOC_FREE(to_server_base64);
return True;
}
static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego)
{
NTSTATUS status;
- DATA_BLOB null_blob = data_blob(NULL, 0);
+ DATA_BLOB null_blob = data_blob_null;
DATA_BLOB request;
DATA_BLOB to_server;
char *to_server_base64;
write_spnego_data(&to_server, &spnego);
data_blob_free(&request);
- to_server_base64 = base64_encode_data_blob(to_server);
+ to_server_base64 = base64_encode_data_blob(talloc_tos(), to_server);
data_blob_free(&to_server);
x_fprintf(x_stdout, "KK %s\n", to_server_base64);
- SAFE_FREE(to_server_base64);
+ TALLOC_FREE(to_server_base64);
return;
}
#ifdef HAVE_KRB5
-static BOOL manage_client_krb5_init(SPNEGO_DATA spnego)
+static bool manage_client_krb5_init(SPNEGO_DATA spnego)
{
char *principal;
DATA_BLOB tkt, to_server;
- DATA_BLOB session_key_krb5 = data_blob(NULL, 0);
+ DATA_BLOB session_key_krb5 = data_blob_null;
SPNEGO_DATA reply;
char *reply_base64;
int retval;
-
+
const char *my_mechs[] = {OID_KERBEROS5_OLD, NULL};
ssize_t len;
retval = cli_krb5_get_ticket(principal, 0, &tkt, &session_key_krb5, 0, NULL, NULL);
if (retval) {
-
- pstring user;
+ char *user = NULL;
/* Let's try to first get the TGT, for that we need a
password. */
return True;
}
- pstr_sprintf(user, "%s@%s", opt_username, opt_domain);
+ user = talloc_asprintf(talloc_tos(), "%s@%s", opt_username, opt_domain);
+ if (!user) {
+ return false;
+ }
if ((retval = kerberos_kinit_password(user, opt_password, 0, NULL))) {
DEBUG(10, ("Requesting TGT failed: %s\n", error_message(retval)));
reply.negTokenInit.mechTypes = my_mechs;
reply.negTokenInit.reqFlags = 0;
reply.negTokenInit.mechToken = tkt;
- reply.negTokenInit.mechListMIC = data_blob(NULL, 0);
+ reply.negTokenInit.mechListMIC = data_blob_null;
len = write_spnego_data(&to_server, &reply);
data_blob_free(&tkt);
return False;
}
- reply_base64 = base64_encode_data_blob(to_server);
+ reply_base64 = base64_encode_data_blob(talloc_tos(), to_server);
x_fprintf(x_stdout, "KK %s *\n", reply_base64);
- SAFE_FREE(reply_base64);
+ TALLOC_FREE(reply_base64);
data_blob_free(&to_server);
DEBUG(10, ("sent GSS-SPNEGO KERBEROS5 negTokenInit\n"));
return True;
static char *username;
static char *domain;
static char *plaintext_password;
- static BOOL ntlm_server_1_user_session_key;
- static BOOL ntlm_server_1_lm_session_key;
+ static bool ntlm_server_1_user_session_key;
+ static bool ntlm_server_1_lm_session_key;
if (strequal(buf, ".")) {
if (!full_username && !username) {
}
}
/* clear out the state */
- challenge = data_blob(NULL, 0);
- nt_response = data_blob(NULL, 0);
- lm_response = data_blob(NULL, 0);
+ challenge = data_blob_null;
+ nt_response = data_blob_null;
+ lm_response = data_blob_null;
SAFE_FREE(full_username);
SAFE_FREE(username);
SAFE_FREE(domain);
x_fprintf(x_stdout, "Error: hex decode of %s failed! (got %d bytes, expected 8)\n.\n",
parameter,
(int)challenge.length);
- challenge = data_blob(NULL, 0);
+ challenge = data_blob_null;
}
} else if (strequal(request, "NT-Response")) {
nt_response = strhex_to_data_blob(NULL, parameter);
x_fprintf(x_stdout, "Error: hex decode of %s failed! (only got %d bytes, needed at least 24)\n.\n",
parameter,
(int)nt_response.length);
- nt_response = data_blob(NULL, 0);
+ nt_response = data_blob_null;
}
} else if (strequal(request, "LANMAN-Response")) {
lm_response = strhex_to_data_blob(NULL, parameter);
x_fprintf(x_stdout, "Error: hex decode of %s failed! (got %d bytes, expected 24)\n.\n",
parameter,
(int)lm_response.length);
- lm_response = data_blob(NULL, 0);
+ lm_response = data_blob_null;
}
} else if (strequal(request, "Password")) {
plaintext_password = smb_xstrdup(parameter);
SAFE_FREE(error_string);
}
/* clear out the state */
- new_nt_pswd = data_blob(NULL, 0);
- old_nt_hash_enc = data_blob(NULL, 0);
- new_lm_pswd = data_blob(NULL, 0);
- old_nt_hash_enc = data_blob(NULL, 0);
+ new_nt_pswd = data_blob_null;
+ old_nt_hash_enc = data_blob_null;
+ new_lm_pswd = data_blob_null;
+ old_nt_hash_enc = data_blob_null;
SAFE_FREE(full_username);
SAFE_FREE(username);
SAFE_FREE(domain);
"(got %d bytes, expected 516)\n.\n",
parameter,
(int)new_nt_pswd.length);
- new_nt_pswd = data_blob(NULL, 0);
+ new_nt_pswd = data_blob_null;
}
} else if (strequal(request, "old-nt-hash-blob")) {
old_nt_hash_enc = strhex_to_data_blob(NULL, parameter);
"(got %d bytes, expected 16)\n.\n",
parameter,
(int)old_nt_hash_enc.length);
- old_nt_hash_enc = data_blob(NULL, 0);
+ old_nt_hash_enc = data_blob_null;
}
} else if (strequal(request, "new-lm-password-blob")) {
new_lm_pswd = strhex_to_data_blob(NULL, parameter);
"(got %d bytes, expected 516)\n.\n",
parameter,
(int)new_lm_pswd.length);
- new_lm_pswd = data_blob(NULL, 0);
+ new_lm_pswd = data_blob_null;
}
}
else if (strequal(request, "old-lm-hash-blob")) {
"(got %d bytes, expected 16)\n.\n",
parameter,
(int)old_lm_hash_enc.length);
- old_lm_hash_enc = data_blob(NULL, 0);
+ old_lm_hash_enc = data_blob_null;
}
} else if (strequal(request, "nt-domain")) {
domain = smb_xstrdup(parameter);
char buf[SQUID_BUFFER_SIZE+1];
int length;
char *c;
- static BOOL err;
+ static bool err;
/* this is not a typo - x_fgets doesn't work too well under squid */
if (fgets(buf, sizeof(buf)-1, stdin) == NULL) {
/* Authenticate a user with a challenge/response */
-static BOOL check_auth_crap(void)
+static bool check_auth_crap(void)
{
NTSTATUS nt_status;
uint32 flags = 0;
int main(int argc, const char **argv)
{
+ TALLOC_CTX *frame = talloc_stackframe();
int opt;
static const char *helper_protocol;
static int diagnostics;
/* Samba client initialisation */
- if (!lp_load(dyn_CONFIGFILE, True, False, False, True)) {
+ if (!lp_load(get_dyn_CONFIGFILE(), True, False, False, True)) {
d_fprintf(stderr, "ntlm_auth: error opening config file %s. Error was %s\n",
- dyn_CONFIGFILE, strerror(errno));
+ get_dyn_CONFIGFILE(), strerror(errno));
exit(1);
}
/* Exit code */
poptFreeContext(pc);
+ TALLOC_FREE(frame);
return 0;
}
git.samba.org / samba.git / blobdiff