source/utils/ntlm_auth.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
   9    Copyright (C) Robert O'Callahan 2006 (added cached credential code).
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "utils/ntlm_auth.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_WINBIND
  30
  31 #define INITIAL_BUFFER_SIZE 300
  32 #define MAX_BUFFER_SIZE 630000
  33
  34 enum stdio_helper_mode {
  35         SQUID_2_4_BASIC,
  36         SQUID_2_5_BASIC,
  37         SQUID_2_5_NTLMSSP,
  38         NTLMSSP_CLIENT_1,
  39         GSS_SPNEGO,
  40         GSS_SPNEGO_CLIENT,
  41         NTLM_SERVER_1,
  42         NTLM_CHANGE_PASSWORD_1,
  43         NUM_HELPER_MODES
  44 };
  45
  46 enum ntlm_auth_cli_state {
  47         CLIENT_INITIAL = 0,
  48         CLIENT_RESPONSE,
  49         CLIENT_FINISHED,
  50         CLIENT_ERROR
  51 };
  52
  53 enum ntlm_auth_svr_state {
  54         SERVER_INITIAL = 0,
  55         SERVER_CHALLENGE,
  56         SERVER_FINISHED,
  57         SERVER_ERROR
  58 };
  59
  60 struct ntlm_auth_state {
  61         TALLOC_CTX *mem_ctx;
  62         enum stdio_helper_mode helper_mode;
  63         enum ntlm_auth_cli_state cli_state;
  64         enum ntlm_auth_svr_state svr_state;
  65         struct ntlmssp_state *ntlmssp_state;
  66         uint32_t neg_flags;
  67         char *want_feature_list;
  68         bool have_session_key;
  69         DATA_BLOB session_key;
  70         DATA_BLOB initial_message;
  71 };
  72
  73 typedef void (*stdio_helper_function)(struct ntlm_auth_state *state, char *buf,
  74                                         int length);
  75
  76 static void manage_squid_basic_request (struct ntlm_auth_state *state,
  77                                         char *buf, int length);
  78
  79 static void manage_squid_ntlmssp_request (struct ntlm_auth_state *state,
  80                                         char *buf, int length);
  81
  82 static void manage_client_ntlmssp_request (struct ntlm_auth_state *state,
  83                                         char *buf, int length);
  84
  85 static void manage_gss_spnego_request (struct ntlm_auth_state *state,
  86                                         char *buf, int length);
  87
  88 static void manage_gss_spnego_client_request (struct ntlm_auth_state *state,
  89                                         char *buf, int length);
  90
  91 static void manage_ntlm_server_1_request (struct ntlm_auth_state *state,
  92                                         char *buf, int length);
  93
  94 static void manage_ntlm_change_password_1_request(struct ntlm_auth_state *state,
  95                                         char *buf, int length);
  96
  97 static const struct {
  98         enum stdio_helper_mode mode;
  99         const char *name;
 100         stdio_helper_function fn;
 101 } stdio_helper_protocols[] = {
 102         { SQUID_2_4_BASIC, "squid-2.4-basic", manage_squid_basic_request},
 103         { SQUID_2_5_BASIC, "squid-2.5-basic", manage_squid_basic_request},
 104         { SQUID_2_5_NTLMSSP, "squid-2.5-ntlmssp", manage_squid_ntlmssp_request},
 105         { NTLMSSP_CLIENT_1, "ntlmssp-client-1", manage_client_ntlmssp_request},
 106         { GSS_SPNEGO, "gss-spnego", manage_gss_spnego_request},
 107         { GSS_SPNEGO_CLIENT, "gss-spnego-client", manage_gss_spnego_client_request},
 108         { NTLM_SERVER_1, "ntlm-server-1", manage_ntlm_server_1_request},
 109         { NTLM_CHANGE_PASSWORD_1, "ntlm-change-password-1", manage_ntlm_change_password_1_request},
 110         { NUM_HELPER_MODES, NULL, NULL}
 111 };
 112
 113 extern int winbindd_fd;
 114
 115 const char *opt_username;
 116 const char *opt_domain;
 117 const char *opt_workstation;
 118 const char *opt_password;
 119 static DATA_BLOB opt_challenge;
 120 static DATA_BLOB opt_lm_response;
 121 static DATA_BLOB opt_nt_response;
 122 static int request_lm_key;
 123 static int request_user_session_key;
 124 static int use_cached_creds;
 125
 126 static const char *require_membership_of;
 127 static const char *require_membership_of_sid;
 128
 129 static char winbind_separator(void)
 130 {
 131         struct winbindd_response response;
 132         static bool got_sep;
 133         static char sep;
 134
 135         if (got_sep)
 136                 return sep;
 137
 138         ZERO_STRUCT(response);
 139
 140         /* Send off request */
 141
 142         if (winbindd_request_response(WINBINDD_INFO, NULL, &response) !=
 143             NSS_STATUS_SUCCESS) {
 144                 d_printf("could not obtain winbind separator!\n");
 145                 return *lp_winbind_separator();
 146         }
 147
 148         sep = response.data.info.winbind_separator;
 149         got_sep = True;
 150
 151         if (!sep) {
 152                 d_printf("winbind separator was NULL!\n");
 153                 return *lp_winbind_separator();
 154         }
 155
 156         return sep;
 157 }
 158
 159 const char *get_winbind_domain(void)
 160 {
 161         struct winbindd_response response;
 162
 163         static fstring winbind_domain;
 164         if (*winbind_domain) {
 165                 return winbind_domain;
 166         }
 167
 168         ZERO_STRUCT(response);
 169
 170         /* Send off request */
 171
 172         if (winbindd_request_response(WINBINDD_DOMAIN_NAME, NULL, &response) !=
 173             NSS_STATUS_SUCCESS) {
 174                 DEBUG(0, ("could not obtain winbind domain name!\n"));
 175                 return lp_workgroup();
 176         }
 177
 178         fstrcpy(winbind_domain, response.data.domain_name);
 179
 180         return winbind_domain;
 181
 182 }
 183
 184 const char *get_winbind_netbios_name(void)
 185 {
 186         struct winbindd_response response;
 187
 188         static fstring winbind_netbios_name;
 189
 190         if (*winbind_netbios_name) {
 191                 return winbind_netbios_name;
 192         }
 193
 194         ZERO_STRUCT(response);
 195
 196         /* Send off request */
 197
 198         if (winbindd_request_response(WINBINDD_NETBIOS_NAME, NULL, &response) !=
 199             NSS_STATUS_SUCCESS) {
 200                 DEBUG(0, ("could not obtain winbind netbios name!\n"));
 201                 return global_myname();
 202         }
 203
 204         fstrcpy(winbind_netbios_name, response.data.netbios_name);
 205
 206         return winbind_netbios_name;
 207
 208 }
 209
 210 DATA_BLOB get_challenge(void)
 211 {
 212         static DATA_BLOB chal;
 213         if (opt_challenge.length)
 214                 return opt_challenge;
 215
 216         chal = data_blob(NULL, 8);
 217
 218         generate_random_buffer(chal.data, chal.length);
 219         return chal;
 220 }
 221
 222 /* Copy of parse_domain_user from winbindd_util.c.  Parse a string of the
 223    form DOMAIN/user into a domain and a user */
 224
 225 static bool parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
 226                                      fstring user)
 227 {
 228
 229         char *p = strchr(domuser,winbind_separator());
 230
 231         if (!p) {
 232                 return False;
 233         }
 234
 235         fstrcpy(user, p+1);
 236         fstrcpy(domain, domuser);
 237         domain[PTR_DIFF(p, domuser)] = 0;
 238         strupper_m(domain);
 239
 240         return True;
 241 }
 242
 243 static bool get_require_membership_sid(void) {
 244         struct winbindd_request request;
 245         struct winbindd_response response;
 246
 247         if (!require_membership_of) {
 248                 return True;
 249         }
 250
 251         if (require_membership_of_sid) {
 252                 return True;
 253         }
 254
 255         /* Otherwise, ask winbindd for the name->sid request */
 256
 257         ZERO_STRUCT(request);
 258         ZERO_STRUCT(response);
 259
 260         if (!parse_ntlm_auth_domain_user(require_membership_of,
 261                                          request.data.name.dom_name,
 262                                          request.data.name.name)) {
 263                 DEBUG(0, ("Could not parse %s into seperate domain/name parts!\n",
 264                           require_membership_of));
 265                 return False;
 266         }
 267
 268         if (winbindd_request_response(WINBINDD_LOOKUPNAME, &request, &response) !=
 269             NSS_STATUS_SUCCESS) {
 270                 DEBUG(0, ("Winbindd lookupname failed to resolve %s into a SID!\n",
 271                           require_membership_of));
 272                 return False;
 273         }
 274
 275         require_membership_of_sid = SMB_STRDUP(response.data.sid.sid);
 276
 277         if (require_membership_of_sid)
 278                 return True;
 279
 280         return False;
 281 }
 282 /* Authenticate a user with a plaintext password */
 283
 284 static bool check_plaintext_auth(const char *user, const char *pass,
 285                                  bool stdout_diagnostics)
 286 {
 287         struct winbindd_request request;
 288         struct winbindd_response response;
 289         NSS_STATUS result;
 290
 291         if (!get_require_membership_sid()) {
 292                 return False;
 293         }
 294
 295         /* Send off request */
 296
 297         ZERO_STRUCT(request);
 298         ZERO_STRUCT(response);
 299
 300         fstrcpy(request.data.auth.user, user);
 301         fstrcpy(request.data.auth.pass, pass);
 302         if (require_membership_of_sid) {
 303                 strlcpy(request.data.auth.require_membership_of_sid,
 304                         require_membership_of_sid,
 305                         sizeof(request.data.auth.require_membership_of_sid));
 306         }
 307
 308         result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
 309
 310         /* Display response */
 311
 312         if (stdout_diagnostics) {
 313                 if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 314                         d_printf("Reading winbind reply failed! (0x01)\n");
 315                 }
 316
 317                 d_printf("%s: %s (0x%x)\n",
 318                          response.data.auth.nt_status_string,
 319                          response.data.auth.error_string,
 320                          response.data.auth.nt_status);
 321         } else {
 322                 if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 323                         DEBUG(1, ("Reading winbind reply failed! (0x01)\n"));
 324                 }
 325
 326                 DEBUG(3, ("%s: %s (0x%x)\n",
 327                           response.data.auth.nt_status_string,
 328                           response.data.auth.error_string,
 329                           response.data.auth.nt_status));
 330         }
 331
 332         return (result == NSS_STATUS_SUCCESS);
 333 }
 334
 335 /* authenticate a user with an encrypted username/password */
 336
 337 NTSTATUS contact_winbind_auth_crap(const char *username,
 338                                    const char *domain,
 339                                    const char *workstation,
 340                                    const DATA_BLOB *challenge,
 341                                    const DATA_BLOB *lm_response,
 342                                    const DATA_BLOB *nt_response,
 343                                    uint32 flags,
 344                                    uint8 lm_key[8],
 345                                    uint8 user_session_key[16],
 346                                    char **error_string,
 347                                    char **unix_name)
 348 {
 349         NTSTATUS nt_status;
 350         NSS_STATUS result;
 351         struct winbindd_request request;
 352         struct winbindd_response response;
 353
 354         if (!get_require_membership_sid()) {
 355                 return NT_STATUS_INVALID_PARAMETER;
 356         }
 357
 358         ZERO_STRUCT(request);
 359         ZERO_STRUCT(response);
 360
 361         request.flags = flags;
 362
 363         request.data.auth_crap.logon_parameters = MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
 364
 365         if (require_membership_of_sid)
 366                 fstrcpy(request.data.auth_crap.require_membership_of_sid, require_membership_of_sid);
 367
 368         fstrcpy(request.data.auth_crap.user, username);
 369         fstrcpy(request.data.auth_crap.domain, domain);
 370
 371         fstrcpy(request.data.auth_crap.workstation,
 372                 workstation);
 373
 374         memcpy(request.data.auth_crap.chal, challenge->data, MIN(challenge->length, 8));
 375
 376         if (lm_response && lm_response->length) {
 377                 memcpy(request.data.auth_crap.lm_resp,
 378                        lm_response->data,
 379                        MIN(lm_response->length, sizeof(request.data.auth_crap.lm_resp)));
 380                 request.data.auth_crap.lm_resp_len = lm_response->length;
 381         }
 382
 383         if (nt_response && nt_response->length) {
 384                 memcpy(request.data.auth_crap.nt_resp,
 385                        nt_response->data,
 386                        MIN(nt_response->length, sizeof(request.data.auth_crap.nt_resp)));
 387                 request.data.auth_crap.nt_resp_len = nt_response->length;
 388         }
 389
 390         result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
 391
 392         /* Display response */
 393
 394         if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 395                 nt_status = NT_STATUS_UNSUCCESSFUL;
 396                 if (error_string)
 397                         *error_string = smb_xstrdup("Reading winbind reply failed!");
 398                 winbindd_free_response(&response);
 399                 return nt_status;
 400         }
 401
 402         nt_status = (NT_STATUS(response.data.auth.nt_status));
 403         if (!NT_STATUS_IS_OK(nt_status)) {
 404                 if (error_string)
 405                         *error_string = smb_xstrdup(response.data.auth.error_string);
 406                 winbindd_free_response(&response);
 407                 return nt_status;
 408         }
 409
 410         if ((flags & WBFLAG_PAM_LMKEY) && lm_key) {
 411                 memcpy(lm_key, response.data.auth.first_8_lm_hash,
 412                        sizeof(response.data.auth.first_8_lm_hash));
 413         }
 414         if ((flags & WBFLAG_PAM_USER_SESSION_KEY) && user_session_key) {
 415                 memcpy(user_session_key, response.data.auth.user_session_key,
 416                         sizeof(response.data.auth.user_session_key));
 417         }
 418
 419         if (flags & WBFLAG_PAM_UNIX_NAME) {
 420                 *unix_name = SMB_STRDUP((char *)response.extra_data.data);
 421                 if (!*unix_name) {
 422                         winbindd_free_response(&response);
 423                         return NT_STATUS_NO_MEMORY;
 424                 }
 425         }
 426
 427         winbindd_free_response(&response);
 428         return nt_status;
 429 }
 430
 431 /* contact server to change user password using auth crap */
 432 static NTSTATUS contact_winbind_change_pswd_auth_crap(const char *username,
 433                                                       const char *domain,
 434                                                       const DATA_BLOB new_nt_pswd,
 435                                                       const DATA_BLOB old_nt_hash_enc,
 436                                                       const DATA_BLOB new_lm_pswd,
 437                                                       const DATA_BLOB old_lm_hash_enc,
 438                                                       char  **error_string)
 439 {
 440         NTSTATUS nt_status;
 441         NSS_STATUS result;
 442         struct winbindd_request request;
 443         struct winbindd_response response;
 444
 445         if (!get_require_membership_sid())
 446         {
 447                 if(error_string)
 448                         *error_string = smb_xstrdup("Can't get membership sid.");
 449                 return NT_STATUS_INVALID_PARAMETER;
 450         }
 451
 452         ZERO_STRUCT(request);
 453         ZERO_STRUCT(response);
 454
 455         if(username != NULL)
 456                 fstrcpy(request.data.chng_pswd_auth_crap.user, username);
 457         if(domain != NULL)
 458                 fstrcpy(request.data.chng_pswd_auth_crap.domain,domain);
 459
 460         if(new_nt_pswd.length)
 461         {
 462                 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd, new_nt_pswd.data, sizeof(request.data.chng_pswd_auth_crap.new_nt_pswd));
 463                 request.data.chng_pswd_auth_crap.new_nt_pswd_len = new_nt_pswd.length;
 464         }
 465
 466         if(old_nt_hash_enc.length)
 467         {
 468                 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc, old_nt_hash_enc.data, sizeof(request.data.chng_pswd_auth_crap.old_nt_hash_enc));
 469                 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len = old_nt_hash_enc.length;
 470         }
 471
 472         if(new_lm_pswd.length)
 473         {
 474                 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd, new_lm_pswd.data, sizeof(request.data.chng_pswd_auth_crap.new_lm_pswd));
 475                 request.data.chng_pswd_auth_crap.new_lm_pswd_len = new_lm_pswd.length;
 476         }
 477
 478         if(old_lm_hash_enc.length)
 479         {
 480                 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc, old_lm_hash_enc.data, sizeof(request.data.chng_pswd_auth_crap.old_lm_hash_enc));
 481                 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len = old_lm_hash_enc.length;
 482         }
 483
 484         result = winbindd_request_response(WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, &request, &response);
 485
 486         /* Display response */
 487
 488         if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0))
 489         {
 490                 nt_status = NT_STATUS_UNSUCCESSFUL;
 491                 if (error_string)
 492                         *error_string = smb_xstrdup("Reading winbind reply failed!");
 493                 winbindd_free_response(&response);
 494                 return nt_status;
 495         }
 496
 497         nt_status = (NT_STATUS(response.data.auth.nt_status));
 498         if (!NT_STATUS_IS_OK(nt_status))
 499         {
 500                 if (error_string)
 501                         *error_string = smb_xstrdup(response.data.auth.error_string);
 502                 winbindd_free_response(&response);
 503                 return nt_status;
 504         }
 505
 506         winbindd_free_response(&response);
 507
 508     return nt_status;
 509 }
 510
 511 static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
 512 {
 513         static const char zeros[16] = { 0, };
 514         NTSTATUS nt_status;
 515         char *error_string;
 516         uint8 lm_key[8];
 517         uint8 user_sess_key[16];
 518         char *unix_name;
 519
 520         nt_status = contact_winbind_auth_crap(ntlmssp_state->user, ntlmssp_state->domain,
 521                                               ntlmssp_state->workstation,
 522                                               &ntlmssp_state->chal,
 523                                               &ntlmssp_state->lm_resp,
 524                                               &ntlmssp_state->nt_resp,
 525                                               WBFLAG_PAM_LMKEY | WBFLAG_PAM_USER_SESSION_KEY | WBFLAG_PAM_UNIX_NAME,
 526                                               lm_key, user_sess_key,
 527                                               &error_string, &unix_name);
 528
 529         if (NT_STATUS_IS_OK(nt_status)) {
 530                 if (memcmp(lm_key, zeros, 8) != 0) {
 531                         *lm_session_key = data_blob(NULL, 16);
 532                         memcpy(lm_session_key->data, lm_key, 8);
 533                         memset(lm_session_key->data+8, '\0', 8);
 534                 }
 535
 536                 if (memcmp(user_sess_key, zeros, 16) != 0) {
 537                         *user_session_key = data_blob(user_sess_key, 16);
 538                 }
 539                 ntlmssp_state->auth_context = talloc_strdup(ntlmssp_state->mem_ctx, unix_name);
 540                 SAFE_FREE(unix_name);
 541         } else {
 542                 DEBUG(NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED) ? 0 : 3,
 543                       ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n",
 544                        ntlmssp_state->domain, ntlmssp_state->user,
 545                        ntlmssp_state->workstation,
 546                        error_string ? error_string : "unknown error (NULL)"));
 547                 ntlmssp_state->auth_context = NULL;
 548         }
 549         return nt_status;
 550 }
 551
 552 static NTSTATUS local_pw_check(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
 553 {
 554         NTSTATUS nt_status;
 555         uint8 lm_pw[16], nt_pw[16];
 556
 557         nt_lm_owf_gen (opt_password, nt_pw, lm_pw);
 558
 559         nt_status = ntlm_password_check(ntlmssp_state->mem_ctx,
 560                                         &ntlmssp_state->chal,
 561                                         &ntlmssp_state->lm_resp,
 562                                         &ntlmssp_state->nt_resp,
 563                                         NULL, NULL,
 564                                         ntlmssp_state->user,
 565                                         ntlmssp_state->user,
 566                                         ntlmssp_state->domain,
 567                                         lm_pw, nt_pw, user_session_key, lm_session_key);
 568
 569         if (NT_STATUS_IS_OK(nt_status)) {
 570                 ntlmssp_state->auth_context = talloc_asprintf(ntlmssp_state->mem_ctx,
 571                                                               "%s%c%s", ntlmssp_state->domain,
 572                                                               *lp_winbind_separator(),
 573                                                               ntlmssp_state->user);
 574         } else {
 575                 DEBUG(3, ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n",
 576                           ntlmssp_state->domain, ntlmssp_state->user, ntlmssp_state->workstation,
 577                           nt_errstr(nt_status)));
 578                 ntlmssp_state->auth_context = NULL;
 579         }
 580         return nt_status;
 581 }
 582
 583 static NTSTATUS ntlm_auth_start_ntlmssp_client(NTLMSSP_STATE **client_ntlmssp_state)
 584 {
 585         NTSTATUS status;
 586         if ( (opt_username == NULL) || (opt_domain == NULL) ) {
 587                 status = NT_STATUS_UNSUCCESSFUL;
 588                 DEBUG(1, ("Need username and domain for NTLMSSP\n"));
 589                 return NT_STATUS_INVALID_PARAMETER;
 590         }
 591
 592         status = ntlmssp_client_start(client_ntlmssp_state);
 593
 594         if (!NT_STATUS_IS_OK(status)) {
 595                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
 596                           nt_errstr(status)));
 597                 ntlmssp_end(client_ntlmssp_state);
 598                 return status;
 599         }
 600
 601         status = ntlmssp_set_username(*client_ntlmssp_state, opt_username);
 602
 603         if (!NT_STATUS_IS_OK(status)) {
 604                 DEBUG(1, ("Could not set username: %s\n",
 605                           nt_errstr(status)));
 606                 ntlmssp_end(client_ntlmssp_state);
 607                 return status;
 608         }
 609
 610         status = ntlmssp_set_domain(*client_ntlmssp_state, opt_domain);
 611
 612         if (!NT_STATUS_IS_OK(status)) {
 613                 DEBUG(1, ("Could not set domain: %s\n",
 614                           nt_errstr(status)));
 615                 ntlmssp_end(client_ntlmssp_state);
 616                 return status;
 617         }
 618
 619         if (opt_password) {
 620                 status = ntlmssp_set_password(*client_ntlmssp_state, opt_password);
 621
 622                 if (!NT_STATUS_IS_OK(status)) {
 623                         DEBUG(1, ("Could not set password: %s\n",
 624                                   nt_errstr(status)));
 625                         ntlmssp_end(client_ntlmssp_state);
 626                         return status;
 627                 }
 628         }
 629
 630         return NT_STATUS_OK;
 631 }
 632
 633 static NTSTATUS ntlm_auth_start_ntlmssp_server(NTLMSSP_STATE **ntlmssp_state)
 634 {
 635         NTSTATUS status = ntlmssp_server_start(ntlmssp_state);
 636
 637         if (!NT_STATUS_IS_OK(status)) {
 638                 DEBUG(1, ("Could not start NTLMSSP server: %s\n",
 639                           nt_errstr(status)));
 640                 return status;
 641         }
 642
 643         /* Have we been given a local password, or should we ask winbind? */
 644         if (opt_password) {
 645                 (*ntlmssp_state)->check_password = local_pw_check;
 646                 (*ntlmssp_state)->get_domain = lp_workgroup;
 647                 (*ntlmssp_state)->get_global_myname = global_myname;
 648         } else {
 649                 (*ntlmssp_state)->check_password = winbind_pw_check;
 650                 (*ntlmssp_state)->get_domain = get_winbind_domain;
 651                 (*ntlmssp_state)->get_global_myname = get_winbind_netbios_name;
 652         }
 653         return NT_STATUS_OK;
 654 }
 655
 656 /*******************************************************************
 657  Used by firefox to drive NTLM auth to IIS servers.
 658 *******************************************************************/
 659
 660 static NTSTATUS do_ccache_ntlm_auth(DATA_BLOB initial_msg, DATA_BLOB challenge_msg,
 661                                 DATA_BLOB *reply)
 662 {
 663         struct winbindd_request wb_request;
 664         struct winbindd_response wb_response;
 665         NSS_STATUS result;
 666
 667         /* get winbindd to do the ntlmssp step on our behalf */
 668         ZERO_STRUCT(wb_request);
 669         ZERO_STRUCT(wb_response);
 670
 671         fstr_sprintf(wb_request.data.ccache_ntlm_auth.user,
 672                 "%s%c%s", opt_domain, winbind_separator(), opt_username);
 673         wb_request.data.ccache_ntlm_auth.uid = geteuid();
 674         wb_request.data.ccache_ntlm_auth.initial_blob_len = initial_msg.length;
 675         wb_request.data.ccache_ntlm_auth.challenge_blob_len = challenge_msg.length;
 676         wb_request.extra_len = initial_msg.length + challenge_msg.length;
 677
 678         if (wb_request.extra_len > 0) {
 679                 wb_request.extra_data.data = SMB_MALLOC_ARRAY(char, wb_request.extra_len);
 680                 if (wb_request.extra_data.data == NULL) {
 681                         return NT_STATUS_NO_MEMORY;
 682                 }
 683
 684                 memcpy(wb_request.extra_data.data, initial_msg.data, initial_msg.length);
 685                 memcpy(wb_request.extra_data.data + initial_msg.length,
 686                         challenge_msg.data, challenge_msg.length);
 687         }
 688
 689         result = winbindd_request_response(WINBINDD_CCACHE_NTLMAUTH, &wb_request, &wb_response);
 690         SAFE_FREE(wb_request.extra_data.data);
 691
 692         if (result != NSS_STATUS_SUCCESS) {
 693                 winbindd_free_response(&wb_response);
 694                 return NT_STATUS_UNSUCCESSFUL;
 695         }
 696
 697         if (reply) {
 698                 *reply = data_blob(wb_response.extra_data.data,
 699                                 wb_response.data.ccache_ntlm_auth.auth_blob_len);
 700                 if (wb_response.data.ccache_ntlm_auth.auth_blob_len > 0 &&
 701                                 reply->data == NULL) {
 702                         winbindd_free_response(&wb_response);
 703                         return NT_STATUS_NO_MEMORY;
 704                 }
 705         }
 706
 707         winbindd_free_response(&wb_response);
 708         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 709 }
 710
 711 static void manage_squid_ntlmssp_request(struct ntlm_auth_state *state,
 712                                                 char *buf, int length)
 713 {
 714         static NTLMSSP_STATE *ntlmssp_state = NULL;
 715         static char* want_feature_list = NULL;
 716         static uint32 neg_flags = 0;
 717         static bool have_session_key = False;
 718         static DATA_BLOB session_key;
 719         DATA_BLOB request, reply;
 720         NTSTATUS nt_status;
 721
 722         if (strlen(buf) < 2) {
 723                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 724                 x_fprintf(x_stdout, "BH\n");
 725                 return;
 726         }
 727
 728         if (strlen(buf) > 3) {
 729                 if(strncmp(buf, "SF ", 3) == 0){
 730                         DEBUG(10, ("Setting flags to negotioate\n"));
 731                         SAFE_FREE(want_feature_list);
 732                         want_feature_list = SMB_STRNDUP(buf+3, strlen(buf)-3);
 733                         x_fprintf(x_stdout, "OK\n");
 734                         return;
 735                 }
 736                 request = base64_decode_data_blob(buf + 3);
 737         } else {
 738                 request = data_blob_null;
 739         }
 740
 741         if ((strncmp(buf, "PW ", 3) == 0)) {
 742                 /* The calling application wants us to use a local password (rather than winbindd) */
 743
 744                 opt_password = SMB_STRNDUP((const char *)request.data, request.length);
 745
 746                 if (opt_password == NULL) {
 747                         DEBUG(1, ("Out of memory\n"));
 748                         x_fprintf(x_stdout, "BH\n");
 749                         data_blob_free(&request);
 750                         return;
 751                 }
 752
 753                 x_fprintf(x_stdout, "OK\n");
 754                 data_blob_free(&request);
 755                 return;
 756         }
 757
 758         if (strncmp(buf, "YR", 2) == 0) {
 759                 if (ntlmssp_state)
 760                         ntlmssp_end(&ntlmssp_state);
 761         } else if (strncmp(buf, "KK", 2) == 0) {
 762
 763         } else if (strncmp(buf, "GF", 2) == 0) {
 764                 DEBUG(10, ("Requested negotiated NTLMSSP flags\n"));
 765                 x_fprintf(x_stdout, "GF 0x%08lx\n", have_session_key?neg_flags:0l);
 766                 data_blob_free(&request);
 767                 return;
 768         } else if (strncmp(buf, "GK", 2) == 0) {
 769                 DEBUG(10, ("Requested NTLMSSP session key\n"));
 770                 if(have_session_key) {
 771                         char *key64 = base64_encode_data_blob(talloc_tos(),
 772                                         session_key);
 773                         x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
 774                         TALLOC_FREE(key64);
 775                 } else {
 776                         x_fprintf(x_stdout, "BH\n");
 777                 }
 778
 779                 data_blob_free(&request);
 780                 return;
 781         } else {
 782                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 783                 x_fprintf(x_stdout, "BH\n");
 784                 return;
 785         }
 786
 787         if (!ntlmssp_state) {
 788                 if (!NT_STATUS_IS_OK(nt_status = ntlm_auth_start_ntlmssp_server(&ntlmssp_state))) {
 789                         x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 790                         return;
 791                 }
 792                 ntlmssp_want_feature_list(ntlmssp_state, want_feature_list);
 793         }
 794
 795         DEBUG(10, ("got NTLMSSP packet:\n"));
 796         dump_data(10, request.data, request.length);
 797
 798         nt_status = ntlmssp_update(ntlmssp_state, request, &reply);
 799
 800         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 801                 char *reply_base64 = base64_encode_data_blob(talloc_tos(),
 802                                 reply);
 803                 x_fprintf(x_stdout, "TT %s\n", reply_base64);
 804                 TALLOC_FREE(reply_base64);
 805                 data_blob_free(&reply);
 806                 DEBUG(10, ("NTLMSSP challenge\n"));
 807         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
 808                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 809                 DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
 810
 811                 ntlmssp_end(&ntlmssp_state);
 812         } else if (!NT_STATUS_IS_OK(nt_status)) {
 813                 x_fprintf(x_stdout, "NA %s\n", nt_errstr(nt_status));
 814                 DEBUG(10, ("NTLMSSP %s\n", nt_errstr(nt_status)));
 815         } else {
 816                 x_fprintf(x_stdout, "AF %s\n", (char *)ntlmssp_state->auth_context);
 817                 DEBUG(10, ("NTLMSSP OK!\n"));
 818
 819                 if(have_session_key)
 820                         data_blob_free(&session_key);
 821                 session_key = data_blob(ntlmssp_state->session_key.data,
 822                                 ntlmssp_state->session_key.length);
 823                 neg_flags = ntlmssp_state->neg_flags;
 824                 have_session_key = True;
 825         }
 826
 827         data_blob_free(&request);
 828 }
 829
 830 static void manage_client_ntlmssp_request(struct ntlm_auth_state *state,
 831                                                 char *buf, int length)
 832 {
 833         DATA_BLOB request, reply;
 834         NTSTATUS nt_status;
 835
 836         if (!opt_username || !*opt_username) {
 837                 x_fprintf(x_stderr, "username must be specified!\n\n");
 838                 exit(1);
 839         }
 840
 841         if (strlen(buf) < 2) {
 842                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 843                 x_fprintf(x_stdout, "BH\n");
 844                 return;
 845         }
 846
 847         if (strlen(buf) > 3) {
 848                 if(strncmp(buf, "SF ", 3) == 0) {
 849                         DEBUG(10, ("Looking for flags to negotiate\n"));
 850                         talloc_free(state->want_feature_list);
 851                         state->want_feature_list = talloc_strdup(state->mem_ctx,
 852                                         buf+3);
 853                         x_fprintf(x_stdout, "OK\n");
 854                         return;
 855                 }
 856                 request = base64_decode_data_blob(buf + 3);
 857         } else {
 858                 request = data_blob_null;
 859         }
 860
 861         if (strncmp(buf, "PW ", 3) == 0) {
 862                 /* We asked for a password and obviously got it :-) */
 863
 864                 opt_password = SMB_STRNDUP((const char *)request.data,
 865                                 request.length);
 866
 867                 if (opt_password == NULL) {
 868                         DEBUG(1, ("Out of memory\n"));
 869                         x_fprintf(x_stdout, "BH\n");
 870                         data_blob_free(&request);
 871                         return;
 872                 }
 873
 874                 x_fprintf(x_stdout, "OK\n");
 875                 data_blob_free(&request);
 876                 return;
 877         }
 878
 879         if (!state->ntlmssp_state && use_cached_creds) {
 880                 /* check whether cached credentials are usable. */
 881                 DATA_BLOB empty_blob = data_blob_null;
 882
 883                 nt_status = do_ccache_ntlm_auth(empty_blob, empty_blob, NULL);
 884                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 885                         /* failed to use cached creds */
 886                         use_cached_creds = False;
 887                 }
 888         }
 889
 890         if (opt_password == NULL && !use_cached_creds) {
 891                 /* Request a password from the calling process.  After
 892                    sending it, the calling process should retry asking for the
 893                    negotiate. */
 894
 895                 DEBUG(10, ("Requesting password\n"));
 896                 x_fprintf(x_stdout, "PW\n");
 897                 return;
 898         }
 899
 900         if (strncmp(buf, "YR", 2) == 0) {
 901                 if (state->ntlmssp_state)
 902                         ntlmssp_end(&state->ntlmssp_state);
 903                 state->cli_state = CLIENT_INITIAL;
 904         } else if (strncmp(buf, "TT", 2) == 0) {
 905                 /* No special preprocessing required */
 906         } else if (strncmp(buf, "GF", 2) == 0) {
 907                 DEBUG(10, ("Requested negotiated NTLMSSP flags\n"));
 908
 909                 if(state->cli_state == CLIENT_FINISHED) {
 910                         x_fprintf(x_stdout, "GF 0x%08x\n", state->neg_flags);
 911                 }
 912                 else {
 913                         x_fprintf(x_stdout, "BH\n");
 914                 }
 915
 916                 data_blob_free(&request);
 917                 return;
 918         } else if (strncmp(buf, "GK", 2) == 0 ) {
 919                 DEBUG(10, ("Requested session key\n"));
 920
 921                 if(state->cli_state == CLIENT_FINISHED) {
 922                         char *key64 = base64_encode_data_blob(state->mem_ctx,
 923                                         state->session_key);
 924                         x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
 925                         TALLOC_FREE(key64);
 926                 }
 927                 else {
 928                         x_fprintf(x_stdout, "BH\n");
 929                 }
 930
 931                 data_blob_free(&request);
 932                 return;
 933         } else {
 934                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 935                 x_fprintf(x_stdout, "BH\n");
 936                 return;
 937         }
 938
 939         if (!state->ntlmssp_state) {
 940                 nt_status = ntlm_auth_start_ntlmssp_client(
 941                                 &state->ntlmssp_state);
 942                 if (!NT_STATUS_IS_OK(nt_status)) {
 943                         x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 944                         return;
 945                 }
 946                 ntlmssp_want_feature_list(state->ntlmssp_state,
 947                                 state->want_feature_list);
 948                 state->initial_message = data_blob_null;
 949         }
 950
 951         DEBUG(10, ("got NTLMSSP packet:\n"));
 952         dump_data(10, request.data, request.length);
 953
 954         if (use_cached_creds && !opt_password &&
 955                         (state->cli_state == CLIENT_RESPONSE)) {
 956                 nt_status = do_ccache_ntlm_auth(state->initial_message, request,
 957                                 &reply);
 958         } else {
 959                 nt_status = ntlmssp_update(state->ntlmssp_state, request,
 960                                 &reply);
 961         }
 962
 963         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 964                 char *reply_base64 = base64_encode_data_blob(state->mem_ctx,
 965                                 reply);
 966                 if (state->cli_state == CLIENT_INITIAL) {
 967                         x_fprintf(x_stdout, "YR %s\n", reply_base64);
 968                         state->initial_message = reply;
 969                         state->cli_state = CLIENT_RESPONSE;
 970                 } else {
 971                         x_fprintf(x_stdout, "KK %s\n", reply_base64);
 972                         data_blob_free(&reply);
 973                 }
 974                 TALLOC_FREE(reply_base64);
 975                 DEBUG(10, ("NTLMSSP challenge\n"));
 976         } else if (NT_STATUS_IS_OK(nt_status)) {
 977                 char *reply_base64 = base64_encode_data_blob(talloc_tos(),
 978                                 reply);
 979                 x_fprintf(x_stdout, "AF %s\n", reply_base64);
 980                 TALLOC_FREE(reply_base64);
 981
 982                 if(state->have_session_key)
 983                         data_blob_free(&state->session_key);
 984
 985                 state->session_key = data_blob(
 986                                 state->ntlmssp_state->session_key.data,
 987                                 state->ntlmssp_state->session_key.length);
 988                 state->neg_flags = state->ntlmssp_state->neg_flags;
 989                 state->have_session_key = true;
 990
 991                 DEBUG(10, ("NTLMSSP OK!\n"));
 992                 state->cli_state = CLIENT_FINISHED;
 993                 if (state->ntlmssp_state)
 994                         ntlmssp_end(&state->ntlmssp_state);
 995         } else {
 996                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 997                 DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
 998                 state->cli_state = CLIENT_ERROR;
 999                 if (state->ntlmssp_state)
1000                         ntlmssp_end(&state->ntlmssp_state);
1001         }
1002
1003         data_blob_free(&request);
1004 }
1005
1006 static void manage_squid_basic_request(struct ntlm_auth_state *state,
1007                                         char *buf, int length)
1008 {
1009         char *user, *pass;
1010         user=buf;
1011
1012         pass=(char *)memchr(buf,' ',length);
1013         if (!pass) {
1014                 DEBUG(2, ("Password not found. Denying access\n"));
1015                 x_fprintf(x_stdout, "ERR\n");
1016                 return;
1017         }
1018         *pass='\0';
1019         pass++;
1020
1021         if (state->helper_mode == SQUID_2_5_BASIC) {
1022                 rfc1738_unescape(user);
1023                 rfc1738_unescape(pass);
1024         }
1025
1026         if (check_plaintext_auth(user, pass, False)) {
1027                 x_fprintf(x_stdout, "OK\n");
1028         } else {
1029                 x_fprintf(x_stdout, "ERR\n");
1030         }
1031 }
1032
1033 static void offer_gss_spnego_mechs(void) {
1034
1035         DATA_BLOB token;
1036         SPNEGO_DATA spnego;
1037         ssize_t len;
1038         char *reply_base64;
1039         TALLOC_CTX *ctx = talloc_tos();
1040         char *principal;
1041         char *myname_lower;
1042
1043         ZERO_STRUCT(spnego);
1044
1045         myname_lower = talloc_strdup(ctx, global_myname());
1046         if (!myname_lower) {
1047                 return;
1048         }
1049         strlower_m(myname_lower);
1050
1051         principal = talloc_asprintf(ctx, "%s$@%s", myname_lower, lp_realm());
1052         if (!principal) {
1053                 return;
1054         }
1055
1056         /* Server negTokenInit (mech offerings) */
1057         spnego.type = SPNEGO_NEG_TOKEN_INIT;
1058         spnego.negTokenInit.mechTypes = SMB_XMALLOC_ARRAY(const char *, 2);
1059 #ifdef HAVE_KRB5
1060         spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_KERBEROS5_OLD);
1061         spnego.negTokenInit.mechTypes[1] = smb_xstrdup(OID_NTLMSSP);
1062         spnego.negTokenInit.mechTypes[2] = NULL;
1063 #else
1064         spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_NTLMSSP);
1065         spnego.negTokenInit.mechTypes[1] = NULL;
1066 #endif
1067
1068
1069         spnego.negTokenInit.mechListMIC = data_blob(principal,
1070                                                     strlen(principal));
1071
1072         len = write_spnego_data(&token, &spnego);
1073         free_spnego_data(&spnego);
1074
1075         if (len == -1) {
1076                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1077                 x_fprintf(x_stdout, "BH\n");
1078                 return;
1079         }
1080
1081         reply_base64 = base64_encode_data_blob(talloc_tos(), token);
1082         x_fprintf(x_stdout, "TT %s *\n", reply_base64);
1083
1084         TALLOC_FREE(reply_base64);
1085         data_blob_free(&token);
1086         DEBUG(10, ("sent SPNEGO negTokenInit\n"));
1087         return;
1088 }
1089
1090 static void manage_gss_spnego_request(struct ntlm_auth_state *state,
1091                                         char *buf, int length)
1092 {
1093         static NTLMSSP_STATE *ntlmssp_state = NULL;
1094         SPNEGO_DATA request, response;
1095         DATA_BLOB token;
1096         NTSTATUS status;
1097         ssize_t len;
1098         TALLOC_CTX *ctx = talloc_tos();
1099
1100         char *user = NULL;
1101         char *domain = NULL;
1102
1103         const char *reply_code;
1104         char       *reply_base64;
1105         char *reply_argument = NULL;
1106
1107         if (strlen(buf) < 2) {
1108                 DEBUG(1, ("SPENGO query [%s] invalid", buf));
1109                 x_fprintf(x_stdout, "BH\n");
1110                 return;
1111         }
1112
1113         if (strncmp(buf, "YR", 2) == 0) {
1114                 if (ntlmssp_state)
1115                         ntlmssp_end(&ntlmssp_state);
1116         } else if (strncmp(buf, "KK", 2) == 0) {
1117                 ;
1118         } else {
1119                 DEBUG(1, ("SPENGO query [%s] invalid", buf));
1120                 x_fprintf(x_stdout, "BH\n");
1121                 return;
1122         }
1123
1124         if ( (strlen(buf) == 2)) {
1125
1126                 /* no client data, get the negTokenInit offering
1127                    mechanisms */
1128
1129                 offer_gss_spnego_mechs();
1130                 return;
1131         }
1132
1133         /* All subsequent requests have a blob. This might be negTokenInit or negTokenTarg */
1134
1135         if (strlen(buf) <= 3) {
1136                 DEBUG(1, ("GSS-SPNEGO query [%s] invalid\n", buf));
1137                 x_fprintf(x_stdout, "BH\n");
1138                 return;
1139         }
1140
1141         token = base64_decode_data_blob(buf + 3);
1142         len = read_spnego_data(token, &request);
1143         data_blob_free(&token);
1144
1145         if (len == -1) {
1146                 DEBUG(1, ("GSS-SPNEGO query [%s] invalid", buf));
1147                 x_fprintf(x_stdout, "BH\n");
1148                 return;
1149         }
1150
1151         if (request.type == SPNEGO_NEG_TOKEN_INIT) {
1152
1153                 /* Second request from Client. This is where the
1154                    client offers its mechanism to use. */
1155
1156                 if ( (request.negTokenInit.mechTypes == NULL) ||
1157                      (request.negTokenInit.mechTypes[0] == NULL) ) {
1158                         DEBUG(1, ("Client did not offer any mechanism"));
1159                         x_fprintf(x_stdout, "BH\n");
1160                         return;
1161                 }
1162
1163                 status = NT_STATUS_UNSUCCESSFUL;
1164                 if (strcmp(request.negTokenInit.mechTypes[0], OID_NTLMSSP) == 0) {
1165
1166                         if ( request.negTokenInit.mechToken.data == NULL ) {
1167                                 DEBUG(1, ("Client did not provide  NTLMSSP data\n"));
1168                                 x_fprintf(x_stdout, "BH\n");
1169                                 return;
1170                         }
1171
1172                         if ( ntlmssp_state != NULL ) {
1173                                 DEBUG(1, ("Client wants a new NTLMSSP challenge, but "
1174                                           "already got one\n"));
1175                                 x_fprintf(x_stdout, "BH\n");
1176                                 ntlmssp_end(&ntlmssp_state);
1177                                 return;
1178                         }
1179
1180                         if (!NT_STATUS_IS_OK(status = ntlm_auth_start_ntlmssp_server(&ntlmssp_state))) {
1181                                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(status));
1182                                 return;
1183                         }
1184
1185                         DEBUG(10, ("got NTLMSSP packet:\n"));
1186                         dump_data(10, request.negTokenInit.mechToken.data,
1187                                   request.negTokenInit.mechToken.length);
1188
1189                         response.type = SPNEGO_NEG_TOKEN_TARG;
1190                         response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
1191                         response.negTokenTarg.mechListMIC = data_blob_null;
1192
1193                         status = ntlmssp_update(ntlmssp_state,
1194                                                        request.negTokenInit.mechToken,
1195                                                        &response.negTokenTarg.responseToken);
1196                 }
1197
1198 #ifdef HAVE_KRB5
1199                 if (strcmp(request.negTokenInit.mechTypes[0], OID_KERBEROS5_OLD) == 0) {
1200
1201                         TALLOC_CTX *mem_ctx = talloc_init("manage_gss_spnego_request");
1202                         char *principal;
1203                         DATA_BLOB ap_rep;
1204                         DATA_BLOB session_key;
1205                         PAC_DATA *pac_data = NULL;
1206
1207                         if ( request.negTokenInit.mechToken.data == NULL ) {
1208                                 DEBUG(1, ("Client did not provide Kerberos data\n"));
1209                                 x_fprintf(x_stdout, "BH\n");
1210                                 return;
1211                         }
1212
1213                         response.type = SPNEGO_NEG_TOKEN_TARG;
1214                         response.negTokenTarg.supportedMech = SMB_STRDUP(OID_KERBEROS5_OLD);
1215                         response.negTokenTarg.mechListMIC = data_blob_null;
1216                         response.negTokenTarg.responseToken = data_blob_null;
1217
1218                         status = ads_verify_ticket(mem_ctx, lp_realm(), 0,
1219                                                    &request.negTokenInit.mechToken,
1220                                                    &principal, &pac_data, &ap_rep,
1221                                                    &session_key, True);
1222
1223                         talloc_destroy(mem_ctx);
1224
1225                         /* Now in "principal" we have the name we are
1226                            authenticated as. */
1227
1228                         if (NT_STATUS_IS_OK(status)) {
1229
1230                                 domain = strchr_m(principal, '@');
1231
1232                                 if (domain == NULL) {
1233                                         DEBUG(1, ("Did not get a valid principal "
1234                                                   "from ads_verify_ticket\n"));
1235                                         x_fprintf(x_stdout, "BH\n");
1236                                         return;
1237                                 }
1238
1239                                 *domain++ = '\0';
1240                                 domain = SMB_STRDUP(domain);
1241                                 user = SMB_STRDUP(principal);
1242
1243                                 data_blob_free(&ap_rep);
1244
1245                                 SAFE_FREE(principal);
1246                         }
1247                 }
1248 #endif
1249
1250         } else {
1251
1252                 if ( (request.negTokenTarg.supportedMech == NULL) ||
1253                      ( strcmp(request.negTokenTarg.supportedMech, OID_NTLMSSP) != 0 ) ) {
1254                         /* Kerberos should never send a negTokenTarg, OID_NTLMSSP
1255                            is the only one we support that sends this stuff */
1256                         DEBUG(1, ("Got a negTokenTarg for something non-NTLMSSP: %s\n",
1257                                   request.negTokenTarg.supportedMech));
1258                         x_fprintf(x_stdout, "BH\n");
1259                         return;
1260                 }
1261
1262                 if (request.negTokenTarg.responseToken.data == NULL) {
1263                         DEBUG(1, ("Got a negTokenTarg without a responseToken!\n"));
1264                         x_fprintf(x_stdout, "BH\n");
1265                         return;
1266                 }
1267
1268                 status = ntlmssp_update(ntlmssp_state,
1269                                                request.negTokenTarg.responseToken,
1270                                                &response.negTokenTarg.responseToken);
1271
1272                 response.type = SPNEGO_NEG_TOKEN_TARG;
1273                 response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
1274                 response.negTokenTarg.mechListMIC = data_blob_null;
1275
1276                 if (NT_STATUS_IS_OK(status)) {
1277                         user = SMB_STRDUP(ntlmssp_state->user);
1278                         domain = SMB_STRDUP(ntlmssp_state->domain);
1279                         ntlmssp_end(&ntlmssp_state);
1280                 }
1281         }
1282
1283         free_spnego_data(&request);
1284
1285         if (NT_STATUS_IS_OK(status)) {
1286                 response.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
1287                 reply_code = "AF";
1288                 reply_argument = talloc_asprintf(ctx, "%s\\%s", domain, user);
1289         } else if (NT_STATUS_EQUAL(status,
1290                                    NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1291                 response.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
1292                 reply_code = "TT";
1293                 reply_argument = talloc_strdup(ctx, "*");
1294         } else {
1295                 response.negTokenTarg.negResult = SPNEGO_REJECT;
1296                 reply_code = "NA";
1297                 reply_argument = talloc_strdup(ctx, nt_errstr(status));
1298         }
1299
1300         if (!reply_argument) {
1301                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1302                 x_fprintf(x_stdout, "BH\n");
1303                 return;
1304         }
1305
1306         SAFE_FREE(user);
1307         SAFE_FREE(domain);
1308
1309         len = write_spnego_data(&token, &response);
1310         free_spnego_data(&response);
1311
1312         if (len == -1) {
1313                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1314                 x_fprintf(x_stdout, "BH\n");
1315                 return;
1316         }
1317
1318         reply_base64 = base64_encode_data_blob(talloc_tos(), token);
1319
1320         x_fprintf(x_stdout, "%s %s %s\n",
1321                   reply_code, reply_base64, reply_argument);
1322
1323         TALLOC_FREE(reply_base64);
1324         data_blob_free(&token);
1325
1326         return;
1327 }
1328
1329 static NTLMSSP_STATE *client_ntlmssp_state = NULL;
1330
1331 static bool manage_client_ntlmssp_init(SPNEGO_DATA spnego)
1332 {
1333         NTSTATUS status;
1334         DATA_BLOB null_blob = data_blob_null;
1335         DATA_BLOB to_server;
1336         char *to_server_base64;
1337         const char *my_mechs[] = {OID_NTLMSSP, NULL};
1338
1339         DEBUG(10, ("Got spnego negTokenInit with NTLMSSP\n"));
1340
1341         if (client_ntlmssp_state != NULL) {
1342                 DEBUG(1, ("Request for initial SPNEGO request where "
1343                           "we already have a state\n"));
1344                 return False;
1345         }
1346
1347         if (!client_ntlmssp_state) {
1348                 if (!NT_STATUS_IS_OK(status = ntlm_auth_start_ntlmssp_client(&client_ntlmssp_state))) {
1349                         x_fprintf(x_stdout, "BH %s\n", nt_errstr(status));
1350                         return False;
1351                 }
1352         }
1353
1354
1355         if (opt_password == NULL) {
1356
1357                 /* Request a password from the calling process.  After
1358                    sending it, the calling process should retry with
1359                    the negTokenInit. */
1360
1361                 DEBUG(10, ("Requesting password\n"));
1362                 x_fprintf(x_stdout, "PW\n");
1363                 return True;
1364         }
1365
1366         spnego.type = SPNEGO_NEG_TOKEN_INIT;
1367         spnego.negTokenInit.mechTypes = my_mechs;
1368         spnego.negTokenInit.reqFlags = 0;
1369         spnego.negTokenInit.mechListMIC = null_blob;
1370
1371         status = ntlmssp_update(client_ntlmssp_state, null_blob,
1372                                        &spnego.negTokenInit.mechToken);
1373
1374         if ( !(NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1375                         NT_STATUS_IS_OK(status)) ) {
1376                 DEBUG(1, ("Expected OK or MORE_PROCESSING_REQUIRED, got: %s\n",
1377                           nt_errstr(status)));
1378                 ntlmssp_end(&client_ntlmssp_state);
1379                 return False;
1380         }
1381
1382         write_spnego_data(&to_server, &spnego);
1383         data_blob_free(&spnego.negTokenInit.mechToken);
1384
1385         to_server_base64 = base64_encode_data_blob(talloc_tos(), to_server);
1386         data_blob_free(&to_server);
1387         x_fprintf(x_stdout, "KK %s\n", to_server_base64);
1388         TALLOC_FREE(to_server_base64);
1389         return True;
1390 }
1391
1392 static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego)
1393 {
1394         NTSTATUS status;
1395         DATA_BLOB null_blob = data_blob_null;
1396         DATA_BLOB request;
1397         DATA_BLOB to_server;
1398         char *to_server_base64;
1399
1400         DEBUG(10, ("Got spnego negTokenTarg with NTLMSSP\n"));
1401
1402         if (client_ntlmssp_state == NULL) {
1403                 DEBUG(1, ("Got NTLMSSP tArg without a client state\n"));
1404                 x_fprintf(x_stdout, "BH\n");
1405                 return;
1406         }
1407
1408         if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
1409                 x_fprintf(x_stdout, "NA\n");
1410                 ntlmssp_end(&client_ntlmssp_state);
1411                 return;
1412         }
1413
1414         if (spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_COMPLETED) {
1415                 x_fprintf(x_stdout, "AF\n");
1416                 ntlmssp_end(&client_ntlmssp_state);
1417                 return;
1418         }
1419
1420         status = ntlmssp_update(client_ntlmssp_state,
1421                                        spnego.negTokenTarg.responseToken,
1422                                        &request);
1423
1424         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1425                 DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED from "
1426                           "ntlmssp_client_update, got: %s\n",
1427                           nt_errstr(status)));
1428                 x_fprintf(x_stdout, "BH\n");
1429                 data_blob_free(&request);
1430                 ntlmssp_end(&client_ntlmssp_state);
1431                 return;
1432         }
1433
1434         spnego.type = SPNEGO_NEG_TOKEN_TARG;
1435         spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
1436         spnego.negTokenTarg.supportedMech = (char *)OID_NTLMSSP;
1437         spnego.negTokenTarg.responseToken = request;
1438         spnego.negTokenTarg.mechListMIC = null_blob;
1439
1440         write_spnego_data(&to_server, &spnego);
1441         data_blob_free(&request);
1442
1443         to_server_base64 = base64_encode_data_blob(talloc_tos(), to_server);
1444         data_blob_free(&to_server);
1445         x_fprintf(x_stdout, "KK %s\n", to_server_base64);
1446         TALLOC_FREE(to_server_base64);
1447         return;
1448 }
1449
1450 #ifdef HAVE_KRB5
1451
1452 static bool manage_client_krb5_init(SPNEGO_DATA spnego)
1453 {
1454         char *principal;
1455         DATA_BLOB tkt, to_server;
1456         DATA_BLOB session_key_krb5 = data_blob_null;
1457         SPNEGO_DATA reply;
1458         char *reply_base64;
1459         int retval;
1460
1461         const char *my_mechs[] = {OID_KERBEROS5_OLD, NULL};
1462         ssize_t len;
1463
1464         if ( (spnego.negTokenInit.mechListMIC.data == NULL) ||
1465              (spnego.negTokenInit.mechListMIC.length == 0) ) {
1466                 DEBUG(1, ("Did not get a principal for krb5\n"));
1467                 return False;
1468         }
1469
1470         principal = (char *)SMB_MALLOC(
1471                 spnego.negTokenInit.mechListMIC.length+1);
1472
1473         if (principal == NULL) {
1474                 DEBUG(1, ("Could not malloc principal\n"));
1475                 return False;
1476         }
1477
1478         memcpy(principal, spnego.negTokenInit.mechListMIC.data,
1479                spnego.negTokenInit.mechListMIC.length);
1480         principal[spnego.negTokenInit.mechListMIC.length] = '\0';
1481
1482         retval = cli_krb5_get_ticket(principal, 0, &tkt, &session_key_krb5, 0, NULL, NULL);
1483
1484         if (retval) {
1485                 char *user = NULL;
1486
1487                 /* Let's try to first get the TGT, for that we need a
1488                    password. */
1489
1490                 if (opt_password == NULL) {
1491                         DEBUG(10, ("Requesting password\n"));
1492                         x_fprintf(x_stdout, "PW\n");
1493                         return True;
1494                 }
1495
1496                 user = talloc_asprintf(talloc_tos(), "%s@%s", opt_username, opt_domain);
1497                 if (!user) {
1498                         return false;
1499                 }
1500
1501                 if ((retval = kerberos_kinit_password(user, opt_password, 0, NULL))) {
1502                         DEBUG(10, ("Requesting TGT failed: %s\n", error_message(retval)));
1503                         return False;
1504                 }
1505
1506                 retval = cli_krb5_get_ticket(principal, 0, &tkt, &session_key_krb5, 0, NULL, NULL);
1507
1508                 if (retval) {
1509                         DEBUG(10, ("Kinit suceeded, but getting a ticket failed: %s\n", error_message(retval)));
1510                         return False;
1511                 }
1512         }
1513
1514         data_blob_free(&session_key_krb5);
1515
1516         ZERO_STRUCT(reply);
1517
1518         reply.type = SPNEGO_NEG_TOKEN_INIT;
1519         reply.negTokenInit.mechTypes = my_mechs;
1520         reply.negTokenInit.reqFlags = 0;
1521         reply.negTokenInit.mechToken = tkt;
1522         reply.negTokenInit.mechListMIC = data_blob_null;
1523
1524         len = write_spnego_data(&to_server, &reply);
1525         data_blob_free(&tkt);
1526
1527         if (len == -1) {
1528                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
1529                 return False;
1530         }
1531
1532         reply_base64 = base64_encode_data_blob(talloc_tos(), to_server);
1533         x_fprintf(x_stdout, "KK %s *\n", reply_base64);
1534
1535         TALLOC_FREE(reply_base64);
1536         data_blob_free(&to_server);
1537         DEBUG(10, ("sent GSS-SPNEGO KERBEROS5 negTokenInit\n"));
1538         return True;
1539 }
1540
1541 static void manage_client_krb5_targ(SPNEGO_DATA spnego)
1542 {
1543         switch (spnego.negTokenTarg.negResult) {
1544         case SPNEGO_ACCEPT_INCOMPLETE:
1545                 DEBUG(1, ("Got a Kerberos negTokenTarg with ACCEPT_INCOMPLETE\n"));
1546                 x_fprintf(x_stdout, "BH\n");
1547                 break;
1548         case SPNEGO_ACCEPT_COMPLETED:
1549                 DEBUG(10, ("Accept completed\n"));
1550                 x_fprintf(x_stdout, "AF\n");
1551                 break;
1552         case SPNEGO_REJECT:
1553                 DEBUG(10, ("Rejected\n"));
1554                 x_fprintf(x_stdout, "NA\n");
1555                 break;
1556         default:
1557                 DEBUG(1, ("Got an invalid negTokenTarg\n"));
1558                 x_fprintf(x_stdout, "AF\n");
1559         }
1560 }
1561
1562 #endif
1563
1564 static void manage_gss_spnego_client_request(struct ntlm_auth_state *state,
1565                                                 char *buf, int length)
1566 {
1567         DATA_BLOB request;
1568         SPNEGO_DATA spnego;
1569         ssize_t len;
1570
1571         if (!opt_username || !*opt_username) {
1572                 x_fprintf(x_stderr, "username must be specified!\n\n");
1573                 exit(1);
1574         }
1575
1576         if (strlen(buf) <= 3) {
1577                 DEBUG(1, ("SPNEGO query [%s] too short\n", buf));
1578                 x_fprintf(x_stdout, "BH\n");
1579                 return;
1580         }
1581
1582         request = base64_decode_data_blob(buf+3);
1583
1584         if (strncmp(buf, "PW ", 3) == 0) {
1585
1586                 /* We asked for a password and obviously got it :-) */
1587
1588                 opt_password = SMB_STRNDUP((const char *)request.data, request.length);
1589
1590                 if (opt_password == NULL) {
1591                         DEBUG(1, ("Out of memory\n"));
1592                         x_fprintf(x_stdout, "BH\n");
1593                         data_blob_free(&request);
1594                         return;
1595                 }
1596
1597                 x_fprintf(x_stdout, "OK\n");
1598                 data_blob_free(&request);
1599                 return;
1600         }
1601
1602         if ( (strncmp(buf, "TT ", 3) != 0) &&
1603              (strncmp(buf, "AF ", 3) != 0) &&
1604              (strncmp(buf, "NA ", 3) != 0) ) {
1605                 DEBUG(1, ("SPNEGO request [%s] invalid\n", buf));
1606                 x_fprintf(x_stdout, "BH\n");
1607                 data_blob_free(&request);
1608                 return;
1609         }
1610
1611         /* So we got a server challenge to generate a SPNEGO
1612            client-to-server request... */
1613
1614         len = read_spnego_data(request, &spnego);
1615         data_blob_free(&request);
1616
1617         if (len == -1) {
1618                 DEBUG(1, ("Could not read SPNEGO data for [%s]\n", buf));
1619                 x_fprintf(x_stdout, "BH\n");
1620                 return;
1621         }
1622
1623         if (spnego.type == SPNEGO_NEG_TOKEN_INIT) {
1624
1625                 /* The server offers a list of mechanisms */
1626
1627                 const char **mechType = (const char **)spnego.negTokenInit.mechTypes;
1628
1629                 while (*mechType != NULL) {
1630
1631 #ifdef HAVE_KRB5
1632                         if ( (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) ||
1633                              (strcmp(*mechType, OID_KERBEROS5) == 0) ) {
1634                                 if (manage_client_krb5_init(spnego))
1635                                         goto out;
1636                         }
1637 #endif
1638
1639                         if (strcmp(*mechType, OID_NTLMSSP) == 0) {
1640                                 if (manage_client_ntlmssp_init(spnego))
1641                                         goto out;
1642                         }
1643
1644                         mechType++;
1645                 }
1646
1647                 DEBUG(1, ("Server offered no compatible mechanism\n"));
1648                 x_fprintf(x_stdout, "BH\n");
1649                 return;
1650         }
1651
1652         if (spnego.type == SPNEGO_NEG_TOKEN_TARG) {
1653
1654                 if (spnego.negTokenTarg.supportedMech == NULL) {
1655                         /* On accept/reject Windows does not send the
1656                            mechanism anymore. Handle that here and
1657                            shut down the mechanisms. */
1658
1659                         switch (spnego.negTokenTarg.negResult) {
1660                         case SPNEGO_ACCEPT_COMPLETED:
1661                                 x_fprintf(x_stdout, "AF\n");
1662                                 break;
1663                         case SPNEGO_REJECT:
1664                                 x_fprintf(x_stdout, "NA\n");
1665                                 break;
1666                         default:
1667                                 DEBUG(1, ("Got a negTokenTarg with no mech and an "
1668                                           "unknown negResult: %d\n",
1669                                           spnego.negTokenTarg.negResult));
1670                                 x_fprintf(x_stdout, "BH\n");
1671                         }
1672
1673                         ntlmssp_end(&client_ntlmssp_state);
1674                         goto out;
1675                 }
1676
1677                 if (strcmp(spnego.negTokenTarg.supportedMech,
1678                            OID_NTLMSSP) == 0) {
1679                         manage_client_ntlmssp_targ(spnego);
1680                         goto out;
1681                 }
1682
1683 #if HAVE_KRB5
1684                 if (strcmp(spnego.negTokenTarg.supportedMech,
1685                            OID_KERBEROS5_OLD) == 0) {
1686                         manage_client_krb5_targ(spnego);
1687                         goto out;
1688                 }
1689 #endif
1690
1691         }
1692
1693         DEBUG(1, ("Got an SPNEGO token I could not handle [%s]!\n", buf));
1694         x_fprintf(x_stdout, "BH\n");
1695         return;
1696
1697  out:
1698         free_spnego_data(&spnego);
1699         return;
1700 }
1701
1702 static void manage_ntlm_server_1_request(struct ntlm_auth_state *state,
1703                                                 char *buf, int length)
1704 {
1705         char *request, *parameter;
1706         static DATA_BLOB challenge;
1707         static DATA_BLOB lm_response;
1708         static DATA_BLOB nt_response;
1709         static char *full_username;
1710         static char *username;
1711         static char *domain;
1712         static char *plaintext_password;
1713         static bool ntlm_server_1_user_session_key;
1714         static bool ntlm_server_1_lm_session_key;
1715
1716         if (strequal(buf, ".")) {
1717                 if (!full_username && !username) {
1718                         x_fprintf(x_stdout, "Error: No username supplied!\n");
1719                 } else if (plaintext_password) {
1720                         /* handle this request as plaintext */
1721                         if (!full_username) {
1722                                 if (asprintf(&full_username, "%s%c%s", domain, winbind_separator(), username) == -1) {
1723                                         x_fprintf(x_stdout, "Error: Out of memory in asprintf!\n.\n");
1724                                         return;
1725                                 }
1726                         }
1727                         if (check_plaintext_auth(full_username, plaintext_password, False)) {
1728                                 x_fprintf(x_stdout, "Authenticated: Yes\n");
1729                         } else {
1730                                 x_fprintf(x_stdout, "Authenticated: No\n");
1731                         }
1732                 } else if (!lm_response.data && !nt_response.data) {
1733                         x_fprintf(x_stdout, "Error: No password supplied!\n");
1734                 } else if (!challenge.data) {
1735                         x_fprintf(x_stdout, "Error: No lanman-challenge supplied!\n");
1736                 } else {
1737                         char *error_string = NULL;
1738                         uchar lm_key[8];
1739                         uchar user_session_key[16];
1740                         uint32 flags = 0;
1741
1742                         if (full_username && !username) {
1743                                 fstring fstr_user;
1744                                 fstring fstr_domain;
1745
1746                                 if (!parse_ntlm_auth_domain_user(full_username, fstr_user, fstr_domain)) {
1747                                         /* username might be 'tainted', don't print into our new-line deleimianted stream */
1748                                         x_fprintf(x_stdout, "Error: Could not parse into domain and username\n");
1749                                 }
1750                                 SAFE_FREE(username);
1751                                 SAFE_FREE(domain);
1752                                 username = smb_xstrdup(fstr_user);
1753                                 domain = smb_xstrdup(fstr_domain);
1754                         }
1755
1756                         if (!domain) {
1757                                 domain = smb_xstrdup(get_winbind_domain());
1758                         }
1759
1760                         if (ntlm_server_1_lm_session_key)
1761                                 flags |= WBFLAG_PAM_LMKEY;
1762
1763                         if (ntlm_server_1_user_session_key)
1764                                 flags |= WBFLAG_PAM_USER_SESSION_KEY;
1765
1766                         if (!NT_STATUS_IS_OK(
1767                                     contact_winbind_auth_crap(username,
1768                                                               domain,
1769                                                               global_myname(),
1770                                                               &challenge,
1771                                                               &lm_response,
1772                                                               &nt_response,
1773                                                               flags,
1774                                                               lm_key,
1775                                                               user_session_key,
1776                                                               &error_string,
1777                                                               NULL))) {
1778
1779                                 x_fprintf(x_stdout, "Authenticated: No\n");
1780                                 x_fprintf(x_stdout, "Authentication-Error: %s\n.\n", error_string);
1781                                 SAFE_FREE(error_string);
1782                         } else {
1783                                 static char zeros[16];
1784                                 char *hex_lm_key;
1785                                 char *hex_user_session_key;
1786
1787                                 x_fprintf(x_stdout, "Authenticated: Yes\n");
1788
1789                                 if (ntlm_server_1_lm_session_key
1790                                     && (memcmp(zeros, lm_key,
1791                                                sizeof(lm_key)) != 0)) {
1792                                         hex_lm_key = hex_encode(NULL,
1793                                                                 (const unsigned char *)lm_key,
1794                                                                 sizeof(lm_key));
1795                                         x_fprintf(x_stdout, "LANMAN-Session-Key: %s\n", hex_lm_key);
1796                                         TALLOC_FREE(hex_lm_key);
1797                                 }
1798
1799                                 if (ntlm_server_1_user_session_key
1800                                     && (memcmp(zeros, user_session_key,
1801                                                sizeof(user_session_key)) != 0)) {
1802                                         hex_user_session_key = hex_encode(NULL,
1803                                                                           (const unsigned char *)user_session_key,
1804                                                                           sizeof(user_session_key));
1805                                         x_fprintf(x_stdout, "User-Session-Key: %s\n", hex_user_session_key);
1806                                         TALLOC_FREE(hex_user_session_key);
1807                                 }
1808                         }
1809                 }
1810                 /* clear out the state */
1811                 challenge = data_blob_null;
1812                 nt_response = data_blob_null;
1813                 lm_response = data_blob_null;
1814                 SAFE_FREE(full_username);
1815                 SAFE_FREE(username);
1816                 SAFE_FREE(domain);
1817                 SAFE_FREE(plaintext_password);
1818                 ntlm_server_1_user_session_key = False;
1819                 ntlm_server_1_lm_session_key = False;
1820                 x_fprintf(x_stdout, ".\n");
1821
1822                 return;
1823         }
1824
1825         request = buf;
1826
1827         /* Indicates a base64 encoded structure */
1828         parameter = strstr_m(request, ":: ");
1829         if (!parameter) {
1830                 parameter = strstr_m(request, ": ");
1831
1832                 if (!parameter) {
1833                         DEBUG(0, ("Parameter not found!\n"));
1834                         x_fprintf(x_stdout, "Error: Parameter not found!\n.\n");
1835                         return;
1836                 }
1837
1838                 parameter[0] ='\0';
1839                 parameter++;
1840                 parameter[0] ='\0';
1841                 parameter++;
1842
1843         } else {
1844                 parameter[0] ='\0';
1845                 parameter++;
1846                 parameter[0] ='\0';
1847                 parameter++;
1848                 parameter[0] ='\0';
1849                 parameter++;
1850
1851                 base64_decode_inplace(parameter);
1852         }
1853
1854         if (strequal(request, "LANMAN-Challenge")) {
1855                 challenge = strhex_to_data_blob(NULL, parameter);
1856                 if (challenge.length != 8) {
1857                         x_fprintf(x_stdout, "Error: hex decode of %s failed! (got %d bytes, expected 8)\n.\n",
1858                                   parameter,
1859                                   (int)challenge.length);
1860                         challenge = data_blob_null;
1861                 }
1862         } else if (strequal(request, "NT-Response")) {
1863                 nt_response = strhex_to_data_blob(NULL, parameter);
1864                 if (nt_response.length < 24) {
1865                         x_fprintf(x_stdout, "Error: hex decode of %s failed! (only got %d bytes, needed at least 24)\n.\n",
1866                                   parameter,
1867                                   (int)nt_response.length);
1868                         nt_response = data_blob_null;
1869                 }
1870         } else if (strequal(request, "LANMAN-Response")) {
1871                 lm_response = strhex_to_data_blob(NULL, parameter);
1872                 if (lm_response.length != 24) {
1873                         x_fprintf(x_stdout, "Error: hex decode of %s failed! (got %d bytes, expected 24)\n.\n",
1874                                   parameter,
1875                                   (int)lm_response.length);
1876                         lm_response = data_blob_null;
1877                 }
1878         } else if (strequal(request, "Password")) {
1879                 plaintext_password = smb_xstrdup(parameter);
1880         } else if (strequal(request, "NT-Domain")) {
1881                 domain = smb_xstrdup(parameter);
1882         } else if (strequal(request, "Username")) {
1883                 username = smb_xstrdup(parameter);
1884         } else if (strequal(request, "Full-Username")) {
1885                 full_username = smb_xstrdup(parameter);
1886         } else if (strequal(request, "Request-User-Session-Key")) {
1887                 ntlm_server_1_user_session_key = strequal(parameter, "Yes");
1888         } else if (strequal(request, "Request-LanMan-Session-Key")) {
1889                 ntlm_server_1_lm_session_key = strequal(parameter, "Yes");
1890         } else {
1891                 x_fprintf(x_stdout, "Error: Unknown request %s\n.\n", request);
1892         }
1893 }
1894
1895 static void manage_ntlm_change_password_1_request(struct ntlm_auth_state *state,
1896                                                         char *buf, int length)
1897 {
1898         char *request, *parameter;
1899         static DATA_BLOB new_nt_pswd;
1900         static DATA_BLOB old_nt_hash_enc;
1901         static DATA_BLOB new_lm_pswd;
1902         static DATA_BLOB old_lm_hash_enc;
1903         static char *full_username = NULL;
1904         static char *username = NULL;
1905         static char *domain = NULL;
1906         static char *newpswd =  NULL;
1907         static char *oldpswd = NULL;
1908
1909         if (strequal(buf, ".")) {
1910                 if(newpswd && oldpswd) {
1911                         uchar old_nt_hash[16];
1912                         uchar old_lm_hash[16];
1913                         uchar new_nt_hash[16];
1914                         uchar new_lm_hash[16];
1915
1916                         new_nt_pswd = data_blob(NULL, 516);
1917                         old_nt_hash_enc = data_blob(NULL, 16);
1918
1919                         /* Calculate the MD4 hash (NT compatible) of the
1920                          * password */
1921                         E_md4hash(oldpswd, old_nt_hash);
1922                         E_md4hash(newpswd, new_nt_hash);
1923
1924                         /* E_deshash returns false for 'long'
1925                            passwords (> 14 DOS chars).
1926
1927                            Therefore, don't send a buffer
1928                            encrypted with the truncated hash
1929                            (it could allow an even easier
1930                            attack on the password)
1931
1932                            Likewise, obey the admin's restriction
1933                         */
1934
1935                         if (lp_client_lanman_auth() &&
1936                             E_deshash(newpswd, new_lm_hash) &&
1937                             E_deshash(oldpswd, old_lm_hash)) {
1938                                 new_lm_pswd = data_blob(NULL, 516);
1939                                 old_lm_hash_enc = data_blob(NULL, 16);
1940                                 encode_pw_buffer(new_lm_pswd.data, newpswd,
1941                                                  STR_UNICODE);
1942
1943                                 SamOEMhash(new_lm_pswd.data, old_nt_hash, 516);
1944                                 E_old_pw_hash(new_nt_hash, old_lm_hash,
1945                                               old_lm_hash_enc.data);
1946                         } else {
1947                                 new_lm_pswd.data = NULL;
1948                                 new_lm_pswd.length = 0;
1949                                 old_lm_hash_enc.data = NULL;
1950                                 old_lm_hash_enc.length = 0;
1951                         }
1952
1953                         encode_pw_buffer(new_nt_pswd.data, newpswd,
1954                                          STR_UNICODE);
1955
1956                         SamOEMhash(new_nt_pswd.data, old_nt_hash, 516);
1957                         E_old_pw_hash(new_nt_hash, old_nt_hash,
1958                                       old_nt_hash_enc.data);
1959                 }
1960
1961                 if (!full_username && !username) {
1962                         x_fprintf(x_stdout, "Error: No username supplied!\n");
1963                 } else if ((!new_nt_pswd.data || !old_nt_hash_enc.data) &&
1964                            (!new_lm_pswd.data || old_lm_hash_enc.data) ) {
1965                         x_fprintf(x_stdout, "Error: No NT or LM password "
1966                                   "blobs supplied!\n");
1967                 } else {
1968                         char *error_string = NULL;
1969
1970                         if (full_username && !username) {
1971                                 fstring fstr_user;
1972                                 fstring fstr_domain;
1973
1974                                 if (!parse_ntlm_auth_domain_user(full_username,
1975                                                                  fstr_user,
1976                                                                  fstr_domain)) {
1977                                         /* username might be 'tainted', don't
1978                                          * print into our new-line
1979                                          * deleimianted stream */
1980                                         x_fprintf(x_stdout, "Error: Could not "
1981                                                   "parse into domain and "
1982                                                   "username\n");
1983                                         SAFE_FREE(username);
1984                                         username = smb_xstrdup(full_username);
1985                                 } else {
1986                                         SAFE_FREE(username);
1987                                         SAFE_FREE(domain);
1988                                         username = smb_xstrdup(fstr_user);
1989                                         domain = smb_xstrdup(fstr_domain);
1990                                 }
1991
1992                         }
1993
1994                         if(!NT_STATUS_IS_OK(contact_winbind_change_pswd_auth_crap(
1995                                                     username, domain,
1996                                                     new_nt_pswd,
1997                                                     old_nt_hash_enc,
1998                                                     new_lm_pswd,
1999                                                     old_lm_hash_enc,
2000                                                     &error_string))) {
2001                                 x_fprintf(x_stdout, "Password-Change: No\n");
2002                                 x_fprintf(x_stdout, "Password-Change-Error: "
2003                                           "%s\n.\n", error_string);
2004                         } else {
2005                                 x_fprintf(x_stdout, "Password-Change: Yes\n");
2006                         }
2007
2008                         SAFE_FREE(error_string);
2009                 }
2010                 /* clear out the state */
2011                 new_nt_pswd = data_blob_null;
2012                 old_nt_hash_enc = data_blob_null;
2013                 new_lm_pswd = data_blob_null;
2014                 old_nt_hash_enc = data_blob_null;
2015                 SAFE_FREE(full_username);
2016                 SAFE_FREE(username);
2017                 SAFE_FREE(domain);
2018                 SAFE_FREE(newpswd);
2019                 SAFE_FREE(oldpswd);
2020                 x_fprintf(x_stdout, ".\n");
2021
2022                 return;
2023         }
2024
2025         request = buf;
2026
2027         /* Indicates a base64 encoded structure */
2028         parameter = strstr_m(request, ":: ");
2029         if (!parameter) {
2030                 parameter = strstr_m(request, ": ");
2031
2032                 if (!parameter) {
2033                         DEBUG(0, ("Parameter not found!\n"));
2034                         x_fprintf(x_stdout, "Error: Parameter not found!\n.\n");
2035                         return;
2036                 }
2037
2038                 parameter[0] ='\0';
2039                 parameter++;
2040                 parameter[0] ='\0';
2041                 parameter++;
2042         } else {
2043                 parameter[0] ='\0';
2044                 parameter++;
2045                 parameter[0] ='\0';
2046                 parameter++;
2047                 parameter[0] ='\0';
2048                 parameter++;
2049
2050                 base64_decode_inplace(parameter);
2051         }
2052
2053         if (strequal(request, "new-nt-password-blob")) {
2054                 new_nt_pswd = strhex_to_data_blob(NULL, parameter);
2055                 if (new_nt_pswd.length != 516) {
2056                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2057                                   "(got %d bytes, expected 516)\n.\n",
2058                                   parameter,
2059                                   (int)new_nt_pswd.length);
2060                         new_nt_pswd = data_blob_null;
2061                 }
2062         } else if (strequal(request, "old-nt-hash-blob")) {
2063                 old_nt_hash_enc = strhex_to_data_blob(NULL, parameter);
2064                 if (old_nt_hash_enc.length != 16) {
2065                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2066                                   "(got %d bytes, expected 16)\n.\n",
2067                                   parameter,
2068                                   (int)old_nt_hash_enc.length);
2069                         old_nt_hash_enc = data_blob_null;
2070                 }
2071         } else if (strequal(request, "new-lm-password-blob")) {
2072                 new_lm_pswd = strhex_to_data_blob(NULL, parameter);
2073                 if (new_lm_pswd.length != 516) {
2074                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2075                                   "(got %d bytes, expected 516)\n.\n",
2076                                   parameter,
2077                                   (int)new_lm_pswd.length);
2078                         new_lm_pswd = data_blob_null;
2079                 }
2080         }
2081         else if (strequal(request, "old-lm-hash-blob")) {
2082                 old_lm_hash_enc = strhex_to_data_blob(NULL, parameter);
2083                 if (old_lm_hash_enc.length != 16)
2084                 {
2085                         x_fprintf(x_stdout, "Error: hex decode of %s failed! "
2086                                   "(got %d bytes, expected 16)\n.\n",
2087                                   parameter,
2088                                   (int)old_lm_hash_enc.length);
2089                         old_lm_hash_enc = data_blob_null;
2090                 }
2091         } else if (strequal(request, "nt-domain")) {
2092                 domain = smb_xstrdup(parameter);
2093         } else if(strequal(request, "username")) {
2094                 username = smb_xstrdup(parameter);
2095         } else if(strequal(request, "full-username")) {
2096                 username = smb_xstrdup(parameter);
2097         } else if(strequal(request, "new-password")) {
2098                 newpswd = smb_xstrdup(parameter);
2099         } else if (strequal(request, "old-password")) {
2100                 oldpswd = smb_xstrdup(parameter);
2101         } else {
2102                 x_fprintf(x_stdout, "Error: Unknown request %s\n.\n", request);
2103         }
2104 }
2105
2106 static void manage_squid_request(struct ntlm_auth_state *state,
2107                 stdio_helper_function fn)
2108 {
2109         char *buf;
2110         char tmp[INITIAL_BUFFER_SIZE+1];
2111         int length, buf_size = 0;
2112         char *c;
2113
2114         buf = talloc_strdup(state->mem_ctx, "");
2115         if (!buf) {
2116                 DEBUG(0, ("Failed to allocate input buffer.\n"));
2117                 x_fprintf(x_stderr, "ERR\n");
2118                 exit(1);
2119         }
2120
2121         do {
2122
2123                 /* this is not a typo - x_fgets doesn't work too well under
2124                  * squid */
2125                 if (fgets(tmp, sizeof(tmp)-1, stdin) == NULL) {
2126                         if (ferror(stdin)) {
2127                                 DEBUG(1, ("fgets() failed! dying..... errno=%d "
2128                                           "(%s)\n", ferror(stdin),
2129                                           strerror(ferror(stdin))));
2130
2131                                 exit(1);
2132                         }
2133                         exit(0);
2134                 }
2135
2136                 buf = talloc_strdup_append_buffer(buf, tmp);
2137                 buf_size += INITIAL_BUFFER_SIZE;
2138
2139                 if (buf_size > MAX_BUFFER_SIZE) {
2140                         DEBUG(2, ("Oversized message\n"));
2141                         x_fprintf(x_stderr, "ERR\n");
2142                         talloc_free(buf);
2143                         return;
2144                 }
2145
2146                 c = strchr(buf, '\n');
2147         } while (c == NULL);
2148
2149         *c = '\0';
2150         length = c-buf;
2151
2152         DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length));
2153
2154         if (buf[0] == '\0') {
2155                 DEBUG(2, ("Invalid Request\n"));
2156                 x_fprintf(x_stderr, "ERR\n");
2157                 talloc_free(buf);
2158                 return;
2159         }
2160
2161         fn(state, buf, length);
2162         talloc_free(buf);
2163 }
2164
2165
2166 static void squid_stream(enum stdio_helper_mode stdio_mode, stdio_helper_function fn) {
2167         TALLOC_CTX *mem_ctx;
2168         struct ntlm_auth_state *state;
2169
2170         /* initialize FDescs */
2171         x_setbuf(x_stdout, NULL);
2172         x_setbuf(x_stderr, NULL);
2173
2174         mem_ctx = talloc_init("ntlm_auth");
2175         if (!mem_ctx) {
2176                 DEBUG(0, ("squid_stream: Failed to create talloc context\n"));
2177                 x_fprintf(x_stderr, "ERR\n");
2178                 exit(1);
2179         }
2180
2181         state = talloc_zero(mem_ctx, struct ntlm_auth_state);
2182         if (!state) {
2183                 DEBUG(0, ("squid_stream: Failed to talloc ntlm_auth_state\n"));
2184                 x_fprintf(x_stderr, "ERR\n");
2185                 exit(1);
2186         }
2187
2188         state->mem_ctx = mem_ctx;
2189         state->helper_mode = stdio_mode;
2190
2191         while(1) {
2192                 manage_squid_request(state, fn);
2193         }
2194 }
2195
2196
2197 /* Authenticate a user with a challenge/response */
2198
2199 static bool check_auth_crap(void)
2200 {
2201         NTSTATUS nt_status;
2202         uint32 flags = 0;
2203         char lm_key[8];
2204         char user_session_key[16];
2205         char *hex_lm_key;
2206         char *hex_user_session_key;
2207         char *error_string;
2208         static uint8 zeros[16];
2209
2210         x_setbuf(x_stdout, NULL);
2211
2212         if (request_lm_key)
2213                 flags |= WBFLAG_PAM_LMKEY;
2214
2215         if (request_user_session_key)
2216                 flags |= WBFLAG_PAM_USER_SESSION_KEY;
2217
2218         flags |= WBFLAG_PAM_NT_STATUS_SQUASH;
2219
2220         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
2221                                               opt_workstation,
2222                                               &opt_challenge,
2223                                               &opt_lm_response,
2224                                               &opt_nt_response,
2225                                               flags,
2226                                               (unsigned char *)lm_key,
2227                                               (unsigned char *)user_session_key,
2228                                               &error_string, NULL);
2229
2230         if (!NT_STATUS_IS_OK(nt_status)) {
2231                 x_fprintf(x_stdout, "%s (0x%x)\n",
2232                           error_string,
2233                           NT_STATUS_V(nt_status));
2234                 SAFE_FREE(error_string);
2235                 return False;
2236         }
2237
2238         if (request_lm_key
2239             && (memcmp(zeros, lm_key,
2240                        sizeof(lm_key)) != 0)) {
2241                 hex_lm_key = hex_encode(NULL, (const unsigned char *)lm_key,
2242                                         sizeof(lm_key));
2243                 x_fprintf(x_stdout, "LM_KEY: %s\n", hex_lm_key);
2244                 TALLOC_FREE(hex_lm_key);
2245         }
2246         if (request_user_session_key
2247             && (memcmp(zeros, user_session_key,
2248                        sizeof(user_session_key)) != 0)) {
2249                 hex_user_session_key = hex_encode(NULL, (const unsigned char *)user_session_key,
2250                                                   sizeof(user_session_key));
2251                 x_fprintf(x_stdout, "NT_KEY: %s\n", hex_user_session_key);
2252                 TALLOC_FREE(hex_user_session_key);
2253         }
2254
2255         return True;
2256 }
2257
2258 /* Main program */
2259
2260 enum {
2261         OPT_USERNAME = 1000,
2262         OPT_DOMAIN,
2263         OPT_WORKSTATION,
2264         OPT_CHALLENGE,
2265         OPT_RESPONSE,
2266         OPT_LM,
2267         OPT_NT,
2268         OPT_PASSWORD,
2269         OPT_LM_KEY,
2270         OPT_USER_SESSION_KEY,
2271         OPT_DIAGNOSTICS,
2272         OPT_REQUIRE_MEMBERSHIP,
2273         OPT_USE_CACHED_CREDS
2274 };
2275
2276  int main(int argc, const char **argv)
2277 {
2278         TALLOC_CTX *frame = talloc_stackframe();
2279         int opt;
2280         static const char *helper_protocol;
2281         static int diagnostics;
2282
2283         static const char *hex_challenge;
2284         static const char *hex_lm_response;
2285         static const char *hex_nt_response;
2286
2287         poptContext pc;
2288
2289         /* NOTE: DO NOT change this interface without considering the implications!
2290            This is an external interface, which other programs will use to interact
2291            with this helper.
2292         */
2293
2294         /* We do not use single-letter command abbreviations, because they harm future
2295            interface stability. */
2296
2297         struct poptOption long_options[] = {
2298                 POPT_AUTOHELP
2299                 { "helper-protocol", 0, POPT_ARG_STRING, &helper_protocol, OPT_DOMAIN, "operate as a stdio-based helper", "helper protocol to use"},
2300                 { "username", 0, POPT_ARG_STRING, &opt_username, OPT_USERNAME, "username"},
2301                 { "domain", 0, POPT_ARG_STRING, &opt_domain, OPT_DOMAIN, "domain name"},
2302                 { "workstation", 0, POPT_ARG_STRING, &opt_workstation, OPT_WORKSTATION, "workstation"},
2303                 { "challenge", 0, POPT_ARG_STRING, &hex_challenge, OPT_CHALLENGE, "challenge (HEX encoded)"},
2304                 { "lm-response", 0, POPT_ARG_STRING, &hex_lm_response, OPT_LM, "LM Response to the challenge (HEX encoded)"},
2305                 { "nt-response", 0, POPT_ARG_STRING, &hex_nt_response, OPT_NT, "NT or NTLMv2 Response to the challenge (HEX encoded)"},
2306                 { "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"},
2307                 { "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retrieve LM session key"},
2308                 { "request-nt-key", 0, POPT_ARG_NONE, &request_user_session_key, OPT_USER_SESSION_KEY, "Retrieve User (NT) session key"},
2309                 { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "Use cached credentials if no password is given"},
2310                 { "diagnostics", 0, POPT_ARG_NONE, &diagnostics, OPT_DIAGNOSTICS, "Perform diagnostics on the authentictaion chain"},
2311                 { "require-membership-of", 0, POPT_ARG_STRING, &require_membership_of, OPT_REQUIRE_MEMBERSHIP, "Require that a user be a member of this group (either name or SID) for authentication to succeed" },
2312                 POPT_COMMON_SAMBA
2313                 POPT_TABLEEND
2314         };
2315
2316         /* Samba client initialisation */
2317         load_case_tables();
2318
2319         dbf = x_stderr;
2320
2321         /* Samba client initialisation */
2322
2323         if (!lp_load(get_dyn_CONFIGFILE(), True, False, False, True)) {
2324                 d_fprintf(stderr, "ntlm_auth: error opening config file %s. Error was %s\n",
2325                         get_dyn_CONFIGFILE(), strerror(errno));
2326                 exit(1);
2327         }
2328
2329         /* Parse options */
2330
2331         pc = poptGetContext("ntlm_auth", argc, argv, long_options, 0);
2332
2333         /* Parse command line options */
2334
2335         if (argc == 1) {
2336                 poptPrintHelp(pc, stderr, 0);
2337                 return 1;
2338         }
2339
2340         pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
2341                             POPT_CONTEXT_KEEP_FIRST);
2342
2343         while((opt = poptGetNextOpt(pc)) != -1) {
2344                 switch (opt) {
2345                 case OPT_CHALLENGE:
2346                         opt_challenge = strhex_to_data_blob(NULL, hex_challenge);
2347                         if (opt_challenge.length != 8) {
2348                                 x_fprintf(x_stderr, "hex decode of %s failed! (only got %d bytes)\n",
2349                                           hex_challenge,
2350                                           (int)opt_challenge.length);
2351                                 exit(1);
2352                         }
2353                         break;
2354                 case OPT_LM:
2355                         opt_lm_response = strhex_to_data_blob(NULL, hex_lm_response);
2356                         if (opt_lm_response.length != 24) {
2357                                 x_fprintf(x_stderr, "hex decode of %s failed! (only got %d bytes)\n",
2358                                           hex_lm_response,
2359                                           (int)opt_lm_response.length);
2360                                 exit(1);
2361                         }
2362                         break;
2363
2364                 case OPT_NT:
2365                         opt_nt_response = strhex_to_data_blob(NULL, hex_nt_response);
2366                         if (opt_nt_response.length < 24) {
2367                                 x_fprintf(x_stderr, "hex decode of %s failed! (only got %d bytes)\n",
2368                                           hex_nt_response,
2369                                           (int)opt_nt_response.length);
2370                                 exit(1);
2371                         }
2372                         break;
2373
2374                 case OPT_REQUIRE_MEMBERSHIP:
2375                         if (StrnCaseCmp("S-", require_membership_of, 2) == 0) {
2376                                 require_membership_of_sid = require_membership_of;
2377                         }
2378                         break;
2379                 }
2380         }
2381
2382         if (opt_username) {
2383                 char *domain = SMB_STRDUP(opt_username);
2384                 char *p = strchr_m(domain, *lp_winbind_separator());
2385                 if (p) {
2386                         opt_username = p+1;
2387                         *p = '\0';
2388                         if (opt_domain && !strequal(opt_domain, domain)) {
2389                                 x_fprintf(x_stderr, "Domain specified in username (%s) "
2390                                         "doesn't match specified domain (%s)!\n\n",
2391                                         domain, opt_domain);
2392                                 poptPrintHelp(pc, stderr, 0);
2393                                 exit(1);
2394                         }
2395                         opt_domain = domain;
2396                 } else {
2397                         SAFE_FREE(domain);
2398                 }
2399         }
2400
2401         /* Note: if opt_domain is "" then send no domain */
2402         if (opt_domain == NULL) {
2403                 opt_domain = get_winbind_domain();
2404         }
2405
2406         if (opt_workstation == NULL) {
2407                 opt_workstation = "";
2408         }
2409
2410         if (helper_protocol) {
2411                 int i;
2412                 for (i=0; i<NUM_HELPER_MODES; i++) {
2413                         if (strcmp(helper_protocol, stdio_helper_protocols[i].name) == 0) {
2414                                 squid_stream(stdio_helper_protocols[i].mode, stdio_helper_protocols[i].fn);
2415                                 exit(0);
2416                         }
2417                 }
2418                 x_fprintf(x_stderr, "unknown helper protocol [%s]\n\nValid helper protools:\n\n", helper_protocol);
2419
2420                 for (i=0; i<NUM_HELPER_MODES; i++) {
2421                         x_fprintf(x_stderr, "%s\n", stdio_helper_protocols[i].name);
2422                 }
2423
2424                 exit(1);
2425         }
2426
2427         if (!opt_username || !*opt_username) {
2428                 x_fprintf(x_stderr, "username must be specified!\n\n");
2429                 poptPrintHelp(pc, stderr, 0);
2430                 exit(1);
2431         }
2432
2433         if (opt_challenge.length) {
2434                 if (!check_auth_crap()) {
2435                         exit(1);
2436                 }
2437                 exit(0);
2438         }
2439
2440         if (!opt_password) {
2441                 opt_password = getpass("password: ");
2442         }
2443
2444         if (diagnostics) {
2445                 if (!diagnose_ntlm_auth()) {
2446                         return 1;
2447                 }
2448         } else {
2449                 fstring user;
2450
2451                 fstr_sprintf(user, "%s%c%s", opt_domain, winbind_separator(), opt_username);
2452                 if (!check_plaintext_auth(user, opt_password, True)) {
2453                         return 1;
2454                 }
2455         }
2456
2457         /* Exit code */
2458
2459         poptFreeContext(pc);
2460         TALLOC_FREE(frame);
2461         return 0;
2462 }