This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "system/filesys.h"
#include "lib/cmdline/popt_common.h"
+#include "lib/ldb/include/ldb.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
#include "auth/auth.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "auth/auth_sam.h"
#include "pstring.h"
#include "libcli/auth/libcli_auth.h"
-#include "librpc/gen_ndr/ndr_security.h"
+#include "libcli/security/security.h"
+#include "lib/events/events.h"
+#include "lib/messaging/messaging.h"
+#include "lib/messaging/irpc.h"
+#include "auth/ntlmssp/ntlmssp.h"
+#include "param/param.h"
-#define SQUID_BUFFER_SIZE 2010
+#define INITIAL_BUFFER_SIZE 300
+#define MAX_BUFFER_SIZE 63000
enum stdio_helper_mode {
SQUID_2_4_BASIC,
typedef void (*stdio_helper_function)(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2);
static void manage_squid_basic_request (enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2);
static void manage_gensec_request (enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2);
static void manage_ntlm_server_1_request (enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2);
static const char *opt_workstation;
static const char *opt_password;
static int opt_multiplex;
+static int use_cached_creds;
static void mux_printf(unsigned int mux_id, const char *format, ...) PRINTF_ATTRIBUTE(2, 3);
/* Copy of parse_domain_user from winbindd_util.c. Parse a string of the
form DOMAIN/user into a domain and a user */
-static BOOL parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
+static bool parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
fstring user)
{
- char *p = strchr(domuser,*lp_winbind_separator());
+ char *p = strchr(domuser,*lp_winbind_separator(global_loadparm));
if (!p) {
- return False;
+ return false;
}
fstrcpy(user, p+1);
fstrcpy(domain, domuser);
domain[PTR_DIFF(p, domuser)] = 0;
- return True;
+ return true;
}
+/**
+ * Decode a base64 string into a DATA_BLOB - simple and slow algorithm
+ **/
+static DATA_BLOB base64_decode_data_blob(TALLOC_CTX *mem_ctx, const char *s)
+{
+ DATA_BLOB ret = data_blob_talloc(mem_ctx, s, strlen(s)+1);
+ ret.length = ldb_base64_decode((char *)ret.data);
+ return ret;
+}
+
+/**
+ * Encode a base64 string into a talloc()ed string caller to free.
+ **/
+static char *base64_encode_data_blob(TALLOC_CTX *mem_ctx, DATA_BLOB data)
+{
+ return ldb_base64_encode(mem_ctx, (const char *)data.data, data.length);
+}
+
+/**
+ * Decode a base64 string in-place - wrapper for the above
+ **/
+static void base64_decode_inplace(char *s)
+{
+ ldb_base64_decode(s);
+}
+
+
+
/* Authenticate a user with a plaintext password */
-static BOOL check_plaintext_auth(const char *user, const char *pass,
- BOOL stdout_diagnostics)
+static bool check_plaintext_auth(const char *user, const char *pass,
+ bool stdout_diagnostics)
{
return (strcmp(pass, opt_password) == 0);
}
/* authenticate a user with an encrypted username/password */
-static NTSTATUS local_pw_check_specified(const char *username,
+static NTSTATUS local_pw_check_specified(struct loadparm_context *lp_ctx,
+ const char *username,
const char *domain,
const char *workstation,
const DATA_BLOB *challenge,
nt_status = ntlm_password_check(mem_ctx,
+ lp_ctx,
MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
challenge,
if (unix_name) {
asprintf(unix_name,
"%s%c%s", domain,
- *lp_winbind_separator(),
+ *lp_winbind_separator(global_loadparm),
username);
}
} else {
}
static void manage_squid_basic_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2)
{
char *user, *pass;
user=buf;
- pass=memchr(buf,' ',length);
+ pass = memchr(buf, ' ', length);
if (!pass) {
DEBUG(2, ("Password not found. Denying access\n"));
mux_printf(mux_id, "ERR\n");
rfc1738_unescape(pass);
}
- if (check_plaintext_auth(user, pass, False)) {
+ if (check_plaintext_auth(user, pass, false)) {
mux_printf(mux_id, "OK\n");
} else {
mux_printf(mux_id, "ERR\n");
to the calling application. The callback comes from within gensec */
static void manage_gensec_get_pw_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **password)
{
return password;
}
+/**
+ Check if a string is part of a list.
+**/
+static bool in_list(const char *s, const char *list, bool casesensitive)
+{
+ pstring tok;
+ const char *p=list;
+
+ if (!list)
+ return false;
+
+ while (next_token(&p, tok, LIST_SEP, sizeof(tok))) {
+ if ((casesensitive?strcmp:strcasecmp_m)(tok,s) == 0)
+ return true;
+ }
+ return false;
+}
+
+static void gensec_want_feature_list(struct gensec_security *state, char* feature_list)
+{
+ if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, true)) {
+ DEBUG(10, ("want GENSEC_FEATURE_SESSION_KEY\n"));
+ gensec_want_feature(state, GENSEC_FEATURE_SESSION_KEY);
+ }
+ if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, true)) {
+ DEBUG(10, ("want GENSEC_FEATURE_SIGN\n"));
+ gensec_want_feature(state, GENSEC_FEATURE_SIGN);
+ }
+ if (in_list("NTLMSSP_FEATURE_SEAL", feature_list, true)) {
+ DEBUG(10, ("want GENSEC_FEATURE_SEAL\n"));
+ gensec_want_feature(state, GENSEC_FEATURE_SEAL);
+ }
+}
+
static void manage_gensec_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2)
{
const char *set_password;
};
struct gensec_ntlm_state *state;
+ struct event_context *ev;
+ struct messaging_context *msg;
NTSTATUS nt_status;
- BOOL first = False;
+ bool first = false;
const char *reply_code;
struct cli_credentials *creds;
+ static char *want_feature_list = NULL;
+ static DATA_BLOB session_key;
+
TALLOC_CTX *mem_ctx;
if (*private) {
- state = *private;
+ state = (struct gensec_ntlm_state *)*private;
} else {
state = talloc_zero(NULL, struct gensec_ntlm_state);
if (!state) {
}
if (strlen(buf) > 3) {
+ if(strncmp(buf, "SF ", 3) == 0) {
+ DEBUG(10, ("Setting flags to negotiate\n"));
+ talloc_free(want_feature_list);
+ want_feature_list = talloc_strndup(state, buf+3, strlen(buf)-3);
+ mux_printf(mux_id, "OK\n");
+ return;
+ }
in = base64_decode_data_blob(NULL, buf + 3);
} else {
in = data_blob(NULL, 0);
state->gensec_state = NULL;
}
} else if ( (strncmp(buf, "OK", 2) == 0)) {
- /* do nothing */
+ /* Just return BH, like ntlm_auth from Samba 3 does. */
+ mux_printf(mux_id, "BH\n");
data_blob_free(&in);
return;
} else if ( (strncmp(buf, "TT ", 3) != 0) &&
(strncmp(buf, "AF ", 3) != 0) &&
(strncmp(buf, "NA ", 3) != 0) &&
(strncmp(buf, "UG", 2) != 0) &&
- (strncmp(buf, "PW ", 3) != 0)) {
+ (strncmp(buf, "PW ", 3) != 0) &&
+ (strncmp(buf, "GK", 2) != 0) &&
+ (strncmp(buf, "GF", 2) != 0)) {
DEBUG(1, ("SPNEGO request [%s] invalid\n", buf));
mux_printf(mux_id, "BH\n");
data_blob_free(&in);
break;
case GSS_SPNEGO_SERVER:
case SQUID_2_5_NTLMSSP:
- if (!NT_STATUS_IS_OK(gensec_server_start(NULL, &state->gensec_state, NULL))) {
+ ev = event_context_init(state);
+ if (!ev) {
+ exit(1);
+ }
+ msg = messaging_client_init(state, lp_messaging_path(state, global_loadparm), ev);
+ if (!msg) {
+ exit(1);
+ }
+ if (!NT_STATUS_IS_OK(gensec_server_start(state, ev, msg, &state->gensec_state))) {
exit(1);
}
break;
}
creds = cli_credentials_init(state->gensec_state);
- cli_credentials_set_conf(creds);
+ cli_credentials_set_conf(creds, global_loadparm);
if (opt_username) {
cli_credentials_set_username(creds, opt_username, CRED_SPECIFIED);
}
}
gensec_set_credentials(state->gensec_state, creds);
+ gensec_want_feature_list(state->gensec_state, want_feature_list);
switch (stdio_helper_mode) {
case GSS_SPNEGO_CLIENT:
case GSS_SPNEGO_SERVER:
nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_SPNEGO);
if (!in.length) {
- first = True;
+ first = true;
}
break;
case NTLMSSP_CLIENT_1:
if (!in.length) {
- first = True;
+ first = true;
}
/* fall through */
case SQUID_2_5_NTLMSSP:
struct security_token *token = session_info->security_token;
const char *sidstr = dom_sid_string(session_info,
token->sids[i]);
- grouplist = talloc_asprintf_append(grouplist, "%s,", sidstr);
+ grouplist = talloc_asprintf_append_buffer(grouplist, "%s,", sidstr);
}
mux_printf(mux_id, "GL %s\n", grouplist);
return;
}
+ if (strncmp(buf, "GK", 2) == 0) {
+ char *base64_key;
+ DEBUG(10, ("Requested session key\n"));
+ nt_status = gensec_session_key(state->gensec_state, &session_key);
+ if(!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(1, ("gensec_session_key failed: %s\n", nt_errstr(nt_status)));
+ mux_printf(mux_id, "BH No session key\n");
+ talloc_free(mem_ctx);
+ return;
+ } else {
+ base64_key = base64_encode_data_blob(state, session_key);
+ mux_printf(mux_id, "GK %s\n", base64_key);
+ talloc_free(base64_key);
+ }
+ talloc_free(mem_ctx);
+ return;
+ }
+
+ if (strncmp(buf, "GF", 2) == 0) {
+ struct gensec_ntlmssp_state *gensec_ntlmssp_state;
+ uint32_t neg_flags;
+
+ gensec_ntlmssp_state = talloc_get_type(state->gensec_state->private_data,
+ struct gensec_ntlmssp_state);
+ neg_flags = gensec_ntlmssp_state->neg_flags;
+
+ DEBUG(10, ("Requested negotiated feature flags\n"));
+ mux_printf(mux_id, "GF 0x%08x\n", neg_flags);
+ return;
+ }
+
nt_status = gensec_update(state->gensec_state, mem_ctx, in, &out);
/* don't leak 'bad password'/'no such user' info to the network client */
reply_code = "AF";
reply_arg = talloc_asprintf(state->gensec_state,
"%s%s%s", session_info->server_info->domain_name,
- lp_winbind_separator(), session_info->server_info->account_name);
+ lp_winbind_separator(global_loadparm), session_info->server_info->account_name);
talloc_free(session_info);
}
} else if (state->gensec_state->gensec_role == GENSEC_CLIENT) {
}
static void manage_ntlm_server_1_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
unsigned int mux_id, void **private2)
{
static char *username;
static char *domain;
static char *plaintext_password;
- static BOOL ntlm_server_1_user_session_key;
- static BOOL ntlm_server_1_lm_session_key;
+ static bool ntlm_server_1_user_session_key;
+ static bool ntlm_server_1_lm_session_key;
if (strequal(buf, ".")) {
if (!full_username && !username) {
} else if (plaintext_password) {
/* handle this request as plaintext */
if (!full_username) {
- if (asprintf(&full_username, "%s%c%s", domain, *lp_winbind_separator(), username) == -1) {
+ if (asprintf(&full_username, "%s%c%s", domain, *lp_winbind_separator(lp_ctx), username) == -1) {
mux_printf(mux_id, "Error: Out of memory in asprintf!\n.\n");
return;
}
}
- if (check_plaintext_auth(full_username, plaintext_password, False)) {
+ if (check_plaintext_auth(full_username, plaintext_password, false)) {
mux_printf(mux_id, "Authenticated: Yes\n");
} else {
mux_printf(mux_id, "Authenticated: No\n");
}
if (!domain) {
- domain = smb_xstrdup(lp_workgroup());
+ domain = smb_xstrdup(lp_workgroup(lp_ctx));
}
if (ntlm_server_1_lm_session_key)
flags |= NTLM_AUTH_FLAG_USER_SESSION_KEY;
if (!NT_STATUS_IS_OK(
- local_pw_check_specified(username,
+ local_pw_check_specified(lp_ctx,
+ username,
domain,
- lp_netbios_name(),
+ lp_netbios_name(lp_ctx),
&challenge,
&lm_response,
&nt_response,
SAFE_FREE(username);
SAFE_FREE(domain);
SAFE_FREE(plaintext_password);
- ntlm_server_1_user_session_key = False;
- ntlm_server_1_lm_session_key = False;
+ ntlm_server_1_user_session_key = false;
+ ntlm_server_1_lm_session_key = false;
mux_printf(mux_id, ".\n");
return;
static void manage_squid_request(enum stdio_helper_mode helper_mode,
stdio_helper_function fn, void **private2)
{
- char buf[SQUID_BUFFER_SIZE+1];
+ char *buf;
+ char tmp[INITIAL_BUFFER_SIZE+1];
unsigned int mux_id = 0;
- int length;
+ int length, buf_size = 0;
char *c;
- static BOOL err;
struct mux_private {
unsigned int max_mux;
void **private_pointers;
};
-
+
static struct mux_private *mux_private;
static void *normal_private;
void **private;
- /* this is not a typo - x_fgets doesn't work too well under squid */
- if (fgets(buf, sizeof(buf)-1, stdin) == NULL) {
- if (ferror(stdin)) {
- DEBUG(1, ("fgets() failed! dying..... errno=%d (%s)\n", ferror(stdin),
- strerror(ferror(stdin))));
-
- exit(1); /* BIIG buffer */
- }
- exit(0);
- }
-
- c=memchr(buf,'\n',sizeof(buf)-1);
- if (c) {
- *c = '\0';
- length = c-buf;
- } else {
- err = 1;
- return;
- }
- if (err) {
- DEBUG(0, ("Oversized message\n"));
+ buf = talloc_strdup(NULL, "");
+
+ if (buf == NULL) {
+ DEBUG(0, ("Failed to allocate memory for reading the input "
+ "buffer.\n"));
x_fprintf(x_stdout, "ERR\n");
- err = 0;
return;
}
+ do {
+ /* this is not a typo - x_fgets doesn't work too well under
+ * squid */
+ if (fgets(tmp, INITIAL_BUFFER_SIZE, stdin) == NULL) {
+ if (ferror(stdin)) {
+ DEBUG(1, ("fgets() failed! dying..... errno=%d "
+ "(%s)\n", ferror(stdin),
+ strerror(ferror(stdin))));
+
+ exit(1); /* BIIG buffer */
+ }
+ exit(0);
+ }
+
+ buf = talloc_strdup_append_buffer(buf, tmp);
+ buf_size += INITIAL_BUFFER_SIZE;
+
+ if (buf_size > MAX_BUFFER_SIZE) {
+ DEBUG(0, ("Invalid Request (too large)\n"));
+ x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
+ return;
+ }
+
+ c = strchr(buf, '\n');
+ } while (c == NULL);
+
+ *c = '\0';
+ length = c-buf;
+
DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length));
if (buf[0] == '\0') {
DEBUG(0, ("Invalid Request (empty)\n"));
x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
return;
}
if (sscanf(buf, "%u ", &mux_id) != 1) {
DEBUG(0, ("Invalid Request - no multiplex id\n"));
x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
return;
}
if (!mux_private) {
if (!c) {
DEBUG(0, ("Invalid Request - no data after multiplex id\n"));
x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
return;
}
c++;
c = buf;
private = &normal_private;
}
-
- fn(helper_mode, c, length, private, mux_id, private2);
+
+ fn(helper_mode, global_loadparm, c, length, private, mux_id, private2);
+ talloc_free(buf);
}
static void squid_stream(enum stdio_helper_mode stdio_mode,
OPT_DIAGNOSTICS,
OPT_REQUIRE_MEMBERSHIP,
OPT_MULTIPLEX,
+ OPT_USE_CACHED_CREDS,
};
int main(int argc, const char **argv)
{ "username", 0, POPT_ARG_STRING, &opt_username, OPT_PASSWORD, "Username"},
{ "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"},
{ "multiplex", 0, POPT_ARG_NONE, &opt_multiplex, OPT_MULTIPLEX, "Multiplex Mode"},
+ { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "silently ignored for compatibility reasons"},
POPT_COMMON_SAMBA
POPT_COMMON_VERSION
- POPT_TABLEEND
+ { NULL }
};
/* Samba client initialisation */
return 1;
}
- gensec_init();
+ gensec_init(global_loadparm);
if (opt_domain == NULL) {
- opt_domain = lp_workgroup();
+ opt_domain = lp_workgroup(global_loadparm);
}
if (helper_protocol) {
}
if (opt_workstation == NULL) {
- opt_workstation = lp_netbios_name();
+ opt_workstation = lp_netbios_name(global_loadparm);
}
if (!opt_password) {
{
char *user;
- asprintf(&user, "%s%c%s", opt_domain, *lp_winbind_separator(), opt_username);
- if (!check_plaintext_auth(user, opt_password, True)) {
+ asprintf(&user, "%s%c%s", opt_domain, *lp_winbind_separator(global_loadparm), opt_username);
+ if (!check_plaintext_auth(user, opt_password, true)) {
return 1;
}
}
git.samba.org / jelmer / samba4-debian.git / blobdiff