This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "dynconfig.h"
-#include "system/passwd.h"
+#include "system/filesys.h"
#include "lib/cmdline/popt_common.h"
+#include "lib/ldb/include/ldb.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
#include "auth/auth.h"
-#include "asn_1.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_WINBIND
-
-#define SQUID_BUFFER_SIZE 2010
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "auth/auth_sam.h"
+#include "pstring.h"
+#include "libcli/auth/libcli_auth.h"
+#include "libcli/security/security.h"
+#include "lib/events/events.h"
+#include "lib/messaging/messaging.h"
+#include "lib/messaging/irpc.h"
+#include "auth/ntlmssp/ntlmssp.h"
+#include "param/param.h"
+
+#define INITIAL_BUFFER_SIZE 300
+#define MAX_BUFFER_SIZE 63000
enum stdio_helper_mode {
SQUID_2_4_BASIC,
typedef void (*stdio_helper_function)(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id);
+ unsigned int mux_id, void **private2);
static void manage_squid_basic_request (enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id);
+ unsigned int mux_id, void **private2);
static void manage_gensec_request (enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id);
+ unsigned int mux_id, void **private2);
static void manage_ntlm_server_1_request (enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id);
+ unsigned int mux_id, void **private2);
static void manage_squid_request(enum stdio_helper_mode helper_mode,
- stdio_helper_function fn);
+ stdio_helper_function fn, void **private2);
static const struct {
enum stdio_helper_mode mode;
extern int winbindd_fd;
-const char *opt_username;
-const char *opt_domain;
-const char *opt_workstation;
-const char *opt_password;
-int opt_multiplex;
+static const char *opt_username;
+static const char *opt_domain;
+static const char *opt_workstation;
+static const char *opt_password;
+static int opt_multiplex;
+static int use_cached_creds;
static void mux_printf(unsigned int mux_id, const char *format, ...) PRINTF_ATTRIBUTE(2, 3);
/* Copy of parse_domain_user from winbindd_util.c. Parse a string of the
form DOMAIN/user into a domain and a user */
-static BOOL parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
+static bool parse_ntlm_auth_domain_user(const char *domuser, fstring domain,
fstring user)
{
- char *p = strchr(domuser,*lp_winbind_separator());
+ char *p = strchr(domuser,*lp_winbind_separator(global_loadparm));
if (!p) {
- return False;
+ return false;
}
fstrcpy(user, p+1);
fstrcpy(domain, domuser);
domain[PTR_DIFF(p, domuser)] = 0;
- return True;
+ return true;
+}
+
+/**
+ * Decode a base64 string into a DATA_BLOB - simple and slow algorithm
+ **/
+static DATA_BLOB base64_decode_data_blob(TALLOC_CTX *mem_ctx, const char *s)
+{
+ DATA_BLOB ret = data_blob_talloc(mem_ctx, s, strlen(s)+1);
+ ret.length = ldb_base64_decode((char *)ret.data);
+ return ret;
+}
+
+/**
+ * Encode a base64 string into a talloc()ed string caller to free.
+ **/
+static char *base64_encode_data_blob(TALLOC_CTX *mem_ctx, DATA_BLOB data)
+{
+ return ldb_base64_encode(mem_ctx, (const char *)data.data, data.length);
}
+/**
+ * Decode a base64 string in-place - wrapper for the above
+ **/
+static void base64_decode_inplace(char *s)
+{
+ ldb_base64_decode(s);
+}
+
+
+
/* Authenticate a user with a plaintext password */
-static BOOL check_plaintext_auth(const char *user, const char *pass,
- BOOL stdout_diagnostics)
+static bool check_plaintext_auth(const char *user, const char *pass,
+ bool stdout_diagnostics)
{
return (strcmp(pass, opt_password) == 0);
}
/* authenticate a user with an encrypted username/password */
-static NTSTATUS local_pw_check_specified(const char *username,
+static NTSTATUS local_pw_check_specified(struct loadparm_context *lp_ctx,
+ const char *username,
const char *domain,
const char *workstation,
const DATA_BLOB *challenge,
const DATA_BLOB *lm_response,
const DATA_BLOB *nt_response,
- uint32 flags,
+ uint32_t flags,
DATA_BLOB *lm_session_key,
DATA_BLOB *user_session_key,
char **error_string,
char **unix_name)
{
NTSTATUS nt_status;
- uint8_t lm_pw[16], nt_pw[16];
- uint8_t *lm_pwd, *nt_pwd;
+ struct samr_Password lm_pw, nt_pw;
+ struct samr_Password *lm_pwd, *nt_pwd;
TALLOC_CTX *mem_ctx = talloc_init("local_pw_check_specified");
if (!mem_ctx) {
nt_status = NT_STATUS_NO_MEMORY;
} else {
- E_md4hash(opt_password, nt_pw);
- if (E_deshash(opt_password, lm_pw)) {
- lm_pwd = lm_pw;
+ E_md4hash(opt_password, nt_pw.hash);
+ if (E_deshash(opt_password, lm_pw.hash)) {
+ lm_pwd = &lm_pw;
} else {
lm_pwd = NULL;
}
- nt_pwd = nt_pw;
+ nt_pwd = &nt_pw;
nt_status = ntlm_password_check(mem_ctx,
+ lp_ctx,
+ MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
+ MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
challenge,
lm_response,
nt_response,
- NULL, NULL,
username,
username,
domain,
if (unix_name) {
asprintf(unix_name,
"%s%c%s", domain,
- *lp_winbind_separator(),
+ *lp_winbind_separator(global_loadparm),
username);
}
} else {
domain, username, workstation,
nt_errstr(nt_status)));
}
- talloc_destroy(mem_ctx);
+ talloc_free(mem_ctx);
}
if (error_string) {
*error_string = strdup(nt_errstr(nt_status));
}
static void manage_squid_basic_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id)
+ unsigned int mux_id, void **private2)
{
char *user, *pass;
user=buf;
- pass=memchr(buf,' ',length);
+ pass = memchr(buf, ' ', length);
if (!pass) {
DEBUG(2, ("Password not found. Denying access\n"));
mux_printf(mux_id, "ERR\n");
rfc1738_unescape(pass);
}
- if (check_plaintext_auth(user, pass, False)) {
+ if (check_plaintext_auth(user, pass, false)) {
mux_printf(mux_id, "OK\n");
} else {
mux_printf(mux_id, "ERR\n");
to the calling application. The callback comes from within gensec */
static void manage_gensec_get_pw_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id)
+ unsigned int mux_id, void **password)
{
DATA_BLOB in;
- struct gensec_security **gensec_state = (struct gensec_security **)private;
if (strlen(buf) < 2) {
DEBUG(1, ("query [%s] invalid", buf));
mux_printf(mux_id, "BH\n");
}
if (strlen(buf) > 3) {
- in = base64_decode_data_blob(buf + 3);
+ in = base64_decode_data_blob(NULL, buf + 3);
} else {
in = data_blob(NULL, 0);
}
if (strncmp(buf, "PW ", 3) == 0) {
- (*gensec_state)->password_callback_private = talloc_strndup((*gensec_state),
- (const char *)in.data, in.length);
+ *password = talloc_strndup(*private /* hopefully the right gensec context, useful to use for talloc */,
+ (const char *)in.data, in.length);
- if ((*gensec_state)->password_callback_private == NULL) {
+ if (*password == NULL) {
DEBUG(1, ("Out of memory\n"));
mux_printf(mux_id, "BH\n");
data_blob_free(&in);
data_blob_free(&in);
}
-/*
- * Callback for gensec, to ask the calling application for a password. Uses the above function
- * for the stdio part of this.
+/**
+ * Callback for password credentails. This is not async, and when
+ * GENSEC and the credentails code is made async, it will look rather
+ * different.
*/
-static NTSTATUS get_password(struct gensec_security *gensec_security,
- TALLOC_CTX *mem_ctx,
- char **password)
+static const char *get_password(struct cli_credentials *credentials)
{
- *password = NULL;
+ char *password = NULL;
/* Ask for a password */
- mux_printf((unsigned int)gensec_security->password_callback_private, "PW\n");
- gensec_security->password_callback_private = NULL;
+ mux_printf((unsigned int)credentials->priv_data, "PW\n");
+ credentials->priv_data = NULL;
- manage_squid_request(NUM_HELPER_MODES /* bogus */, manage_gensec_get_pw_request);
- *password = (char *)gensec_security->password_callback_private;
- if (*password) {
- return NT_STATUS_OK;
- } else {
- return NT_STATUS_INVALID_PARAMETER;
+ manage_squid_request(NUM_HELPER_MODES /* bogus */, manage_gensec_get_pw_request, (void **)&password);
+ return password;
+}
+
+/**
+ Check if a string is part of a list.
+**/
+static bool in_list(const char *s, const char *list, bool casesensitive)
+{
+ pstring tok;
+ const char *p=list;
+
+ if (!list)
+ return false;
+
+ while (next_token(&p, tok, LIST_SEP, sizeof(tok))) {
+ if ((casesensitive?strcmp:strcasecmp_m)(tok,s) == 0)
+ return true;
+ }
+ return false;
+}
+
+static void gensec_want_feature_list(struct gensec_security *state, char* feature_list)
+{
+ if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, true)) {
+ DEBUG(10, ("want GENSEC_FEATURE_SESSION_KEY\n"));
+ gensec_want_feature(state, GENSEC_FEATURE_SESSION_KEY);
+ }
+ if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, true)) {
+ DEBUG(10, ("want GENSEC_FEATURE_SIGN\n"));
+ gensec_want_feature(state, GENSEC_FEATURE_SIGN);
+ }
+ if (in_list("NTLMSSP_FEATURE_SEAL", feature_list, true)) {
+ DEBUG(10, ("want GENSEC_FEATURE_SEAL\n"));
+ gensec_want_feature(state, GENSEC_FEATURE_SEAL);
}
}
static void manage_gensec_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id)
+ unsigned int mux_id, void **private2)
{
DATA_BLOB in;
DATA_BLOB out = data_blob(NULL, 0);
char *out_base64 = NULL;
const char *reply_arg = NULL;
- struct gensec_security **gensec_state = (struct gensec_security **)private;
+ struct gensec_ntlm_state {
+ struct gensec_security *gensec_state;
+ const char *set_password;
+ };
+ struct gensec_ntlm_state *state;
+ struct event_context *ev;
+ struct messaging_context *msg;
+
NTSTATUS nt_status;
- BOOL first = False;
+ bool first = false;
const char *reply_code;
+ struct cli_credentials *creds;
+
+ static char *want_feature_list = NULL;
+ static DATA_BLOB session_key;
+
+ TALLOC_CTX *mem_ctx;
+
+ if (*private) {
+ state = (struct gensec_ntlm_state *)*private;
+ } else {
+ state = talloc_zero(NULL, struct gensec_ntlm_state);
+ if (!state) {
+ mux_printf(mux_id, "BH No Memory\n");
+ exit(1);
+ }
+ *private = state;
+ if (opt_password) {
+ state->set_password = opt_password;
+ }
+ }
if (strlen(buf) < 2) {
DEBUG(1, ("query [%s] invalid", buf));
}
if (strlen(buf) > 3) {
- in = base64_decode_data_blob(buf + 3);
+ if(strncmp(buf, "SF ", 3) == 0) {
+ DEBUG(10, ("Setting flags to negotiate\n"));
+ talloc_free(want_feature_list);
+ want_feature_list = talloc_strndup(state, buf+3, strlen(buf)-3);
+ mux_printf(mux_id, "OK\n");
+ return;
+ }
+ in = base64_decode_data_blob(NULL, buf + 3);
} else {
in = data_blob(NULL, 0);
}
if (strncmp(buf, "YR", 2) == 0) {
- if (gensec_state && *gensec_state) {
- gensec_end(gensec_state);
- *gensec_state = NULL;
+ if (state->gensec_state) {
+ talloc_free(state->gensec_state);
+ state->gensec_state = NULL;
}
} else if ( (strncmp(buf, "OK", 2) == 0)) {
- /* do nothing */
+ /* Just return BH, like ntlm_auth from Samba 3 does. */
+ mux_printf(mux_id, "BH\n");
data_blob_free(&in);
return;
} else if ( (strncmp(buf, "TT ", 3) != 0) &&
(strncmp(buf, "AF ", 3) != 0) &&
(strncmp(buf, "NA ", 3) != 0) &&
(strncmp(buf, "UG", 2) != 0) &&
- (strncmp(buf, "PW ", 3) != 0)) {
+ (strncmp(buf, "PW ", 3) != 0) &&
+ (strncmp(buf, "GK", 2) != 0) &&
+ (strncmp(buf, "GF", 2) != 0)) {
DEBUG(1, ("SPNEGO request [%s] invalid\n", buf));
mux_printf(mux_id, "BH\n");
data_blob_free(&in);
}
/* setup gensec */
- if (!(gensec_state && *gensec_state)) {
+ if (!(state->gensec_state)) {
switch (stdio_helper_mode) {
case GSS_SPNEGO_CLIENT:
case NTLMSSP_CLIENT_1:
/* setup the client side */
-
- if (!NT_STATUS_IS_OK(gensec_client_start(NULL, gensec_state))) {
+
+ nt_status = gensec_client_start(NULL, &state->gensec_state, NULL);
+ if (!NT_STATUS_IS_OK(nt_status)) {
exit(1);
}
- gensec_set_username(*gensec_state, opt_username);
- gensec_set_domain(*gensec_state, opt_domain);
- if (opt_password) {
- if (!NT_STATUS_IS_OK(gensec_set_password(*gensec_state, opt_password))) {
- DEBUG(1, ("Out of memory\n"));
- mux_printf(mux_id, "BH\n");
- data_blob_free(&in);
- return;
- }
- } else {
- gensec_set_password_callback(*gensec_state, get_password, (void*)mux_id);
- }
-
+
break;
case GSS_SPNEGO_SERVER:
case SQUID_2_5_NTLMSSP:
- if (!NT_STATUS_IS_OK(gensec_server_start(NULL, gensec_state))) {
+ ev = event_context_init(state);
+ if (!ev) {
+ exit(1);
+ }
+ msg = messaging_client_init(state, lp_messaging_path(state, global_loadparm), ev);
+ if (!msg) {
+ exit(1);
+ }
+ if (!NT_STATUS_IS_OK(gensec_server_start(state, ev, msg, &state->gensec_state))) {
exit(1);
}
break;
abort();
}
+ creds = cli_credentials_init(state->gensec_state);
+ cli_credentials_set_conf(creds, global_loadparm);
+ if (opt_username) {
+ cli_credentials_set_username(creds, opt_username, CRED_SPECIFIED);
+ }
+ if (opt_domain) {
+ cli_credentials_set_domain(creds, opt_domain, CRED_SPECIFIED);
+ }
+ if (state->set_password) {
+ cli_credentials_set_password(creds, state->set_password, CRED_SPECIFIED);
+ } else {
+ cli_credentials_set_password_callback(creds, get_password);
+ creds->priv_data = (void*)mux_id;
+ }
+ if (opt_workstation) {
+ cli_credentials_set_workstation(creds, opt_workstation, CRED_SPECIFIED);
+ }
+
+ switch (stdio_helper_mode) {
+ case GSS_SPNEGO_SERVER:
+ case SQUID_2_5_NTLMSSP:
+ cli_credentials_set_machine_account(creds);
+ break;
+ default:
+ break;
+ }
+
+ gensec_set_credentials(state->gensec_state, creds);
+ gensec_want_feature_list(state->gensec_state, want_feature_list);
+
switch (stdio_helper_mode) {
case GSS_SPNEGO_CLIENT:
case GSS_SPNEGO_SERVER:
- nt_status = gensec_start_mech_by_oid(*gensec_state, OID_SPNEGO);
+ nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_SPNEGO);
if (!in.length) {
- first = True;
+ first = true;
}
break;
case NTLMSSP_CLIENT_1:
if (!in.length) {
- first = True;
+ first = true;
}
+ /* fall through */
case SQUID_2_5_NTLMSSP:
- nt_status = gensec_start_mech_by_oid(*gensec_state, OID_NTLMSSP);
+ nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_NTLMSSP);
break;
default:
abort();
}
if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(1, ("SPENGO login failed to initialise: %s\n", nt_errstr(nt_status)));
+ DEBUG(1, ("GENSEC mech failed to start: %s\n", nt_errstr(nt_status)));
mux_printf(mux_id, "BH\n");
return;
}
+
}
+
+ /* update */
+ mem_ctx = talloc_named(NULL, 0, "manage_gensec_request internal mem_ctx");
if (strncmp(buf, "PW ", 3) == 0) {
-
- if (!NT_STATUS_IS_OK(gensec_set_password(*gensec_state,
- talloc_strndup((*gensec_state),
- (const char *)in.data,
- in.length)))) {
- DEBUG(1, ("gensec_set_password failed: %s\n", nt_errstr(nt_status)));
- mux_printf(mux_id, "BH %s\n", nt_errstr(nt_status));
- data_blob_free(&in);
- return;
- }
-
+ state->set_password = talloc_strndup(state,
+ (const char *)in.data,
+ in.length);
+
+ cli_credentials_set_password(gensec_get_credentials(state->gensec_state),
+ state->set_password,
+ CRED_SPECIFIED);
mux_printf(mux_id, "OK\n");
data_blob_free(&in);
+ talloc_free(mem_ctx);
return;
}
char *grouplist = NULL;
struct auth_session_info *session_info;
- if (!NT_STATUS_IS_OK(gensec_session_info(*gensec_state, &session_info))) {
+ nt_status = gensec_session_info(state->gensec_state, &session_info);
+ if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(1, ("gensec_session_info failed: %s\n", nt_errstr(nt_status)));
mux_printf(mux_id, "BH %s\n", nt_errstr(nt_status));
data_blob_free(&in);
+ talloc_free(mem_ctx);
return;
}
/* get the string onto the context */
- grouplist = talloc_strdup(session_info, "");
+ grouplist = talloc_strdup(mem_ctx, "");
- for (i=0; i< session_info->nt_user_token->num_sids; i++) {
- grouplist = talloc_asprintf_append(grouplist, "%s,",
- dom_sid_string(session_info,
- session_info->nt_user_token->user_sids[i]));
+ for (i=0; i<session_info->security_token->num_sids; i++) {
+ struct security_token *token = session_info->security_token;
+ const char *sidstr = dom_sid_string(session_info,
+ token->sids[i]);
+ grouplist = talloc_asprintf_append_buffer(grouplist, "%s,", sidstr);
}
mux_printf(mux_id, "GL %s\n", grouplist);
- free_session_info(&session_info);
+ talloc_free(session_info);
data_blob_free(&in);
+ talloc_free(mem_ctx);
return;
}
- /* update */
+ if (strncmp(buf, "GK", 2) == 0) {
+ char *base64_key;
+ DEBUG(10, ("Requested session key\n"));
+ nt_status = gensec_session_key(state->gensec_state, &session_key);
+ if(!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(1, ("gensec_session_key failed: %s\n", nt_errstr(nt_status)));
+ mux_printf(mux_id, "BH No session key\n");
+ talloc_free(mem_ctx);
+ return;
+ } else {
+ base64_key = base64_encode_data_blob(state, session_key);
+ mux_printf(mux_id, "GK %s\n", base64_key);
+ talloc_free(base64_key);
+ }
+ talloc_free(mem_ctx);
+ return;
+ }
+
+ if (strncmp(buf, "GF", 2) == 0) {
+ struct gensec_ntlmssp_state *gensec_ntlmssp_state;
+ uint32_t neg_flags;
- nt_status = gensec_update(*gensec_state, NULL, in, &out);
+ gensec_ntlmssp_state = talloc_get_type(state->gensec_state->private_data,
+ struct gensec_ntlmssp_state);
+ neg_flags = gensec_ntlmssp_state->neg_flags;
+
+ DEBUG(10, ("Requested negotiated feature flags\n"));
+ mux_printf(mux_id, "GF 0x%08x\n", neg_flags);
+ return;
+ }
+
+ nt_status = gensec_update(state->gensec_state, mem_ctx, in, &out);
/* don't leak 'bad password'/'no such user' info to the network client */
- nt_status = nt_status_squash(nt_status);
+ nt_status = auth_nt_status_squash(nt_status);
if (out.length) {
- out_base64 = base64_encode_data_blob(out);
+ out_base64 = base64_encode_data_blob(mem_ctx, out);
} else {
out_base64 = NULL;
}
+
if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
reply_arg = "*";
if (first) {
reply_code = "YR";
- } else if ((*gensec_state)->gensec_role == GENSEC_CLIENT) {
+ } else if (state->gensec_state->gensec_role == GENSEC_CLIENT) {
reply_code = "KK";
- } else if ((*gensec_state)->gensec_role == GENSEC_SERVER) {
+ } else if (state->gensec_state->gensec_role == GENSEC_SERVER) {
reply_code = "TT";
} else {
abort();
reply_code = "NA";
reply_arg = nt_errstr(nt_status);
DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status)));
- } else if /* OK */ ((*gensec_state)->gensec_role == GENSEC_SERVER) {
+ } else if /* OK */ (state->gensec_state->gensec_role == GENSEC_SERVER) {
struct auth_session_info *session_info;
- nt_status = gensec_session_info(*gensec_state, &session_info);
+ nt_status = gensec_session_info(state->gensec_state, &session_info);
if (!NT_STATUS_IS_OK(nt_status)) {
reply_code = "BH";
reply_arg = nt_errstr(nt_status);
} else {
reply_code = "AF";
- reply_arg = talloc_asprintf(*gensec_state,
- "%s%s%s", session_info->server_info->domain,
- lp_winbind_separator(), session_info->server_info->account_name);
+ reply_arg = talloc_asprintf(state->gensec_state,
+ "%s%s%s", session_info->server_info->domain_name,
+ lp_winbind_separator(global_loadparm), session_info->server_info->account_name);
talloc_free(session_info);
}
- } else if ((*gensec_state)->gensec_role == GENSEC_CLIENT) {
+ } else if (state->gensec_state->gensec_role == GENSEC_CLIENT) {
reply_code = "AF";
- reply_arg = NULL;
+ reply_arg = out_base64;
} else {
abort();
}
}
}
- SAFE_FREE(out_base64);
+ talloc_free(mem_ctx);
return;
}
static void manage_ntlm_server_1_request(enum stdio_helper_mode stdio_helper_mode,
+ struct loadparm_context *lp_ctx,
char *buf, int length, void **private,
- unsigned int mux_id)
+ unsigned int mux_id, void **private2)
{
char *request, *parameter;
static DATA_BLOB challenge;
static char *username;
static char *domain;
static char *plaintext_password;
- static BOOL ntlm_server_1_user_session_key;
- static BOOL ntlm_server_1_lm_session_key;
+ static bool ntlm_server_1_user_session_key;
+ static bool ntlm_server_1_lm_session_key;
if (strequal(buf, ".")) {
if (!full_username && !username) {
} else if (plaintext_password) {
/* handle this request as plaintext */
if (!full_username) {
- if (asprintf(&full_username, "%s%c%s", domain, *lp_winbind_separator(), username) == -1) {
+ if (asprintf(&full_username, "%s%c%s", domain, *lp_winbind_separator(lp_ctx), username) == -1) {
mux_printf(mux_id, "Error: Out of memory in asprintf!\n.\n");
return;
}
}
- if (check_plaintext_auth(full_username, plaintext_password, False)) {
+ if (check_plaintext_auth(full_username, plaintext_password, false)) {
mux_printf(mux_id, "Authenticated: Yes\n");
} else {
mux_printf(mux_id, "Authenticated: No\n");
char *error_string = NULL;
DATA_BLOB lm_key;
DATA_BLOB user_session_key;
- uint32 flags = 0;
+ uint32_t flags = 0;
if (full_username && !username) {
fstring fstr_user;
}
if (!domain) {
- domain = smb_xstrdup(lp_workgroup());
+ domain = smb_xstrdup(lp_workgroup(lp_ctx));
}
if (ntlm_server_1_lm_session_key)
flags |= NTLM_AUTH_FLAG_USER_SESSION_KEY;
if (!NT_STATUS_IS_OK(
- local_pw_check_specified(username,
+ local_pw_check_specified(lp_ctx,
+ username,
domain,
- lp_netbios_name(),
+ lp_netbios_name(lp_ctx),
&challenge,
&lm_response,
&nt_response,
SAFE_FREE(username);
SAFE_FREE(domain);
SAFE_FREE(plaintext_password);
- ntlm_server_1_user_session_key = False;
- ntlm_server_1_lm_session_key = False;
+ ntlm_server_1_user_session_key = false;
+ ntlm_server_1_lm_session_key = false;
mux_printf(mux_id, ".\n");
return;
}
static void manage_squid_request(enum stdio_helper_mode helper_mode,
- stdio_helper_function fn)
+ stdio_helper_function fn, void **private2)
{
- char buf[SQUID_BUFFER_SIZE+1];
- unsigned int mux_id;
- int length;
+ char *buf;
+ char tmp[INITIAL_BUFFER_SIZE+1];
+ unsigned int mux_id = 0;
+ int length, buf_size = 0;
char *c;
- static BOOL err;
struct mux_private {
unsigned int max_mux;
void **private_pointers;
};
-
+
static struct mux_private *mux_private;
static void *normal_private;
void **private;
- /* this is not a typo - x_fgets doesn't work too well under squid */
- if (fgets(buf, sizeof(buf)-1, stdin) == NULL) {
- if (ferror(stdin)) {
- DEBUG(1, ("fgets() failed! dying..... errno=%d (%s)\n", ferror(stdin),
- strerror(ferror(stdin))));
-
- exit(1); /* BIIG buffer */
- }
- exit(0);
- }
-
- c=memchr(buf,'\n',sizeof(buf)-1);
- if (c) {
- *c = '\0';
- length = c-buf;
- } else {
- err = 1;
- return;
- }
- if (err) {
- DEBUG(0, ("Oversized message\n"));
+ buf = talloc_strdup(NULL, "");
+
+ if (buf == NULL) {
+ DEBUG(0, ("Failed to allocate memory for reading the input "
+ "buffer.\n"));
x_fprintf(x_stdout, "ERR\n");
- err = 0;
return;
}
+ do {
+ /* this is not a typo - x_fgets doesn't work too well under
+ * squid */
+ if (fgets(tmp, INITIAL_BUFFER_SIZE, stdin) == NULL) {
+ if (ferror(stdin)) {
+ DEBUG(1, ("fgets() failed! dying..... errno=%d "
+ "(%s)\n", ferror(stdin),
+ strerror(ferror(stdin))));
+
+ exit(1); /* BIIG buffer */
+ }
+ exit(0);
+ }
+
+ buf = talloc_strdup_append_buffer(buf, tmp);
+ buf_size += INITIAL_BUFFER_SIZE;
+
+ if (buf_size > MAX_BUFFER_SIZE) {
+ DEBUG(0, ("Invalid Request (too large)\n"));
+ x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
+ return;
+ }
+
+ c = strchr(buf, '\n');
+ } while (c == NULL);
+
+ *c = '\0';
+ length = c-buf;
+
DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length));
if (buf[0] == '\0') {
DEBUG(0, ("Invalid Request (empty)\n"));
x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
return;
}
if (sscanf(buf, "%u ", &mux_id) != 1) {
DEBUG(0, ("Invalid Request - no multiplex id\n"));
x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
return;
}
if (!mux_private) {
- mux_private = talloc_p(NULL, struct mux_private);
+ mux_private = talloc(NULL, struct mux_private);
mux_private->max_mux = 0;
mux_private->private_pointers = NULL;
}
- c=memchr(buf,' ',sizeof(buf)-1);
+ c=strchr(buf,' ');
+ if (!c) {
+ DEBUG(0, ("Invalid Request - no data after multiplex id\n"));
+ x_fprintf(x_stdout, "ERR\n");
+ talloc_free(buf);
+ return;
+ }
c++;
if (mux_id >= mux_private->max_mux) {
unsigned int prev_max = mux_private->max_mux;
mux_private->max_mux = mux_id + 1;
mux_private->private_pointers
- = talloc_realloc_p(mux_private,
+ = talloc_realloc(mux_private,
mux_private->private_pointers,
void *, mux_private->max_mux);
memset(&mux_private->private_pointers[prev_max], '\0',
c = buf;
private = &normal_private;
}
-
- fn(helper_mode, c, length, private, mux_id);
+
+ fn(helper_mode, global_loadparm, c, length, private, mux_id, private2);
+ talloc_free(buf);
}
static void squid_stream(enum stdio_helper_mode stdio_mode,
x_setbuf(x_stdout, NULL);
x_setbuf(x_stderr, NULL);
while(1) {
- manage_squid_request(stdio_mode, fn);
+ manage_squid_request(stdio_mode, fn, NULL);
}
}
OPT_DIAGNOSTICS,
OPT_REQUIRE_MEMBERSHIP,
OPT_MULTIPLEX,
+ OPT_USE_CACHED_CREDS,
};
- int main(int argc, const char **argv)
+int main(int argc, const char **argv)
{
static const char *helper_protocol;
int opt;
{ "username", 0, POPT_ARG_STRING, &opt_username, OPT_PASSWORD, "Username"},
{ "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"},
{ "multiplex", 0, POPT_ARG_NONE, &opt_multiplex, OPT_MULTIPLEX, "Multiplex Mode"},
+ { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "silently ignored for compatibility reasons"},
POPT_COMMON_SAMBA
- POPT_TABLEEND
+ POPT_COMMON_VERSION
+ { NULL }
};
/* Samba client initialisation */
- setup_logging("ntlm_auth", DEBUG_STDERR);
-
- if (!lp_load(dyn_CONFIGFILE, True, False, False)) {
- d_fprintf(stderr, "wbinfo: error opening config file %s. Error was %s\n",
- dyn_CONFIGFILE, strerror(errno));
- exit(1);
- }
+ setup_logging(NULL, DEBUG_STDERR);
/* Parse options */
return 1;
}
+ gensec_init(global_loadparm);
+
if (opt_domain == NULL) {
- opt_domain = lp_workgroup();
+ opt_domain = lp_workgroup(global_loadparm);
}
if (helper_protocol) {
}
if (opt_workstation == NULL) {
- opt_workstation = lp_netbios_name();
+ opt_workstation = lp_netbios_name(global_loadparm);
}
if (!opt_password) {
{
char *user;
- asprintf(&user, "%s%c%s", opt_domain, *lp_winbind_separator(), opt_username);
- if (!check_plaintext_auth(user, opt_password, True)) {
+ asprintf(&user, "%s%c%s", opt_domain, *lp_winbind_separator(global_loadparm), opt_username);
+ if (!check_plaintext_auth(user, opt_password, true)) {
return 1;
}
}
git.samba.org / jelmer / samba4-debian.git / blobdiff