source/utils/ntlm_auth.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2002
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
   8    Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 #define SQUID_BUFFER_SIZE 2010
  31
  32 enum stdio_helper_mode {
  33         SQUID_2_4_BASIC,
  34         SQUID_2_5_BASIC,
  35         SQUID_2_5_NTLMSSP,
  36         GSS_SPNEGO,
  37         GSS_SPNEGO_CLIENT,
  38         NUM_HELPER_MODES
  39 };
  40
  41 typedef void (*stdio_helper_function)(enum stdio_helper_mode stdio_helper_mode,
  42                                      char *buf, int length);
  43
  44 static void manage_squid_basic_request (enum stdio_helper_mode stdio_helper_mode,
  45                                         char *buf, int length);
  46
  47 static void manage_squid_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode,
  48                                           char *buf, int length);
  49
  50 static void manage_gss_spnego_request (enum stdio_helper_mode stdio_helper_mode,
  51                                        char *buf, int length);
  52
  53 static void manage_gss_spnego_client_request (enum stdio_helper_mode stdio_helper_mode,
  54                                               char *buf, int length);
  55
  56 static const struct {
  57         enum stdio_helper_mode mode;
  58         const char *name;
  59         stdio_helper_function fn;
  60 } stdio_helper_protocols[] = {
  61         { SQUID_2_4_BASIC, "squid-2.4-basic", manage_squid_basic_request},
  62         { SQUID_2_5_BASIC, "squid-2.5-basic", manage_squid_basic_request},
  63         { SQUID_2_5_NTLMSSP, "squid-2.5-ntlmssp", manage_squid_ntlmssp_request},
  64         { GSS_SPNEGO, "gss-spnego", manage_gss_spnego_request},
  65         { GSS_SPNEGO_CLIENT, "gss-spnego-client", manage_gss_spnego_client_request},
  66         { NUM_HELPER_MODES, NULL, NULL}
  67 };
  68
  69 extern int winbindd_fd;
  70
  71 static const char *opt_username;
  72 static const char *opt_domain;
  73 static const char *opt_workstation;
  74 static const char *opt_password;
  75 static DATA_BLOB opt_challenge;
  76 static DATA_BLOB opt_lm_response;
  77 static DATA_BLOB opt_nt_response;
  78 static int request_lm_key;
  79 static int request_nt_key;
  80
  81
  82 static char winbind_separator(void)
  83 {
  84         struct winbindd_response response;
  85         static BOOL got_sep;
  86         static char sep;
  87
  88         if (got_sep)
  89                 return sep;
  90
  91         ZERO_STRUCT(response);
  92
  93         /* Send off request */
  94
  95         if (winbindd_request(WINBINDD_INFO, NULL, &response) !=
  96             NSS_STATUS_SUCCESS) {
  97                 d_printf("could not obtain winbind separator!\n");
  98                 return '\\';
  99         }
 100
 101         sep = response.data.info.winbind_separator;
 102         got_sep = True;
 103
 104         if (!sep) {
 105                 d_printf("winbind separator was NULL!\n");
 106                 return '\\';
 107         }
 108
 109         return sep;
 110 }
 111
 112 static const char *get_winbind_domain(void)
 113 {
 114         struct winbindd_response response;
 115
 116         static fstring winbind_domain;
 117         if (*winbind_domain) {
 118                 return winbind_domain;
 119         }
 120
 121         ZERO_STRUCT(response);
 122
 123         /* Send off request */
 124
 125         if (winbindd_request(WINBINDD_DOMAIN_NAME, NULL, &response) !=
 126             NSS_STATUS_SUCCESS) {
 127                 DEBUG(0, ("could not obtain winbind domain name!\n"));
 128                 return NULL;
 129         }
 130
 131         fstrcpy(winbind_domain, response.data.domain_name);
 132
 133         return winbind_domain;
 134
 135 }
 136
 137 static const char *get_winbind_netbios_name(void)
 138 {
 139         struct winbindd_response response;
 140
 141         static fstring winbind_netbios_name;
 142
 143         if (*winbind_netbios_name) {
 144                 return winbind_netbios_name;
 145         }
 146
 147         ZERO_STRUCT(response);
 148
 149         /* Send off request */
 150
 151         if (winbindd_request(WINBINDD_NETBIOS_NAME, NULL, &response) !=
 152             NSS_STATUS_SUCCESS) {
 153                 DEBUG(0, ("could not obtain winbind netbios name!\n"));
 154                 return NULL;
 155         }
 156
 157         fstrcpy(winbind_netbios_name, response.data.netbios_name);
 158
 159         return winbind_netbios_name;
 160
 161 }
 162
 163 /* Authenticate a user with a plaintext password */
 164
 165 static BOOL check_plaintext_auth(const char *user, const char *pass, BOOL stdout_diagnostics)
 166 {
 167         struct winbindd_request request;
 168         struct winbindd_response response;
 169         NSS_STATUS result;
 170
 171         /* Send off request */
 172
 173         ZERO_STRUCT(request);
 174         ZERO_STRUCT(response);
 175
 176         fstrcpy(request.data.auth.user, user);
 177         fstrcpy(request.data.auth.pass, pass);
 178
 179         result = winbindd_request(WINBINDD_PAM_AUTH, &request, &response);
 180
 181         /* Display response */
 182
 183         if (stdout_diagnostics) {
 184                 if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 185                         d_printf("Reading winbind reply failed! (0x01)\n");
 186                 }
 187
 188                 d_printf("%s: %s (0x%x)\n",
 189                          response.data.auth.nt_status_string,
 190                          response.data.auth.error_string,
 191                          response.data.auth.nt_status);
 192         } else {
 193                 if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 194                         DEBUG(1, ("Reading winbind reply failed! (0x01)\n"));
 195                 }
 196
 197                 DEBUG(3, ("%s: %s (0x%x)\n",
 198                           response.data.auth.nt_status_string,
 199                           response.data.auth.error_string,
 200                           response.data.auth.nt_status));
 201         }
 202
 203         return (result == NSS_STATUS_SUCCESS);
 204 }
 205
 206 /* authenticate a user with an encrypted username/password */
 207
 208 static NTSTATUS contact_winbind_auth_crap(const char *username,
 209                                           const char *domain,
 210                                           const char *workstation,
 211                                           const DATA_BLOB *challenge,
 212                                           const DATA_BLOB *lm_response,
 213                                           const DATA_BLOB *nt_response,
 214                                           uint32 flags,
 215                                           uint8 lm_key[8],
 216                                           uint8 nt_key[16],
 217                                           char **error_string)
 218 {
 219         NTSTATUS nt_status;
 220         NSS_STATUS result;
 221         struct winbindd_request request;
 222         struct winbindd_response response;
 223
 224         static uint8 zeros[16];
 225
 226         ZERO_STRUCT(request);
 227         ZERO_STRUCT(response);
 228
 229         request.flags = flags;
 230
 231         if (push_utf8_fstring(request.data.auth_crap.user, username) == -1) {
 232                 *error_string = smb_xstrdup(
 233                         "unable to create utf8 string for username");
 234                 return NT_STATUS_UNSUCCESSFUL;
 235         }
 236
 237         if (push_utf8_fstring(request.data.auth_crap.domain, domain) == -1) {
 238                 *error_string = smb_xstrdup(
 239                         "unable to create utf8 string for domain");
 240                 return NT_STATUS_UNSUCCESSFUL;
 241         }
 242
 243         if (push_utf8_fstring(request.data.auth_crap.workstation,
 244                               workstation) == -1) {
 245                 *error_string = smb_xstrdup(
 246                         "unable to create utf8 string for workstation");
 247                 return NT_STATUS_UNSUCCESSFUL;
 248         }
 249
 250         memcpy(request.data.auth_crap.chal, challenge->data, MIN(challenge->length, 8));
 251
 252         if (lm_response && lm_response->length) {
 253                 memcpy(request.data.auth_crap.lm_resp, lm_response->data, MIN(lm_response->length, sizeof(request.data.auth_crap.lm_resp)));
 254                 request.data.auth_crap.lm_resp_len = lm_response->length;
 255         }
 256
 257         if (nt_response && nt_response->length) {
 258                 memcpy(request.data.auth_crap.nt_resp, nt_response->data, MIN(nt_response->length, sizeof(request.data.auth_crap.nt_resp)));
 259                 request.data.auth_crap.nt_resp_len = nt_response->length;
 260         }
 261
 262         result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response);
 263
 264         /* Display response */
 265
 266         if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) {
 267                 nt_status = NT_STATUS_UNSUCCESSFUL;
 268                 if (error_string)
 269                         *error_string = smb_xstrdup("Reading winbind reply failed!");
 270                 return nt_status;
 271         }
 272
 273         nt_status = (NT_STATUS(response.data.auth.nt_status));
 274         if (!NT_STATUS_IS_OK(nt_status)) {
 275                 if (error_string)
 276                         *error_string = smb_xstrdup(response.data.auth.error_string);
 277                 return nt_status;
 278         }
 279
 280         if ((flags & WBFLAG_PAM_LMKEY) && lm_key
 281             && (memcmp(zeros, response.data.auth.first_8_lm_hash,
 282                        sizeof(response.data.auth.first_8_lm_hash)) != 0)) {
 283                 memcpy(lm_key, response.data.auth.first_8_lm_hash,
 284                         sizeof(response.data.auth.first_8_lm_hash));
 285         }
 286         if ((flags & WBFLAG_PAM_NTKEY) && nt_key
 287                     && (memcmp(zeros, response.data.auth.nt_session_key,
 288                                sizeof(response.data.auth.nt_session_key)) != 0)) {
 289                 memcpy(nt_key, response.data.auth.nt_session_key,
 290                         sizeof(response.data.auth.nt_session_key));
 291         }
 292         return nt_status;
 293 }
 294
 295 static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *nt_session_key, DATA_BLOB *lm_session_key)
 296 {
 297         static const char zeros[16];
 298         NTSTATUS nt_status;
 299         char *error_string;
 300         uint8 lm_key[8];
 301         uint8 nt_key[16];
 302
 303         nt_status = contact_winbind_auth_crap(ntlmssp_state->user, ntlmssp_state->domain,
 304                                               ntlmssp_state->workstation,
 305                                               &ntlmssp_state->chal,
 306                                               &ntlmssp_state->lm_resp,
 307                                               &ntlmssp_state->nt_resp,
 308                                               WBFLAG_PAM_LMKEY | WBFLAG_PAM_NTKEY,
 309                                               lm_key, nt_key,
 310                                               &error_string);
 311
 312         if (NT_STATUS_IS_OK(nt_status)) {
 313                 if (memcmp(lm_key, zeros, 8) != 0) {
 314                         *lm_session_key = data_blob(NULL, 16);
 315                         memcpy(lm_session_key->data, lm_key, 8);
 316                         memset(lm_session_key->data+8, '\0', 8);
 317                 }
 318
 319                 if (memcmp(nt_key, zeros, 16) != 0) {
 320                         *nt_session_key = data_blob(nt_key, 16);
 321                 }
 322         } else {
 323                 DEBUG(NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED) ? 0 : 3,
 324                       ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n",
 325                        ntlmssp_state->domain, ntlmssp_state->user, ntlmssp_state->workstation, error_string ? error_string : "unknown error (NULL)"));
 326         }
 327         return nt_status;
 328 }
 329
 330 static void manage_squid_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode,
 331                                          char *buf, int length)
 332 {
 333         static NTLMSSP_STATE *ntlmssp_state = NULL;
 334         DATA_BLOB request, reply;
 335         NTSTATUS nt_status;
 336
 337         if (strlen(buf) < 2) {
 338                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 339                 x_fprintf(x_stdout, "BH\n");
 340                 return;
 341         }
 342
 343         if (strlen(buf) > 3) {
 344                 request = base64_decode_data_blob(buf + 3);
 345         } else if (strcmp(buf, "YR") == 0) {
 346                 request = data_blob(NULL, 0);
 347                 if (ntlmssp_state)
 348                         ntlmssp_end(&ntlmssp_state);
 349         } else {
 350                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 351                 x_fprintf(x_stdout, "BH\n");
 352                 return;
 353         }
 354
 355         if (!ntlmssp_state) {
 356                 ntlmssp_server_start(&ntlmssp_state);
 357                 ntlmssp_state->check_password = winbind_pw_check;
 358                 ntlmssp_state->get_domain = get_winbind_domain;
 359                 ntlmssp_state->get_global_myname = get_winbind_netbios_name;
 360         }
 361
 362         DEBUG(10, ("got NTLMSSP packet:\n"));
 363         dump_data(10, (const char *)request.data, request.length);
 364
 365         nt_status = ntlmssp_update(ntlmssp_state, request, &reply);
 366
 367         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 368                 char *reply_base64 = base64_encode_data_blob(reply);
 369                 x_fprintf(x_stdout, "TT %s\n", reply_base64);
 370                 SAFE_FREE(reply_base64);
 371                 data_blob_free(&reply);
 372                 DEBUG(10, ("NTLMSSP challenge\n"));
 373         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
 374                 x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
 375                 DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
 376         } else if (!NT_STATUS_IS_OK(nt_status)) {
 377                 x_fprintf(x_stdout, "NA %s\n", nt_errstr(nt_status));
 378                 DEBUG(10, ("NTLMSSP %s\n", nt_errstr(nt_status)));
 379         } else {
 380                 x_fprintf(x_stdout, "AF %s\\%s\n", ntlmssp_state->domain, ntlmssp_state->user);
 381                 DEBUG(10, ("NTLMSSP OK!\n"));
 382         }
 383
 384         data_blob_free(&request);
 385 }
 386
 387 static void manage_squid_basic_request(enum stdio_helper_mode stdio_helper_mode,
 388                                        char *buf, int length)
 389 {
 390         char *user, *pass;
 391         user=buf;
 392
 393         pass=memchr(buf,' ',length);
 394         if (!pass) {
 395                 DEBUG(2, ("Password not found. Denying access\n"));
 396                 x_fprintf(x_stderr, "ERR\n");
 397                 return;
 398         }
 399         *pass='\0';
 400         pass++;
 401
 402         if (stdio_helper_mode == SQUID_2_5_BASIC) {
 403                 rfc1738_unescape(user);
 404                 rfc1738_unescape(pass);
 405         }
 406
 407         if (check_plaintext_auth(user, pass, False)) {
 408                 x_fprintf(x_stdout, "OK\n");
 409         } else {
 410                 x_fprintf(x_stdout, "ERR\n");
 411         }
 412 }
 413
 414 static void offer_gss_spnego_mechs(void) {
 415
 416         DATA_BLOB token;
 417         SPNEGO_DATA spnego;
 418         ssize_t len;
 419         char *reply_base64;
 420
 421         pstring principal;
 422         pstring myname_lower;
 423
 424         ZERO_STRUCT(spnego);
 425
 426         pstrcpy(myname_lower, global_myname());
 427         strlower_m(myname_lower);
 428
 429         pstr_sprintf(principal, "%s$@%s", myname_lower, lp_realm());
 430
 431         /* Server negTokenInit (mech offerings) */
 432         spnego.type = SPNEGO_NEG_TOKEN_INIT;
 433         spnego.negTokenInit.mechTypes = smb_xmalloc(sizeof(char *) * 3);
 434 #ifdef HAVE_KRB5
 435         spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_KERBEROS5_OLD);
 436         spnego.negTokenInit.mechTypes[1] = smb_xstrdup(OID_NTLMSSP);
 437         spnego.negTokenInit.mechTypes[2] = NULL;
 438 #else
 439         spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_NTLMSSP);
 440         spnego.negTokenInit.mechTypes[1] = NULL;
 441 #endif
 442
 443
 444         spnego.negTokenInit.mechListMIC = data_blob(principal,
 445                                                     strlen(principal));
 446
 447         len = write_spnego_data(&token, &spnego);
 448         free_spnego_data(&spnego);
 449
 450         if (len == -1) {
 451                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
 452                 x_fprintf(x_stdout, "BH\n");
 453                 return;
 454         }
 455
 456         reply_base64 = base64_encode_data_blob(token);
 457         x_fprintf(x_stdout, "TT %s *\n", reply_base64);
 458
 459         SAFE_FREE(reply_base64);
 460         data_blob_free(&token);
 461         DEBUG(10, ("sent SPNEGO negTokenInit\n"));
 462         return;
 463 }
 464
 465 static void manage_gss_spnego_request(enum stdio_helper_mode stdio_helper_mode,
 466                                       char *buf, int length)
 467 {
 468         static NTLMSSP_STATE *ntlmssp_state = NULL;
 469         SPNEGO_DATA request, response;
 470         DATA_BLOB token;
 471         NTSTATUS status;
 472         ssize_t len;
 473
 474         char *user = NULL;
 475         char *domain = NULL;
 476
 477         const char *reply_code;
 478         char       *reply_base64;
 479         pstring     reply_argument;
 480
 481         if (strlen(buf) < 2) {
 482
 483                 if (ntlmssp_state != NULL) {
 484                         DEBUG(1, ("Request for initial SPNEGO request where "
 485                                   "we already have a state\n"));
 486                         x_fprintf(x_stdout, "BH\n");
 487                         return;
 488                 }
 489
 490                 DEBUG(1, ("NTLMSSP query [%s] invalid", buf));
 491                 x_fprintf(x_stdout, "BH\n");
 492                 return;
 493         }
 494
 495         if ( (strlen(buf) == 2) && (strcmp(buf, "YR") == 0) ) {
 496
 497                 /* Initial request, get the negTokenInit offering
 498                    mechanisms */
 499
 500                 offer_gss_spnego_mechs();
 501                 return;
 502         }
 503
 504         /* All subsequent requests are "KK" (Knock, Knock ;)) and have
 505            a blob. This might be negTokenInit or negTokenTarg */
 506
 507         if ( (strlen(buf) <= 3) || (strncmp(buf, "KK", 2) != 0) ) {
 508                 DEBUG(1, ("GSS-SPNEGO query [%s] invalid\n", buf));
 509                 x_fprintf(x_stdout, "BH\n");
 510                 return;
 511         }
 512
 513         token = base64_decode_data_blob(buf + 3);
 514         len = read_spnego_data(token, &request);
 515         data_blob_free(&token);
 516
 517         if (len == -1) {
 518                 DEBUG(1, ("GSS-SPNEGO query [%s] invalid", buf));
 519                 x_fprintf(x_stdout, "BH\n");
 520                 return;
 521         }
 522
 523         if (request.type == SPNEGO_NEG_TOKEN_INIT) {
 524
 525                 /* Second request from Client. This is where the
 526                    client offers its mechanism to use. */
 527
 528                 if ( (request.negTokenInit.mechTypes == NULL) ||
 529                      (request.negTokenInit.mechTypes[0] == NULL) ) {
 530                         DEBUG(1, ("Client did not offer any mechanism"));
 531                         x_fprintf(x_stdout, "BH\n");
 532                         return;
 533                 }
 534
 535                 if (strcmp(request.negTokenInit.mechTypes[0], OID_NTLMSSP) == 0) {
 536
 537                         if ( request.negTokenInit.mechToken.data == NULL ) {
 538                                 DEBUG(1, ("Client did not provide  NTLMSSP data\n"));
 539                                 x_fprintf(x_stdout, "BH\n");
 540                                 return;
 541                         }
 542
 543                         if ( ntlmssp_state != NULL ) {
 544                                 DEBUG(1, ("Client wants a new NTLMSSP challenge, but "
 545                                           "already got one\n"));
 546                                 x_fprintf(x_stdout, "BH\n");
 547                                 ntlmssp_end(&ntlmssp_state);
 548                                 return;
 549                         }
 550
 551                         ntlmssp_server_start(&ntlmssp_state);
 552                         ntlmssp_state->check_password = winbind_pw_check;
 553                         ntlmssp_state->get_domain = get_winbind_domain;
 554                         ntlmssp_state->get_global_myname = get_winbind_netbios_name;
 555
 556                         DEBUG(10, ("got NTLMSSP packet:\n"));
 557                         dump_data(10, (const char *)request.negTokenInit.mechToken.data,
 558                                   request.negTokenInit.mechToken.length);
 559
 560                         response.type = SPNEGO_NEG_TOKEN_TARG;
 561                         response.negTokenTarg.supportedMech = strdup(OID_NTLMSSP);
 562                         response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
 563
 564                         status = ntlmssp_update(ntlmssp_state,
 565                                                        request.negTokenInit.mechToken,
 566                                                        &response.negTokenTarg.responseToken);
 567                 }
 568
 569 #ifdef HAVE_KRB5
 570                 if (strcmp(request.negTokenInit.mechTypes[0], OID_KERBEROS5_OLD) == 0) {
 571
 572                         char *principal;
 573                         DATA_BLOB auth_data;
 574                         DATA_BLOB ap_rep;
 575                         DATA_BLOB session_key;
 576
 577                         if ( request.negTokenInit.mechToken.data == NULL ) {
 578                                 DEBUG(1, ("Client did not provide Kerberos data\n"));
 579                                 x_fprintf(x_stdout, "BH\n");
 580                                 return;
 581                         }
 582
 583                         response.type = SPNEGO_NEG_TOKEN_TARG;
 584                         response.negTokenTarg.supportedMech = strdup(OID_KERBEROS5_OLD);
 585                         response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
 586                         response.negTokenTarg.responseToken = data_blob(NULL, 0);
 587
 588                         status = ads_verify_ticket(lp_realm(),
 589                                                    &request.negTokenInit.mechToken,
 590                                                    &principal, &auth_data, &ap_rep,
 591                                                    &session_key);
 592
 593                         /* Now in "principal" we have the name we are
 594                            authenticated as. */
 595
 596                         if (NT_STATUS_IS_OK(status)) {
 597
 598                                 domain = strchr(principal, '@');
 599
 600                                 if (domain == NULL) {
 601                                         DEBUG(1, ("Did not get a valid principal "
 602                                                   "from ads_verify_ticket\n"));
 603                                         x_fprintf(x_stdout, "BH\n");
 604                                         return;
 605                                 }
 606
 607                                 *domain++ = '\0';
 608                                 domain = strdup(domain);
 609                                 user = strdup(principal);
 610
 611                                 data_blob_free(&ap_rep);
 612                                 data_blob_free(&auth_data);
 613
 614                                 SAFE_FREE(principal);
 615                         }
 616                 }
 617 #endif
 618
 619         } else {
 620
 621                 if ( (request.negTokenTarg.supportedMech == NULL) ||
 622                      ( strcmp(request.negTokenTarg.supportedMech, OID_NTLMSSP) != 0 ) ) {
 623                         /* Kerberos should never send a negTokenTarg, OID_NTLMSSP
 624                            is the only one we support that sends this stuff */
 625                         DEBUG(1, ("Got a negTokenTarg for something non-NTLMSSP: %s\n",
 626                                   request.negTokenTarg.supportedMech));
 627                         x_fprintf(x_stdout, "BH\n");
 628                         return;
 629                 }
 630
 631                 if (request.negTokenTarg.responseToken.data == NULL) {
 632                         DEBUG(1, ("Got a negTokenTarg without a responseToken!\n"));
 633                         x_fprintf(x_stdout, "BH\n");
 634                         return;
 635                 }
 636
 637                 status = ntlmssp_update(ntlmssp_state,
 638                                                request.negTokenTarg.responseToken,
 639                                                &response.negTokenTarg.responseToken);
 640
 641                 response.type = SPNEGO_NEG_TOKEN_TARG;
 642                 response.negTokenTarg.supportedMech = strdup(OID_NTLMSSP);
 643                 response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
 644
 645                 if (NT_STATUS_IS_OK(status)) {
 646                         user = strdup(ntlmssp_state->user);
 647                         domain = strdup(ntlmssp_state->domain);
 648                         ntlmssp_end(&ntlmssp_state);
 649                 }
 650         }
 651
 652         free_spnego_data(&request);
 653
 654         if (NT_STATUS_IS_OK(status)) {
 655                 response.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
 656                 reply_code = "AF";
 657                 pstr_sprintf(reply_argument, "%s\\%s", domain, user);
 658         } else if (NT_STATUS_EQUAL(status,
 659                                    NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 660                 response.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
 661                 reply_code = "TT";
 662                 pstr_sprintf(reply_argument, "*");
 663         } else {
 664                 response.negTokenTarg.negResult = SPNEGO_REJECT;
 665                 reply_code = "NA";
 666                 pstrcpy(reply_argument, nt_errstr(status));
 667         }
 668
 669         SAFE_FREE(user);
 670         SAFE_FREE(domain);
 671
 672         len = write_spnego_data(&token, &response);
 673         free_spnego_data(&response);
 674
 675         if (len == -1) {
 676                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
 677                 x_fprintf(x_stdout, "BH\n");
 678                 return;
 679         }
 680
 681         reply_base64 = base64_encode_data_blob(token);
 682
 683         x_fprintf(x_stdout, "%s %s %s\n",
 684                   reply_code, reply_base64, reply_argument);
 685
 686         SAFE_FREE(reply_base64);
 687         data_blob_free(&token);
 688
 689         return;
 690 }
 691
 692 static NTLMSSP_STATE *client_ntlmssp_state = NULL;
 693
 694 static BOOL manage_client_ntlmssp_init(SPNEGO_DATA spnego)
 695 {
 696         NTSTATUS status;
 697         DATA_BLOB null_blob = data_blob(NULL, 0);
 698         DATA_BLOB to_server;
 699         char *to_server_base64;
 700         const char *my_mechs[] = {OID_NTLMSSP, NULL};
 701
 702         DEBUG(10, ("Got spnego negTokenInit with NTLMSSP\n"));
 703
 704         if (client_ntlmssp_state != NULL) {
 705                 DEBUG(1, ("Request for initial SPNEGO request where "
 706                           "we already have a state\n"));
 707                 return False;
 708         }
 709
 710         if ( (opt_username == NULL) || (opt_domain == NULL) ) {
 711                 DEBUG(1, ("Need username and domain for NTLMSSP\n"));
 712                 return False;
 713         }
 714
 715         if (opt_password == NULL) {
 716
 717                 /* Request a password from the calling process.  After
 718                    sending it, the calling process should retry with
 719                    the negTokenInit. */
 720
 721                 DEBUG(10, ("Requesting password\n"));
 722                 x_fprintf(x_stdout, "PW\n");
 723                 return True;
 724         }
 725
 726         status = ntlmssp_client_start(&client_ntlmssp_state);
 727
 728         if (!NT_STATUS_IS_OK(status)) {
 729                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
 730                           nt_errstr(status)));
 731                 ntlmssp_end(&client_ntlmssp_state);
 732                 return False;
 733         }
 734
 735         status = ntlmssp_set_username(client_ntlmssp_state, opt_username);
 736
 737         if (!NT_STATUS_IS_OK(status)) {
 738                 DEBUG(1, ("Could not set username: %s\n",
 739                           nt_errstr(status)));
 740                 ntlmssp_end(&client_ntlmssp_state);
 741                 return False;
 742         }
 743
 744         status = ntlmssp_set_domain(client_ntlmssp_state, opt_domain);
 745
 746         if (!NT_STATUS_IS_OK(status)) {
 747                 DEBUG(1, ("Could not set domain: %s\n",
 748                           nt_errstr(status)));
 749                 ntlmssp_end(&client_ntlmssp_state);
 750                 return False;
 751         }
 752
 753         status = ntlmssp_set_password(client_ntlmssp_state, opt_password);
 754
 755         if (!NT_STATUS_IS_OK(status)) {
 756                 DEBUG(1, ("Could not set password: %s\n",
 757                           nt_errstr(status)));
 758                 ntlmssp_end(&client_ntlmssp_state);
 759                 return False;
 760         }
 761
 762         spnego.type = SPNEGO_NEG_TOKEN_INIT;
 763         spnego.negTokenInit.mechTypes = my_mechs;
 764         spnego.negTokenInit.reqFlags = 0;
 765         spnego.negTokenInit.mechListMIC = null_blob;
 766
 767         status = ntlmssp_update(client_ntlmssp_state, null_blob,
 768                                        &spnego.negTokenInit.mechToken);
 769
 770         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 771                 DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED, got: %s\n",
 772                           nt_errstr(status)));
 773                 ntlmssp_end(&client_ntlmssp_state);
 774                 return False;
 775         }
 776
 777         write_spnego_data(&to_server, &spnego);
 778         data_blob_free(&spnego.negTokenInit.mechToken);
 779
 780         to_server_base64 = base64_encode_data_blob(to_server);
 781         data_blob_free(&to_server);
 782         x_fprintf(x_stdout, "KK %s\n", to_server_base64);
 783         SAFE_FREE(to_server_base64);
 784         return True;
 785 }
 786
 787 static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego)
 788 {
 789         NTSTATUS status;
 790         DATA_BLOB null_blob = data_blob(NULL, 0);
 791         DATA_BLOB request;
 792         DATA_BLOB to_server;
 793         char *to_server_base64;
 794
 795         DEBUG(10, ("Got spnego negTokenTarg with NTLMSSP\n"));
 796
 797         if (client_ntlmssp_state == NULL) {
 798                 DEBUG(1, ("Got NTLMSSP tArg without a client state\n"));
 799                 x_fprintf(x_stdout, "BH\n");
 800                 ntlmssp_end(&client_ntlmssp_state);
 801                 return;
 802         }
 803
 804         if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
 805                 x_fprintf(x_stdout, "NA\n");
 806                 ntlmssp_end(&client_ntlmssp_state);
 807                 return;
 808         }
 809
 810         if (spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_COMPLETED) {
 811                 x_fprintf(x_stdout, "AF\n");
 812                 ntlmssp_end(&client_ntlmssp_state);
 813                 return;
 814         }
 815
 816         status = ntlmssp_update(client_ntlmssp_state,
 817                                        spnego.negTokenTarg.responseToken,
 818                                        &request);
 819
 820         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 821                 DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED from "
 822                           "ntlmssp_client_update, got: %s\n",
 823                           nt_errstr(status)));
 824                 x_fprintf(x_stdout, "BH\n");
 825                 data_blob_free(&request);
 826                 ntlmssp_end(&client_ntlmssp_state);
 827                 return;
 828         }
 829
 830         spnego.type = SPNEGO_NEG_TOKEN_TARG;
 831         spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
 832         spnego.negTokenTarg.supportedMech = OID_NTLMSSP;
 833         spnego.negTokenTarg.responseToken = request;
 834         spnego.negTokenTarg.mechListMIC = null_blob;
 835
 836         write_spnego_data(&to_server, &spnego);
 837         data_blob_free(&request);
 838
 839         to_server_base64 = base64_encode_data_blob(to_server);
 840         data_blob_free(&to_server);
 841         x_fprintf(x_stdout, "KK %s\n", to_server_base64);
 842         SAFE_FREE(to_server_base64);
 843         return;
 844 }
 845
 846 #ifdef HAVE_KRB5
 847
 848 static BOOL manage_client_krb5_init(SPNEGO_DATA spnego)
 849 {
 850         char *principal;
 851         DATA_BLOB tkt, to_server;
 852         DATA_BLOB session_key_krb5;
 853         SPNEGO_DATA reply;
 854         char *reply_base64;
 855
 856         const char *my_mechs[] = {OID_KERBEROS5_OLD, NULL};
 857         ssize_t len;
 858
 859         if ( (spnego.negTokenInit.mechListMIC.data == NULL) ||
 860              (spnego.negTokenInit.mechListMIC.length == 0) ) {
 861                 DEBUG(1, ("Did not get a principal for krb5\n"));
 862                 return False;
 863         }
 864
 865         principal = malloc(spnego.negTokenInit.mechListMIC.length+1);
 866
 867         if (principal == NULL) {
 868                 DEBUG(1, ("Could not malloc principal\n"));
 869                 return False;
 870         }
 871
 872         memcpy(principal, spnego.negTokenInit.mechListMIC.data,
 873                spnego.negTokenInit.mechListMIC.length);
 874         principal[spnego.negTokenInit.mechListMIC.length] = '\0';
 875
 876         tkt = cli_krb5_get_ticket(principal, 0, &session_key_krb5);
 877
 878         if (tkt.data == NULL) {
 879
 880                 pstring user;
 881
 882                 /* Let's try to first get the TGT, for that we need a
 883                    password. */
 884
 885                 if (opt_password == NULL) {
 886                         DEBUG(10, ("Requesting password\n"));
 887                         x_fprintf(x_stdout, "PW\n");
 888                         return True;
 889                 }
 890
 891                 pstr_sprintf(user, "%s@%s", opt_username, opt_domain);
 892
 893                 if (kerberos_kinit_password(user, opt_password, 0) != 0) {
 894                         DEBUG(10, ("Requesting TGT failed\n"));
 895                         x_fprintf(x_stdout, "NA\n");
 896                         return True;
 897                 }
 898
 899                 tkt = cli_krb5_get_ticket(principal, 0, &session_key_krb5);
 900         }
 901
 902         data_blob_free(&session_key_krb5);
 903
 904         ZERO_STRUCT(reply);
 905
 906         reply.type = SPNEGO_NEG_TOKEN_INIT;
 907         reply.negTokenInit.mechTypes = my_mechs;
 908         reply.negTokenInit.reqFlags = 0;
 909         reply.negTokenInit.mechToken = tkt;
 910         reply.negTokenInit.mechListMIC = data_blob(NULL, 0);
 911
 912         len = write_spnego_data(&to_server, &reply);
 913         data_blob_free(&tkt);
 914
 915         if (len == -1) {
 916                 DEBUG(1, ("Could not write SPNEGO data blob\n"));
 917                 return False;
 918         }
 919
 920         reply_base64 = base64_encode_data_blob(to_server);
 921         x_fprintf(x_stdout, "KK %s *\n", reply_base64);
 922
 923         SAFE_FREE(reply_base64);
 924         data_blob_free(&to_server);
 925         DEBUG(10, ("sent GSS-SPNEGO KERBEROS5 negTokenInit\n"));
 926         return True;
 927 }
 928
 929 static void manage_client_krb5_targ(SPNEGO_DATA spnego)
 930 {
 931         switch (spnego.negTokenTarg.negResult) {
 932         case SPNEGO_ACCEPT_INCOMPLETE:
 933                 DEBUG(1, ("Got a Kerberos negTokenTarg with ACCEPT_INCOMPLETE\n"));
 934                 x_fprintf(x_stdout, "BH\n");
 935                 break;
 936         case SPNEGO_ACCEPT_COMPLETED:
 937                 DEBUG(10, ("Accept completed\n"));
 938                 x_fprintf(x_stdout, "AF\n");
 939                 break;
 940         case SPNEGO_REJECT:
 941                 DEBUG(10, ("Rejected\n"));
 942                 x_fprintf(x_stdout, "NA\n");
 943                 break;
 944         default:
 945                 DEBUG(1, ("Got an invalid negTokenTarg\n"));
 946                 x_fprintf(x_stdout, "AF\n");
 947         }
 948 }
 949
 950 #endif
 951
 952 static void manage_gss_spnego_client_request(enum stdio_helper_mode stdio_helper_mode,
 953                                              char *buf, int length)
 954 {
 955         DATA_BLOB request;
 956         SPNEGO_DATA spnego;
 957         ssize_t len;
 958
 959         if (strlen(buf) <= 3) {
 960                 DEBUG(1, ("SPNEGO query [%s] too short\n", buf));
 961                 x_fprintf(x_stdout, "BH\n");
 962                 return;
 963         }
 964
 965         request = base64_decode_data_blob(buf+3);
 966
 967         if (strncmp(buf, "PW ", 3) == 0) {
 968
 969                 /* We asked for a password and obviously got it :-) */
 970
 971                 opt_password = strndup((const char *)request.data, request.length);
 972
 973                 if (opt_password == NULL) {
 974                         DEBUG(1, ("Out of memory\n"));
 975                         x_fprintf(x_stdout, "BH\n");
 976                         data_blob_free(&request);
 977                         return;
 978                 }
 979
 980                 x_fprintf(x_stdout, "OK\n");
 981                 data_blob_free(&request);
 982                 return;
 983         }
 984
 985         if ( (strncmp(buf, "TT ", 3) != 0) &&
 986              (strncmp(buf, "AF ", 3) != 0) &&
 987              (strncmp(buf, "NA ", 3) != 0) ) {
 988                 DEBUG(1, ("SPNEGO request [%s] invalid\n", buf));
 989                 x_fprintf(x_stdout, "BH\n");
 990                 data_blob_free(&request);
 991                 return;
 992         }
 993
 994         /* So we got a server challenge to generate a SPNEGO
 995            client-to-server request... */
 996
 997         len = read_spnego_data(request, &spnego);
 998         data_blob_free(&request);
 999
1000         if (len == -1) {
1001                 DEBUG(1, ("Could not read SPNEGO data for [%s]\n", buf));
1002                 x_fprintf(x_stdout, "BH\n");
1003                 return;
1004         }
1005
1006         if (spnego.type == SPNEGO_NEG_TOKEN_INIT) {
1007
1008                 /* The server offers a list of mechanisms */
1009
1010                 const char **mechType = spnego.negTokenInit.mechTypes;
1011
1012                 while (*mechType != NULL) {
1013
1014 #ifdef HAVE_KRB5
1015                         if ( (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) ||
1016                              (strcmp(*mechType, OID_KERBEROS5) == 0) ) {
1017                                 if (manage_client_krb5_init(spnego))
1018                                         goto out;
1019                         }
1020 #endif
1021
1022                         if (strcmp(*mechType, OID_NTLMSSP) == 0) {
1023                                 if (manage_client_ntlmssp_init(spnego))
1024                                         goto out;
1025                         }
1026
1027                         mechType++;
1028                 }
1029
1030                 DEBUG(1, ("Server offered no compatible mechanism\n"));
1031                 x_fprintf(x_stdout, "BH\n");
1032                 return;
1033         }
1034
1035         if (spnego.type == SPNEGO_NEG_TOKEN_TARG) {
1036
1037                 if (spnego.negTokenTarg.supportedMech == NULL) {
1038                         /* On accept/reject Windows does not send the
1039                            mechanism anymore. Handle that here and
1040                            shut down the mechanisms. */
1041
1042                         switch (spnego.negTokenTarg.negResult) {
1043                         case SPNEGO_ACCEPT_COMPLETED:
1044                                 x_fprintf(x_stdout, "AF\n");
1045                                 break;
1046                         case SPNEGO_REJECT:
1047                                 x_fprintf(x_stdout, "NA\n");
1048                                 break;
1049                         default:
1050                                 DEBUG(1, ("Got a negTokenTarg with no mech and an "
1051                                           "unknown negResult: %d\n",
1052                                           spnego.negTokenTarg.negResult));
1053                                 x_fprintf(x_stdout, "BH\n");
1054                         }
1055
1056                         ntlmssp_end(&client_ntlmssp_state);
1057                         goto out;
1058                 }
1059
1060                 if (strcmp(spnego.negTokenTarg.supportedMech,
1061                            OID_NTLMSSP) == 0) {
1062                         manage_client_ntlmssp_targ(spnego);
1063                         goto out;
1064                 }
1065
1066 #if HAVE_KRB5
1067                 if (strcmp(spnego.negTokenTarg.supportedMech,
1068                            OID_KERBEROS5_OLD) == 0) {
1069                         manage_client_krb5_targ(spnego);
1070                         goto out;
1071                 }
1072 #endif
1073
1074         }
1075
1076         DEBUG(1, ("Got an SPNEGO token I could not handle [%s]!\n", buf));
1077         x_fprintf(x_stdout, "BH\n");
1078         return;
1079
1080  out:
1081         free_spnego_data(&spnego);
1082         return;
1083 }
1084
1085 static void manage_squid_request(enum stdio_helper_mode helper_mode, stdio_helper_function fn)
1086 {
1087         char buf[SQUID_BUFFER_SIZE+1];
1088         int length;
1089         char *c;
1090         static BOOL err;
1091
1092         /* this is not a typo - x_fgets doesn't work too well under squid */
1093         if (fgets(buf, sizeof(buf)-1, stdin) == NULL) {
1094                 DEBUG(1, ("fgets() failed! dying..... errno=%d (%s)\n", ferror(stdin),
1095                           strerror(ferror(stdin))));
1096                 exit(1);    /* BIIG buffer */
1097         }
1098
1099         c=memchr(buf,'\n',sizeof(buf)-1);
1100         if (c) {
1101                 *c = '\0';
1102                 length = c-buf;
1103         } else {
1104                 err = 1;
1105                 return;
1106         }
1107         if (err) {
1108                 DEBUG(2, ("Oversized message\n"));
1109                 x_fprintf(x_stderr, "ERR\n");
1110                 err = 0;
1111                 return;
1112         }
1113
1114         DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length));
1115
1116         if (buf[0] == '\0') {
1117                 DEBUG(2, ("Invalid Request\n"));
1118                 x_fprintf(x_stderr, "ERR\n");
1119                 return;
1120         }
1121
1122         fn(helper_mode, buf, length);
1123 }
1124
1125
1126 static void squid_stream(enum stdio_helper_mode stdio_mode, stdio_helper_function fn) {
1127         /* initialize FDescs */
1128         x_setbuf(x_stdout, NULL);
1129         x_setbuf(x_stderr, NULL);
1130         while(1) {
1131                 manage_squid_request(stdio_mode, fn);
1132         }
1133 }
1134
1135
1136 /* Authenticate a user with a challenge/response */
1137
1138 static BOOL check_auth_crap(void)
1139 {
1140         NTSTATUS nt_status;
1141         uint32 flags = 0;
1142         char lm_key[8];
1143         char nt_key[16];
1144         char *hex_lm_key;
1145         char *hex_nt_key;
1146         char *error_string;
1147         static uint8 zeros[16];
1148
1149         x_setbuf(x_stdout, NULL);
1150
1151         if (request_lm_key)
1152                 flags |= WBFLAG_PAM_LMKEY;
1153
1154         if (request_nt_key)
1155                 flags |= WBFLAG_PAM_NTKEY;
1156
1157         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1158                                               opt_workstation,
1159                                               &opt_challenge,
1160                                               &opt_lm_response,
1161                                               &opt_nt_response,
1162                                               flags,
1163                                               (unsigned char *)lm_key,
1164                                               (unsigned char *)nt_key,
1165                                               &error_string);
1166
1167         if (!NT_STATUS_IS_OK(nt_status)) {
1168                 x_fprintf(x_stdout, "%s (0x%x)\n",
1169                           error_string,
1170                           NT_STATUS_V(nt_status));
1171                 SAFE_FREE(error_string);
1172                 return False;
1173         }
1174
1175         if (request_lm_key
1176             && (memcmp(zeros, lm_key,
1177                        sizeof(lm_key)) != 0)) {
1178                 hex_encode((const unsigned char *)lm_key,
1179                            sizeof(lm_key),
1180                            &hex_lm_key);
1181                 x_fprintf(x_stdout, "LM_KEY: %s\n", hex_lm_key);
1182                 SAFE_FREE(hex_lm_key);
1183         }
1184         if (request_nt_key
1185             && (memcmp(zeros, nt_key,
1186                        sizeof(nt_key)) != 0)) {
1187                 hex_encode((const unsigned char *)nt_key,
1188                            sizeof(nt_key),
1189                            &hex_nt_key);
1190                 x_fprintf(x_stdout, "NT_KEY: %s\n", hex_nt_key);
1191                 SAFE_FREE(hex_nt_key);
1192         }
1193
1194         return True;
1195 }
1196
1197 /*
1198    Authenticate a user with a challenge/response, checking session key
1199    and valid authentication types
1200 */
1201
1202 static DATA_BLOB get_challenge(void)
1203 {
1204         static DATA_BLOB chal;
1205         if (opt_challenge.length)
1206                 return opt_challenge;
1207
1208         chal = data_blob(NULL, 8);
1209
1210         generate_random_buffer(chal.data, chal.length, False);
1211         return chal;
1212 }
1213
1214 /*
1215  * Test LM authentication, no NT response supplied
1216  */
1217
1218 static BOOL test_lm(void)
1219 {
1220         NTSTATUS nt_status;
1221         uint32 flags = 0;
1222         DATA_BLOB lm_response = data_blob(NULL, 24);
1223
1224         uchar lm_key[8];
1225         uchar nt_key[16];
1226         uchar lm_hash[16];
1227         DATA_BLOB chall = get_challenge();
1228         char *error_string;
1229
1230         ZERO_STRUCT(lm_key);
1231         ZERO_STRUCT(nt_key);
1232
1233         flags |= WBFLAG_PAM_LMKEY;
1234         flags |= WBFLAG_PAM_NTKEY;
1235
1236         SMBencrypt(opt_password, chall.data, lm_response.data);
1237         E_deshash(opt_password, lm_hash);
1238
1239         nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation,
1240                                               &chall,
1241                                               &lm_response,
1242                                               NULL,
1243                                               flags,
1244                                               lm_key,
1245                                               nt_key,
1246                                               &error_string);
1247
1248         data_blob_free(&lm_response);
1249
1250         if (!NT_STATUS_IS_OK(nt_status)) {
1251                 d_printf("%s (0x%x)\n",
1252                          error_string,
1253                          NT_STATUS_V(nt_status));
1254                 return False;
1255         }
1256
1257         if (memcmp(lm_hash, lm_key,
1258                    sizeof(lm_key)) != 0) {
1259                 DEBUG(1, ("LM Key does not match expectations!\n"));
1260                 DEBUG(1, ("lm_key:\n"));
1261                 dump_data(1, (const char *)lm_key, 8);
1262                 DEBUG(1, ("expected:\n"));
1263                 dump_data(1, (const char *)lm_hash, 8);
1264         }
1265         if (memcmp(lm_hash, nt_key, 8) != 0) {
1266                 DEBUG(1, ("Session Key (first 8, lm hash) does not match expectations!\n"));
1267                 DEBUG(1, ("nt_key:\n"));
1268                 dump_data(1, (const char *)nt_key, 8);
1269                 DEBUG(1, ("expected:\n"));
1270                 dump_data(1, (const char *)lm_hash, 8);
1271         }
1272         return True;
1273 }
1274
1275 /*
1276  * Test the normal 'LM and NTLM' combination
1277  */
1278
1279 static BOOL test_lm_ntlm(void)
1280 {
1281         BOOL pass = True;
1282         NTSTATUS nt_status;
1283         uint32 flags = 0;
1284         DATA_BLOB lm_response = data_blob(NULL, 24);
1285         DATA_BLOB nt_response = data_blob(NULL, 24);
1286         DATA_BLOB session_key = data_blob(NULL, 16);
1287
1288         uchar lm_key[8];
1289         uchar nt_key[16];
1290         uchar lm_hash[16];
1291         uchar nt_hash[16];
1292         DATA_BLOB chall = get_challenge();
1293         char *error_string;
1294
1295         ZERO_STRUCT(lm_key);
1296         ZERO_STRUCT(nt_key);
1297
1298         flags |= WBFLAG_PAM_LMKEY;
1299         flags |= WBFLAG_PAM_NTKEY;
1300
1301         SMBencrypt(opt_password,chall.data,lm_response.data);
1302         E_deshash(opt_password, lm_hash);
1303
1304         SMBNTencrypt(opt_password,chall.data,nt_response.data);
1305
1306         E_md4hash(opt_password, nt_hash);
1307         SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
1308
1309         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1310                                               opt_workstation,
1311                                               &chall,
1312                                               &lm_response,
1313                                               &nt_response,
1314                                               flags,
1315                                               lm_key,
1316                                               nt_key,
1317                                               &error_string);
1318
1319         data_blob_free(&lm_response);
1320
1321         if (!NT_STATUS_IS_OK(nt_status)) {
1322                 d_printf("%s (0x%x)\n",
1323                          error_string,
1324                          NT_STATUS_V(nt_status));
1325                 SAFE_FREE(error_string);
1326                 return False;
1327         }
1328
1329         if (memcmp(lm_hash, lm_key,
1330                    sizeof(lm_key)) != 0) {
1331                 DEBUG(1, ("LM Key does not match expectations!\n"));
1332                 DEBUG(1, ("lm_key:\n"));
1333                 dump_data(1, (const char *)lm_key, 8);
1334                 DEBUG(1, ("expected:\n"));
1335                 dump_data(1, (const char *)lm_hash, 8);
1336                 pass = False;
1337         }
1338         if (memcmp(session_key.data, nt_key,
1339                    sizeof(nt_key)) != 0) {
1340                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
1341                 DEBUG(1, ("nt_key:\n"));
1342                 dump_data(1, (const char *)nt_key, 16);
1343                 DEBUG(1, ("expected:\n"));
1344                 dump_data(1, (const char *)session_key.data, session_key.length);
1345                 pass = False;
1346         }
1347         return pass;
1348 }
1349
1350 /*
1351  * Test the NTLM response only, no LM.
1352  */
1353
1354 static BOOL test_ntlm(void)
1355 {
1356         BOOL pass = True;
1357         NTSTATUS nt_status;
1358         uint32 flags = 0;
1359         DATA_BLOB nt_response = data_blob(NULL, 24);
1360         DATA_BLOB session_key = data_blob(NULL, 16);
1361
1362         char lm_key[8];
1363         char nt_key[16];
1364         char lm_hash[16];
1365         char nt_hash[16];
1366         DATA_BLOB chall = get_challenge();
1367         char *error_string;
1368
1369         ZERO_STRUCT(lm_key);
1370         ZERO_STRUCT(nt_key);
1371
1372         flags |= WBFLAG_PAM_LMKEY;
1373         flags |= WBFLAG_PAM_NTKEY;
1374
1375         SMBNTencrypt(opt_password,chall.data,nt_response.data);
1376         E_md4hash(opt_password, (unsigned char *)nt_hash);
1377         SMBsesskeygen_ntv1((const unsigned char *)nt_hash, NULL, session_key.data);
1378
1379         E_deshash(opt_password, (unsigned char *)lm_hash);
1380
1381         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1382                                               opt_workstation,
1383                                               &chall,
1384                                               NULL,
1385                                               &nt_response,
1386                                               flags,
1387                                               (unsigned char *)lm_key,
1388                                               (unsigned char *)nt_key,
1389                                               &error_string);
1390
1391         data_blob_free(&nt_response);
1392
1393         if (!NT_STATUS_IS_OK(nt_status)) {
1394                 d_printf("%s (0x%x)\n",
1395                          error_string,
1396                          NT_STATUS_V(nt_status));
1397                 SAFE_FREE(error_string);
1398                 return False;
1399         }
1400
1401         if (memcmp(lm_hash, lm_key,
1402                    sizeof(lm_key)) != 0) {
1403                 DEBUG(1, ("LM Key does not match expectations!\n"));
1404                 DEBUG(1, ("lm_key:\n"));
1405                 dump_data(1, lm_key, 8);
1406                 DEBUG(1, ("expected:\n"));
1407                 dump_data(1, lm_hash, 8);
1408                 pass = False;
1409         }
1410         if (memcmp(session_key.data, nt_key,
1411                    sizeof(nt_key)) != 0) {
1412                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
1413                 DEBUG(1, ("nt_key:\n"));
1414                 dump_data(1, nt_key, 16);
1415                 DEBUG(1, ("expected:\n"));
1416                 dump_data(1, (const char *)session_key.data, session_key.length);
1417                 pass = False;
1418         }
1419         return pass;
1420 }
1421
1422 /*
1423  * Test the NTLM response only, but in the LM field.
1424  */
1425
1426 static BOOL test_ntlm_in_lm(void)
1427 {
1428         BOOL pass = True;
1429         NTSTATUS nt_status;
1430         uint32 flags = 0;
1431         DATA_BLOB nt_response = data_blob(NULL, 24);
1432
1433         uchar lm_key[8];
1434         uchar lm_hash[16];
1435         uchar nt_key[16];
1436         DATA_BLOB chall = get_challenge();
1437         char *error_string;
1438
1439         ZERO_STRUCT(nt_key);
1440
1441         flags |= WBFLAG_PAM_LMKEY;
1442         flags |= WBFLAG_PAM_NTKEY;
1443
1444         SMBNTencrypt(opt_password,chall.data,nt_response.data);
1445
1446         E_deshash(opt_password, lm_hash);
1447
1448         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1449                                               opt_workstation,
1450                                               &chall,
1451                                               &nt_response,
1452                                               NULL,
1453                                               flags,
1454                                               lm_key,
1455                                               nt_key,
1456                                               &error_string);
1457
1458         data_blob_free(&nt_response);
1459
1460         if (!NT_STATUS_IS_OK(nt_status)) {
1461                 d_printf("%s (0x%x)\n",
1462                          error_string,
1463                          NT_STATUS_V(nt_status));
1464                 SAFE_FREE(error_string);
1465                 return False;
1466         }
1467
1468         if (memcmp(lm_hash, lm_key,
1469                    sizeof(lm_key)) != 0) {
1470                 DEBUG(1, ("LM Key does not match expectations!\n"));
1471                 DEBUG(1, ("lm_key:\n"));
1472                 dump_data(1, (const char *)lm_key, 8);
1473                 DEBUG(1, ("expected:\n"));
1474                 dump_data(1, (const char *)lm_hash, 8);
1475                 pass = False;
1476         }
1477         if (memcmp(lm_hash, nt_key, 8) != 0) {
1478                 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
1479                 DEBUG(1, ("nt_key:\n"));
1480                 dump_data(1, (const char *)nt_key, 16);
1481                 DEBUG(1, ("expected:\n"));
1482                 dump_data(1, (const char *)lm_hash, 8);
1483                 pass = False;
1484         }
1485         return pass;
1486 }
1487
1488 /*
1489  * Test the NTLM response only, but in the both the NT and LM fields.
1490  */
1491
1492 static BOOL test_ntlm_in_both(void)
1493 {
1494         BOOL pass = True;
1495         NTSTATUS nt_status;
1496         uint32 flags = 0;
1497         DATA_BLOB nt_response = data_blob(NULL, 24);
1498         DATA_BLOB session_key = data_blob(NULL, 16);
1499
1500         char lm_key[8];
1501         char lm_hash[16];
1502         char nt_key[16];
1503         char nt_hash[16];
1504         DATA_BLOB chall = get_challenge();
1505         char *error_string;
1506
1507         ZERO_STRUCT(lm_key);
1508         ZERO_STRUCT(nt_key);
1509
1510         flags |= WBFLAG_PAM_LMKEY;
1511         flags |= WBFLAG_PAM_NTKEY;
1512
1513         SMBNTencrypt(opt_password,chall.data,nt_response.data);
1514         E_md4hash(opt_password, (unsigned char *)nt_hash);
1515         SMBsesskeygen_ntv1((const unsigned char *)nt_hash, NULL, session_key.data);
1516
1517         E_deshash(opt_password, (unsigned char *)lm_hash);
1518
1519         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1520                                               opt_workstation,
1521                                               &chall,
1522                                               &nt_response,
1523                                               &nt_response,
1524                                               flags,
1525                                               (unsigned char *)lm_key,
1526                                               (unsigned char *)nt_key,
1527                                               &error_string);
1528
1529         data_blob_free(&nt_response);
1530
1531         if (!NT_STATUS_IS_OK(nt_status)) {
1532                 d_printf("%s (0x%x)\n",
1533                          error_string,
1534                          NT_STATUS_V(nt_status));
1535                 SAFE_FREE(error_string);
1536                 return False;
1537         }
1538
1539         if (memcmp(lm_hash, lm_key,
1540                    sizeof(lm_key)) != 0) {
1541                 DEBUG(1, ("LM Key does not match expectations!\n"));
1542                 DEBUG(1, ("lm_key:\n"));
1543                 dump_data(1, lm_key, 8);
1544                 DEBUG(1, ("expected:\n"));
1545                 dump_data(1, lm_hash, 8);
1546                 pass = False;
1547         }
1548         if (memcmp(session_key.data, nt_key,
1549                    sizeof(nt_key)) != 0) {
1550                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
1551                 DEBUG(1, ("nt_key:\n"));
1552                 dump_data(1, nt_key, 16);
1553                 DEBUG(1, ("expected:\n"));
1554                 dump_data(1, (const char *)session_key.data, session_key.length);
1555                 pass = False;
1556         }
1557
1558
1559         return pass;
1560 }
1561
1562 /*
1563  * Test the NTLMv2 response only
1564  */
1565
1566 static BOOL test_ntlmv2(void)
1567 {
1568         BOOL pass = True;
1569         NTSTATUS nt_status;
1570         uint32 flags = 0;
1571         DATA_BLOB ntlmv2_response = data_blob(NULL, 0);
1572         DATA_BLOB nt_session_key = data_blob(NULL, 0);
1573         DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain());
1574
1575         uchar nt_key[16];
1576         DATA_BLOB chall = get_challenge();
1577         char *error_string;
1578
1579         ZERO_STRUCT(nt_key);
1580
1581         flags |= WBFLAG_PAM_NTKEY;
1582
1583         if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall,
1584                               &names_blob,
1585                               NULL, &ntlmv2_response,
1586                               &nt_session_key)) {
1587                 data_blob_free(&names_blob);
1588                 return False;
1589         }
1590         data_blob_free(&names_blob);
1591
1592         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1593                                               opt_workstation,
1594                                               &chall,
1595                                               NULL,
1596                                               &ntlmv2_response,
1597                                               flags,
1598                                               NULL,
1599                                               nt_key,
1600                                               &error_string);
1601
1602         data_blob_free(&ntlmv2_response);
1603
1604         if (!NT_STATUS_IS_OK(nt_status)) {
1605                 d_printf("%s (0x%x)\n",
1606                          error_string,
1607                          NT_STATUS_V(nt_status));
1608                 SAFE_FREE(error_string);
1609                 return False;
1610         }
1611
1612         if (memcmp(nt_session_key.data, nt_key,
1613                    sizeof(nt_key)) != 0) {
1614                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
1615                 DEBUG(1, ("nt_key:\n"));
1616                 dump_data(1, (const char *)nt_key, 16);
1617                 DEBUG(1, ("expected:\n"));
1618                 dump_data(1, (const char *)nt_session_key.data, nt_session_key.length);
1619                 pass = False;
1620         }
1621         return pass;
1622 }
1623
1624 /*
1625  * Test the NTLMv2 and LMv2 responses
1626  */
1627
1628 static BOOL test_lmv2_ntlmv2(void)
1629 {
1630         BOOL pass = True;
1631         NTSTATUS nt_status;
1632         uint32 flags = 0;
1633         DATA_BLOB ntlmv2_response = data_blob(NULL, 0);
1634         DATA_BLOB lmv2_response = data_blob(NULL, 0);
1635         DATA_BLOB nt_session_key = data_blob(NULL, 0);
1636         DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain());
1637
1638         uchar nt_key[16];
1639         DATA_BLOB chall = get_challenge();
1640         char *error_string;
1641
1642         ZERO_STRUCT(nt_key);
1643
1644         flags |= WBFLAG_PAM_NTKEY;
1645
1646         if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall,
1647                               &names_blob,
1648                               &lmv2_response, &ntlmv2_response,
1649                               &nt_session_key)) {
1650                 data_blob_free(&names_blob);
1651                 return False;
1652         }
1653         data_blob_free(&names_blob);
1654
1655         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1656                                               opt_workstation,
1657                                               &chall,
1658                                               &lmv2_response,
1659                                               &ntlmv2_response,
1660                                               flags,
1661                                               NULL,
1662                                               nt_key,
1663                                               &error_string);
1664
1665         data_blob_free(&lmv2_response);
1666         data_blob_free(&ntlmv2_response);
1667
1668         if (!NT_STATUS_IS_OK(nt_status)) {
1669                 d_printf("%s (0x%x)\n",
1670                          error_string,
1671                          NT_STATUS_V(nt_status));
1672                 SAFE_FREE(error_string);
1673                 return False;
1674         }
1675
1676         if (memcmp(nt_session_key.data, nt_key,
1677                    sizeof(nt_key)) != 0) {
1678                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
1679                 DEBUG(1, ("nt_key:\n"));
1680                 dump_data(1, (const char *)nt_key, 16);
1681                 DEBUG(1, ("expected:\n"));
1682                 dump_data(1, (const char *)nt_session_key.data, nt_session_key.length);
1683                 pass = False;
1684         }
1685         return pass;
1686 }
1687
1688 /*
1689  * Test the LMv2 response only
1690  */
1691
1692 static BOOL test_lmv2(void)
1693 {
1694         BOOL pass = True;
1695         NTSTATUS nt_status;
1696         uint32 flags = 0;
1697         DATA_BLOB lmv2_response = data_blob(NULL, 0);
1698
1699         DATA_BLOB chall = get_challenge();
1700         char *error_string;
1701
1702         if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall,
1703                               NULL,
1704                               &lmv2_response, NULL,
1705                               NULL)) {
1706                 return False;
1707         }
1708
1709         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1710                                               opt_workstation,
1711                                               &chall,
1712                                               &lmv2_response,
1713                                               NULL,
1714                                               flags,
1715                                               NULL,
1716                                               NULL,
1717                                               &error_string);
1718
1719         data_blob_free(&lmv2_response);
1720
1721         if (!NT_STATUS_IS_OK(nt_status)) {
1722                 d_printf("%s (0x%x)\n",
1723                          error_string,
1724                          NT_STATUS_V(nt_status));
1725                 SAFE_FREE(error_string);
1726                 return False;
1727         }
1728
1729         return pass;
1730 }
1731
1732 /*
1733  * Test the normal 'LM and NTLM' combination but deliberately break one
1734  */
1735
1736 static BOOL test_ntlm_broken(BOOL break_lm)
1737 {
1738         BOOL pass = True;
1739         NTSTATUS nt_status;
1740         uint32 flags = 0;
1741         DATA_BLOB lm_response = data_blob(NULL, 24);
1742         DATA_BLOB nt_response = data_blob(NULL, 24);
1743         DATA_BLOB session_key = data_blob(NULL, 16);
1744
1745         uchar lm_key[8];
1746         uchar nt_key[16];
1747         uchar lm_hash[16];
1748         uchar nt_hash[16];
1749         DATA_BLOB chall = get_challenge();
1750         char *error_string;
1751
1752         ZERO_STRUCT(lm_key);
1753         ZERO_STRUCT(nt_key);
1754
1755         flags |= WBFLAG_PAM_LMKEY;
1756         flags |= WBFLAG_PAM_NTKEY;
1757
1758         SMBencrypt(opt_password,chall.data,lm_response.data);
1759         E_deshash(opt_password, lm_hash);
1760
1761         SMBNTencrypt(opt_password,chall.data,nt_response.data);
1762
1763         E_md4hash(opt_password, nt_hash);
1764         SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
1765
1766         if (break_lm)
1767                 lm_response.data[0]++;
1768         else
1769                 nt_response.data[0]++;
1770
1771         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1772                                               opt_workstation,
1773                                               &chall,
1774                                               &lm_response,
1775                                               &nt_response,
1776                                               flags,
1777                                               lm_key,
1778                                               nt_key,
1779                                               &error_string);
1780
1781         data_blob_free(&lm_response);
1782
1783         if (!NT_STATUS_IS_OK(nt_status)) {
1784                 d_printf("%s (0x%x)\n",
1785                          error_string,
1786                          NT_STATUS_V(nt_status));
1787                 SAFE_FREE(error_string);
1788                 return False;
1789         }
1790
1791         if (memcmp(lm_hash, lm_key,
1792                    sizeof(lm_key)) != 0) {
1793                 DEBUG(1, ("LM Key does not match expectations!\n"));
1794                 DEBUG(1, ("lm_key:\n"));
1795                 dump_data(1, (const char *)lm_key, 8);
1796                 DEBUG(1, ("expected:\n"));
1797                 dump_data(1, (const char *)lm_hash, 8);
1798                 pass = False;
1799         }
1800         if (memcmp(session_key.data, nt_key,
1801                    sizeof(nt_key)) != 0) {
1802                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
1803                 DEBUG(1, ("nt_key:\n"));
1804                 dump_data(1, (const char *)nt_key, 16);
1805                 DEBUG(1, ("expected:\n"));
1806                 dump_data(1, (const char *)session_key.data, session_key.length);
1807                 pass = False;
1808         }
1809         return pass;
1810 }
1811
1812 static BOOL test_ntlm_lm_broken(void)
1813 {
1814         return test_ntlm_broken(True);
1815 }
1816
1817 static BOOL test_ntlm_ntlm_broken(void)
1818 {
1819         return test_ntlm_broken(False);
1820 }
1821
1822 static BOOL test_ntlmv2_broken(BOOL break_lmv2)
1823 {
1824         BOOL pass = True;
1825         NTSTATUS nt_status;
1826         uint32 flags = 0;
1827         DATA_BLOB ntlmv2_response = data_blob(NULL, 0);
1828         DATA_BLOB lmv2_response = data_blob(NULL, 0);
1829         DATA_BLOB nt_session_key = data_blob(NULL, 0);
1830         DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain());
1831
1832         uchar nt_key[16];
1833         DATA_BLOB chall = get_challenge();
1834         char *error_string;
1835
1836         ZERO_STRUCT(nt_key);
1837
1838         flags |= WBFLAG_PAM_NTKEY;
1839
1840         if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall,
1841                               &names_blob,
1842                               &lmv2_response, &ntlmv2_response,
1843                               &nt_session_key)) {
1844                 data_blob_free(&names_blob);
1845                 return False;
1846         }
1847         data_blob_free(&names_blob);
1848
1849         /* Heh - this should break the appropriate password hash nicely! */
1850
1851         if (break_lmv2)
1852                 lmv2_response.data[0]++;
1853         else
1854                 ntlmv2_response.data[0]++;
1855
1856         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
1857                                               opt_workstation,
1858                                               &chall,
1859                                               &lmv2_response,
1860                                               &ntlmv2_response,
1861                                               flags,
1862                                               NULL,
1863                                               nt_key,
1864                                               &error_string);
1865
1866         data_blob_free(&lmv2_response);
1867         data_blob_free(&ntlmv2_response);
1868
1869         if (!NT_STATUS_IS_OK(nt_status)) {
1870                 d_printf("%s (0x%x)\n",
1871                          error_string,
1872                          NT_STATUS_V(nt_status));
1873                 SAFE_FREE(error_string);
1874                 return False;
1875         }
1876
1877         return pass;
1878 }
1879
1880 static BOOL test_ntlmv2_lmv2_broken(void)
1881 {
1882         return test_ntlmv2_broken(True);
1883 }
1884
1885 static BOOL test_ntlmv2_ntlmv2_broken(void)
1886 {
1887         return test_ntlmv2_broken(False);
1888 }
1889
1890 /*
1891    Tests:
1892
1893    - LM only
1894    - NT and LM
1895    - NT
1896    - NT in LM field
1897    - NT in both fields
1898    - NTLMv2
1899    - NTLMv2 and LMv2
1900    - LMv2
1901
1902    check we get the correct session key in each case
1903    check what values we get for the LM session key
1904
1905 */
1906
1907 struct ntlm_tests {
1908         BOOL (*fn)(void);
1909         const char *name;
1910 } test_table[] = {
1911         {test_lm, "LM"},
1912         {test_lm_ntlm, "LM and NTLM"},
1913         {test_ntlm, "NTLM"},
1914         {test_ntlm_in_lm, "NTLM in LM"},
1915         {test_ntlm_in_both, "NTLM in both"},
1916         {test_ntlmv2, "NTLMv2"},
1917         {test_lmv2_ntlmv2, "NTLMv2 and LMv2"},
1918         {test_lmv2, "LMv2"},
1919         {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"},
1920         {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"},
1921         {test_ntlm_lm_broken, "NTLM and LM, LM broken"},
1922         {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"}
1923 };
1924
1925 static BOOL diagnose_ntlm_auth(void)
1926 {
1927         unsigned int i;
1928         BOOL pass = True;
1929
1930         for (i=0; test_table[i].fn; i++) {
1931                 if (!test_table[i].fn()) {
1932                         DEBUG(1, ("Test %s failed!\n", test_table[i].name));
1933                         pass = False;
1934                 }
1935         }
1936
1937         return pass;
1938 }
1939
1940 /* Main program */
1941
1942 enum {
1943         OPT_USERNAME = 1000,
1944         OPT_DOMAIN,
1945         OPT_WORKSTATION,
1946         OPT_CHALLENGE,
1947         OPT_RESPONSE,
1948         OPT_LM,
1949         OPT_NT,
1950         OPT_PASSWORD,
1951         OPT_LM_KEY,
1952         OPT_NT_KEY,
1953         OPT_DIAGNOSTICS
1954 };
1955
1956  int main(int argc, const char **argv)
1957 {
1958         int opt;
1959         static const char *helper_protocol;
1960         static int diagnostics;
1961
1962         static const char *hex_challenge;
1963         static const char *hex_lm_response;
1964         static const char *hex_nt_response;
1965         char *challenge;
1966         char *lm_response;
1967         char *nt_response;
1968         size_t challenge_len;
1969         size_t lm_response_len;
1970         size_t nt_response_len;
1971
1972         poptContext pc;
1973
1974         /* NOTE: DO NOT change this interface without considering the implications!
1975            This is an external interface, which other programs will use to interact
1976            with this helper.
1977         */
1978
1979         /* We do not use single-letter command abbreviations, because they harm future
1980            interface stability. */
1981
1982         struct poptOption long_options[] = {
1983                 POPT_AUTOHELP
1984                 { "helper-protocol", 0, POPT_ARG_STRING, &helper_protocol, OPT_DOMAIN, "operate as a stdio-based helper", "helper protocol to use"},
1985                 { "username", 0, POPT_ARG_STRING, &opt_username, OPT_USERNAME, "username"},
1986                 { "domain", 0, POPT_ARG_STRING, &opt_domain, OPT_DOMAIN, "domain name"},
1987                 { "workstation", 0, POPT_ARG_STRING, &opt_workstation, OPT_WORKSTATION, "workstation"},
1988                 { "challenge", 0, POPT_ARG_STRING, &hex_challenge, OPT_CHALLENGE, "challenge (HEX encoded)"},
1989                 { "lm-response", 0, POPT_ARG_STRING, &hex_lm_response, OPT_LM, "LM Response to the challenge (HEX encoded)"},
1990                 { "nt-response", 0, POPT_ARG_STRING, &hex_nt_response, OPT_NT, "NT or NTLMv2 Response to the challenge (HEX encoded)"},
1991                 { "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"},
1992                 { "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retreive LM session key"},
1993                 { "request-nt-key", 0, POPT_ARG_NONE, &request_nt_key, OPT_NT_KEY, "Retreive NT session key"},
1994                 { "diagnostics", 0, POPT_ARG_NONE, &diagnostics, OPT_DIAGNOSTICS, "Perform diagnostics on the authentictaion chain"},
1995                 POPT_COMMON_SAMBA
1996                 POPT_TABLEEND
1997         };
1998
1999         /* Samba client initialisation */
2000
2001         dbf = x_stderr;
2002
2003         /* Samba client initialisation */
2004
2005         if (!lp_load(dyn_CONFIGFILE, True, False, False)) {
2006                 d_fprintf(stderr, "wbinfo: error opening config file %s. Error was %s\n",
2007                         dyn_CONFIGFILE, strerror(errno));
2008                 exit(1);
2009         }
2010
2011         /* Parse options */
2012
2013         pc = poptGetContext("ntlm_auth", argc, argv, long_options, 0);
2014
2015         /* Parse command line options */
2016
2017         if (argc == 1) {
2018                 poptPrintHelp(pc, stderr, 0);
2019                 return 1;
2020         }
2021
2022         pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
2023                             POPT_CONTEXT_KEEP_FIRST);
2024
2025         while((opt = poptGetNextOpt(pc)) != -1) {
2026                 switch (opt) {
2027                 case OPT_CHALLENGE:
2028                         challenge = smb_xmalloc((strlen(hex_challenge))/2+1);
2029                         if ((challenge_len = strhex_to_str(challenge,
2030                                                            strlen(hex_challenge),
2031                                                            hex_challenge)) != 8) {
2032                                 x_fprintf(x_stderr, "hex decode of %s failed (only got %u bytes)!\n",
2033                                         hex_challenge, challenge_len);
2034                                 exit(1);
2035                         }
2036                         opt_challenge = data_blob(challenge, challenge_len);
2037                         SAFE_FREE(challenge);
2038                         break;
2039                 case OPT_LM:
2040                         lm_response = smb_xmalloc((strlen(hex_lm_response))/2+1);
2041                         lm_response_len = strhex_to_str(lm_response,
2042                                                         strlen(hex_lm_response),
2043                                                         hex_lm_response);
2044                         if (lm_response_len != 24) {
2045                                 x_fprintf(x_stderr, "hex decode of %s failed!\n", hex_lm_response);
2046                                 exit(1);
2047                         }
2048                         opt_lm_response = data_blob(lm_response, lm_response_len);
2049                         SAFE_FREE(lm_response);
2050                         break;
2051                 case OPT_NT:
2052                         nt_response = smb_xmalloc((strlen(hex_nt_response)+2)/2+1);
2053                         nt_response_len = strhex_to_str(nt_response,
2054                                                         strlen(hex_nt_response),
2055                                                         hex_nt_response);
2056                         if (nt_response_len < 24) {
2057                                 x_fprintf(x_stderr, "hex decode of %s failed!\n", hex_nt_response);
2058                                 exit(1);
2059                         }
2060                         opt_nt_response = data_blob(nt_response, nt_response_len);
2061                         SAFE_FREE(nt_response);
2062                         break;
2063                 }
2064         }
2065
2066         if (helper_protocol) {
2067                 int i;
2068                 for (i=0; i<NUM_HELPER_MODES; i++) {
2069                         if (strcmp(helper_protocol, stdio_helper_protocols[i].name) == 0) {
2070                                 squid_stream(stdio_helper_protocols[i].mode, stdio_helper_protocols[i].fn);
2071                                 exit(0);
2072                         }
2073                 }
2074                 x_fprintf(x_stderr, "unknown helper protocol [%s]\n", helper_protocol);
2075                 exit(1);
2076         }
2077
2078         if (!opt_username) {
2079                 x_fprintf(x_stderr, "username must be specified!\n\n");
2080                 poptPrintHelp(pc, stderr, 0);
2081                 exit(1);
2082         }
2083
2084         if (opt_domain == NULL) {
2085                 opt_domain = get_winbind_domain();
2086         }
2087
2088         if (opt_workstation == NULL) {
2089                 opt_workstation = "";
2090         }
2091
2092         if (opt_challenge.length) {
2093                 if (!check_auth_crap()) {
2094                         exit(1);
2095                 }
2096                 exit(0);
2097         }
2098
2099         if (!opt_password) {
2100                 opt_password = getpass("password: ");
2101         }
2102
2103         if (diagnostics) {
2104                 if (!diagnose_ntlm_auth()) {
2105                         exit(1);
2106                 }
2107         } else {
2108                 fstring user;
2109
2110                 fstr_sprintf(user, "%s%c%s", opt_domain, winbind_separator(), opt_username);
2111                 if (!check_plaintext_auth(user, opt_password, True)) {
2112                         exit(1);
2113                 }
2114         }
2115
2116         /* Exit code */
2117
2118         poptFreeContext(pc);
2119         return 0;
2120 }