From 8daa83a594a2e98f39d764422bfbdbc62c9efd44 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:20:00 +0200 Subject: Adding upstream version 2:4.20.0+dfsg. Signed-off-by: Daniel Baumann --- source3/utils/ntlm_auth.c | 2856 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 2856 insertions(+) create mode 100644 source3/utils/ntlm_auth.c (limited to 'source3/utils/ntlm_auth.c') diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c new file mode 100644 index 0000000..6660a31 --- /dev/null +++ b/source3/utils/ntlm_auth.c @@ -0,0 +1,2856 @@ +/* + Unix SMB/CIFS implementation. + + Winbind status program. + + Copyright (C) Tim Potter 2000-2003 + Copyright (C) Andrew Bartlett 2003-2004 + Copyright (C) Francesco Chemolli 2000 + Copyright (C) Robert O'Callahan 2006 (added cached credential code). + Copyright (C) Kai Blin 2008 + Copyright (C) Simo Sorce 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "lib/param/param.h" +#include "lib/cmdline/cmdline.h" +#include "libcli/security/security.h" +#include "utils/ntlm_auth.h" +#include "../libcli/auth/libcli_auth.h" +#include "auth/ntlmssp/ntlmssp.h" +#include "auth/gensec/gensec.h" +#include "auth/gensec/gensec_internal.h" +#include "auth/credentials/credentials.h" +#include "librpc/crypto/gse.h" +#include "smb_krb5.h" +#include "lib/util/tiniparser.h" +#include "librpc/gen_ndr/krb5pac.h" +#include "auth/common_auth.h" +#include "source3/include/auth.h" +#include "source3/auth/proto.h" +#include "nsswitch/libwbclient/wbclient.h" +#include "nsswitch/winbind_struct_protocol.h" +#include "nsswitch/libwbclient/wbclient_internal.h" +#include "lib/param/loadparm.h" +#include "lib/util/base64.h" +#include "cmdline_contexts.h" +#include "lib/util/tevent_ntstatus.h" +#include "lib/util/string_wrappers.h" + +#include +#include + +#ifdef HAVE_KRB5 +#include "auth/kerberos/pac_utils.h" +#endif + +#ifndef PAM_WINBIND_CONFIG_FILE +#define PAM_WINBIND_CONFIG_FILE "/etc/security/pam_winbind.conf" +#endif + +#define WINBIND_KRB5_AUTH 0x00000080 + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_WINBIND + +#define INITIAL_BUFFER_SIZE 300 +#define MAX_BUFFER_SIZE 630000 + +enum stdio_helper_mode { + SQUID_2_4_BASIC, + SQUID_2_5_BASIC, + SQUID_2_5_NTLMSSP, + NTLMSSP_CLIENT_1, + GSS_SPNEGO_SERVER, + GSS_SPNEGO_CLIENT, + NTLM_SERVER_1, + NTLM_CHANGE_PASSWORD_1, + NUM_HELPER_MODES +}; + +enum ntlm_auth_cli_state { + CLIENT_INITIAL = 0, + CLIENT_RESPONSE, + CLIENT_FINISHED, + CLIENT_ERROR +}; + +struct ntlm_auth_state { + TALLOC_CTX *mem_ctx; + enum stdio_helper_mode helper_mode; + enum ntlm_auth_cli_state cli_state; + struct ntlmssp_state *ntlmssp_state; + uint32_t neg_flags; + char *want_feature_list; + bool have_session_key; + DATA_BLOB session_key; + DATA_BLOB initial_message; + void *gensec_private_1; +}; +typedef void (*stdio_helper_function)(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, char *buf, + int length, void **private2); + +static void manage_gensec_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + char *buf, int length, void **private1); + +static void manage_squid_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + stdio_helper_function fn, void **private2); + +static void manage_squid_basic_request (enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static void manage_squid_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static void manage_client_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static void manage_gss_spnego_request (enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static void manage_gss_spnego_client_request (enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static void manage_ntlm_server_1_request (enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static void manage_ntlm_change_password_1_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2); + +static const struct { + enum stdio_helper_mode mode; + const char *name; + stdio_helper_function fn; +} stdio_helper_protocols[] = { + { SQUID_2_4_BASIC, "squid-2.4-basic", manage_squid_basic_request}, + { SQUID_2_5_BASIC, "squid-2.5-basic", manage_squid_basic_request}, + { SQUID_2_5_NTLMSSP, "squid-2.5-ntlmssp", manage_squid_ntlmssp_request}, + { NTLMSSP_CLIENT_1, "ntlmssp-client-1", manage_client_ntlmssp_request}, + { GSS_SPNEGO_SERVER, "gss-spnego", manage_gss_spnego_request}, + { GSS_SPNEGO_CLIENT, "gss-spnego-client", manage_gss_spnego_client_request}, + { NTLM_SERVER_1, "ntlm-server-1", manage_ntlm_server_1_request}, + { NTLM_CHANGE_PASSWORD_1, "ntlm-change-password-1", manage_ntlm_change_password_1_request}, + { NUM_HELPER_MODES, NULL, NULL} +}; + +const char *opt_username; +const char *opt_domain; +const char *opt_workstation; +const char *opt_password; +static DATA_BLOB opt_challenge; +static DATA_BLOB opt_lm_response; +static DATA_BLOB opt_nt_response; +static int request_lm_key; +static int request_user_session_key; +static int use_cached_creds; +static int offline_logon; +static int opt_allow_mschapv2; + +static const char *require_membership_of; +static const char *require_membership_of_sid; +static const char *opt_pam_winbind_conf; + +const char *opt_target_service; +const char *opt_target_hostname; + + +/* This is a bit hairy, but the basic idea is to do a password callback + to the calling application. The callback comes from within gensec */ + +static void manage_gensec_get_pw_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, char *buf, int length, + void **password) +{ + DATA_BLOB in; + if (strlen(buf) < 2) { + DEBUG(1, ("query [%s] invalid\n", buf)); + printf("BH Query invalid\n"); + return; + } + + if (strlen(buf) > 3) { + in = base64_decode_data_blob(buf + 3); + } else { + in = data_blob(NULL, 0); + } + + if (strncmp(buf, "PW ", 3) == 0) { + + *password = talloc_strndup(NULL, + (const char *)in.data, in.length); + + if (*password == NULL) { + DEBUG(1, ("Out of memory\n")); + printf("BH Out of memory\n"); + data_blob_free(&in); + return; + } + + printf("OK\n"); + data_blob_free(&in); + return; + } + DEBUG(1, ("Asked for (and expected) a password\n")); + printf("BH Expected a password\n"); + data_blob_free(&in); +} + +/** + * Callback for password credentials. This is not async, and when + * GENSEC and the credentials code is made async, it will look rather + * different. + */ + +static const char *get_password(struct cli_credentials *credentials) +{ + TALLOC_CTX *frame = talloc_stackframe(); + char *password = NULL; + struct ntlm_auth_state *state; + + state = talloc_zero(frame, struct ntlm_auth_state); + if (state == NULL) { + DEBUG(0, ("squid_stream: Failed to talloc ntlm_auth_state\n")); + fprintf(stderr, "ERR\n"); + exit(1); + } + + state->mem_ctx = state; + + /* Ask for a password */ + printf("PW\n"); + + manage_squid_request(NUM_HELPER_MODES /* bogus */, NULL, state, manage_gensec_get_pw_request, (void **)&password); + talloc_steal(credentials, password); + TALLOC_FREE(frame); + return password; +} + +/** + * A limited set of features are defined with text strings as needed + * by ntlm_auth + * + */ +static void gensec_want_feature_list(struct gensec_security *state, char* feature_list) +{ + if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, true)) { + DEBUG(10, ("want GENSEC_FEATURE_SESSION_KEY\n")); + gensec_want_feature(state, GENSEC_FEATURE_SESSION_KEY); + } + if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, true)) { + DEBUG(10, ("want GENSEC_FEATURE_SIGN\n")); + gensec_want_feature(state, GENSEC_FEATURE_SIGN); + } + if (in_list("NTLMSSP_FEATURE_SEAL", feature_list, true)) { + DEBUG(10, ("want GENSEC_FEATURE_SEAL\n")); + gensec_want_feature(state, GENSEC_FEATURE_SEAL); + } + if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) { + DEBUG(10, ("want GENSEC_FEATURE_NTLM_CCACHE\n")); + gensec_want_feature(state, GENSEC_FEATURE_NTLM_CCACHE); + } +} + +static char winbind_separator(void) +{ + struct wbcInterfaceDetails *details; + wbcErr ret; + static bool got_sep; + static char sep; + + if (got_sep) + return sep; + + ret = wbcInterfaceDetails(&details); + if (!WBC_ERROR_IS_OK(ret)) { + d_fprintf(stderr, "could not obtain winbind separator!\n"); + return *lp_winbind_separator(); + } + + sep = details->winbind_separator; + + wbcFreeMemory(details); + + got_sep = True; + + if (!sep) { + d_fprintf(stderr, "winbind separator was NULL!\n"); + return *lp_winbind_separator(); + } + + return sep; +} + +const char *get_winbind_domain(void) +{ + struct wbcInterfaceDetails *details; + wbcErr ret; + + static fstring winbind_domain; + if (*winbind_domain) { + return winbind_domain; + } + + /* Send off request */ + + ret = wbcInterfaceDetails(&details); + if (!WBC_ERROR_IS_OK(ret)) { + DEBUG(1, ("could not obtain winbind domain name!\n")); + return lp_workgroup(); + } + + fstrcpy(winbind_domain, details->netbios_domain); + + wbcFreeMemory(details); + + return winbind_domain; + +} + +const char *get_winbind_netbios_name(void) +{ + struct wbcInterfaceDetails *details; + wbcErr ret; + + static fstring winbind_netbios_name; + + if (*winbind_netbios_name) { + return winbind_netbios_name; + } + + /* Send off request */ + + ret = wbcInterfaceDetails(&details); + if (!WBC_ERROR_IS_OK(ret)) { + DEBUG(1, ("could not obtain winbind netbios name!\n")); + return lp_netbios_name(); + } + + fstrcpy(winbind_netbios_name, details->netbios_name); + + wbcFreeMemory(details); + + return winbind_netbios_name; + +} + +DATA_BLOB get_challenge(void) +{ + static DATA_BLOB chal; + if (opt_challenge.length) + return opt_challenge; + + chal = data_blob(NULL, 8); + + generate_random_buffer(chal.data, chal.length); + return chal; +} + +/* Copy of parse_domain_user from winbindd_util.c. Parse a string of the + form DOMAIN/user into a domain and a user */ + +static bool parse_ntlm_auth_domain_user(const char *domuser, fstring domain, + fstring user) +{ + + char *p = strchr(domuser,winbind_separator()); + + if (!p) { + return False; + } + + fstrcpy(user, p+1); + fstrcpy(domain, domuser); + domain[PTR_DIFF(p, domuser)] = 0; + return strupper_m(domain); +} + +static bool get_require_membership_sid(void) { + fstring domain, name, sidbuf; + struct wbcDomainSid sid; + enum wbcSidType type; + wbcErr ret; + + if (!require_membership_of) { + return True; + } + + if (require_membership_of_sid) { + return True; + } + + /* Otherwise, ask winbindd for the name->sid request */ + + if (!parse_ntlm_auth_domain_user(require_membership_of, + domain, name)) { + DEBUG(0, ("Could not parse %s into separate domain/name parts!\n", + require_membership_of)); + return False; + } + + ret = wbcLookupName(domain, name, &sid, &type); + if (!WBC_ERROR_IS_OK(ret)) { + DEBUG(0, ("Winbindd lookupname failed to resolve %s into a SID!\n", + require_membership_of)); + return False; + } + + wbcSidToStringBuf(&sid, sidbuf, sizeof(sidbuf)); + + require_membership_of_sid = SMB_STRDUP(sidbuf); + + if (require_membership_of_sid) + return True; + + return False; +} + +/* + * Get some configuration from pam_winbind.conf to see if we + * need to contact trusted domain + */ + +int get_pam_winbind_config(void) +{ + int ctrl = 0; + struct tiniparser_dictionary *d = NULL; + + if (!opt_pam_winbind_conf || !*opt_pam_winbind_conf) { + opt_pam_winbind_conf = PAM_WINBIND_CONFIG_FILE; + } + + d = tiniparser_load(opt_pam_winbind_conf); + + if (!d) { + return 0; + } + + if (tiniparser_getboolean(d, "global:krb5_auth", false)) { + ctrl |= WINBIND_KRB5_AUTH; + } + + tiniparser_freedict(d); + + return ctrl; +} + +/* Authenticate a user with a plaintext password */ + +static bool check_plaintext_auth(const char *user, const char *pass, + bool stdout_diagnostics) +{ + struct winbindd_request request; + struct winbindd_response response; + wbcErr ret; + + if (!get_require_membership_sid()) { + return False; + } + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + fstrcpy(request.data.auth.user, user); + fstrcpy(request.data.auth.pass, pass); + if (require_membership_of_sid) { + strlcpy(request.data.auth.require_membership_of_sid, + require_membership_of_sid, + sizeof(request.data.auth.require_membership_of_sid)); + } + + if (offline_logon) { + request.flags |= WBFLAG_PAM_CACHED_LOGIN; + } + + ret = wbcRequestResponse(NULL, WINBINDD_PAM_AUTH, + &request, &response); + + /* Display response */ + + if (stdout_diagnostics) { + if (!WBC_ERROR_IS_OK(ret) && (response.data.auth.nt_status == 0)) { + d_fprintf(stderr, "Reading winbind reply failed! (0x01)\n"); + } + + d_printf("%s: %s (0x%x)\n", + response.data.auth.nt_status_string, + response.data.auth.error_string, + response.data.auth.nt_status); + } else { + if (!WBC_ERROR_IS_OK(ret) && (response.data.auth.nt_status == 0)) { + DEBUG(1, ("Reading winbind reply failed! (0x01)\n")); + } + + DEBUG(3, ("%s: %s (0x%x)\n", + response.data.auth.nt_status_string, + response.data.auth.error_string, + response.data.auth.nt_status)); + } + + return WBC_ERROR_IS_OK(ret); +} + +/* authenticate a user with an encrypted username/password */ + +NTSTATUS contact_winbind_auth_crap(const char *username, + const char *domain, + const char *workstation, + const DATA_BLOB *challenge, + const DATA_BLOB *lm_response, + const DATA_BLOB *nt_response, + uint32_t flags, + uint32_t extra_logon_parameters, + uint8_t lm_key[8], + uint8_t user_session_key[16], + uint8_t *pauthoritative, + char **error_string, + char **unix_name) +{ + NTSTATUS nt_status; + wbcErr ret; + struct winbindd_request request; + struct winbindd_response response; + + *pauthoritative = 1; + + if (!get_require_membership_sid()) { + return NT_STATUS_INVALID_PARAMETER; + } + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + request.flags = flags; + + request.data.auth_crap.logon_parameters = extra_logon_parameters + | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT; + + if (opt_allow_mschapv2) { + request.data.auth_crap.logon_parameters |= MSV1_0_ALLOW_MSVCHAPV2; + } + + if (require_membership_of_sid) + fstrcpy(request.data.auth_crap.require_membership_of_sid, require_membership_of_sid); + + fstrcpy(request.data.auth_crap.user, username); + fstrcpy(request.data.auth_crap.domain, domain); + + fstrcpy(request.data.auth_crap.workstation, + workstation); + + memcpy(request.data.auth_crap.chal, challenge->data, MIN(challenge->length, 8)); + + if (lm_response && lm_response->length) { + size_t capped_lm_response_len = MIN( + lm_response->length, + sizeof(request.data.auth_crap.lm_resp)); + + memcpy(request.data.auth_crap.lm_resp, + lm_response->data, + capped_lm_response_len); + request.data.auth_crap.lm_resp_len = capped_lm_response_len; + } + + if (nt_response && nt_response->length) { + if (nt_response->length > sizeof(request.data.auth_crap.nt_resp)) { + request.flags = request.flags | WBFLAG_BIG_NTLMV2_BLOB; + request.extra_len = nt_response->length; + request.extra_data.data = SMB_MALLOC_ARRAY(char, request.extra_len); + if (request.extra_data.data == NULL) { + return NT_STATUS_NO_MEMORY; + } + memcpy(request.extra_data.data, nt_response->data, + nt_response->length); + + } else { + memcpy(request.data.auth_crap.nt_resp, + nt_response->data, nt_response->length); + } + request.data.auth_crap.nt_resp_len = nt_response->length; + } + + ret = wbcRequestResponsePriv( + NULL, + WINBINDD_PAM_AUTH_CRAP, + &request, + &response); + SAFE_FREE(request.extra_data.data); + + /* Display response */ + + if (!WBC_ERROR_IS_OK(ret) && (response.data.auth.nt_status == 0)) { + nt_status = NT_STATUS_UNSUCCESSFUL; + if (error_string) + *error_string = smb_xstrdup("Reading winbind reply failed!"); + winbindd_free_response(&response); + return nt_status; + } + + nt_status = (NT_STATUS(response.data.auth.nt_status)); + if (!NT_STATUS_IS_OK(nt_status)) { + if (error_string) + *error_string = smb_xstrdup(response.data.auth.error_string); + *pauthoritative = response.data.auth.authoritative; + winbindd_free_response(&response); + return nt_status; + } + + if ((flags & WBFLAG_PAM_LMKEY) && lm_key) { + memcpy(lm_key, response.data.auth.first_8_lm_hash, + sizeof(response.data.auth.first_8_lm_hash)); + } + if ((flags & WBFLAG_PAM_USER_SESSION_KEY) && user_session_key) { + memcpy(user_session_key, response.data.auth.user_session_key, + sizeof(response.data.auth.user_session_key)); + } + + if (flags & WBFLAG_PAM_UNIX_NAME) { + *unix_name = SMB_STRDUP(response.data.auth.unix_username); + if (!*unix_name) { + winbindd_free_response(&response); + return NT_STATUS_NO_MEMORY; + } + } + + winbindd_free_response(&response); + return nt_status; +} + +/* contact server to change user password using auth crap */ +static NTSTATUS contact_winbind_change_pswd_auth_crap(const char *username, + const char *domain, + const DATA_BLOB new_nt_pswd, + const DATA_BLOB old_nt_hash_enc, + const DATA_BLOB new_lm_pswd, + const DATA_BLOB old_lm_hash_enc, + char **error_string) +{ + NTSTATUS nt_status; + wbcErr ret; + struct winbindd_request request; + struct winbindd_response response; + + if (!get_require_membership_sid()) + { + if(error_string) + *error_string = smb_xstrdup("Can't get membership sid."); + return NT_STATUS_INVALID_PARAMETER; + } + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + if(username != NULL) + fstrcpy(request.data.chng_pswd_auth_crap.user, username); + if(domain != NULL) + fstrcpy(request.data.chng_pswd_auth_crap.domain,domain); + + if(new_nt_pswd.length) + { + memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd, new_nt_pswd.data, sizeof(request.data.chng_pswd_auth_crap.new_nt_pswd)); + request.data.chng_pswd_auth_crap.new_nt_pswd_len = new_nt_pswd.length; + } + + if(old_nt_hash_enc.length) + { + memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc, old_nt_hash_enc.data, sizeof(request.data.chng_pswd_auth_crap.old_nt_hash_enc)); + request.data.chng_pswd_auth_crap.old_nt_hash_enc_len = old_nt_hash_enc.length; + } + + if(new_lm_pswd.length) + { + memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd, new_lm_pswd.data, sizeof(request.data.chng_pswd_auth_crap.new_lm_pswd)); + request.data.chng_pswd_auth_crap.new_lm_pswd_len = new_lm_pswd.length; + } + + if(old_lm_hash_enc.length) + { + memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc, old_lm_hash_enc.data, sizeof(request.data.chng_pswd_auth_crap.old_lm_hash_enc)); + request.data.chng_pswd_auth_crap.old_lm_hash_enc_len = old_lm_hash_enc.length; + } + + ret = wbcRequestResponse(NULL, WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, + &request, &response); + + /* Display response */ + + if (!WBC_ERROR_IS_OK(ret) && (response.data.auth.nt_status == 0)) + { + nt_status = NT_STATUS_UNSUCCESSFUL; + if (error_string) + *error_string = smb_xstrdup("Reading winbind reply failed!"); + winbindd_free_response(&response); + return nt_status; + } + + nt_status = (NT_STATUS(response.data.auth.nt_status)); + if (!NT_STATUS_IS_OK(nt_status)) + { + if (error_string) + *error_string = smb_xstrdup(response.data.auth.error_string); + winbindd_free_response(&response); + return nt_status; + } + + winbindd_free_response(&response); + + return nt_status; +} + +/* + * This function does not create a full auth_session_info, just enough + * for the caller to get the "unix" username + */ +static NTSTATUS ntlm_auth_generate_session_info(struct auth4_context *auth_context, + TALLOC_CTX *mem_ctx, + void *server_returned_info, + const char *original_user_name, + uint32_t session_info_flags, + struct auth_session_info **session_info_out) +{ + const char *unix_username = (const char *)server_returned_info; + struct dom_sid *sids = NULL; + struct auth_session_info *session_info = NULL; + + session_info = talloc_zero(mem_ctx, struct auth_session_info); + if (session_info == NULL) { + return NT_STATUS_NO_MEMORY; + } + + session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix); + if (session_info->unix_info == NULL) { + TALLOC_FREE(session_info); + return NT_STATUS_NO_MEMORY; + } + session_info->unix_info->unix_name = talloc_strdup(session_info->unix_info, + unix_username); + if (session_info->unix_info->unix_name == NULL) { + TALLOC_FREE(session_info); + return NT_STATUS_NO_MEMORY; + } + + /* + * This is not a full session_info - it is not created + * correctly and misses any claims etc, because all we + * actually use in the caller is the unix username. + * + * Therefore so no claims need to be added and + * se_access_check() will never run. + */ + session_info->security_token + = security_token_initialise(talloc_tos(), + CLAIMS_EVALUATION_INVALID_STATE); + if (session_info->security_token == NULL) { + TALLOC_FREE(session_info); + return NT_STATUS_NO_MEMORY; + } + + sids = talloc_zero_array(session_info->security_token, + struct dom_sid, 3); + if (sids == NULL) { + TALLOC_FREE(session_info); + return NT_STATUS_NO_MEMORY; + } + sid_copy(&sids[0], &global_sid_World); + sid_copy(&sids[1], &global_sid_Network); + sid_copy(&sids[2], &global_sid_Authenticated_Users); + + session_info->security_token->num_sids = talloc_array_length(sids); + session_info->security_token->sids = sids; + + *session_info_out = session_info; + + return NT_STATUS_OK; +} + +static NTSTATUS ntlm_auth_generate_session_info_pac(struct auth4_context *auth_ctx, + TALLOC_CTX *mem_ctx, + struct smb_krb5_context *smb_krb5_context, + DATA_BLOB *pac_blob, + const char *princ_name, + const struct tsocket_address *remote_address, + uint32_t session_info_flags, + struct auth_session_info **session_info) +{ + TALLOC_CTX *tmp_ctx; + struct PAC_LOGON_INFO *logon_info = NULL; + char *unixuser; + NTSTATUS status; + const char *domain = ""; + const char *user = ""; + + tmp_ctx = talloc_new(mem_ctx); + if (!tmp_ctx) { + return NT_STATUS_NO_MEMORY; + } + + if (pac_blob) { +#ifdef HAVE_KRB5 + status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL, + NULL, NULL, 0, &logon_info); +#else + status = NT_STATUS_ACCESS_DENIED; +#endif + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + } else { + status = NT_STATUS_ACCESS_DENIED; + DBG_WARNING("Kerberos ticket for[%s] has no PAC: %s\n", + princ_name, nt_errstr(status)); + goto done; + } + + if (logon_info->info3.base.account_name.string != NULL) { + user = logon_info->info3.base.account_name.string; + } else { + user = ""; + } + if (logon_info->info3.base.logon_domain.string != NULL) { + domain = logon_info->info3.base.logon_domain.string; + } else { + domain = ""; + } + + if (strlen(user) == 0 || strlen(domain) == 0) { + status = NT_STATUS_ACCESS_DENIED; + DBG_WARNING("Kerberos ticket for[%s] has invalid " + "account_name[%s]/logon_domain[%s]: %s\n", + princ_name, + logon_info->info3.base.account_name.string, + logon_info->info3.base.logon_domain.string, + nt_errstr(status)); + goto done; + } + + DBG_NOTICE("Kerberos ticket principal name is [%s] " + "account_name[%s]/logon_domain[%s]\n", + princ_name, user, domain); + + if (!strequal(domain, lp_workgroup())) { + if (!lp_allow_trusted_domains()) { + status = NT_STATUS_LOGON_FAILURE; + goto done; + } + } + + unixuser = talloc_asprintf(tmp_ctx, "%s%c%s", domain, winbind_separator(), user); + if (!unixuser) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + + status = ntlm_auth_generate_session_info(auth_ctx, mem_ctx, unixuser, NULL, session_info_flags, session_info); + +done: + TALLOC_FREE(tmp_ctx); + return status; +} + + + +/** + * Return the challenge as determined by the authentication subsystem + * @return an 8 byte random challenge + */ + +static NTSTATUS ntlm_auth_get_challenge(struct auth4_context *auth_ctx, + uint8_t chal[8]) +{ + if (auth_ctx->challenge.data.length == 8) { + DEBUG(5, ("auth_get_challenge: returning previous challenge by module %s (normal)\n", + auth_ctx->challenge.set_by)); + memcpy(chal, auth_ctx->challenge.data.data, 8); + return NT_STATUS_OK; + } + + if (!auth_ctx->challenge.set_by) { + generate_random_buffer(chal, 8); + + auth_ctx->challenge.data = data_blob_talloc(auth_ctx, chal, 8); + NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data); + auth_ctx->challenge.set_by = "random"; + } + + DEBUG(10,("auth_get_challenge: challenge set by %s\n", + auth_ctx->challenge.set_by)); + + return NT_STATUS_OK; +} + +/** + * NTLM2 authentication modifies the effective challenge, + * @param challenge The new challenge value + */ +static NTSTATUS ntlm_auth_set_challenge(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by) +{ + auth_ctx->challenge.set_by = talloc_strdup(auth_ctx, set_by); + NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.set_by); + + auth_ctx->challenge.data = data_blob_talloc(auth_ctx, chal, 8); + NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data); + + return NT_STATUS_OK; +} + +/** + * Check the password on an NTLMSSP login. + * + * Return the session keys used on the connection. + */ + +struct winbind_pw_check_state { + uint8_t authoritative; + void *server_info; + DATA_BLOB nt_session_key; + DATA_BLOB lm_session_key; +}; + +static struct tevent_req *winbind_pw_check_send( + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct auth4_context *auth4_context, + const struct auth_usersupplied_info *user_info) +{ + struct tevent_req *req = NULL; + struct winbind_pw_check_state *state = NULL; + NTSTATUS nt_status; + char *error_string = NULL; + uint8_t lm_key[8]; + uint8_t user_sess_key[16]; + char *unix_name = NULL; + + req = tevent_req_create( + mem_ctx, &state, struct winbind_pw_check_state); + if (req == NULL) { + return NULL; + } + + nt_status = contact_winbind_auth_crap( + user_info->client.account_name, + user_info->client.domain_name, + user_info->workstation_name, + &auth4_context->challenge.data, + &user_info->password.response.lanman, + &user_info->password.response.nt, + WBFLAG_PAM_LMKEY | + WBFLAG_PAM_USER_SESSION_KEY | + WBFLAG_PAM_UNIX_NAME, + 0, + lm_key, user_sess_key, + &state->authoritative, + &error_string, + &unix_name); + + if (tevent_req_nterror(req, nt_status)) { + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) { + DBG_ERR("Login for user [%s]\\[%s]@[%s] failed due " + "to [%s]\n", + user_info->client.domain_name, + user_info->client.account_name, + user_info->workstation_name, + error_string ? + error_string : + "unknown error (NULL)"); + } else { + DBG_NOTICE("Login for user [%s]\\[%s]@[%s] failed due " + "to [%s]\n", + user_info->client.domain_name, + user_info->client.account_name, + user_info->workstation_name, + error_string ? + error_string : + "unknown error (NULL)"); + } + goto done; + } + + if (!all_zero(lm_key, 8)) { + state->lm_session_key = data_blob_talloc(state, NULL, 16); + if (tevent_req_nomem(state->lm_session_key.data, req)) { + goto done; + } + memcpy(state->lm_session_key.data, lm_key, 8); + memset(state->lm_session_key.data+8, '\0', 8); + } + if (!all_zero(user_sess_key, 16)) { + state->nt_session_key = data_blob_talloc( + state, user_sess_key, 16); + if (tevent_req_nomem(state->nt_session_key.data, req)) { + goto done; + } + } + state->server_info = talloc_strdup(state, unix_name); + if (tevent_req_nomem(state->server_info, req)) { + goto done; + } + tevent_req_done(req); + +done: + SAFE_FREE(error_string); + SAFE_FREE(unix_name); + return tevent_req_post(req, ev); +} + +static NTSTATUS winbind_pw_check_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + uint8_t *pauthoritative, + void **server_returned_info, + DATA_BLOB *nt_session_key, + DATA_BLOB *lm_session_key) +{ + struct winbind_pw_check_state *state = tevent_req_data( + req, struct winbind_pw_check_state); + NTSTATUS status; + + if (pauthoritative != NULL) { + *pauthoritative = state->authoritative; + } + + if (tevent_req_is_nterror(req, &status)) { + return status; + } + + if (server_returned_info != NULL) { + *server_returned_info = talloc_move( + mem_ctx, &state->server_info); + } + if (nt_session_key != NULL) { + *nt_session_key = (DATA_BLOB) { + .data = talloc_move( + mem_ctx, &state->nt_session_key.data), + .length = state->nt_session_key.length, + }; + } + if (lm_session_key != NULL) { + *lm_session_key = (DATA_BLOB) { + .data = talloc_move( + mem_ctx, &state->lm_session_key.data), + .length = state->lm_session_key.length, + }; + } + + return NT_STATUS_OK; +} + +struct local_pw_check_state { + uint8_t authoritative; + void *server_info; + DATA_BLOB nt_session_key; + DATA_BLOB lm_session_key; +}; + +static struct tevent_req *local_pw_check_send( + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct auth4_context *auth4_context, + const struct auth_usersupplied_info *user_info) +{ + struct tevent_req *req = NULL; + struct local_pw_check_state *state = NULL; + struct samr_Password lm_pw, nt_pw; + NTSTATUS nt_status; + + req = tevent_req_create( + mem_ctx, &state, struct local_pw_check_state); + if (req == NULL) { + return NULL; + } + state->authoritative = 1; + + nt_lm_owf_gen (opt_password, nt_pw.hash, lm_pw.hash); + + nt_status = ntlm_password_check( + state, + true, + NTLM_AUTH_ON, + 0, + &auth4_context->challenge.data, + &user_info->password.response.lanman, + &user_info->password.response.nt, + user_info->client.account_name, + user_info->client.account_name, + user_info->client.domain_name, + &lm_pw, + &nt_pw, + &state->nt_session_key, + &state->lm_session_key); + + if (tevent_req_nterror(req, nt_status)) { + DBG_NOTICE("Login for user [%s]\\[%s]@[%s] failed due to " + "[%s]\n", + user_info->client.domain_name, + user_info->client.account_name, + user_info->workstation_name, + nt_errstr(nt_status)); + return tevent_req_post(req, ev); + } + + state->server_info = talloc_asprintf( + state, + "%s%c%s", + user_info->client.domain_name, + *lp_winbind_separator(), + user_info->client.account_name); + if (tevent_req_nomem(state->server_info, req)) { + return tevent_req_post(req, ev); + } + + tevent_req_done(req); + return tevent_req_post(req, ev); +} + +static NTSTATUS local_pw_check_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + uint8_t *pauthoritative, + void **server_returned_info, + DATA_BLOB *nt_session_key, + DATA_BLOB *lm_session_key) +{ + struct local_pw_check_state *state = tevent_req_data( + req, struct local_pw_check_state); + NTSTATUS status; + + if (pauthoritative != NULL) { + *pauthoritative = state->authoritative; + } + + if (tevent_req_is_nterror(req, &status)) { + return status; + } + + if (server_returned_info != NULL) { + *server_returned_info = talloc_move( + mem_ctx, &state->server_info); + } + if (nt_session_key != NULL) { + *nt_session_key = (DATA_BLOB) { + .data = talloc_move( + mem_ctx, &state->nt_session_key.data), + .length = state->nt_session_key.length, + }; + } + if (lm_session_key != NULL) { + *lm_session_key = (DATA_BLOB) { + .data = talloc_move( + mem_ctx, &state->lm_session_key.data), + .length = state->lm_session_key.length, + }; + } + + return NT_STATUS_OK; +} + +static NTSTATUS ntlm_auth_prepare_gensec_client(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx, + struct gensec_security **gensec_security_out) +{ + struct gensec_security *gensec_security = NULL; + NTSTATUS nt_status; + TALLOC_CTX *tmp_ctx; + const struct gensec_security_ops **backends = NULL; + struct gensec_settings *gensec_settings = NULL; + size_t idx = 0; + + tmp_ctx = talloc_new(mem_ctx); + NT_STATUS_HAVE_NO_MEMORY(tmp_ctx); + + gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx); + if (gensec_settings == NULL) { + DEBUG(10, ("lpcfg_gensec_settings failed\n")); + TALLOC_FREE(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + backends = talloc_zero_array(gensec_settings, + const struct gensec_security_ops *, 4); + if (backends == NULL) { + TALLOC_FREE(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + gensec_settings->backends = backends; + + gensec_init(); + + /* These need to be in priority order, krb5 before NTLMSSP */ +#if defined(HAVE_KRB5) + backends[idx++] = &gensec_gse_krb5_security_ops; +#endif + + backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP); + + backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO); + + nt_status = gensec_client_start(NULL, &gensec_security, + gensec_settings); + if (!NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(tmp_ctx); + return nt_status; + } + + talloc_unlink(tmp_ctx, gensec_settings); + + if (opt_target_service != NULL) { + nt_status = gensec_set_target_service(gensec_security, + opt_target_service); + if (!NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(tmp_ctx); + return nt_status; + } + } + + if (opt_target_hostname != NULL) { + nt_status = gensec_set_target_hostname(gensec_security, + opt_target_hostname); + if (!NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(tmp_ctx); + return nt_status; + } + } + + *gensec_security_out = talloc_steal(mem_ctx, gensec_security); + TALLOC_FREE(tmp_ctx); + return NT_STATUS_OK; +} + +static struct auth4_context *make_auth4_context_ntlm_auth(TALLOC_CTX *mem_ctx, bool local_pw) +{ + struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context); + if (auth4_context == NULL) { + DEBUG(10, ("failed to allocate auth4_context\n")); + return NULL; + } + auth4_context->generate_session_info = ntlm_auth_generate_session_info; + auth4_context->generate_session_info_pac = ntlm_auth_generate_session_info_pac; + auth4_context->get_ntlm_challenge = ntlm_auth_get_challenge; + auth4_context->set_ntlm_challenge = ntlm_auth_set_challenge; + if (local_pw) { + auth4_context->check_ntlm_password_send = local_pw_check_send; + auth4_context->check_ntlm_password_recv = local_pw_check_recv; + } else { + auth4_context->check_ntlm_password_send = + winbind_pw_check_send; + auth4_context->check_ntlm_password_recv = + winbind_pw_check_recv; + } + auth4_context->private_data = NULL; + return auth4_context; +} + +static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx, + struct gensec_security **gensec_security_out) +{ + struct gensec_security *gensec_security; + NTSTATUS nt_status; + + TALLOC_CTX *tmp_ctx; + const struct gensec_security_ops **backends; + struct gensec_settings *gensec_settings; + size_t idx = 0; + struct cli_credentials *server_credentials; + + struct auth4_context *auth4_context; + + tmp_ctx = talloc_new(mem_ctx); + NT_STATUS_HAVE_NO_MEMORY(tmp_ctx); + + auth4_context = make_auth4_context_ntlm_auth(tmp_ctx, opt_password); + if (auth4_context == NULL) { + TALLOC_FREE(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx); + if (lp_ctx == NULL) { + DEBUG(10, ("lpcfg_gensec_settings failed\n")); + TALLOC_FREE(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + /* + * This should be a 'netbios domain -> DNS domain' + * mapping, and can currently validly return NULL on + * poorly configured systems. + * + * This is used for the NTLMSSP server + * + */ + if (opt_password) { + gensec_settings->server_netbios_name = lp_netbios_name(); + gensec_settings->server_netbios_domain = lp_workgroup(); + } else { + gensec_settings->server_netbios_name = get_winbind_netbios_name(); + gensec_settings->server_netbios_domain = get_winbind_domain(); + } + + gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, + get_mydnsdomname(talloc_tos())); + gensec_settings->server_dns_name = strlower_talloc(gensec_settings, + get_mydnsfullname()); + + backends = talloc_zero_array(gensec_settings, + const struct gensec_security_ops *, 4); + + if (backends == NULL) { + TALLOC_FREE(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + gensec_settings->backends = backends; + + gensec_init(); + + /* These need to be in priority order, krb5 before NTLMSSP */ +#if defined(HAVE_KRB5) + backends[idx++] = &gensec_gse_krb5_security_ops; +#endif + + backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP); + + backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO); + + /* + * This is anonymous for now, because we just use it + * to set the kerberos state at the moment + */ + server_credentials = cli_credentials_init_anon(tmp_ctx); + if (!server_credentials) { + DBG_ERR("Failed to init server credentials\n"); + return NT_STATUS_NO_MEMORY; + } + + cli_credentials_set_conf(server_credentials, lp_ctx); + + if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { + cli_credentials_set_kerberos_state(server_credentials, + CRED_USE_KERBEROS_DESIRED, + CRED_SPECIFIED); + } else { + cli_credentials_set_kerberos_state(server_credentials, + CRED_USE_KERBEROS_DISABLED, + CRED_SPECIFIED); + } + + nt_status = gensec_server_start(tmp_ctx, gensec_settings, + auth4_context, &gensec_security); + + if (!NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(tmp_ctx); + return nt_status; + } + + gensec_set_credentials(gensec_security, server_credentials); + + /* + * TODO: Allow the caller to pass their own description here + * via a command-line option + */ + nt_status = gensec_set_target_service_description(gensec_security, + "ntlm_auth"); + if (!NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(tmp_ctx); + return nt_status; + } + + talloc_unlink(tmp_ctx, lp_ctx); + talloc_unlink(tmp_ctx, server_credentials); + talloc_unlink(tmp_ctx, gensec_settings); + talloc_unlink(tmp_ctx, auth4_context); + + *gensec_security_out = talloc_steal(mem_ctx, gensec_security); + TALLOC_FREE(tmp_ctx); + return NT_STATUS_OK; +} + +static void manage_client_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1); + return; +} + +static void manage_squid_basic_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + char *user, *pass; + user=buf; + + pass=(char *)memchr(buf,' ',length); + if (!pass) { + DEBUG(2, ("Password not found. Denying access\n")); + printf("ERR\n"); + return; + } + *pass='\0'; + pass++; + + if (state->helper_mode == SQUID_2_5_BASIC) { + char *end = rfc1738_unescape(user); + if (end == NULL || (end - user) != strlen(user)) { + DEBUG(2, ("Badly rfc1738 encoded username: %s; " + "denying access\n", user)); + printf("ERR\n"); + return; + } + end = rfc1738_unescape(pass); + if (end == NULL || (end - pass) != strlen(pass)) { + DEBUG(2, ("Badly encoded password for %s; " + "denying access\n", user)); + printf("ERR\n"); + return; + } + } + + if (check_plaintext_auth(user, pass, False)) { + printf("OK\n"); + } else { + printf("ERR\n"); + } +} + +static void manage_gensec_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + char *buf, int length, void **private1) +{ + DATA_BLOB in; + DATA_BLOB out = data_blob(NULL, 0); + char *out_base64 = NULL; + const char *reply_arg = NULL; + struct gensec_ntlm_state { + struct gensec_security *gensec_state; + const char *set_password; + }; + struct gensec_ntlm_state *state; + + NTSTATUS nt_status; + bool first = false; + const char *reply_code; + struct cli_credentials *creds; + + static char *want_feature_list = NULL; + static DATA_BLOB session_key; + + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_named(NULL, 0, "manage_gensec_request internal mem_ctx"); + if (mem_ctx == NULL) { + printf("BH No Memory\n"); + exit(1); + } + + if (*private1) { + state = talloc_get_type(*private1, struct gensec_ntlm_state); + if (state == NULL) { + DBG_WARNING("*private1 is of type %s\n", + talloc_get_name(*private1)); + printf("BH *private1 is of type %s\n", + talloc_get_name(*private1)); + exit(1); + } + } else { + state = talloc_zero(NULL, struct gensec_ntlm_state); + if (!state) { + printf("BH No Memory\n"); + exit(1); + } + *private1 = state; + if (opt_password) { + state->set_password = opt_password; + } + } + + if (strlen(buf) < 2) { + DEBUG(1, ("query [%s] invalid\n", buf)); + printf("BH Query invalid\n"); + talloc_free(mem_ctx); + return; + } + + if (strlen(buf) > 3) { + if(strncmp(buf, "SF ", 3) == 0) { + DEBUG(10, ("Setting flags to negotiate\n")); + talloc_free(want_feature_list); + want_feature_list = talloc_strndup(state, buf+3, strlen(buf)-3); + printf("OK\n"); + talloc_free(mem_ctx); + return; + } + in = base64_decode_data_blob_talloc(mem_ctx, buf + 3); + } else { + in = data_blob(NULL, 0); + } + + if (strncmp(buf, "YR", 2) == 0) { + if (state->gensec_state) { + talloc_free(state->gensec_state); + state->gensec_state = NULL; + } + } else if ( (strncmp(buf, "OK", 2) == 0)) { + /* Just return BH, like ntlm_auth from Samba 3 does. */ + printf("BH Command expected\n"); + talloc_free(mem_ctx); + return; + } else if ( (strncmp(buf, "TT ", 3) != 0) && + (strncmp(buf, "KK ", 3) != 0) && + (strncmp(buf, "AF ", 3) != 0) && + (strncmp(buf, "NA ", 3) != 0) && + (strncmp(buf, "UG", 2) != 0) && + (strncmp(buf, "PW ", 3) != 0) && + (strncmp(buf, "GK", 2) != 0) && + (strncmp(buf, "GF", 2) != 0)) { + DEBUG(1, ("SPNEGO request [%s] invalid prefix\n", buf)); + printf("BH SPNEGO request invalid prefix\n"); + talloc_free(mem_ctx); + return; + } + + /* setup gensec */ + if (!(state->gensec_state)) { + switch (stdio_helper_mode) { + case GSS_SPNEGO_CLIENT: + /* + * cached credentials are only supported by + * NTLMSSP_CLIENT_1 for now. + */ + use_cached_creds = false; + FALL_THROUGH; + case NTLMSSP_CLIENT_1: + /* setup the client side */ + + if (state->set_password != NULL) { + use_cached_creds = false; + } + + if (use_cached_creds) { + struct wbcCredentialCacheParams params; + struct wbcCredentialCacheInfo *info = NULL; + struct wbcAuthErrorInfo *error = NULL; + wbcErr wbc_status; + + params.account_name = opt_username; + params.domain_name = opt_domain; + params.level = WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP; + params.num_blobs = 0; + params.blobs = NULL; + + wbc_status = wbcCredentialCache(¶ms, &info, + &error); + wbcFreeMemory(error); + if (!WBC_ERROR_IS_OK(wbc_status)) { + use_cached_creds = false; + } + wbcFreeMemory(info); + } + + nt_status = ntlm_auth_prepare_gensec_client(state, lp_ctx, + &state->gensec_state); + if (!NT_STATUS_IS_OK(nt_status)) { + printf("BH GENSEC mech failed to start: %s\n", + nt_errstr(nt_status)); + talloc_free(mem_ctx); + return; + } + + creds = cli_credentials_init(state->gensec_state); + cli_credentials_set_conf(creds, lp_ctx); + if (opt_username) { + cli_credentials_set_username(creds, opt_username, CRED_SPECIFIED); + } + if (opt_domain) { + cli_credentials_set_domain(creds, opt_domain, CRED_SPECIFIED); + } + if (use_cached_creds) { + gensec_want_feature(state->gensec_state, + GENSEC_FEATURE_NTLM_CCACHE); + } else if (state->set_password) { + cli_credentials_set_password(creds, state->set_password, CRED_SPECIFIED); + } else { + cli_credentials_set_password_callback(creds, get_password); + } + if (opt_workstation) { + cli_credentials_set_workstation(creds, opt_workstation, CRED_SPECIFIED); + } + + gensec_set_credentials(state->gensec_state, creds); + + break; + case GSS_SPNEGO_SERVER: + case SQUID_2_5_NTLMSSP: + { + nt_status = ntlm_auth_prepare_gensec_server(state, lp_ctx, + &state->gensec_state); + if (!NT_STATUS_IS_OK(nt_status)) { + printf("BH GENSEC mech failed to start: %s\n", + nt_errstr(nt_status)); + talloc_free(mem_ctx); + return; + } + break; + } + default: + talloc_free(mem_ctx); + abort(); + } + + gensec_want_feature_list(state->gensec_state, want_feature_list); + + /* Session info is not complete, do not pass to auth log */ + gensec_want_feature(state->gensec_state, GENSEC_FEATURE_NO_AUTHZ_LOG); + + switch (stdio_helper_mode) { + case GSS_SPNEGO_CLIENT: + case GSS_SPNEGO_SERVER: + nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_SPNEGO); + if (!in.length) { + first = true; + } + break; + case NTLMSSP_CLIENT_1: + if (!in.length) { + first = true; + } + FALL_THROUGH; + case SQUID_2_5_NTLMSSP: + nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_NTLMSSP); + break; + default: + talloc_free(mem_ctx); + abort(); + } + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(1, ("GENSEC mech failed to start: %s\n", nt_errstr(nt_status))); + printf("BH GENSEC mech failed to start\n"); + talloc_free(mem_ctx); + return; + } + + } + + /* update */ + + if (strncmp(buf, "PW ", 3) == 0) { + state->set_password = talloc_strndup(state, + (const char *)in.data, + in.length); + + cli_credentials_set_password(gensec_get_credentials(state->gensec_state), + state->set_password, + CRED_SPECIFIED); + printf("OK\n"); + talloc_free(mem_ctx); + return; + } + + if (strncmp(buf, "GK", 2) == 0) { + char *base64_key; + DEBUG(10, ("Requested session key\n")); + nt_status = gensec_session_key(state->gensec_state, mem_ctx, &session_key); + if(!NT_STATUS_IS_OK(nt_status)) { + DEBUG(1, ("gensec_session_key failed: %s\n", nt_errstr(nt_status))); + printf("BH No session key\n"); + talloc_free(mem_ctx); + return; + } else { + base64_key = base64_encode_data_blob(state, session_key); + SMB_ASSERT(base64_key != NULL); + printf("GK %s\n", base64_key); + talloc_free(base64_key); + } + talloc_free(mem_ctx); + return; + } + + if (strncmp(buf, "GF", 2) == 0) { + uint32_t neg_flags; + + DEBUG(10, ("Requested negotiated NTLMSSP feature flags\n")); + + neg_flags = gensec_ntlmssp_neg_flags(state->gensec_state); + if (neg_flags == 0) { + printf("BH\n"); + talloc_free(mem_ctx); + return; + } + + printf("GF 0x%08x\n", neg_flags); + talloc_free(mem_ctx); + return; + } + + nt_status = gensec_update(state->gensec_state, mem_ctx, in, &out); + + /* don't leak 'bad password'/'no such user' info to the network client */ + nt_status = nt_status_squash(nt_status); + + if (out.length) { + out_base64 = base64_encode_data_blob(mem_ctx, out); + SMB_ASSERT(out_base64 != NULL); + } else { + out_base64 = NULL; + } + + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + reply_arg = "*"; + if (first && state->gensec_state->gensec_role == GENSEC_CLIENT) { + reply_code = "YR"; + } else if (state->gensec_state->gensec_role == GENSEC_CLIENT) { + reply_code = "KK"; + } else if (state->gensec_state->gensec_role == GENSEC_SERVER) { + reply_code = "TT"; + } else { + abort(); + } + + + } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) { + reply_code = "BH NT_STATUS_ACCESS_DENIED"; + reply_arg = nt_errstr(nt_status); + DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status))); + } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_UNSUCCESSFUL)) { + reply_code = "BH NT_STATUS_UNSUCCESSFUL"; + reply_arg = nt_errstr(nt_status); + DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status))); + } else if (!NT_STATUS_IS_OK(nt_status)) { + reply_code = "NA"; + reply_arg = nt_errstr(nt_status); + DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status))); + } else if /* OK */ (state->gensec_state->gensec_role == GENSEC_SERVER) { + struct auth_session_info *session_info; + + nt_status = gensec_session_info(state->gensec_state, mem_ctx, &session_info); + if (!NT_STATUS_IS_OK(nt_status)) { + reply_code = "BH Failed to retrieve session info"; + reply_arg = nt_errstr(nt_status); + DEBUG(1, ("GENSEC failed to retrieve the session info: %s\n", nt_errstr(nt_status))); + } else { + + reply_code = "AF"; + reply_arg = talloc_strdup(state->gensec_state, session_info->unix_info->unix_name); + if (reply_arg == NULL) { + reply_code = "BH out of memory"; + reply_arg = nt_errstr(NT_STATUS_NO_MEMORY); + } + talloc_free(session_info); + } + } else if (state->gensec_state->gensec_role == GENSEC_CLIENT) { + reply_code = "AF"; + reply_arg = out_base64; + } else { + abort(); + } + + switch (stdio_helper_mode) { + case GSS_SPNEGO_SERVER: + printf("%s %s %s\n", reply_code, + out_base64 ? out_base64 : "*", + reply_arg ? reply_arg : "*"); + break; + default: + if (out_base64) { + printf("%s %s\n", reply_code, out_base64); + } else if (reply_arg) { + printf("%s %s\n", reply_code, reply_arg); + } else { + printf("%s\n", reply_code); + } + } + + talloc_free(mem_ctx); + return; +} + +static void manage_gss_spnego_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1); + return; +} + +static void manage_squid_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1); + return; +} + +static void manage_gss_spnego_client_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1); + return; +} + +static void manage_ntlm_server_1_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + char *request, *parameter; + static DATA_BLOB challenge; + static DATA_BLOB lm_response; + static DATA_BLOB nt_response; + static char *full_username; + static char *username; + static char *domain; + static char *plaintext_password; + static bool ntlm_server_1_user_session_key; + static bool ntlm_server_1_lm_session_key; + + if (strequal(buf, ".")) { + if (!full_username && !username) { + printf("Error: No username supplied!\n"); + } else if (plaintext_password) { + /* handle this request as plaintext */ + if (!full_username) { + if (asprintf(&full_username, "%s%c%s", domain, winbind_separator(), username) == -1) { + printf("Error: Out of memory in " + "asprintf!\n.\n"); + return; + } + } + if (check_plaintext_auth(full_username, plaintext_password, False)) { + printf("Authenticated: Yes\n"); + } else { + printf("Authenticated: No\n"); + } + } else if (!lm_response.data && !nt_response.data) { + printf("Error: No password supplied!\n"); + } else if (!challenge.data) { + printf("Error: No lanman-challenge supplied!\n"); + } else { + char *error_string = NULL; + uchar lm_key[8]; + uchar user_session_key[16]; + uint32_t flags = 0; + NTSTATUS nt_status; + if (full_username && !username) { + fstring fstr_user; + fstring fstr_domain; + + if (!parse_ntlm_auth_domain_user(full_username, fstr_user, fstr_domain)) { + /* username might be 'tainted', don't print into our new-line deleimianted stream */ + printf("Error: Could not parse into " + "domain and username\n"); + } + SAFE_FREE(username); + SAFE_FREE(domain); + username = smb_xstrdup(fstr_user); + domain = smb_xstrdup(fstr_domain); + } + + if (opt_password) { + DATA_BLOB nt_session_key, lm_session_key; + struct samr_Password lm_pw, nt_pw; + TALLOC_CTX *mem_ctx = talloc_new(NULL); + ZERO_STRUCT(user_session_key); + ZERO_STRUCT(lm_key); + + nt_lm_owf_gen (opt_password, nt_pw.hash, lm_pw.hash); + nt_status = ntlm_password_check(mem_ctx, + true, + NTLM_AUTH_ON, + 0, + &challenge, + &lm_response, + &nt_response, + username, + username, + domain, + &lm_pw, &nt_pw, + &nt_session_key, + &lm_session_key); + error_string = smb_xstrdup(get_friendly_nt_error_msg(nt_status)); + if (ntlm_server_1_user_session_key) { + if (nt_session_key.length == sizeof(user_session_key)) { + memcpy(user_session_key, + nt_session_key.data, + sizeof(user_session_key)); + } + } + if (ntlm_server_1_lm_session_key) { + if (lm_session_key.length == sizeof(lm_key)) { + memcpy(lm_key, + lm_session_key.data, + sizeof(lm_key)); + } + } + TALLOC_FREE(mem_ctx); + + } else { + uint8_t authoritative = 1; + + if (!domain) { + domain = smb_xstrdup(get_winbind_domain()); + } + + if (ntlm_server_1_lm_session_key) + flags |= WBFLAG_PAM_LMKEY; + + if (ntlm_server_1_user_session_key) + flags |= WBFLAG_PAM_USER_SESSION_KEY; + + nt_status = contact_winbind_auth_crap(username, + domain, + lp_netbios_name(), + &challenge, + &lm_response, + &nt_response, + flags, 0, + lm_key, + user_session_key, + &authoritative, + &error_string, + NULL); + } + + if (!NT_STATUS_IS_OK(nt_status)) { + printf("Authenticated: No\n"); + printf("Authentication-Error: %s\n.\n", + error_string); + } else { + char *hex_lm_key; + char *hex_user_session_key; + + printf("Authenticated: Yes\n"); + + if (ntlm_server_1_lm_session_key + && (!all_zero(lm_key, + sizeof(lm_key)))) { + hex_lm_key = hex_encode_talloc(NULL, + (const unsigned char *)lm_key, + sizeof(lm_key)); + printf("LANMAN-Session-Key: %s\n", + hex_lm_key); + TALLOC_FREE(hex_lm_key); + } + + if (ntlm_server_1_user_session_key + && (!all_zero(user_session_key, + sizeof(user_session_key)))) { + hex_user_session_key = hex_encode_talloc(NULL, + (const unsigned char *)user_session_key, + sizeof(user_session_key)); + printf("User-Session-Key: %s\n", + hex_user_session_key); + TALLOC_FREE(hex_user_session_key); + } + } + SAFE_FREE(error_string); + } + /* clear out the state */ + challenge = data_blob_null; + nt_response = data_blob_null; + lm_response = data_blob_null; + SAFE_FREE(full_username); + SAFE_FREE(username); + SAFE_FREE(domain); + SAFE_FREE(plaintext_password); + ntlm_server_1_user_session_key = False; + ntlm_server_1_lm_session_key = False; + printf(".\n"); + + return; + } + + request = buf; + + /* Indicates a base64 encoded structure */ + parameter = strstr_m(request, ":: "); + if (!parameter) { + parameter = strstr_m(request, ": "); + + if (!parameter) { + DEBUG(0, ("Parameter not found!\n")); + printf("Error: Parameter not found!\n.\n"); + return; + } + + parameter[0] ='\0'; + parameter++; + parameter[0] ='\0'; + parameter++; + + } else { + parameter[0] ='\0'; + parameter++; + parameter[0] ='\0'; + parameter++; + parameter[0] ='\0'; + parameter++; + + base64_decode_inplace(parameter); + } + + if (strequal(request, "LANMAN-Challenge")) { + challenge = strhex_to_data_blob(NULL, parameter); + if (challenge.length != 8) { + printf("Error: hex decode of %s failed! " + "(got %d bytes, expected 8)\n.\n", + parameter, + (int)challenge.length); + challenge = data_blob_null; + } + } else if (strequal(request, "NT-Response")) { + nt_response = strhex_to_data_blob(NULL, parameter); + if (nt_response.length < 24) { + printf("Error: hex decode of %s failed! " + "(only got %d bytes, needed at least 24)\n.\n", + parameter, + (int)nt_response.length); + nt_response = data_blob_null; + } + } else if (strequal(request, "LANMAN-Response")) { + lm_response = strhex_to_data_blob(NULL, parameter); + if (lm_response.length != 24) { + printf("Error: hex decode of %s failed! " + "(got %d bytes, expected 24)\n.\n", + parameter, + (int)lm_response.length); + lm_response = data_blob_null; + } + } else if (strequal(request, "Password")) { + plaintext_password = smb_xstrdup(parameter); + } else if (strequal(request, "NT-Domain")) { + domain = smb_xstrdup(parameter); + } else if (strequal(request, "Username")) { + username = smb_xstrdup(parameter); + } else if (strequal(request, "Full-Username")) { + full_username = smb_xstrdup(parameter); + } else if (strequal(request, "Request-User-Session-Key")) { + ntlm_server_1_user_session_key = strequal(parameter, "Yes"); + } else if (strequal(request, "Request-LanMan-Session-Key")) { + ntlm_server_1_lm_session_key = strequal(parameter, "Yes"); + } else { + printf("Error: Unknown request %s\n.\n", request); + } +} + +static void manage_ntlm_change_password_1_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + char *buf, int length, void **private2) +{ + char *request, *parameter; + static DATA_BLOB new_nt_pswd; + static DATA_BLOB old_nt_hash_enc; + static DATA_BLOB new_lm_pswd; + static DATA_BLOB old_lm_hash_enc; + static char *full_username = NULL; + static char *username = NULL; + static char *domain = NULL; + static char *newpswd = NULL; + static char *oldpswd = NULL; + + if (strequal(buf, ".")) { + if(newpswd && oldpswd) { + uchar old_nt_hash[16]; + uchar old_lm_hash[16]; + uchar new_nt_hash[16]; + uchar new_lm_hash[16]; + + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t old_nt_key = { + .data = old_nt_hash, + .size = sizeof(old_nt_hash), + }; + int rc; + + new_nt_pswd = data_blob(NULL, 516); + old_nt_hash_enc = data_blob(NULL, 16); + + /* Calculate the MD4 hash (NT compatible) of the + * password */ + E_md4hash(oldpswd, old_nt_hash); + E_md4hash(newpswd, new_nt_hash); + + /* E_deshash returns false for 'long' + passwords (> 14 DOS chars). + + Therefore, don't send a buffer + encrypted with the truncated hash + (it could allow an even easier + attack on the password) + + Likewise, obey the admin's restriction + */ + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &old_nt_key, + NULL); + if (rc < 0) { + DBG_ERR("gnutls_cipher_init failed: %s\n", + gnutls_strerror(rc)); + if (rc == GNUTLS_E_UNWANTED_ALGORITHM) { + DBG_ERR("Running in FIPS mode, NTLM blocked\n"); + } + return; + } + + if (lp_client_lanman_auth() && + E_deshash(newpswd, new_lm_hash) && + E_deshash(oldpswd, old_lm_hash)) { + new_lm_pswd = data_blob(NULL, 516); + old_lm_hash_enc = data_blob(NULL, 16); + encode_pw_buffer(new_lm_pswd.data, newpswd, + STR_UNICODE); + + rc = gnutls_cipher_encrypt(cipher_hnd, + new_lm_pswd.data, + 516); + if (rc < 0) { + gnutls_cipher_deinit(cipher_hnd); + return; + } + rc = E_old_pw_hash(new_nt_hash, old_lm_hash, + old_lm_hash_enc.data); + if (rc != 0) { + DBG_ERR("E_old_pw_hash failed: %s\n", + gnutls_strerror(rc)); + return; + } + } else { + new_lm_pswd.data = NULL; + new_lm_pswd.length = 0; + old_lm_hash_enc.data = NULL; + old_lm_hash_enc.length = 0; + } + + encode_pw_buffer(new_nt_pswd.data, newpswd, + STR_UNICODE); + + rc = gnutls_cipher_encrypt(cipher_hnd, + new_nt_pswd.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + return; + } + rc = E_old_pw_hash(new_nt_hash, old_nt_hash, + old_nt_hash_enc.data); + if (rc != 0) { + DBG_ERR("E_old_pw_hash failed: %s\n", + gnutls_strerror(rc)); + return; + } + + ZERO_ARRAY(old_nt_hash); + ZERO_ARRAY(old_lm_hash); + ZERO_ARRAY(new_nt_hash); + ZERO_ARRAY(new_lm_hash); + } + + if (!full_username && !username) { + printf("Error: No username supplied!\n"); + } else if ((!new_nt_pswd.data || !old_nt_hash_enc.data) && + (!new_lm_pswd.data || old_lm_hash_enc.data) ) { + printf("Error: No NT or LM password " + "blobs supplied!\n"); + } else { + char *error_string = NULL; + + if (full_username && !username) { + fstring fstr_user; + fstring fstr_domain; + + if (!parse_ntlm_auth_domain_user(full_username, + fstr_user, + fstr_domain)) { + /* username might be 'tainted', don't + * print into our new-line + * deleimianted stream */ + printf("Error: Could not " + "parse into domain and " + "username\n"); + SAFE_FREE(username); + username = smb_xstrdup(full_username); + } else { + SAFE_FREE(username); + SAFE_FREE(domain); + username = smb_xstrdup(fstr_user); + domain = smb_xstrdup(fstr_domain); + } + + } + + if(!NT_STATUS_IS_OK(contact_winbind_change_pswd_auth_crap( + username, domain, + new_nt_pswd, + old_nt_hash_enc, + new_lm_pswd, + old_lm_hash_enc, + &error_string))) { + printf("Password-Change: No\n"); + printf("Password-Change-Error: %s\n.\n", + error_string); + } else { + printf("Password-Change: Yes\n"); + } + + SAFE_FREE(error_string); + } + /* clear out the state */ + new_nt_pswd = data_blob_null; + old_nt_hash_enc = data_blob_null; + new_lm_pswd = data_blob_null; + old_nt_hash_enc = data_blob_null; + SAFE_FREE(full_username); + SAFE_FREE(username); + SAFE_FREE(domain); + SAFE_FREE(newpswd); + SAFE_FREE(oldpswd); + printf(".\n"); + + return; + } + + request = buf; + + /* Indicates a base64 encoded structure */ + parameter = strstr_m(request, ":: "); + if (!parameter) { + parameter = strstr_m(request, ": "); + + if (!parameter) { + DEBUG(0, ("Parameter not found!\n")); + printf("Error: Parameter not found!\n.\n"); + return; + } + + parameter[0] ='\0'; + parameter++; + parameter[0] ='\0'; + parameter++; + } else { + parameter[0] ='\0'; + parameter++; + parameter[0] ='\0'; + parameter++; + parameter[0] ='\0'; + parameter++; + + base64_decode_inplace(parameter); + } + + if (strequal(request, "new-nt-password-blob")) { + new_nt_pswd = strhex_to_data_blob(NULL, parameter); + if (new_nt_pswd.length != 516) { + printf("Error: hex decode of %s failed! " + "(got %d bytes, expected 516)\n.\n", + parameter, + (int)new_nt_pswd.length); + new_nt_pswd = data_blob_null; + } + } else if (strequal(request, "old-nt-hash-blob")) { + old_nt_hash_enc = strhex_to_data_blob(NULL, parameter); + if (old_nt_hash_enc.length != 16) { + printf("Error: hex decode of %s failed! " + "(got %d bytes, expected 16)\n.\n", + parameter, + (int)old_nt_hash_enc.length); + old_nt_hash_enc = data_blob_null; + } + } else if (strequal(request, "new-lm-password-blob")) { + new_lm_pswd = strhex_to_data_blob(NULL, parameter); + if (new_lm_pswd.length != 516) { + printf("Error: hex decode of %s failed! " + "(got %d bytes, expected 516)\n.\n", + parameter, + (int)new_lm_pswd.length); + new_lm_pswd = data_blob_null; + } + } + else if (strequal(request, "old-lm-hash-blob")) { + old_lm_hash_enc = strhex_to_data_blob(NULL, parameter); + if (old_lm_hash_enc.length != 16) + { + printf("Error: hex decode of %s failed! " + "(got %d bytes, expected 16)\n.\n", + parameter, + (int)old_lm_hash_enc.length); + old_lm_hash_enc = data_blob_null; + } + } else if (strequal(request, "nt-domain")) { + domain = smb_xstrdup(parameter); + } else if(strequal(request, "username")) { + username = smb_xstrdup(parameter); + } else if(strequal(request, "full-username")) { + username = smb_xstrdup(parameter); + } else if(strequal(request, "new-password")) { + newpswd = smb_xstrdup(parameter); + } else if (strequal(request, "old-password")) { + oldpswd = smb_xstrdup(parameter); + } else { + printf("Error: Unknown request %s\n.\n", request); + } +} + +static void manage_squid_request(enum stdio_helper_mode stdio_helper_mode, + struct loadparm_context *lp_ctx, + struct ntlm_auth_state *state, + stdio_helper_function fn, void **private2) +{ + char *buf; + char tmp[INITIAL_BUFFER_SIZE+1]; + int length, buf_size = 0; + char *c; + + buf = talloc_strdup(state->mem_ctx, ""); + if (!buf) { + DEBUG(0, ("Failed to allocate input buffer.\n")); + fprintf(stderr, "ERR\n"); + exit(1); + } + + do { + + /* this is not a typo - x_fgets doesn't work too well under + * squid */ + if (fgets(tmp, sizeof(tmp)-1, stdin) == NULL) { + if (ferror(stdin)) { + DEBUG(1, ("fgets() failed! dying..... errno=%d " + "(%s)\n", ferror(stdin), + strerror(ferror(stdin)))); + + exit(1); + } + exit(0); + } + + buf = talloc_strdup_append_buffer(buf, tmp); + buf_size += INITIAL_BUFFER_SIZE; + + if (buf_size > MAX_BUFFER_SIZE) { + DEBUG(2, ("Oversized message\n")); + fprintf(stderr, "ERR\n"); + talloc_free(buf); + return; + } + + c = strchr(buf, '\n'); + } while (c == NULL); + + *c = '\0'; + length = c-buf; + + DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length)); + + if (buf[0] == '\0') { + DEBUG(2, ("Invalid Request\n")); + fprintf(stderr, "ERR\n"); + talloc_free(buf); + return; + } + + fn(stdio_helper_mode, lp_ctx, state, buf, length, private2); + talloc_free(buf); +} + + +static void squid_stream(enum stdio_helper_mode stdio_mode, + struct loadparm_context *lp_ctx, + stdio_helper_function fn) { + TALLOC_CTX *mem_ctx; + struct ntlm_auth_state *state; + + /* initialize FDescs */ + setbuf(stdout, NULL); + setbuf(stderr, NULL); + + mem_ctx = talloc_init("ntlm_auth"); + if (!mem_ctx) { + DEBUG(0, ("squid_stream: Failed to create talloc context\n")); + fprintf(stderr, "ERR\n"); + exit(1); + } + + state = talloc_zero(mem_ctx, struct ntlm_auth_state); + if (!state) { + DEBUG(0, ("squid_stream: Failed to talloc ntlm_auth_state\n")); + fprintf(stderr, "ERR\n"); + exit(1); + } + + state->mem_ctx = mem_ctx; + state->helper_mode = stdio_mode; + + while(1) { + TALLOC_CTX *frame = talloc_stackframe(); + manage_squid_request(stdio_mode, lp_ctx, state, fn, NULL); + TALLOC_FREE(frame); + } +} + + +/* Authenticate a user with a challenge/response */ + +static bool check_auth_crap(void) +{ + NTSTATUS nt_status; + uint32_t flags = 0; + char lm_key[8]; + char user_session_key[16]; + char *hex_lm_key; + char *hex_user_session_key; + char *error_string; + uint8_t authoritative = 1; + + setbuf(stdout, NULL); + + if (request_lm_key) + flags |= WBFLAG_PAM_LMKEY; + + if (request_user_session_key) + flags |= WBFLAG_PAM_USER_SESSION_KEY; + + flags |= WBFLAG_PAM_NT_STATUS_SQUASH; + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &opt_challenge, + &opt_lm_response, + &opt_nt_response, + flags, 0, + (unsigned char *)lm_key, + (unsigned char *)user_session_key, + &authoritative, + &error_string, NULL); + + if (!NT_STATUS_IS_OK(nt_status)) { + printf("%s (0x%x)\n", error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (request_lm_key + && (!all_zero((uint8_t *)lm_key, sizeof(lm_key)))) { + hex_lm_key = hex_encode_talloc(talloc_tos(), (const unsigned char *)lm_key, + sizeof(lm_key)); + printf("LM_KEY: %s\n", hex_lm_key); + TALLOC_FREE(hex_lm_key); + } + if (request_user_session_key + && (!all_zero((uint8_t *)user_session_key, + sizeof(user_session_key)))) { + hex_user_session_key = hex_encode_talloc(talloc_tos(), (const unsigned char *)user_session_key, + sizeof(user_session_key)); + printf("NT_KEY: %s\n", hex_user_session_key); + TALLOC_FREE(hex_user_session_key); + } + + return True; +} + +/* Main program */ + +enum { + OPT_USERNAME = 1000, + OPT_DOMAIN, + OPT_WORKSTATION, + OPT_CHALLENGE, + OPT_RESPONSE, + OPT_LM, + OPT_NT, + OPT_PASSWORD, + OPT_LM_KEY, + OPT_USER_SESSION_KEY, + OPT_DIAGNOSTICS, + OPT_REQUIRE_MEMBERSHIP, + OPT_USE_CACHED_CREDS, + OPT_ALLOW_MSCHAPV2, + OPT_PAM_WINBIND_CONF, + OPT_TARGET_SERVICE, + OPT_TARGET_HOSTNAME, + OPT_OFFLINE_LOGON +}; + + int main(int argc, const char **argv) +{ + TALLOC_CTX *frame = talloc_stackframe(); + int opt; + const char *helper_protocol = NULL; + int diagnostics = 0; + + const char *hex_challenge = NULL; + const char *hex_lm_response = NULL; + const char *hex_nt_response = NULL; + struct loadparm_context *lp_ctx; + poptContext pc; + bool ok; + + /* NOTE: DO NOT change this interface without considering the implications! + This is an external interface, which other programs will use to interact + with this helper. + */ + + /* We do not use single-letter command abbreviations, because they harm future + interface stability. */ + + struct poptOption long_options[] = { + POPT_AUTOHELP + { + .longName = "helper-protocol", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &helper_protocol, + .val = OPT_DOMAIN, + .descrip = "operate as a stdio-based helper", + .argDescrip = "helper protocol to use" + }, + { + .longName = "username", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_username, + .val = OPT_USERNAME, + .descrip = "username" + }, + { + .longName = "domain", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_domain, + .val = OPT_DOMAIN, + .descrip = "domain name" + }, + { + .longName = "workstation", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_workstation, + .val = OPT_WORKSTATION, + .descrip = "workstation" + }, + { + .longName = "challenge", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &hex_challenge, + .val = OPT_CHALLENGE, + .descrip = "challenge (HEX encoded)" + }, + { + .longName = "lm-response", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &hex_lm_response, + .val = OPT_LM, + .descrip = "LM Response to the challenge (HEX encoded)" + }, + { + .longName = "nt-response", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &hex_nt_response, + .val = OPT_NT, + .descrip = "NT or NTLMv2 Response to the challenge (HEX encoded)" + }, + { + .longName = "password", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_password, + .val = OPT_PASSWORD, + .descrip = "User's plaintext password" + }, + { + .longName = "request-lm-key", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &request_lm_key, + .val = OPT_LM_KEY, + .descrip = "Retrieve LM session key (or, with --diagnostics, expect LM support)" + }, + { + .longName = "request-nt-key", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &request_user_session_key, + .val = OPT_USER_SESSION_KEY, + .descrip = "Retrieve User (NT) session key" + }, + { + .longName = "use-cached-creds", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &use_cached_creds, + .val = OPT_USE_CACHED_CREDS, + .descrip = "Use cached credentials if no password is given" + }, + { + .longName = "allow-mschapv2", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &opt_allow_mschapv2, + .val = OPT_ALLOW_MSCHAPV2, + .descrip = "Explicitly allow MSCHAPv2", + }, + { + .longName = "offline-logon", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &offline_logon, + .val = OPT_OFFLINE_LOGON, + .descrip = "Use cached passwords when DC is offline" + }, + { + .longName = "diagnostics", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &diagnostics, + .val = OPT_DIAGNOSTICS, + .descrip = "Perform diagnostics on the authentication chain" + }, + { + .longName = "require-membership-of", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &require_membership_of, + .val = OPT_REQUIRE_MEMBERSHIP, + .descrip = "Require that a user be a member of this group (either name or SID) for authentication to succeed", + }, + { + .longName = "pam-winbind-conf", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_pam_winbind_conf, + .val = OPT_PAM_WINBIND_CONF, + .descrip = "Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required", + }, + { + .longName = "target-service", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_target_service, + .val = OPT_TARGET_SERVICE, + .descrip = "Target service (eg http)", + }, + { + .longName = "target-hostname", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &opt_target_hostname, + .val = OPT_TARGET_HOSTNAME, + .descrip = "Target hostname", + }, + POPT_COMMON_DEBUG_ONLY + POPT_COMMON_CONFIG_ONLY + POPT_COMMON_OPTION_ONLY + POPT_COMMON_VERSION + POPT_TABLEEND + }; + + /* Samba client initialisation */ + smb_init_locale(); + + ok = samba_cmdline_init(frame, + SAMBA_CMDLINE_CONFIG_CLIENT, + false /* require_smbconf */); + if (!ok) { + DBG_ERR("Failed to init cmdline parser!\n"); + TALLOC_FREE(frame); + exit(1); + } + + pc = samba_popt_get_context(getprogname(), + argc, + argv, + long_options, + POPT_CONTEXT_KEEP_FIRST); + if (pc == NULL) { + DBG_ERR("Failed to setup popt context!\n"); + TALLOC_FREE(frame); + exit(1); + } + + while((opt = poptGetNextOpt(pc)) != -1) { + switch (opt) { + case OPT_CHALLENGE: + opt_challenge = strhex_to_data_blob(NULL, hex_challenge); + if (opt_challenge.length != 8) { + fprintf(stderr, "hex decode of %s failed! " + "(only got %d bytes)\n", + hex_challenge, + (int)opt_challenge.length); + exit(1); + } + break; + case OPT_LM: + opt_lm_response = strhex_to_data_blob(NULL, hex_lm_response); + if (opt_lm_response.length != 24) { + fprintf(stderr, "hex decode of %s failed! " + "(only got %d bytes)\n", + hex_lm_response, + (int)opt_lm_response.length); + exit(1); + } + break; + + case OPT_NT: + opt_nt_response = strhex_to_data_blob(NULL, hex_nt_response); + if (opt_nt_response.length < 24) { + fprintf(stderr, "hex decode of %s failed! " + "(only got %d bytes)\n", + hex_nt_response, + (int)opt_nt_response.length); + exit(1); + } + break; + + case OPT_REQUIRE_MEMBERSHIP: + if (strncasecmp_m("S-", require_membership_of, 2) == 0) { + require_membership_of_sid = require_membership_of; + } + break; + + case POPT_ERROR_BADOPT: + fprintf(stderr, "\nInvalid option %s: %s\n\n", + poptBadOption(pc, 0), poptStrerror(opt)); + poptPrintUsage(pc, stderr, 0); + exit(1); + } + } + + if (opt_username) { + char *domain = SMB_STRDUP(opt_username); + char *p = strchr_m(domain, *lp_winbind_separator()); + if (p) { + opt_username = p+1; + *p = '\0'; + if (opt_domain && !strequal(opt_domain, domain)) { + fprintf(stderr, "Domain specified in username (%s) " + "doesn't match specified domain (%s)!\n\n", + domain, opt_domain); + poptPrintHelp(pc, stderr, 0); + exit(1); + } + opt_domain = domain; + } else { + SAFE_FREE(domain); + } + } + + /* Note: if opt_domain is "" then send no domain */ + if (opt_domain == NULL) { + opt_domain = get_winbind_domain(); + } + + if (opt_workstation == NULL) { + opt_workstation = ""; + } + + lp_ctx = loadparm_init_s3(NULL, loadparm_s3_helpers()); + if (lp_ctx == NULL) { + fprintf(stderr, "loadparm_init_s3() failed!\n"); + exit(1); + } + + if (helper_protocol) { + int i; + for (i=0; i