/* Unix SMB/CIFS implementation. Winbind status program. Copyright (C) Tim Potter 2000-2002 Copyright (C) Andrew Bartlett 2003 Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ #include "includes.h" #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND #define SQUID_BUFFER_SIZE 2010 enum squid_mode { SQUID_2_4_BASIC, SQUID_2_5_BASIC, SQUID_2_5_NTLMSSP }; extern int winbindd_fd; static const char *helper_protocol; static const char *username; static const char *domain; static const char *workstation; static const char *hex_challenge; static const char *hex_lm_response; static const char *hex_nt_response; static unsigned char *challenge; static size_t challenge_len; static unsigned char *lm_response; static size_t lm_response_len; static unsigned char *nt_response; static size_t nt_response_len; static int request_lm_key; static int request_nt_key; static char *password; static char winbind_separator(void) { struct winbindd_response response; static BOOL got_sep; static char sep; if (got_sep) return sep; ZERO_STRUCT(response); /* Send off request */ if (winbindd_request(WINBINDD_INFO, NULL, &response) != NSS_STATUS_SUCCESS) { d_printf("could not obtain winbind separator!\n"); return '\\'; } sep = response.data.info.winbind_separator; got_sep = True; if (!sep) { d_printf("winbind separator was NULL!\n"); return '\\'; } return sep; } static const char *get_winbind_domain(void) { struct winbindd_response response; static fstring winbind_domain; if (*winbind_domain) { return winbind_domain; } ZERO_STRUCT(response); /* Send off request */ if (winbindd_request(WINBINDD_DOMAIN_NAME, NULL, &response) != NSS_STATUS_SUCCESS) { d_printf("could not obtain winbind domain name!\n"); return NULL; } fstrcpy(winbind_domain, response.data.domain_name); return winbind_domain; } static const char *get_winbind_netbios_name(void) { struct winbindd_response response; static fstring winbind_netbios_name; if (*winbind_netbios_name) { return winbind_netbios_name; } ZERO_STRUCT(response); /* Send off request */ if (winbindd_request(WINBINDD_NETBIOS_NAME, NULL, &response) != NSS_STATUS_SUCCESS) { d_printf("could not obtain winbind netbios name!\n"); return NULL; } fstrcpy(winbind_netbios_name, response.data.netbios_name); return winbind_netbios_name; } /* Authenticate a user with a plaintext password */ static BOOL check_plaintext_auth(const char *user, const char *pass, BOOL stdout_diagnostics) { struct winbindd_request request; struct winbindd_response response; NSS_STATUS result; /* Send off request */ ZERO_STRUCT(request); ZERO_STRUCT(response); fstrcpy(request.data.auth.user, user); fstrcpy(request.data.auth.pass, pass); result = winbindd_request(WINBINDD_PAM_AUTH, &request, &response); /* Display response */ if (stdout_diagnostics) { if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { d_printf("Reading winbind reply failed! (0x01)\n"); } d_printf("%s (0x%x)\n", response.data.auth.nt_status_string, response.data.auth.nt_status); } else { if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { DEBUG(1, ("Reading winbind reply failed! (0x01)\n")); } DEBUG(3, ("%s (0x%x)\n", response.data.auth.nt_status_string, response.data.auth.nt_status)); } return (result == NSS_STATUS_SUCCESS); } static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state) { struct winbindd_request request; struct winbindd_response response; NSS_STATUS result; /* Send off request */ ZERO_STRUCT(request); ZERO_STRUCT(response); fstrcpy(request.data.auth_crap.user, ntlmssp_state->user); fstrcpy(request.data.auth_crap.domain, ntlmssp_state->domain); fstrcpy(request.data.auth_crap.workstation, ntlmssp_state->workstation); memcpy(request.data.auth_crap.chal, ntlmssp_state->chal.data, MIN(ntlmssp_state->chal.length, 8)); memcpy(request.data.auth_crap.lm_resp, ntlmssp_state->lm_resp.data, MIN(ntlmssp_state->lm_resp.length, sizeof(request.data.auth_crap.lm_resp))); memcpy(request.data.auth_crap.nt_resp, ntlmssp_state->nt_resp.data, MIN(ntlmssp_state->nt_resp.length, sizeof(request.data.auth_crap.nt_resp))); request.data.auth_crap.lm_resp_len = ntlmssp_state->lm_resp.length; request.data.auth_crap.nt_resp_len = ntlmssp_state->nt_resp.length; result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response); /* Display response */ if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { return NT_STATUS_UNSUCCESSFUL; } return NT_STATUS(response.data.auth.nt_status); } static void manage_squid_ntlmssp_request(enum squid_mode squid_mode, char *buf, int length) { static NTLMSSP_STATE *ntlmssp_state = NULL; DATA_BLOB request, reply; NTSTATUS nt_status; if (strlen(buf) < 2) { DEBUG(1, ("NTLMSSP query [%s] invalid", buf)); x_fprintf(x_stdout, "BH\n"); return; } if (strlen(buf) > 3) { request = base64_decode_data_blob(buf + 3); } else if (strcmp(buf, "YR") == 0) { request = data_blob(NULL, 0); if (ntlmssp_state) ntlmssp_server_end(&ntlmssp_state); } else { DEBUG(1, ("NTLMSSP query [%s] invalid", buf)); x_fprintf(x_stdout, "BH\n"); return; } if (!ntlmssp_state) { ntlmssp_server_start(&ntlmssp_state); ntlmssp_state->check_password = winbind_pw_check; ntlmssp_state->get_domain = get_winbind_domain; ntlmssp_state->get_global_myname = get_winbind_netbios_name; } DEBUG(10, ("got NTLMSSP packet:\n")); dump_data(10, request.data, request.length); nt_status = ntlmssp_server_update(ntlmssp_state, request, &reply); if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { char *reply_base64 = base64_encode_data_blob(reply); x_fprintf(x_stdout, "TT %s\n", reply_base64); SAFE_FREE(reply_base64); data_blob_free(&reply); DEBUG(10, ("NTLMSSP challenge\n")); } else if (!NT_STATUS_IS_OK(nt_status)) { x_fprintf(x_stdout, "NA %s\n", nt_errstr(nt_status)); DEBUG(10, ("NTLMSSP %s\n", nt_errstr(nt_status))); } else { x_fprintf(x_stdout, "AF %s\\%s\n", ntlmssp_state->domain, ntlmssp_state->user); DEBUG(10, ("NTLMSSP OK!\n")); } data_blob_free(&request); } static void manage_squid_basic_request(enum squid_mode squid_mode, char *buf, int length) { char *user, *pass; user=buf; pass=memchr(buf,' ',length); if (!pass) { DEBUG(2, ("Password not found. Denying access\n")); x_fprintf(x_stderr, "ERR\n"); return; } *pass='\0'; pass++; if (squid_mode == SQUID_2_5_BASIC) { rfc1738_unescape(user); rfc1738_unescape(pass); } if (check_plaintext_auth(user, pass, False)) { x_fprintf(x_stdout, "OK\n"); } else { x_fprintf(x_stdout, "ERR\n"); } } static void manage_squid_request(enum squid_mode squid_mode) { char buf[SQUID_BUFFER_SIZE+1]; int length; char *c; static BOOL err; /* this is not a typo - x_fgets doesn't work too well under squid */ if (fgets(buf, sizeof(buf)-1, stdin) == NULL) { DEBUG(1, ("fgets() failed! dying..... errno=%d (%s)\n", ferror(stdin), strerror(ferror(stdin)))); exit(1); /* BIIG buffer */ } c=memchr(buf,'\n',sizeof(buf)-1); if (c) { *c = '\0'; length = c-buf; } else { err = 1; return; } if (err) { DEBUG(2, ("Oversized message\n")); x_fprintf(x_stderr, "ERR\n"); err = 0; return; } DEBUG(10, ("Got '%s' from squid (length: %d).\n",buf,length)); if (buf[0] == '\0') { DEBUG(2, ("Invalid Request\n")); x_fprintf(x_stderr, "ERR\n"); return; } if (squid_mode == SQUID_2_5_BASIC || squid_mode == SQUID_2_4_BASIC) { manage_squid_basic_request(squid_mode, buf, length); } else if (squid_mode == SQUID_2_5_NTLMSSP) { manage_squid_ntlmssp_request(squid_mode, buf, length); } } static void squid_stream(enum squid_mode squid_mode) { /* initialize FDescs */ x_setbuf(x_stdout, NULL); x_setbuf(x_stderr, NULL); while(1) { manage_squid_request(squid_mode); } } /* Authenticate a user with a challenge/response */ static BOOL check_auth_crap(void) { struct winbindd_request request; struct winbindd_response response; char *lm_key; char *nt_key; static uint8 zeros[16]; NSS_STATUS result; /* Send off request */ ZERO_STRUCT(request); ZERO_STRUCT(response); if (request_lm_key) request.data.auth_crap.flags |= WINBIND_PAM_LMKEY; if (request_nt_key) request.data.auth_crap.flags |= WINBIND_PAM_NTKEY; fstrcpy(request.data.auth_crap.user, username); fstrcpy(request.data.auth_crap.domain, domain); fstrcpy(request.data.auth_crap.workstation, workstation); memcpy(request.data.auth_crap.chal, challenge, MIN(challenge_len, 8)); memcpy(request.data.auth_crap.lm_resp, lm_response, MIN(lm_response_len, sizeof(request.data.auth_crap.lm_resp))); memcpy(request.data.auth_crap.nt_resp, nt_response, MIN(nt_response_len, sizeof(request.data.auth_crap.nt_resp))); request.data.auth_crap.lm_resp_len = lm_response_len; request.data.auth_crap.nt_resp_len = nt_response_len; result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response); /* Display response */ if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { d_printf("Reading winbind reply failed! (0x01)\n"); } d_printf("%s (0x%x)\n", response.data.auth.nt_status_string, response.data.auth.nt_status); if (response.data.auth.nt_status == 0) { if (request_lm_key && (memcmp(zeros, response.data.auth.first_8_lm_hash, sizeof(response.data.auth.first_8_lm_hash)) != 0)) { hex_encode(response.data.auth.first_8_lm_hash, sizeof(response.data.auth.first_8_lm_hash), &lm_key); d_printf("LM_KEY: %s\n", lm_key); SAFE_FREE(lm_key); } if (request_nt_key && (memcmp(zeros, response.data.auth.nt_session_key, sizeof(response.data.auth.nt_session_key)) != 0)) { hex_encode(response.data.auth.nt_session_key, sizeof(response.data.auth.nt_session_key), &nt_key); d_printf("NT_KEY: %s\n", nt_key); SAFE_FREE(nt_key); } } return result == NSS_STATUS_SUCCESS; } /* Main program */ enum { OPT_USERNAME = 1000, OPT_DOMAIN, OPT_WORKSTATION, OPT_CHALLENGE, OPT_RESPONSE, OPT_LM, OPT_NT, OPT_PASSWORD, OPT_LM_KEY, OPT_NT_KEY }; int main(int argc, const char **argv) { int opt; poptContext pc; struct poptOption long_options[] = { POPT_AUTOHELP { "helper-protocol", 0, POPT_ARG_STRING, &helper_protocol, OPT_DOMAIN, "operate as a stdio-based helper", "helper protocol to use"}, { "username", 0, POPT_ARG_STRING, &username, OPT_USERNAME, "username"}, { "domain", 0, POPT_ARG_STRING, &domain, OPT_DOMAIN, "domain name"}, { "workstation", 0, POPT_ARG_STRING, &domain, OPT_WORKSTATION, "workstation"}, { "challenge", 0, POPT_ARG_STRING, &hex_challenge, OPT_CHALLENGE, "challenge (HEX encoded)"}, { "lm-response", 0, POPT_ARG_STRING, &hex_lm_response, OPT_LM, "LM Response to the challenge (HEX encoded)"}, { "nt-response", 0, POPT_ARG_STRING, &hex_nt_response, OPT_NT, "NT or NTLMv2 Response to the challenge (HEX encoded)"}, { "password", 0, POPT_ARG_STRING, &password, OPT_PASSWORD, "User's plaintext password"}, { "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retreive LM session key"}, { "request-nt-key", 0, POPT_ARG_NONE, &request_nt_key, OPT_NT_KEY, "Retreive NT session key"}, POPT_COMMON_SAMBA POPT_COMMON_CONNECTION POPT_COMMON_CREDENTIALS POPT_TABLEEND }; /* Samba client initialisation */ dbf = x_stderr; /* Parse options */ pc = poptGetContext("ntlm_auth", argc, argv, long_options, 0); /* Parse command line options */ if (argc == 1) { poptPrintHelp(pc, stderr, 0); return 1; } pc = poptGetContext(NULL, argc, (const char **)argv, long_options, POPT_CONTEXT_KEEP_FIRST); while((opt = poptGetNextOpt(pc)) != -1) { switch (opt) { case OPT_CHALLENGE: challenge_len = strlen(hex_challenge); challenge = smb_xmalloc((challenge_len+1)/2); if ((challenge_len = strhex_to_str(challenge, challenge_len, hex_challenge)) != 8) { fprintf(stderr, "hex decode of %s failed (only got %u bytes)!\n", hex_challenge, challenge_len); exit(1); } break; case OPT_LM: lm_response_len = strlen(hex_lm_response); lm_response = smb_xmalloc((lm_response_len+1)/2); if ((lm_response_len = strhex_to_str(lm_response, lm_response_len, hex_lm_response)) != 24) { fprintf(stderr, "hex decode of %s failed!\n", hex_lm_response); exit(1); } break; case OPT_NT: nt_response_len = strlen(hex_nt_response); nt_response = smb_xmalloc((nt_response_len+1)/2); if ((nt_response_len = strhex_to_str(nt_response, nt_response_len, hex_nt_response)) < 24) { fprintf(stderr, "hex decode of %s failed!\n", hex_nt_response); exit(1); } break; } } if (helper_protocol) { if (strcmp(helper_protocol, "squid-2.5-ntlmssp")== 0) { squid_stream(SQUID_2_5_NTLMSSP); } else if (strcmp(helper_protocol, "squid-2.5-basic")== 0) { squid_stream(SQUID_2_5_BASIC); } else if (strcmp(helper_protocol, "squid-2.4-basic")== 0) { squid_stream(SQUID_2_4_BASIC); } else { fprintf(stderr, "unknown helper protocol [%s]\n", helper_protocol); exit(1); } } if (domain == NULL) { domain = get_winbind_domain(); } if (workstation == NULL) { workstation = ""; } if (challenge) { if (!check_auth_crap()) { exit(1); } } else if (password) { fstring user; snprintf(user, sizeof(user)-1, "%s%c%s", domain, winbind_separator(), username); if (!check_plaintext_auth(user, password, True)) { exit(1); } } /* Exit code */ poptFreeContext(pc); return 0; }