2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
10 * NDS LDAP helper functions
11 * Copied From Samba-3.0.24 pdb_nds.c and trimmed down to the
12 * limited functionality needed to access the plain text password only
14 * Original copyright & license follows:
16 * Copyright (C) Vince Brimhall 2004-2005
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License as published by
20 * the Free Software Foundation; either version 2 of the License, or
21 * (at your option) any later version.
23 * This program is distributed in the hope that it will be useful,
24 * but WITHOUT ANY WARRANTY; without even the implied warranty of
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 * GNU General Public License for more details.
28 * You should have received a copy of the GNU General Public License
29 * along with this program; if not, write to the Free Software
30 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
34 #include "auth/digest/eDirectory/digest_common.h"
35 #include "mem/Sensitive.h"
37 #if _SQUID_WINDOWS_ && !_SQUID_CYGWIN_
39 #define snprintf _snprintf
44 #define LDAPAPI __cdecl
47 #ifndef LDAP_OPT_X_TLS
48 #define LDAP_OPT_X_TLS 0x6000
50 #define ber_alloc() ber_alloc_t(0)
51 #endif /* LDAP_VERSION3 */
61 #include "edir_ldapext.h"
63 #define NMASLDAP_GET_LOGIN_CONFIG_REQUEST "2.16.840.1.113719.1.39.42.100.3"
64 #define NMASLDAP_GET_LOGIN_CONFIG_RESPONSE "2.16.840.1.113719.1.39.42.100.4"
65 #define NMASLDAP_SET_PASSWORD_REQUEST "2.16.840.1.113719.1.39.42.100.11"
66 #define NMASLDAP_SET_PASSWORD_RESPONSE "2.16.840.1.113719.1.39.42.100.12"
67 #define NMASLDAP_GET_PASSWORD_REQUEST "2.16.840.1.113719.1.39.42.100.13"
68 #define NMASLDAP_GET_PASSWORD_RESPONSE "2.16.840.1.113719.1.39.42.100.14"
70 #define NMAS_LDAP_EXT_VERSION 1
72 #define SMB_MALLOC_ARRAY(type, nelem) calloc(sizeof(type), nelem)
73 #define DEBUG(level, args)
75 /**********************************************************************
76 Take the request BER value and input data items and BER encodes the
77 data into the BER value
78 **********************************************************************/
80 static int berEncodePasswordData(
81 struct berval
**requestBV
,
84 const char *password2
)
87 BerElement
*requestBer
= nullptr;
89 const char * utf8ObjPtr
= nullptr;
91 const char * utf8PwdPtr
= nullptr;
93 const char * utf8Pwd2Ptr
= nullptr;
96 /* Convert objectDN and tag strings from Unicode to UTF-8 */
97 utf8ObjSize
= strlen(objectDN
)+1;
98 utf8ObjPtr
= objectDN
;
100 if (password
!= nullptr) {
101 utf8PwdSize
= strlen(password
)+1;
102 utf8PwdPtr
= password
;
105 if (password2
!= nullptr) {
106 utf8Pwd2Size
= strlen(password2
)+1;
107 utf8Pwd2Ptr
= password2
;
110 /* Allocate a BerElement for the request parameters. */
111 if ((requestBer
= ber_alloc()) == nullptr) {
112 err
= LDAP_ENCODING_ERROR
;
113 ber_free(requestBer
, 1);
117 if (password
!= nullptr && password2
!= nullptr) {
118 /* BER encode the NMAS Version, the objectDN, and the password */
119 rc
= ber_printf(requestBer
, "{iooo}", NMAS_LDAP_EXT_VERSION
, utf8ObjPtr
, utf8ObjSize
, utf8PwdPtr
, utf8PwdSize
, utf8Pwd2Ptr
, utf8Pwd2Size
);
120 } else if (password
!= nullptr) {
121 /* BER encode the NMAS Version, the objectDN, and the password */
122 rc
= ber_printf(requestBer
, "{ioo}", NMAS_LDAP_EXT_VERSION
, utf8ObjPtr
, utf8ObjSize
, utf8PwdPtr
, utf8PwdSize
);
124 /* BER encode the NMAS Version and the objectDN */
125 rc
= ber_printf(requestBer
, "{io}", NMAS_LDAP_EXT_VERSION
, utf8ObjPtr
, utf8ObjSize
);
129 err
= LDAP_ENCODING_ERROR
;
132 /* Convert the BER we just built to a berval that we'll send with the extended request. */
133 if ((ber_tag_t
)ber_flatten(requestBer
, requestBV
) == LBER_ERROR
) {
134 err
= LDAP_ENCODING_ERROR
;
139 ber_free(requestBer
, 1);
145 /**********************************************************************
146 Take the request BER value and input data items and BER encodes the
147 data into the BER value
148 **********************************************************************/
150 static int berEncodeLoginData(
151 struct berval
**requestBV
,
153 unsigned int methodIDLen
,
154 unsigned int *methodID
,
159 unsigned int elemCnt
= methodIDLen
/ sizeof(unsigned int);
161 char *utf8ObjPtr
=nullptr;
164 char *utf8TagPtr
= nullptr;
167 utf8ObjPtr
= objectDN
;
168 utf8ObjSize
= strlen(utf8ObjPtr
)+1;
171 utf8TagSize
= strlen(utf8TagPtr
)+1;
173 /* Allocate a BerElement for the request parameters. */
174 BerElement
*requestBer
= ber_alloc();
176 return LDAP_ENCODING_ERROR
;
178 /* BER encode the NMAS Version and the objectDN */
179 if (ber_printf(requestBer
, "{io", NMAS_LDAP_EXT_VERSION
, utf8ObjPtr
, utf8ObjSize
) < 0) {
180 ber_free(requestBer
, 1);
181 return LDAP_ENCODING_ERROR
;
184 /* BER encode the MethodID Length and value */
185 if (ber_printf(requestBer
, "{i{", methodIDLen
) < 0) {
186 ber_free(requestBer
, 1);
187 return LDAP_ENCODING_ERROR
;
190 for (unsigned int i
= 0; i
< elemCnt
; ++i
) {
191 if (ber_printf(requestBer
, "i", methodID
[i
]) < 0) {
192 ber_free(requestBer
, 1);
193 return LDAP_ENCODING_ERROR
;
197 if (ber_printf(requestBer
, "}}", 0) < 0) {
198 ber_free(requestBer
, 1);
199 return LDAP_ENCODING_ERROR
;
203 /* BER Encode the the tag and data */
204 if (ber_printf(requestBer
, "oio}", utf8TagPtr
, utf8TagSize
, putDataLen
, putData
, putDataLen
) < 0) {
205 ber_free(requestBer
, 1);
206 return LDAP_ENCODING_ERROR
;
209 /* BER Encode the the tag */
210 if (ber_printf(requestBer
, "o}", utf8TagPtr
, utf8TagSize
) < 0) {
211 ber_free(requestBer
, 1);
212 return LDAP_ENCODING_ERROR
;
216 /* Convert the BER we just built to a berval that we'll send with the extended request. */
217 if (static_cast<ber_tag_t
>(ber_flatten(requestBer
, requestBV
)) == LBER_ERROR
) {
218 ber_free(requestBer
, 1);
219 return LDAP_ENCODING_ERROR
;
222 ber_free(requestBer
, 1);
223 return 0; /* no error */
226 /**********************************************************************
227 Takes the reply BER Value and decodes the NMAS server version and
228 return code and if a non null retData buffer was supplied, tries to
229 decode the the return data and length
230 **********************************************************************/
232 static int berDecodeLoginData(
233 struct berval
*replyBV
,
239 BerElement
*replyBer
= nullptr;
240 char *retOctStr
= nullptr;
241 size_t retOctStrLen
= 0;
243 if ((replyBer
= ber_init(replyBV
)) == nullptr) {
244 err
= LDAP_OPERATIONS_ERROR
;
245 } else if (retData
) {
246 retOctStrLen
= *retDataLen
+ 1;
247 retOctStr
= (char*)SMB_MALLOC_ARRAY(char, retOctStrLen
);
249 err
= LDAP_OPERATIONS_ERROR
;
250 } else if (ber_scanf(replyBer
, "{iis}", serverVersion
, &err
, retOctStr
, &retOctStrLen
) != LBER_ERROR
) {
251 if (*retDataLen
>= retOctStrLen
) {
252 memcpy(retData
, retOctStr
, retOctStrLen
);
254 err
= LDAP_NO_MEMORY
;
257 *retDataLen
= retOctStrLen
;
259 err
= LDAP_DECODING_ERROR
;
262 if (ber_scanf(replyBer
, "{ii}", serverVersion
, &err
) == LBER_ERROR
) {
264 err
= LDAP_DECODING_ERROR
;
270 ber_free(replyBer
, 1);
273 if (retOctStr
!= nullptr) {
274 memset(retOctStr
, 0, retOctStrLen
);
281 /**********************************************************************
282 Retrieves data in the login configuration of the specified object
283 that is tagged with the specified methodID and tag.
284 **********************************************************************/
286 static int getLoginConfig(
289 unsigned int methodIDLen
,
290 unsigned int *methodID
,
296 struct berval
*requestBV
= nullptr;
297 char *replyOID
= nullptr;
298 struct berval
*replyBV
= nullptr;
299 int serverVersion
= 0;
301 /* Validate unicode parameters. */
302 if ((strlen(objectDN
) == 0) || ld
== nullptr) {
303 return LDAP_NO_SUCH_ATTRIBUTE
;
306 err
= berEncodeLoginData(&requestBV
, objectDN
, methodIDLen
, methodID
, tag
, 0, nullptr);
309 } else if (!err
&& (err
= ldap_extended_operation_s(ld
, NMASLDAP_GET_LOGIN_CONFIG_REQUEST
,
310 requestBV
, nullptr, nullptr, &replyOID
, &replyBV
))) {
311 /* Call the ldap_extended_operation (synchronously) */
313 } else if (!replyOID
) {
314 /* Make sure there is a return OID */
315 err
= LDAP_NOT_SUPPORTED
;
316 } else if (strcmp(replyOID
, NMASLDAP_GET_LOGIN_CONFIG_RESPONSE
)) {
317 /* Is this what we were expecting to get back. */
318 err
= LDAP_NOT_SUPPORTED
;
319 } else if (!replyBV
) {
320 /* Do we have a good returned berval? */
322 /* No; returned berval means we experienced a rather drastic error. */
323 /* Return operations error. */
324 err
= LDAP_OPERATIONS_ERROR
;
327 err
= berDecodeLoginData(replyBV
, &serverVersion
, dataLen
, data
);
329 if (serverVersion
!= NMAS_LDAP_EXT_VERSION
) {
330 err
= LDAP_OPERATIONS_ERROR
;
338 /* Free the return OID string if one was returned. */
340 ldap_memfree(replyOID
);
343 /* Free memory allocated while building the request ber and berval. */
345 ber_bvfree(requestBV
);
348 /* Return the appropriate error/success code. */
352 /**********************************************************************
353 Attempts to get the Simple Password
354 **********************************************************************/
356 static int nmasldap_get_simple_pwd(
363 unsigned int methodID
= 0;
364 unsigned int methodIDLen
= sizeof(methodID
);
365 char tag
[] = {'P','A','S','S','W','O','R','D',' ','H','A','S','H',0};
366 char *pwdBuf
=nullptr;
367 size_t pwdBufLen
, bufferLen
;
369 bufferLen
= pwdBufLen
= pwdLen
+2;
370 pwdBuf
= (char*)SMB_MALLOC_ARRAY(char, pwdBufLen
); /* digest and null */
371 if (pwdBuf
== nullptr) {
372 return LDAP_NO_MEMORY
;
375 err
= getLoginConfig(ld
, objectDN
, methodIDLen
, &methodID
, tag
, &pwdBufLen
, pwdBuf
);
378 pwdBuf
[pwdBufLen
] = 0; /* null terminate */
381 case 1: /* cleartext password */
383 case 2: /* SHA1 HASH */
385 case 4: /* UNIXCrypt_ID */
386 case 8: /* SSHA_ID */
387 default: /* Unknown digest */
388 err
= LDAP_INAPPROPRIATE_AUTH
; /* only return clear text */
393 if (pwdLen
>= pwdBufLen
-1) {
394 memcpy(pwd
, &pwdBuf
[1], pwdBufLen
-1); /* skip digest tag and include null */
396 err
= LDAP_NO_MEMORY
;
402 if (pwdBuf
!= nullptr) {
403 Mem::ZeroSensitiveMemory(pwdBuf
, bufferLen
);
410 /**********************************************************************
411 Attempts to get the Universal Password
412 **********************************************************************/
414 static int nmasldap_get_password(
417 size_t *pwdSize
, /* in bytes */
422 struct berval
*requestBV
= nullptr;
423 char *replyOID
= nullptr;
424 struct berval
*replyBV
= nullptr;
427 size_t pwdBufLen
, bufferLen
;
429 /* Validate char parameters. */
430 if (objectDN
== nullptr || (strlen(objectDN
) == 0) || pwdSize
== nullptr || ld
== nullptr) {
431 return LDAP_NO_SUCH_ATTRIBUTE
;
434 bufferLen
= pwdBufLen
= *pwdSize
;
435 pwdBuf
= (char*)SMB_MALLOC_ARRAY(char, pwdBufLen
+2);
436 if (pwdBuf
== nullptr) {
437 return LDAP_NO_MEMORY
;
440 err
= berEncodePasswordData(&requestBV
, objectDN
, nullptr, nullptr);
443 } else if ((err
= ldap_extended_operation_s(ld
, NMASLDAP_GET_PASSWORD_REQUEST
, requestBV
, nullptr, nullptr, &replyOID
, &replyBV
))) {
444 ; /* Call the ldap_extended_operation (synchronously) */
445 } else if (!replyOID
) {
446 /* Make sure there is a return OID */
447 err
= LDAP_NOT_SUPPORTED
;
448 } else if (strcmp(replyOID
, NMASLDAP_GET_PASSWORD_RESPONSE
)) {
449 /* Is this what we were expecting to get back. */
450 err
= LDAP_NOT_SUPPORTED
;
451 } else if (!replyBV
) {
452 /* Do we have a good returned berval? */
453 /* No; returned berval means we experienced a rather drastic error. */
454 /* Return operations error. */
455 err
= LDAP_OPERATIONS_ERROR
;
457 err
= berDecodeLoginData(replyBV
, &serverVersion
, &pwdBufLen
, pwdBuf
);
459 if (serverVersion
!= NMAS_LDAP_EXT_VERSION
) {
460 err
= LDAP_OPERATIONS_ERROR
;
462 } else if (!err
&& pwdBufLen
!= 0) {
463 if (*pwdSize
>= pwdBufLen
+1 && pwd
!= nullptr) {
464 memcpy(pwd
, pwdBuf
, pwdBufLen
);
465 pwd
[pwdBufLen
] = 0; /* add null termination */
467 *pwdSize
= pwdBufLen
; /* does not include null termination */
475 /* Free the return OID string if one was returned. */
477 ldap_memfree(replyOID
);
480 /* Free memory allocated while building the request ber and berval. */
482 ber_bvfree(requestBV
);
485 if (pwdBuf
!= nullptr) {
486 Mem::ZeroSensitiveMemory(pwdBuf
, bufferLen
);
490 /* Return the appropriate error/success code. */
494 /**********************************************************************
495 Get the user's password from NDS.
496 *********************************************************************/
498 int nds_get_password(
506 rc
= nmasldap_get_password(ld
, object_dn
, pwd_len
, (unsigned char *)pwd
);
507 if (rc
== LDAP_SUCCESS
) {
508 DEBUG(5, ("NDS Universal Password retrieved for %s\n", object_dn
));
510 DEBUG(3, ("NDS Universal Password NOT retrieved for %s\n", object_dn
));
513 if (rc
!= LDAP_SUCCESS
) {
514 rc
= nmasldap_get_simple_pwd(ld
, object_dn
, *pwd_len
, pwd
);
515 if (rc
== LDAP_SUCCESS
) {
516 DEBUG(5, ("NDS Simple Password retrieved for %s\n", object_dn
));
518 /* We couldn't get the password */
519 DEBUG(3, ("NDS Simple Password NOT retrieved for %s\n", object_dn
));
520 return LDAP_INVALID_CREDENTIALS
;
524 /* We got the password */