]>
Commit | Line | Data |
---|---|---|
ca02e0ec AJ |
1 | /* |
2 | * Copyright (C) 1996-2014 The Squid Software Foundation and contributors | |
3 | * | |
4 | * Squid software is distributed under GPLv2+ license and includes | |
5 | * contributions from numerous individuals and organizations. | |
6 | * Please see the COPYING and CONTRIBUTORS files for details. | |
7 | */ | |
8 | ||
75aa769b | 9 | /* |
75aa769b AJ |
10 | * AUTHOR: Andrew Doran <ad@interlude.eu.org> |
11 | * AUTHOR: Robert Collins <rbtcollins@hotmail.com> | |
ca02e0ec | 12 | * AUTHOR: Guido Serassio <guido.serassio@acmeconsulting.it> |
75aa769b | 13 | */ |
ca02e0ec | 14 | |
75aa769b AJ |
15 | /* |
16 | * Example ntlm authentication program for Squid, based on the | |
17 | * original proxy_auth code from client_side.c, written by | |
18 | * Jon Thackray <jrmt@uk.gdscorp.com>. Initial ntlm code by | |
19 | * Andrew Doran <ad@interlude.eu.org>. | |
20 | * | |
21 | * This code gets the username and returns it. No validation is done. | |
22 | * and by the way: it is a complete patch-up. Use the "real thing" NTLMSSP | |
23 | * if you can. | |
24 | * | |
25 | * Revised by Guido Serassio: <guido.serassio@acmeconsulting.it> | |
26 | * | |
27 | * - Added negotiation of UNICODE char support | |
28 | * - More detailed debugging info | |
29 | * | |
30 | */ | |
31 | ||
32 | /* undefine this to have strict protocol adherence. You don't really need | |
33 | * that though */ | |
34 | #define IGNORANCE_IS_BLISS | |
35 | ||
f7f3304a | 36 | #include "squid.h" |
25f98340 | 37 | #include "base64.h" |
dcb9c96c | 38 | #include "helpers/defines.h" |
7c16470c AJ |
39 | #include "ntlmauth/ntlmauth.h" |
40 | #include "ntlmauth/support_bits.cci" | |
75aa769b | 41 | |
074d6a40 AJ |
42 | #include <cctype> |
43 | #include <cstring> | |
75aa769b AJ |
44 | #if HAVE_CRYPT_H |
45 | #include <crypt.h> | |
46 | #endif | |
47 | #if HAVE_PWD_H | |
48 | #include <pwd.h> | |
49 | #endif | |
50 | #if HAVE_GETOPT_H | |
51 | #include <getopt.h> | |
52 | #endif | |
5dc2526c FC |
53 | #if HAVE_STDINT_H |
54 | #include <stdint.h> | |
55 | #endif | |
56 | #if HAVE_INTTYPES_H | |
57 | #include <inttypes.h> | |
58 | #endif | |
75aa769b | 59 | |
75aa769b | 60 | /* A couple of harmless helper macros */ |
2b506a23 | 61 | #define SEND(X) {debug("sending '%s' to squid\n",X); printf(X "\n");} |
75aa769b | 62 | #ifdef __GNUC__ |
2b506a23 AJ |
63 | #define SEND2(X,Y...) {debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);} |
64 | #define SEND4(X,Y...) {debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);} | |
75aa769b AJ |
65 | #else |
66 | /* no gcc, no debugging. varargs macros are a gcc extension */ | |
2b506a23 AJ |
67 | #define SEND2(X,Y) {debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);} |
68 | #define SEND4(X,Y,Z,W) {debug("sending '" X "' to squid\n",Y,Z,W); printf(X "\n",Y,Z,W);} | |
75aa769b AJ |
69 | #endif |
70 | ||
75aa769b AJ |
71 | const char *authenticate_ntlm_domain = "WORKGROUP"; |
72 | int strip_domain_enabled = 0; | |
73 | int NTLM_packet_debug_enabled = 0; | |
74 | ||
75aa769b AJ |
75 | /* |
76 | * options: | |
77 | * -d enable debugging. | |
78 | * -v enable verbose NTLM packet debugging. | |
79 | * -l if specified, changes behavior on failures to last-ditch. | |
80 | */ | |
81 | char *my_program_name = NULL; | |
82 | ||
83 | static void | |
84 | usage(void) | |
85 | { | |
86 | fprintf(stderr, | |
87 | "Usage: %s [-d] [-v] [-h]\n" | |
88 | " -d enable debugging.\n" | |
89 | " -S strip domain from username.\n" | |
90 | " -v enable verbose NTLM packet debugging.\n" | |
91 | " -h this message\n\n", | |
92 | my_program_name); | |
93 | } | |
94 | ||
95 | static void | |
96 | process_options(int argc, char *argv[]) | |
97 | { | |
98 | int opt, had_error = 0; | |
99 | ||
100 | opterr = 0; | |
101 | while (-1 != (opt = getopt(argc, argv, "hdvS"))) { | |
102 | switch (opt) { | |
103 | case 'd': | |
104 | debug_enabled = 1; | |
105 | break; | |
106 | case 'v': | |
107 | debug_enabled = 1; | |
108 | NTLM_packet_debug_enabled = 1; | |
109 | break; | |
110 | case 'S': | |
111 | strip_domain_enabled = 1; | |
112 | break; | |
113 | case 'h': | |
114 | usage(); | |
115 | exit(0); | |
116 | case '?': | |
117 | opt = optopt; | |
f53969cc | 118 | /* fall thru to default */ |
75aa769b AJ |
119 | default: |
120 | fprintf(stderr, "unknown option: -%c. Exiting\n", opt); | |
121 | usage(); | |
122 | had_error = 1; | |
123 | } | |
124 | } | |
125 | if (had_error) | |
126 | exit(1); | |
127 | } | |
128 | ||
129 | int | |
130 | main(int argc, char *argv[]) | |
131 | { | |
4c4ca9c2 | 132 | char buf[HELPER_INPUT_BUFFER]; |
75aa769b | 133 | int buflen = 0; |
8bdd0cec AJ |
134 | char decodedBuf[HELPER_INPUT_BUFFER]; |
135 | int decodedLen; | |
75aa769b | 136 | char user[NTLM_MAX_FIELD_LENGTH], domain[NTLM_MAX_FIELD_LENGTH]; |
350f6838 | 137 | char *p; |
75aa769b AJ |
138 | ntlmhdr *packet = NULL; |
139 | char helper_command[3]; | |
140 | int len; | |
141 | char *data = NULL; | |
142 | ||
143 | setbuf(stdout, NULL); | |
144 | setbuf(stderr, NULL); | |
145 | ||
146 | my_program_name = argv[0]; | |
147 | ||
148 | process_options(argc, argv); | |
149 | ||
150 | debug("%s build " __DATE__ ", " __TIME__ " starting up...\n", my_program_name); | |
151 | ||
dcb9c96c | 152 | while (fgets(buf, HELPER_INPUT_BUFFER, stdin) != NULL) { |
f53969cc SM |
153 | user[0] = '\0'; /*no user code */ |
154 | domain[0] = '\0'; /*no domain code */ | |
75aa769b AJ |
155 | |
156 | if ((p = strchr(buf, '\n')) != NULL) | |
f53969cc | 157 | *p = '\0'; /* strip \n */ |
75aa769b | 158 | buflen = strlen(buf); /* keep this so we only scan the buffer for \0 once per loop */ |
8bdd0cec AJ |
159 | if (buflen > 3) { |
160 | decodedLen = base64_decode(decodedBuf, sizeof(decodedBuf), buf+3); | |
161 | packet = (ntlmhdr*)decodedBuf; | |
162 | } else { | |
163 | packet = NULL; | |
fb599974 | 164 | decodedLen = 0; |
8bdd0cec | 165 | } |
75aa769b AJ |
166 | if (buflen > 3 && NTLM_packet_debug_enabled) { |
167 | strncpy(helper_command, buf, 2); | |
168 | helper_command[2] = '\0'; | |
169 | debug("Got '%s' from Squid with data:\n", helper_command); | |
8bdd0cec | 170 | hex_dump((unsigned char *)decodedBuf, decodedLen); |
75aa769b AJ |
171 | } else |
172 | debug("Got '%s' from Squid\n", buf); | |
173 | ||
5dc2526c | 174 | if (strncmp(buf, "YR", 2) == 0) { |
75aa769b AJ |
175 | char nonce[NTLM_NONCE_LEN]; |
176 | ntlm_challenge chal; | |
177 | ntlm_make_nonce(nonce); | |
178 | if (buflen > 3) { | |
179 | ntlm_negotiate *nego = (ntlm_negotiate *)packet; | |
180 | ntlm_make_challenge(&chal, authenticate_ntlm_domain, NULL, nonce, NTLM_NONCE_LEN, nego->flags); | |
181 | } else { | |
1dcf61eb | 182 | ntlm_make_challenge(&chal, authenticate_ntlm_domain, NULL, nonce, NTLM_NONCE_LEN, NTLM_NEGOTIATE_ASCII); |
75aa769b AJ |
183 | } |
184 | // TODO: find out what this context means, and why only the fake auth helper contains it. | |
185 | chal.context_high = htole32(0x003a<<16); | |
186 | ||
187 | len = sizeof(chal) - sizeof(chal.payload) + le16toh(chal.target.maxlen); | |
188 | data = (char *) base64_encode_bin((char *) &chal, len); | |
189 | if (NTLM_packet_debug_enabled) { | |
190 | printf("TT %s\n", data); | |
191 | debug("sending 'TT' to squid with data:\n"); | |
192 | hex_dump((unsigned char *)&chal, len); | |
193 | } else | |
194 | SEND2("TT %s", data); | |
5dc2526c | 195 | } else if (strncmp(buf, "KK ", 3) == 0) { |
75aa769b AJ |
196 | if (!packet) { |
197 | SEND("BH received KK with no data! user="); | |
1dcf61eb | 198 | } else if (ntlm_validate_packet(packet, NTLM_AUTHENTICATE) == NTLM_ERR_NONE) { |
8bdd0cec | 199 | if (ntlm_unpack_auth((ntlm_authenticate *)packet, user, domain, decodedLen) == NTLM_ERR_NONE) { |
75aa769b | 200 | lc(user); |
75aa769b AJ |
201 | if (strip_domain_enabled) { |
202 | SEND2("AF %s", user); | |
203 | } else { | |
59a09b98 | 204 | SEND4("AF %s%s%s", domain, (*domain?"\\":""), user); |
75aa769b AJ |
205 | } |
206 | } else { | |
207 | lc(user); | |
59a09b98 | 208 | SEND4("NA invalid credentials, user=%s%s%s", domain, (*domain?"\\":""), user); |
75aa769b AJ |
209 | } |
210 | } else { | |
211 | SEND("BH wrong packet type! user="); | |
212 | } | |
213 | } | |
214 | } | |
215 | exit(0); | |
216 | } | |
f53969cc | 217 |