2 * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
10 * negotiate_sspi_auth: helper for Negotiate Authentication for Squid Cache
12 * (C)2005 Guido Serassio - Acme Consulting S.r.l.
15 * Guido Serassio <guido.serassio@acmeconsulting.it>
16 * Acme Consulting S.r.l., Italy <http://www.acmeconsulting.it>
18 * With contributions from others mentioned in the change history section
21 * Based on previous work of Francesco Chemolli and Robert Collins.
23 * Dependencies: Windows 2000 and later.
25 * This program is free software; you can redistribute it and/or modify
26 * it under the terms of the GNU General Public License as published by
27 * the Free Software Foundation; either version 2 of the License, or
28 * (at your option) any later version.
30 * This program is distributed in the hope that it will be useful,
31 * but WITHOUT ANY WARRANTY; without even the implied warranty of
32 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
33 * GNU General Public License for more details.
35 * You should have received a copy of the GNU General Public License
36 * along with this program; if not, write to the Free Software
37 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
42 * 29-10-2005 Guido Serassio
48 #include "helpers/defines.h"
49 #include "ntlmauth/ntlmauth.h"
50 #include "ntlmauth/support_bits.cci"
64 int Negotiate_packet_debug_enabled
= 0;
65 static int have_serverblob
;
67 /* A couple of harmless helper macros */
68 #define SEND(X) debug("sending '%s' to squid\n",X); printf(X "\n");
70 #define SEND2(X,Y...) debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);
71 #define SEND3(X,Y...) debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);
73 /* no gcc, no debugging. varargs macros are a gcc extension */
74 #define SEND2(X,Y) debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);
75 #define SEND3(X,Y,Z) debug("sending '" X "' to squid\n",Y,Z); printf(X "\n",Y,Z);
78 char *negotiate_check_auth(SSP_blobP auth
, int auth_length
);
82 * -d enable debugging.
83 * -v enable verbose Negotiate packet debugging.
85 char *my_program_name
= NULL
;
91 "Usage: %s [-d] [-v] [-h]\n"
92 " -d enable debugging.\n"
93 " -v enable verbose Negotiate packet debugging.\n"
94 " -h this message\n\n",
99 process_options(int argc
, char *argv
[])
101 int opt
, had_error
= 0;
104 while (-1 != (opt
= getopt(argc
, argv
, "hdv"))) {
111 Negotiate_packet_debug_enabled
= 1;
118 /* fall thru to default */
120 fprintf(stderr
, "ERROR: unknown option: -%c. Exiting\n", opt
);
132 char buf
[HELPER_INPUT_BUFFER
];
133 char decoded
[HELPER_INPUT_BUFFER
];
135 char helper_command
[3];
140 static char cred
[SSP_MAX_CRED_LEN
+ 1];
144 if (fgets(buf
, HELPER_INPUT_BUFFER
, stdin
))
147 c
= static_cast<char*>(memchr(buf
, '\n', HELPER_INPUT_BUFFER
));
150 SEND("BH illegal request received");
151 fprintf(stderr
, "ERROR: Illegal request received: '%s'\n", buf
);
156 fprintf(stderr
, "No newline in '%s'\n", buf
);
161 if ((strlen(buf
) > 3) && Negotiate_packet_debug_enabled
) {
162 decodedLen
= base64_decode(decoded
, sizeof(decoded
), buf
+3);
163 strncpy(helper_command
, buf
, 2);
164 debug("Got '%s' from Squid with data:\n", helper_command
);
165 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
167 debug("Got '%s' from Squid\n", buf
);
169 if (memcmp(buf
, "YR ", 3) == 0) { /* refresh-request */
170 /* figure out what we got */
171 decodedLen
= base64_decode(decoded
, sizeof(decoded
), buf
+ 3);
172 if ((size_t)decodedLen
< sizeof(ntlmhdr
)) { /* decoding failure, return error */
173 SEND("NA * Packet format error, couldn't base64-decode");
176 /* Obtain server blob against SSPI */
177 c
= (char *) SSP_MakeNegotiateBlob(decoded
, decodedLen
, &Done
, &status
, cred
);
179 if (status
== SSP_OK
) {
181 lc(cred
); /* let's lowercase them for our convenience */
184 if (Negotiate_packet_debug_enabled
) {
185 decodedLen
= base64_decode(decoded
, sizeof(decoded
), c
);
186 debug("sending 'AF' %s to squid with data:\n", cred
);
188 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
190 fprintf(stderr
, "No data available.\n");
191 printf("AF %s %s\n", c
, cred
);
193 SEND3("AF %s %s", c
, cred
);
195 if (Negotiate_packet_debug_enabled
) {
196 decodedLen
= base64_decode(decoded
, sizeof(decoded
), c
);
197 debug("sending 'TT' to squid with data:\n");
198 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
199 printf("TT %s\n", c
);
206 SEND("BH can't obtain server blob");
209 if (memcmp(buf
, "KK ", 3) == 0) { /* authenticate-request */
210 if (!have_serverblob
) {
211 SEND("BH invalid server blob");
214 /* figure out what we got */
215 decodedLen
= base64_decode(decoded
, sizeof(decoded
), buf
+3);
216 if ((size_t)decodedLen
< sizeof(ntlmhdr
)) { /* decoding failure, return error */
217 SEND("NA * Packet format error, couldn't base64-decode");
220 /* check against SSPI */
221 c
= (char *) SSP_ValidateNegotiateCredentials(decoded
, decodedLen
, &Done
, &status
, cred
);
223 if (status
== SSP_ERROR
) {
224 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER
| FORMAT_MESSAGE_FROM_SYSTEM
|
225 FORMAT_MESSAGE_IGNORE_INSERTS
,
228 MAKELANGID(LANG_NEUTRAL
, SUBLANG_DEFAULT
), /* Default language */
229 (LPTSTR
) & ErrorMessage
,
232 if (ErrorMessage
[strlen(ErrorMessage
) - 1] == '\n')
233 ErrorMessage
[strlen(ErrorMessage
) - 1] = '\0';
234 if (ErrorMessage
[strlen(ErrorMessage
) - 1] == '\r')
235 ErrorMessage
[strlen(ErrorMessage
) - 1] = '\0';
236 SEND2("NA * %s", ErrorMessage
);
237 LocalFree(ErrorMessage
);
241 lc(cred
); /* let's lowercase them for our convenience */
244 if (Negotiate_packet_debug_enabled
) {
245 decodedLen
= base64_decode(decoded
, sizeof(decoded
), c
);
246 debug("sending 'AF' %s to squid with data:\n", cred
);
248 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
250 fprintf(stderr
, "No data available.\n");
251 printf("AF %s %s\n", c
, cred
);
253 SEND3("AF %s %s", c
, cred
);
257 if (Negotiate_packet_debug_enabled
) {
258 decodedLen
= base64_decode(decoded
, sizeof(decoded
), c
);
259 debug("sending 'TT' to squid with data:\n");
260 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
261 printf("TT %s\n", c
);
267 } else { /* not an auth-request */
268 SEND("BH illegal request received");
269 fprintf(stderr
, "Illegal request received: '%s'\n", buf
);
272 SEND("BH detected protocol error");
274 /********* END ********/
278 main(int argc
, char *argv
[])
280 my_program_name
= argv
[0];
282 process_options(argc
, argv
);
284 debug("%s build " __DATE__
", " __TIME__
" starting up...\n", my_program_name
);
286 if (LoadSecurityDll(SSP_NTLM
, NEGOTIATE_PACKAGE_NAME
) == NULL
) {
287 fprintf(stderr
, "FATAL: %s: can't initialize SSPI, exiting.\n", argv
[0]);
290 debug("SSPI initialized OK\n");
292 atexit(UnloadSecurityDll
);
294 /* initialize FDescs */
295 setbuf(stdout
, NULL
);
296 setbuf(stderr
, NULL
);
298 while (manage_request()) {
299 /* everything is done within manage_request */