helpers/ntlm_auth/SSPI/ntlm_sspi_auth.cc

   1 /*
   2  * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /*
  10  * ntlm_sspi_auth: helper for NTLM Authentication for Squid Cache
  11  *
  12  * (C)2002,2005 Guido Serassio - Acme Consulting S.r.l.
  13  *
  14  * Authors:
  15  *  Guido Serassio <guido.serassio@acmeconsulting.it>
  16  *  Acme Consulting S.r.l., Italy <http://www.acmeconsulting.it>
  17  *
  18  * With contributions from others mentioned in the change history section
  19  * below.
  20  *
  21  * Based on previous work of Francesco Chemolli and Robert Collins.
  22  *
  23  * Dependencies: Windows NT4 SP4 and later.
  24  *
  25  * This program is free software; you can redistribute it and/or modify
  26  * it under the terms of the GNU General Public License as published by
  27  * the Free Software Foundation; either version 2 of the License, or
  28  * (at your option) any later version.
  29  *
  30  * This program is distributed in the hope that it will be useful,
  31  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  32  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  33  * GNU General Public License for more details.
  34  *
  35  * You should have received a copy of the GNU General Public License
  36  * along with this program; if not, write to the Free Software
  37  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  38  *
  39  * History:
  40  *
  41  * Version 1.22
  42  * 29-10-2005 Guido Serassio
  43  *              Updated for Negotiate auth support.
  44  * Version 1.21
  45  * 21-02-2004 Guido Serassio
  46  *              Removed control of use of NTLM NEGOTIATE packet from
  47  *              command line, now the support is automatic.
  48  * Version 1.20
  49  * 30-11-2003 Guido Serassio
  50  *              Added support for NTLM local calls.
  51  *              Added control of use of NTLM NEGOTIATE packet from
  52  *              command line.
  53  *              Updated documentation.
  54  * Version 1.10
  55  * 07-09-2003 Guido Serassio
  56  *              Now is true NTLM authenticator.
  57  *              More debug info.
  58  *              Updated documentation.
  59  * Version 1.0
  60  * 29-06-2002 Guido Serassio
  61  *              First release.
  62  *
  63  *
  64  */
  65
  66 /************* CONFIGURATION ***************/
  67
  68 #define FAIL_DEBUG 0
  69
  70 /************* END CONFIGURATION ***************/
  71
  72 //typedef unsigned char uchar;
  73
  74 #include "squid.h"
  75 #include "base64.h"
  76 #include "helpers/defines.h"
  77 #include "ntlmauth/ntlmauth.h"
  78 #include "ntlmauth/support_bits.cci"
  79 #include "sspwin32.h"
  80 #include "util.h"
  81
  82 #include <windows.h>
  83 #include <sspi.h>
  84 #include <security.h>
  85 #if HAVE_CTYPE_H
  86 #include <ctype.h>
  87 #endif
  88 #if HAVE_GETOPT_H
  89 #include <getopt.h>
  90 #endif
  91 #include <lm.h>
  92 #include <ntsecapi.h>
  93
  94 int NTLM_packet_debug_enabled = 0;
  95 static int have_challenge;
  96 char * NTAllowedGroup;
  97 char * NTDisAllowedGroup;
  98 int UseDisallowedGroup = 0;
  99 int UseAllowedGroup = 0;
 100
 101 #if FAIL_DEBUG
 102 int fail_debug_enabled = 0;
 103 #endif
 104
 105 /* returns 1 on success, 0 on failure */
 106 int
 107 Valid_Group(char *UserName, char *Group)
 108 {
 109     int result = FALSE;
 110     WCHAR wszUserName[UNLEN+1]; // Unicode user name
 111     WCHAR wszGroup[GNLEN+1];    // Unicode Group
 112
 113     LPLOCALGROUP_USERS_INFO_0 pBuf = NULL;
 114     LPLOCALGROUP_USERS_INFO_0 pTmpBuf;
 115     DWORD dwLevel = 0;
 116     DWORD dwFlags = LG_INCLUDE_INDIRECT;
 117     DWORD dwPrefMaxLen = -1;
 118     DWORD dwEntriesRead = 0;
 119     DWORD dwTotalEntries = 0;
 120     NET_API_STATUS nStatus;
 121     DWORD i;
 122     DWORD dwTotalCount = 0;
 123
 124     /* Convert ANSI User Name and Group to Unicode */
 125
 126     MultiByteToWideChar(CP_ACP, 0, UserName,
 127                         strlen(UserName) + 1, wszUserName,
 128                         sizeof(wszUserName) / sizeof(wszUserName[0]));
 129     MultiByteToWideChar(CP_ACP, 0, Group,
 130                         strlen(Group) + 1, wszGroup, sizeof(wszGroup) / sizeof(wszGroup[0]));
 131
 132     /*
 133      * Call the NetUserGetLocalGroups function
 134      * specifying information level 0.
 135      *
 136      * The LG_INCLUDE_INDIRECT flag specifies that the
 137      * function should also return the names of the local
 138      * groups in which the user is indirectly a member.
 139      */
 140     nStatus = NetUserGetLocalGroups(NULL,
 141                                     wszUserName,
 142                                     dwLevel,
 143                                     dwFlags,
 144                                     (LPBYTE *) & pBuf, dwPrefMaxLen, &dwEntriesRead, &dwTotalEntries);
 145     /*
 146      * If the call succeeds,
 147      */
 148     if (nStatus == NERR_Success) {
 149         if ((pTmpBuf = pBuf) != NULL) {
 150             for (i = 0; i < dwEntriesRead; ++i) {
 151                 if (pTmpBuf == NULL) {
 152                     result = FALSE;
 153                     break;
 154                 }
 155                 if (wcscmp(pTmpBuf->lgrui0_name, wszGroup) == 0) {
 156                     result = TRUE;
 157                     break;
 158                 }
 159                 ++pTmpBuf;
 160                 ++dwTotalCount;
 161             }
 162         }
 163     } else
 164         result = FALSE;
 165     /*
 166      * Free the allocated memory.
 167      */
 168     if (pBuf != NULL)
 169         NetApiBufferFree(pBuf);
 170     return result;
 171 }
 172
 173 char * AllocStrFromLSAStr(LSA_UNICODE_STRING LsaStr)
 174 {
 175     size_t len;
 176     static char * target;
 177
 178     len = LsaStr.Length/sizeof(WCHAR) + 1;
 179
 180     /* allocate buffer for str + null termination */
 181     safe_free(target);
 182     target = (char *)xmalloc(len);
 183     if (target == NULL)
 184         return NULL;
 185
 186     /* copy unicode buffer */
 187     WideCharToMultiByte(CP_ACP, 0, LsaStr.Buffer, LsaStr.Length, target, len, NULL, NULL );
 188
 189     /* add null termination */
 190     target[len-1] = '\0';
 191     return target;
 192 }
 193
 194 char * GetDomainName(void)
 195
 196 {
 197     LSA_HANDLE PolicyHandle;
 198     LSA_OBJECT_ATTRIBUTES ObjectAttributes;
 199     NTSTATUS status;
 200     PPOLICY_PRIMARY_DOMAIN_INFO ppdiDomainInfo;
 201     PWKSTA_INFO_100 pwkiWorkstationInfo;
 202     DWORD netret;
 203     char * DomainName = NULL;
 204
 205     /*
 206      * Always initialize the object attributes to all zeroes.
 207      */
 208     memset(&ObjectAttributes, '\0', sizeof(ObjectAttributes));
 209
 210     /*
 211      * You need the local workstation name. Use NetWkstaGetInfo at level
 212      * 100 to retrieve a WKSTA_INFO_100 structure.
 213      *
 214      * The wki100_computername field contains a pointer to a UNICODE
 215      * string containing the local computer name.
 216      */
 217     netret = NetWkstaGetInfo(NULL, 100, (LPBYTE *)&pwkiWorkstationInfo);
 218     if (netret == NERR_Success) {
 219         /*
 220          * We have the workstation name in:
 221          * pwkiWorkstationInfo->wki100_computername
 222          *
 223          * Next, open the policy object for the local system using
 224          * the LsaOpenPolicy function.
 225          */
 226         status = LsaOpenPolicy(
 227                      NULL,
 228                      &ObjectAttributes,
 229                      GENERIC_READ | POLICY_VIEW_LOCAL_INFORMATION,
 230                      &PolicyHandle
 231                  );
 232
 233         /*
 234          * Error checking.
 235          */
 236         if (status) {
 237             debug("OpenPolicy Error: %ld\n", status);
 238         } else {
 239
 240             /*
 241              * You have a handle to the policy object. Now, get the
 242              * domain information using LsaQueryInformationPolicy.
 243              */
 244             status = LsaQueryInformationPolicy(PolicyHandle,
 245                                                PolicyPrimaryDomainInformation,
 246                                                (void **)&ppdiDomainInfo);
 247             if (status) {
 248                 debug("LsaQueryInformationPolicy Error: %ld\n", status);
 249             } else  {
 250
 251                 /* Get name in useable format */
 252                 DomainName = AllocStrFromLSAStr(ppdiDomainInfo->Name);
 253
 254                 /*
 255                  * Check the Sid pointer, if it is null, the
 256                  * workstation is either a stand-alone computer
 257                  * or a member of a workgroup.
 258                  */
 259                 if (ppdiDomainInfo->Sid) {
 260
 261                     /*
 262                      * Member of a domain. Display it in debug mode.
 263                      */
 264                     debug("Member of Domain %s\n",DomainName);
 265                 } else {
 266                     DomainName = NULL;
 267                 }
 268             }
 269         }
 270
 271         /*
 272          * Clean up all the memory buffers created by the LSA and
 273          * Net* APIs.
 274          */
 275         NetApiBufferFree(pwkiWorkstationInfo);
 276         LsaFreeMemory((LPVOID)ppdiDomainInfo);
 277     } else
 278         debug("NetWkstaGetInfo Error: %ld\n", netret);
 279     return DomainName;
 280 }
 281
 282 /*
 283  * Fills auth with the user's credentials.
 284  *
 285  * In case of problem returns one of the
 286  * codes defined in libntlmauth/ntlmauth.h
 287  */
 288 int
 289 ntlm_check_auth(ntlm_authenticate * auth, char *user, char *domain, int auth_length)
 290 {
 291     int x;
 292     int rv;
 293     char credentials[DNLEN+UNLEN+2];    /* we can afford to waste */
 294
 295     if (!NTLM_LocalCall) {
 296
 297         user[0] = '\0';
 298         domain[0] = '\0';
 299         x = ntlm_unpack_auth(auth, user, domain, auth_length);
 300
 301         if (x != NTLM_ERR_NONE)
 302             return x;
 303
 304         if (domain[0] == '\0') {
 305             debug("No domain supplied. Returning no-auth\n");
 306             return NTLM_BAD_REQUEST;
 307         }
 308         if (user[0] == '\0') {
 309             debug("No username supplied. Returning no-auth\n");
 310             return NTLM_BAD_REQUEST;
 311         }
 312         debug("checking domain: '%s', user: '%s'\n", domain, user);
 313
 314     } else
 315         debug("checking local user\n");
 316
 317     snprintf(credentials, DNLEN+UNLEN+2, "%s\\%s", domain, user);
 318
 319     rv = SSP_ValidateNTLMCredentials(auth, auth_length, credentials);
 320
 321     debug("Login attempt had result %d\n", rv);
 322
 323     if (!rv) {          /* failed */
 324         return NTLM_SSPI_ERROR;
 325     }
 326
 327     if (UseAllowedGroup) {
 328         if (!Valid_Group(credentials, NTAllowedGroup)) {
 329             debug("User %s not in allowed Group %s\n", credentials, NTAllowedGroup);
 330             return NTLM_BAD_NTGROUP;
 331         }
 332     }
 333     if (UseDisallowedGroup) {
 334         if (Valid_Group(credentials, NTDisAllowedGroup)) {
 335             debug("User %s is in denied Group %s\n", credentials, NTDisAllowedGroup);
 336             return NTLM_BAD_NTGROUP;
 337         }
 338     }
 339
 340     debug("credentials: %s\n", credentials);
 341     return NTLM_ERR_NONE;
 342 }
 343
 344 void
 345 helperfail(const char *reason)
 346 {
 347 #if FAIL_DEBUG
 348     fail_debug_enabled =1;
 349 #endif
 350     SEND_BH(reason);
 351 }
 352
 353 /*
 354   options:
 355   -d enable debugging.
 356   -v enable verbose NTLM packet debugging.
 357   -A can specify a Windows Local Group name allowed to authenticate.
 358   -D can specify a Windows Local Group name not allowed to authenticate.
 359  */
 360 char *my_program_name = NULL;
 361
 362 void
 363 usage()
 364 {
 365     fprintf(stderr,
 366             "Usage: %s [-d] [-v] [-A|D LocalUserGroup] [-h]\n"
 367             " -d  enable debugging.\n"
 368             " -v  enable verbose NTLM packet debugging.\n"
 369             " -A  specify a Windows Local Group name allowed to authenticate\n"
 370             " -D  specify a Windows Local Group name not allowed to authenticate\n"
 371             " -h  this message\n\n",
 372             my_program_name);
 373 }
 374
 375 void
 376 process_options(int argc, char *argv[])
 377 {
 378     int opt, had_error = 0;
 379
 380     opterr =0;
 381     while (-1 != (opt = getopt(argc, argv, "hdvA:D:"))) {
 382         switch (opt) {
 383         case 'A':
 384             safe_free(NTAllowedGroup);
 385             NTAllowedGroup=xstrdup(optarg);
 386             UseAllowedGroup = 1;
 387             break;
 388         case 'D':
 389             safe_free(NTDisAllowedGroup);
 390             NTDisAllowedGroup=xstrdup(optarg);
 391             UseDisallowedGroup = 1;
 392             break;
 393         case 'd':
 394             debug_enabled = 1;
 395             break;
 396         case 'v':
 397             debug_enabled = 1;
 398             NTLM_packet_debug_enabled = 1;
 399             break;
 400         case 'h':
 401             usage();
 402             exit(0);
 403         case '?':
 404             opt = optopt;
 405         /* fall thru to default */
 406         default:
 407             fprintf(stderr, "unknown option: -%c. Exiting\n", opt);
 408             usage();
 409             had_error = 1;
 410         }
 411     }
 412     if (had_error)
 413         exit(1);
 414 }
 415
 416 int
 417 manage_request()
 418 {
 419     ntlmhdr *fast_header;
 420     char buf[HELPER_INPUT_BUFFER];
 421     char decoded[HELPER_INPUT_BUFFER];
 422     int decodedLen;
 423     char helper_command[3];
 424     int oversized = 0;
 425     char * ErrorMessage;
 426     static ntlm_negotiate local_nego;
 427     char domain[DNLEN+1];
 428     char user[UNLEN+1];
 429
 430     /* NP: for some reason this helper sometimes needs to accept
 431      * from clients that send no negotiate packet. */
 432     if (memcpy(local_nego.hdr.signature, "NTLMSSP", 8) != 0) {
 433         memset(&local_nego, 0, sizeof(ntlm_negotiate)); /* reset */
 434         memcpy(local_nego.hdr.signature, "NTLMSSP", 8);     /* set the signature */
 435         local_nego.hdr.type = le32toh(NTLM_NEGOTIATE);      /* this is a challenge */
 436         local_nego.flags = le32toh(NTLM_NEGOTIATE_ALWAYS_SIGN |
 437                                    NTLM_NEGOTIATE_USE_NTLM |
 438                                    NTLM_NEGOTIATE_USE_LM |
 439                                    NTLM_NEGOTIATE_ASCII );
 440     }
 441
 442     do {
 443         if (fgets(buf, sizeof(buf), stdin) == NULL)
 444             return 0;
 445
 446         char *c = static_cast<char*>(memchr(buf, '\n', sizeof(buf)));
 447         if (c) {
 448             if (oversized) {
 449                 helperfail("messge=\"illegal request received\"");
 450                 fprintf(stderr, "Illegal request received: '%s'\n", buf);
 451                 return 1;
 452             }
 453             *c = '\0';
 454         } else {
 455             fprintf(stderr, "No newline in '%s'\n", buf);
 456             oversized = 1;
 457             continue;
 458         }
 459     } while (false);
 460
 461     if ((strlen(buf) > 3) && NTLM_packet_debug_enabled) {
 462         decodedLen = base64_decode(decoded, sizeof(decoded), buf+3);
 463         strncpy(helper_command, buf, 2);
 464         debug("Got '%s' from Squid with data:\n", helper_command);
 465         hex_dump(reinterpret_cast<unsigned char*>(decoded), decodedLen);
 466     } else
 467         debug("Got '%s' from Squid\n", buf);
 468     if (memcmp(buf, "YR", 2) == 0) {    /* refresh-request */
 469         /* figure out what we got */
 470         if (strlen(buf) > 3)
 471             decodedLen = base64_decode(decoded, sizeof(decoded), buf+3);
 472         else {
 473             debug("Negotiate packet not supplied - self generated\n");
 474             memcpy(decoded, &local_nego, sizeof(local_nego));
 475             decodedLen = sizeof(local_nego);
 476         }
 477         if ((size_t)decodedLen < sizeof(ntlmhdr)) {     /* decoding failure, return error */
 478             SEND_ERR("message=\"Packet format error, couldn't base64-decode\"");
 479             return 1;
 480         }
 481         /* fast-track-decode request type. */
 482         fast_header = (struct _ntlmhdr *) decoded;
 483
 484         /* sanity-check: it IS a NTLMSSP packet, isn't it? */
 485         if (ntlm_validate_packet(fast_header, NTLM_ANY) != NTLM_ERR_NONE) {
 486             SEND_ERR("message=\"Broken authentication packet\"");
 487             return 1;
 488         }
 489         switch (fast_header->type) {
 490         case NTLM_NEGOTIATE: {
 491             /* Obtain challenge against SSPI */
 492             debug("attempting SSPI challenge retrieval\n");
 493             char *c = (char *) SSP_MakeChallenge((ntlm_negotiate *) decoded, decodedLen);
 494             if (c) {
 495                 SEND_TT(c);
 496                 if (NTLM_packet_debug_enabled) {
 497                     decodedLen = base64_decode(decoded, sizeof(decoded), c);
 498                     debug("send 'TT' to squid with data:\n");
 499                     hex_dump(reinterpret_cast<unsigned char*>(decoded), decodedLen);
 500                     if (NTLM_LocalCall) {
 501                         debug("NTLM Local Call detected\n");
 502                     }
 503                 }
 504                 have_challenge = 1;
 505             } else
 506                 helperfail("message=\"can't obtain challenge\"");
 507
 508             return 1;
 509         }
 510         /* notreached */
 511         case NTLM_CHALLENGE:
 512             SEND_ERR("message=\"Got a challenge. We refuse to have our authority disputed\"");
 513             return 1;
 514         /* notreached */
 515         case NTLM_AUTHENTICATE:
 516             SEND_ERR("message=\"Got authentication request instead of negotiate request\"");
 517             return 1;
 518         /* notreached */
 519         default:
 520             helperfail("message=\"unknown refresh-request packet type\"");
 521             return 1;
 522         }
 523         return 1;
 524     }
 525     if (memcmp(buf, "KK ", 3) == 0) {   /* authenticate-request */
 526         if (!have_challenge) {
 527             helperfail("message=\"invalid challenge\"");
 528             return 1;
 529         }
 530         /* figure out what we got */
 531         decodedLen = base64_decode(decoded, sizeof(decoded), buf+3);
 532
 533         if ((size_t)decodedLen < sizeof(ntlmhdr)) {     /* decoding failure, return error */
 534             SEND_ERR("message=\"Packet format error, couldn't base64-decode\"");
 535             return 1;
 536         }
 537         /* fast-track-decode request type. */
 538         fast_header = (struct _ntlmhdr *) decoded;
 539
 540         /* sanity-check: it IS a NTLMSSP packet, isn't it? */
 541         if (ntlm_validate_packet(fast_header, NTLM_ANY) != NTLM_ERR_NONE) {
 542             SEND_ERR("message=\"Broken authentication packet\"");
 543             return 1;
 544         }
 545         switch (fast_header->type) {
 546         case NTLM_NEGOTIATE:
 547             SEND_ERR("message=\"Invalid negotiation request received\"");
 548             return 1;
 549         /* notreached */
 550         case NTLM_CHALLENGE:
 551             SEND_ERR("message=\"Got a challenge. We refuse to have our authority disputed\"");
 552             return 1;
 553         /* notreached */
 554         case NTLM_AUTHENTICATE: {
 555             /* check against SSPI */
 556             int err = ntlm_check_auth((ntlm_authenticate *) decoded, user, domain, decodedLen);
 557             have_challenge = 0;
 558             if (err != NTLM_ERR_NONE) {
 559 #if FAIL_DEBUG
 560                 fail_debug_enabled =1;
 561 #endif
 562                 switch (err) {
 563                 case NTLM_ERR_NONE:
 564                     break;
 565                 case NTLM_BAD_NTGROUP:
 566                     SEND_ERR("message=\"Incorrect Group Membership\"");
 567                     return 1;
 568                 case NTLM_BAD_REQUEST:
 569                     SEND_ERR("message=\"Incorrect Request Format\"");
 570                     return 1;
 571                 case NTLM_SSPI_ERROR:
 572                     FormatMessage(
 573                         FORMAT_MESSAGE_ALLOCATE_BUFFER |
 574                         FORMAT_MESSAGE_FROM_SYSTEM |
 575                         FORMAT_MESSAGE_IGNORE_INSERTS,
 576                         NULL,
 577                         GetLastError(),
 578                         MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
 579                         (LPTSTR) &ErrorMessage,
 580                         0,
 581                         NULL);
 582                     if (ErrorMessage[strlen(ErrorMessage) - 1] == '\n')
 583                         ErrorMessage[strlen(ErrorMessage) - 1] = '\0';
 584                     if (ErrorMessage[strlen(ErrorMessage) - 1] == '\r')
 585                         ErrorMessage[strlen(ErrorMessage) - 1] = '\0';
 586                     SEND_ERR(ErrorMessage); // TODO update to new syntax
 587                     LocalFree(ErrorMessage);
 588                     return 1;
 589                 default:
 590                     SEND_ERR("message=\"Unknown Error\"");
 591                     return 1;
 592                 }
 593             }
 594             /* let's lowercase them for our convenience */
 595             lc(domain);
 596             lc(user);
 597             fprintf(stdout, "OK user=\"%s\\%s\"", domain, user);
 598             return 1;
 599         }
 600         default:
 601             helperfail("message=\"unknown authentication packet type\"");
 602             return 1;
 603         }
 604         return 1;
 605     } else {    /* not an auth-request */
 606         helperfail("message=\"illegal request received\"");
 607         fprintf(stderr, "Illegal request received: '%s'\n", buf);
 608         return 1;
 609     }
 610     helperfail("message=\"detected protocol error\"");
 611     return 1;
 612     /********* END ********/
 613 }
 614
 615 int
 616 main(int argc, char *argv[])
 617 {
 618     my_program_name = argv[0];
 619
 620     process_options(argc, argv);
 621
 622     debug("%s build " __DATE__ ", " __TIME__ " starting up...\n", my_program_name);
 623
 624     if (LoadSecurityDll(SSP_NTLM, NTLM_PACKAGE_NAME) == NULL) {
 625         fprintf(stderr, "FATAL, can't initialize SSPI, exiting.\n");
 626         exit(1);
 627     }
 628     debug("SSPI initialized OK\n");
 629
 630     atexit(UnloadSecurityDll);
 631
 632     /* initialize FDescs */
 633     setbuf(stdout, NULL);
 634     setbuf(stderr, NULL);
 635
 636     while (manage_request()) {
 637         /* everything is done within manage_request */
 638     }
 639     exit(0);
 640 }
 641