2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
10 * negotiate_sspi_auth: helper for Negotiate Authentication for Squid Cache
12 * (C)2005 Guido Serassio - Acme Consulting S.r.l.
15 * Guido Serassio <guido.serassio@acmeconsulting.it>
16 * Acme Consulting S.r.l., Italy <http://www.acmeconsulting.it>
18 * With contributions from others mentioned in the change history section
21 * Based on previous work of Francesco Chemolli and Robert Collins.
23 * Dependencies: Windows 2000 and later.
25 * This program is free software; you can redistribute it and/or modify
26 * it under the terms of the GNU General Public License as published by
27 * the Free Software Foundation; either version 2 of the License, or
28 * (at your option) any later version.
30 * This program is distributed in the hope that it will be useful,
31 * but WITHOUT ANY WARRANTY; without even the implied warranty of
32 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
33 * GNU General Public License for more details.
35 * You should have received a copy of the GNU General Public License
36 * along with this program; if not, write to the Free Software
37 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
42 * 29-10-2005 Guido Serassio
48 #include "helper/protocol_defines.h"
49 #include "ntlmauth/ntlmauth.h"
50 #include "ntlmauth/support_bits.cci"
51 #include "sspi/sspwin32.h"
59 int Negotiate_packet_debug_enabled
= 0;
60 static int have_serverblob
;
62 /* A couple of harmless helper macros */
63 #define SEND(X) debug("sending '%s' to squid\n",X); printf(X "\n");
65 #define SEND2(X,Y...) debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);
66 #define SEND3(X,Y...) debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);
68 /* no gcc, no debugging. varargs macros are a gcc extension */
69 #define SEND2(X,Y) debug("sending '" X "' to squid\n",Y); printf(X "\n",Y);
70 #define SEND3(X,Y,Z) debug("sending '" X "' to squid\n",Y,Z); printf(X "\n",Y,Z);
75 * -d enable debugging.
76 * -v enable verbose Negotiate packet debugging.
78 char *my_program_name
= nullptr;
84 "Usage: %s [-d] [-v] [-h]\n"
85 " -d enable debugging.\n"
86 " -v enable verbose Negotiate packet debugging.\n"
87 " -h this message\n\n",
92 process_options(int argc
, char *argv
[])
94 int opt
, had_error
= 0;
97 while (-1 != (opt
= getopt(argc
, argv
, "hdv"))) {
104 Negotiate_packet_debug_enabled
= 1;
113 fprintf(stderr
, "ERROR: unknown option: -%c. Exiting\n", opt
);
123 token_decode(size_t *decodedLen
, uint8_t decoded
[], const char *buf
)
125 struct base64_decode_ctx ctx
;
126 base64_decode_init(&ctx
);
127 if (!base64_decode_update(&ctx
, decodedLen
, decoded
, strlen(buf
), buf
) ||
128 !base64_decode_final(&ctx
)) {
129 SEND("BH base64 decode failed");
130 fprintf(stderr
, "ERROR: base64 decoding failed for: '%s'\n", buf
);
139 char buf
[HELPER_INPUT_BUFFER
];
140 uint8_t decoded
[HELPER_INPUT_BUFFER
];
141 size_t decodedLen
= 0;
142 char helper_command
[3];
147 static char cred
[SSP_MAX_CRED_LEN
+ 1];
151 if (fgets(buf
, HELPER_INPUT_BUFFER
, stdin
))
154 c
= static_cast<char*>(memchr(buf
, '\n', HELPER_INPUT_BUFFER
));
157 SEND("BH illegal request received");
158 fprintf(stderr
, "ERROR: Illegal request received: '%s'\n", buf
);
163 fprintf(stderr
, "No newline in '%s'\n", buf
);
168 if ((strlen(buf
) > 3) && Negotiate_packet_debug_enabled
) {
169 if (!token_decode(&decodedLen
, decoded
, buf
+3))
171 strncpy(helper_command
, buf
, 2);
172 debug("Got '%s' from Squid with data:\n", helper_command
);
173 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
175 debug("Got '%s' from Squid\n", buf
);
177 if (memcmp(buf
, "YR ", 3) == 0) { /* refresh-request */
178 /* figure out what we got */
179 if (!decodedLen
/* already decoded */ && !token_decode(&decodedLen
, decoded
, buf
+3))
181 if (decodedLen
< sizeof(ntlmhdr
)) { /* decoding failure, return error */
182 SEND("NA * Packet format error");
185 /* Obtain server blob against SSPI */
186 c
= (char *) SSP_MakeNegotiateBlob(decoded
, decodedLen
, &Done
, &status
, cred
);
188 if (status
== SSP_OK
) {
190 lc(cred
); /* let's lowercase them for our convenience */
193 if (Negotiate_packet_debug_enabled
) {
194 if (!token_decode(&decodedLen
, decoded
, c
))
196 debug("sending 'AF' %s to squid with data:\n", cred
);
198 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
200 fprintf(stderr
, "No data available.\n");
201 printf("AF %s %s\n", c
, cred
);
203 SEND3("AF %s %s", c
, cred
);
205 if (Negotiate_packet_debug_enabled
) {
206 if (!token_decode(&decodedLen
, decoded
, c
))
208 debug("sending 'TT' to squid with data:\n");
209 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
210 printf("TT %s\n", c
);
217 SEND("BH can't obtain server blob");
220 if (memcmp(buf
, "KK ", 3) == 0) { /* authenticate-request */
221 if (!have_serverblob
) {
222 SEND("BH invalid server blob");
225 /* figure out what we got */
226 if (!decodedLen
/* already decoded */ && !token_decode(&decodedLen
, decoded
, buf
+3))
228 if (decodedLen
< sizeof(ntlmhdr
)) { /* decoding failure, return error */
229 SEND("NA * Packet format error");
232 /* check against SSPI */
233 c
= (char *) SSP_ValidateNegotiateCredentials(decoded
, decodedLen
, &Done
, &status
, cred
);
235 if (status
== SSP_ERROR
) {
236 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER
| FORMAT_MESSAGE_FROM_SYSTEM
|
237 FORMAT_MESSAGE_IGNORE_INSERTS
,
240 MAKELANGID(LANG_NEUTRAL
, SUBLANG_DEFAULT
), /* Default language */
241 (LPTSTR
) & ErrorMessage
,
244 if (ErrorMessage
[strlen(ErrorMessage
) - 1] == '\n')
245 ErrorMessage
[strlen(ErrorMessage
) - 1] = '\0';
246 if (ErrorMessage
[strlen(ErrorMessage
) - 1] == '\r')
247 ErrorMessage
[strlen(ErrorMessage
) - 1] = '\0';
248 SEND2("NA * %s", ErrorMessage
);
249 LocalFree(ErrorMessage
);
253 lc(cred
); /* let's lowercase them for our convenience */
256 if (Negotiate_packet_debug_enabled
) {
257 if (!token_decode(&decodedLen
, decoded
, c
))
259 debug("sending 'AF' %s to squid with data:\n", cred
);
261 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
263 fprintf(stderr
, "No data available.\n");
264 printf("AF %s %s\n", c
, cred
);
266 SEND3("AF %s %s", c
, cred
);
270 if (Negotiate_packet_debug_enabled
) {
271 if (!token_decode(&decodedLen
, decoded
, c
))
273 debug("sending 'TT' to squid with data:\n");
274 hex_dump(reinterpret_cast<unsigned char*>(decoded
), decodedLen
);
275 printf("TT %s\n", c
);
281 } else { /* not an auth-request */
282 SEND("BH illegal request received");
283 fprintf(stderr
, "Illegal request received: '%s'\n", buf
);
286 SEND("BH detected protocol error");
288 /********* END ********/
292 main(int argc
, char *argv
[])
294 my_program_name
= argv
[0];
296 process_options(argc
, argv
);
298 debug("%s " VERSION
" " SQUID_BUILD_INFO
" starting up...\n", my_program_name
);
300 if (LoadSecurityDll(SSP_NTLM
, NEGOTIATE_PACKAGE_NAME
) == NULL
) {
301 fprintf(stderr
, "FATAL: %s: can't initialize SSPI, exiting.\n", argv
[0]);
304 debug("SSPI initialized OK\n");
306 atexit(UnloadSecurityDll
);
308 /* initialize FDescs */
309 setbuf(stdout
, nullptr);
310 setbuf(stderr
, nullptr);
312 while (manage_request()) {
313 /* everything is done within manage_request */