libexec_PROGRAMS = basic_msnt_auth
basic_msnt_auth_SOURCES = \
- allowusers.cc \
- confload.cc \
- denyusers.cc \
msntauth.cc \
msntauth.h \
- usersfile.cc \
- usersfile.h \
valid.cc \
valid.h
+++ /dev/null
-/*
- * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
- *
- * Squid software is distributed under GPLv2+ license and includes
- * contributions from numerous individuals and organizations.
- * Please see the COPYING and CONTRIBUTORS files for details.
- */
-
-/*
- * allowusers.c
- * (C) 2000 Antonino Iannella, Stellar-X Pty Ltd
- * Released under GPL, see COPYING-2.0 for details.
- *
- * These routines are to allow users attempting to use the proxy which
- * have been explicitly allowed by the system administrator.
- * The code originated from denyusers.c.
- */
-
-#include "squid.h"
-#include "msntauth.h"
-#include "usersfile.h"
-
-#include <cstdlib>
-#include <cstring>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/param.h>
-
-static usersfile AllowUsers;
-static int init = 0;
-
-/* shared */
-char Allowuserpath[MAXPATHLEN]; /* MAXPATHLEN defined in param.h */
-
-int
-Read_allowusers(void)
-{
- if (!init) {
- memset(&AllowUsers, '\0', sizeof(AllowUsers));
- init = 1;
- }
- if (*Allowuserpath)
- return Read_usersfile(Allowuserpath, &AllowUsers);
- else
- return 0;
-}
-
-int
-Check_ifuserallowed(char *ConnectingUser)
-{
- return Check_userlist(&AllowUsers, ConnectingUser);
-}
-
-void
-Check_forallowchange(void)
-{
- Check_forfilechange(&AllowUsers);
-}
#include <csignal>
#include <cstring>
+#include <iostream>
+#include <string>
+#include <vector> //todo: turn into multimap
#include <syslog.h>
#include "msntauth.h"
+#include "valid.h"
extern char version[];
-char msntauth_version[] = "Msntauth v2.0.3 (C) 2 Sep 2001 Stellar-X Antonino Iannella.\nModified by the Squid HTTP Proxy team 26 Jun 2002";
+char msntauth_version[] = "Msntauth v2.0.3 (C) 2 Sep 2001 Stellar-X Antonino Iannella.\nModified by the Squid HTTP Proxy team 2002-2014";
-/* Main program for simple authentication.
- * Reads the denied user file. Sets alarm timer.
- * Scans and checks for Squid input, and attempts to validate the user.
- */
+//todo: turn into a multimap
+struct domaincontroller {
+ std::string domain;
+ std::string server;
+};
+std::vector<domaincontroller> domaincontrollers;
+bool
+validate_user(char *username, char *password)
+{
+ for (domaincontroller dc : domaincontrollers) {
+ if (Valid_User(username, password, dc.server.c_str(), NULL, dc.domain.c_str()))
+ return true;
+ }
+ return false;
+}
+// arguments: domain/server_name
int
main(int argc, char **argv)
{
openlog("msnt_auth", LOG_PID, LOG_USER);
setbuf(stdout, NULL);
- /* Read configuration file. Abort wildly if error. */
- if (OpenConfigFile() == 1)
- return 1;
-
- /*
- * Read denied and allowed user files.
- * If they fails, there is a serious problem.
- * Check syslog messages. Deny all users while in this state.
- * The msntauth process should then be killed.
- */
- if ((Read_denyusers() == 1) || (Read_allowusers() == 1)) {
- while (1) {
- memset(wstr, '\0', sizeof(wstr));
- if (fgets(wstr, 255, stdin) == NULL)
- break;
- puts("ERR");
- }
- return 1;
+ for (int j = 1; j < argc; ++j) {
+ std::string arg = argv[j];
+ size_t pos=arg.find('/');
+ if (arg.find('/',pos+1)) {
+ std::cerr << "Error: can't understand domain controller specification '"
+ << arg << '"' << std::endl;
+ exit(1);
+ }
+ domaincontroller dc;
+ dc.domain = arg.substr(0,pos);
+ dc.server = arg.substr(pos+1);
+ if (dc.domain.length() == 0 || dc.server.length() == 0) {
+ std::cerr << "Error: invalid domain specification in '" << arg <<
+ "'" << std::endl;
+ exit(1);
+ }
+ domaincontrollers.push_back(dc);
}
- /*
- * Make Check_forchange() the handle for HUP signals.
- * Don't use alarms any more. I don't think it was very
- * portable between systems.
- * XXX this should be sigaction()
- */
- signal(SIGHUP, Check_forchange);
-
while (1) {
int n;
/* Read whole line from standard input. Terminate on break. */
/*
* extract username and password.
- * XXX is sscanf() safe?
*/
username[0] = '\0';
password[0] = '\0';
puts("ERR");
continue;
}
- Checktimer(); /* Check if the user lists have changed */
rfc1738_unescape(username);
rfc1738_unescape(password);
- /*
- * Check if user is explicitly denied or allowed.
- * If user passes both checks, they can be authenticated.
- */
- if (Check_user(username) == 1) {
- syslog(LOG_INFO, "'%s' denied", username);
- puts("ERR");
- } else if (QueryServers(username, password) == 0)
+ if (validate_user(username, password)) {
puts("OK");
- else {
+ } else {
syslog(LOG_INFO, "'%s' login failed", username);
puts("ERR");
}
#ifndef _SQUID_HELPERS_BASIC_AUTH_MSNT_MSNTAUTH_H
#define _SQUID_HELPERS_BASIC_AUTH_MSNT_MSNTAUTH_H
-extern int OpenConfigFile(void);
extern int QueryServers(char *, char *);
-extern void Checktimer(void);
-extern "C" void Check_forchange(int);
-extern int Read_denyusers(void);
-extern int Read_allowusers(void);
-extern int Check_user(char *);
-extern int QueryServers(char *, char *);
-extern int Check_ifuserallowed(char *ConnectingUser);
extern void Check_forallowchange(void);
#endif /* _SQUID_HELPERS_BASIC_AUTH_MSNT_MSNTAUTH_H */
#include "smblib/smblib.h"
#include "valid.h"
+
+//TODO: remove BACKUP
int
-Valid_User(char *USERNAME, char *PASSWORD, char *SERVER, char *BACKUP, char *DOMAIN)
+Valid_User(char *USERNAME, char *PASSWORD, const char *SERVER, char *BACKUP, const char *DOMAIN)
{
const char *supportedDialects[] = {"PC NETWORK PROGRAM 1.0",
- "MICROSOFT NETWORKS 1.03",
+ "MICchecROSOFT NETWORKS 1.03",
"MICROSOFT NETWORKS 3.0",
"LANMAN1.0",
"LM1.2X002",
#define NTV_PROTOCOL_ERROR 2
#define NTV_LOGON_ERROR 3
-int Valid_User(char *USERNAME, char *PASSWORD, char *SERVER, char *BACKUP, char *DOMAIN);
+int Valid_User(char *USERNAME, char *PASSWORD, const char *SERVER, char *BACKUP, const char *DOMAIN);
#endif
NetApiBufferFree(pBuf);
return result;
}
-
-/* Valid_User return codes -
- 0 - User authenticated successfully.
- 1 - Server error.
- 2 - Group membership error.
- 3 - Logon error; Incorrect password or username given.
-*/
-
-int
-Valid_User(char *UserName, char *Password, char *Group)
-{
- int result = NTV_SERVER_ERROR;
- size_t i;
- char NTDomain[256];
- char *domain_qualify = NULL;
- char DomainUser[256];
- char User[256];
-
- errormsg = NTV_SERVER_ERROR_MSG;
- strncpy(NTDomain, UserName, sizeof(NTDomain));
-
- for (i=0; i < strlen(NTV_VALID_DOMAIN_SEPARATOR); ++i) {
- if ((domain_qualify = strchr(NTDomain, NTV_VALID_DOMAIN_SEPARATOR[i])) != NULL)
- break;
- }
- if (domain_qualify == NULL) {
- strcpy(User, NTDomain);
- strcpy(NTDomain, Default_NTDomain);
- } else {
- strcpy(User, domain_qualify + 1);
- domain_qualify[0] = '\0';
- }
- /* Log the client on to the local computer. */
- if (!SSP_LogonUser(User, Password, NTDomain)) {
- result = NTV_LOGON_ERROR;
- errormsg = NTV_LOGON_ERROR_MSG;
- debug("%s\n", errormsg);
- } else {
- result = NTV_NO_ERROR;
- if (strcmp(NTDomain, NTV_DEFAULT_DOMAIN) == 0)
- strcpy(DomainUser, User);
- else {
- strcpy(DomainUser, NTDomain);
- strcat(DomainUser, "\\");
- strcat(DomainUser, User);
- }
- if (UseAllowedGroup) {
- if (!Valid_Group(DomainUser, NTAllowedGroup)) {
- result = NTV_GROUP_ERROR;
- errormsg = NTV_GROUP_ERROR_MSG;
- debug("%s\n", errormsg);
- }
- }
- if (UseDisallowedGroup) {
- if (Valid_Group(DomainUser, NTDisAllowedGroup)) {
- result = NTV_GROUP_ERROR;
- errormsg = NTV_GROUP_ERROR_MSG;
- debug("%s\n", errormsg);
- }
- }
- }
- return result;
-}
}
#endif /* __GNUC__ */
-int Valid_User(char *,char *, char *);
-
#endif
/* or anything else ... */
SMB_Handle_Type SMB_Connect_Server(SMB_Handle_Type Con_Handle,
- char *server, const char *NTdomain)
+ const char *server, const char *NTdomain)
{
SMB_Handle_Type con;
/* Connect to a server, but do not do a tree con etc ... */
SMB_Handle_Type SMB_Connect_Server(SMB_Handle_Type Con_Handle,
- char *server,
+ const char *server,
const char *NTdomain);
/* Connect to a server and give us back a handle. If Con == NULL, create */
projects / thirdparty / squid.git / commitdiff
