winbind helpers cleanup by Guido

- wb_ntlmauth (ntlm): Fixed error message on wrong command line
- wb_auth (basic): Added same command line handling and fix to Squid
potential DoS issue as wb_ntlmauth.
- wb_group (External ACL): Added same command line handling and fix to
Squid potential DoS issue as wb_ntlmauth.

diff --git a/helpers/basic_auth/winbind/wb_basic_auth.c b/helpers/basic_auth/winbind/wb_basic_auth.c
index 762e13a61329947ff610bb01a682e84899b0a05d..1c7f94a8021cc20d3e9ef4bd8ac6ce2da2df5038 100644 (file)
--- a/helpers/basic_auth/winbind/wb_basic_auth.c
+++ b/helpers/basic_auth/winbind/wb_basic_auth.c
@@ -31,6 +31,7 @@
 char debug_enabled=0;
 char *myname;
 pid_t mypid;
+int err = 0;
 
 NSS_STATUS winbindd_request(int req_type,
                            struct winbindd_request *request,
@@ -62,19 +63,35 @@ void do_authenticate(char *user, char *pass)
     return;            /* useless */
 }
 
+static void
+usage(char *program)
+{
+    fprintf(stderr,"Usage: %s [-d] [-h]\n"
+               " -d      enable debugging\n"
+               " -h      this message\n",
+               program);
+}
 
 void
 process_options(int argc, char *argv[])
 {
     int opt;
 
-    while (-1 != (opt = getopt(argc, argv, "d"))) {
+    opterr = 0;
+    while (-1 != (opt = getopt(argc, argv, "dh"))) {
        switch (opt) {
        case 'd':
            debug_enabled = 1;
            break;
+       case 'h':
+           usage(argv[0]);
+           exit(0);
+       case '?':
+           opt = optopt;
+           /* fall thru to default */
        default:
-           warn("Unknown option: -%c. Exiting\n", opt);
+           warn("Unknown option: -%c\n\n", opt);
+           usage(argv[0]);
            exit(1);
            break;              /* not reached */
        }
@@ -82,7 +99,6 @@ process_options(int argc, char *argv[])
     return;
 }
 
-
 void manage_request(void)
 {
     char buf[BUFFER_SIZE+1];
@@ -97,14 +113,27 @@ void manage_request(void)
        
     c=memchr(buf,'\n',BUFFER_SIZE);
     if (c) {
-       *c='\0';
-       length=c-buf;
+       *c = '\0';
+       length = c-buf;
     } else {
-       warn("No newline in '%s'. Dying.\n",buf);
-       exit(1);
+       err = 1;
+       return;
+    }
+    if (err) {
+       warn("Oversized message\n");
+       SEND("ERR");
+       err = 0;
+       return;
     }
   
     debug("Got '%s' from squid (length: %d).\n",buf,length);
+
+    if (buf[0] == '\0') {
+       warn("Invalid Request\n");
+       SEND("ERR");
+       return;
+    }
+
     user=buf;
 
     pass=memchr(buf,' ',length);

diff --git a/helpers/basic_auth/winbind/wbntlm.h b/helpers/basic_auth/winbind/wbntlm.h
index 1b01f4709546ed02df8eebaf6d0e0a7cd8ab703d..0abce5def611e4e7545c0b486b6688bbee03897a 100644 (file)
--- a/helpers/basic_auth/winbind/wbntlm.h
+++ b/helpers/basic_auth/winbind/wbntlm.h
@@ -33,8 +33,6 @@
 /* the attempted entropy source. If it doesn't exist, random() is uesed */
 #define ENTROPY_SOURCE "/dev/urandom"
 
-#define DOMAIN "GCSINT"         /* TODO: fix ntlm_make_challenge */
-
 /************* END CONFIGURATION *************/
 
 /* Debugging stuff */

diff --git a/helpers/external_acl/winbind_group/wb_check_group.c b/helpers/external_acl/winbind_group/wb_check_group.c
index 3ecdf8dec50961f899664d34fc91f3728f0f3522..9052d546c1130d4f04b7809d636c73d3d68c0d9a 100755 (executable)
--- a/helpers/external_acl/winbind_group/wb_check_group.c
+++ b/helpers/external_acl/winbind_group/wb_check_group.c
@@ -1,5 +1,5 @@
 /*
- * $Id: wb_check_group.c,v 1.2 2002/07/07 21:36:58 hno Exp $
+ * $Id: wb_check_group.c,v 1.3 2002/07/20 11:26:20 hno Exp $
  *
  * This is a helper for the external ACL interface for Squid Cache
  * Copyright (C) 2002 Guido Serassio <squidnt@serassio.it>
@@ -186,18 +186,35 @@ Valid_Group(char *UserName, char *UserGroup)
     return match;
 }
 
+static void
+usage(char *program)
+{
+    fprintf(stderr,"Usage: %s [-d] [-h]\n"
+               " -d      enable debugging\n"
+               " -h      this message\n",
+               program);
+}
+
 void
 process_options(int argc, char *argv[])
 {
     int opt;
 
-    while (-1 != (opt = getopt(argc, argv, "d"))) {
+    opterr = 0;
+    while (-1 != (opt = getopt(argc, argv, "dh"))) {
        switch (opt) {
        case 'd':
            debug_enabled = 1;
            break;
+       case 'h':
+           usage(argv[0]);
+           exit(0);
+       case '?':
+           opt = optopt;
+           /* fall thru to default */
        default:
-           warn("Unknown option: -%c. Exiting\n", opt);
+           warn("Unknown option: -%c\n\n", opt);
+           usage(argv[0]);
            exit(1);
            break;              /* not reached */
        }
@@ -212,6 +229,7 @@ main (int argc, char *argv[])
     char buf[BUFSIZE];
     char *username;
     char *group;
+    int err = 0;
 
     if (argc > 0) {    /* should always be true */
        myname=strrchr(argv[0],'/');
@@ -234,22 +252,37 @@ main (int argc, char *argv[])
     /* Main Loop */
     while (fgets (buf, BUFSIZE, stdin))
     {
-       
+       if (NULL == strchr(buf, '\n')) {
+           err = 1;
+           continue;
+       }
+       if (err) {
+           warn("Oversized message\n");
+           goto error;
+       }
+
        if ((p = strchr(buf, '\n')) != NULL)
            *p = '\0';          /* strip \n */
        if ((p = strchr(buf, '\r')) != NULL)
            *p = '\0';          /* strip \r */
 
        debug("Got '%s' from Squid (length: %d).\n",buf,sizeof(buf));
-       
+
+       if (buf[0] == '\0') {
+           warn("Invalid Request\n");
+           goto error;
+       }
+
        username = strwordtok(buf, &t);
        group = strwordtok(NULL, &t);
 
        if (Valid_Group(username, group)) {
            printf ("OK\n");
        } else {
+error:
            printf ("ERR\n");
        }
+       err = 0;
     }
     return 0;
 }

diff --git a/helpers/ntlm_auth/winbind/wb_ntlm_auth.c b/helpers/ntlm_auth/winbind/wb_ntlm_auth.c
index a7cd3627d8a9b1c0ccc0238a928e997520d549e7..a8be7fa109efb3574d322b941764f6eaba17adea 100644 (file)
--- a/helpers/ntlm_auth/winbind/wb_ntlm_auth.c
+++ b/helpers/ntlm_auth/winbind/wb_ntlm_auth.c
@@ -17,9 +17,7 @@
  */
 /*
  * TODO:
- * -add handling of the -d flag
  * -move all squid-helper-protocol-related operations to helper functions
- * -remove the hard-coded target NT domain name
  *
  * - MAYBE move squid-helper-protocol-related opetations to an external
  *   library?
@@ -363,7 +361,7 @@ usage(char *program)
 {
     fprintf(stderr,"Usage: %s [-d] [-h] [domain]\n"
                " -d      enable debugging\n"
-               " -hi     this message\n"
+               " -h      this message\n"
                " domain  target domain, if different from the winbind configuration\n",
                program);
 }
@@ -374,6 +372,7 @@ process_options(int argc, char *argv[])
     int opt;
     char *target_domain = NULL;
 
+    opterr = 0;
     while (-1 != (opt = getopt(argc, argv, "dh"))) {
        switch (opt) {
        case 'd':
@@ -382,6 +381,9 @@ process_options(int argc, char *argv[])
        case 'h':
            usage(argv[0]);
            exit(0);
+       case '?':
+           opt = optopt;
+           /* fall thru to default */
        default:
            warn("Unknown option: -%c\n\n", opt);
            usage(argv[0]);