negotiate_wrapper.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /*
10  * -----------------------------------------------------------------------------
11  *
12  * Author: Markus Moeller (markus_moeller at compuserve.com)
13  *
14  * Copyright (C) 2011 Markus Moeller. All rights reserved.
15  *
16  * This program is free software; you can redistribute it and/or modify
17  * it under the terms of the GNU General Public License as published by
18  * the Free Software Foundation; either version 2 of the License, or
19  * (at your option) any later version.
20  *
21  * This program is distributed in the hope that it will be useful,
22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24  * GNU General Public License for more details.
25  *
26  * You should have received a copy of the GNU General Public License
27  * along with this program; if not, write to the Free Software
28  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
29  *
30  * -----------------------------------------------------------------------------
31  */
32 
33 #include "squid.h"
34 #include "base64.h"
35 
36 #include <cerrno>
37 #include <cstring>
38 #include <cstdlib>
39 #include <ctime>
40 #if HAVE_NETDB_H
41 #include <netdb.h>
42 #endif
43 #if HAVE_UNISTD_H
44 #include <unistd.h>
45 #endif
46 
47 #if !defined(HAVE_DECL_XMALLOC) || !HAVE_DECL_XMALLOC
48 #define xmalloc malloc
49 #endif
50 #if !defined(HAVE_DECL_XSTRDUP) || !HAVE_DECL_XSTRDUP
51 #define xstrdup strdup
52 #endif
53 #if !defined(HAVE_DECL_XFREE) || !HAVE_DECL_XFREE
54 #define xfree free
55 #endif
56 
57 #undef PROGRAM
58 #define PROGRAM "negotiate_wrapper"
59 #undef VERSION
60 #define VERSION "1.0.1"
61 
62 #ifndef MAX_AUTHTOKEN_LEN
63 #define MAX_AUTHTOKEN_LEN 65535
64 #endif
65 
66 static const unsigned char ntlmProtocol[] = {'N', 'T', 'L', 'M', 'S', 'S', 'P', 0};
67 
68 static const char *
70 {
71  struct timeval now;
72  static time_t last_t = 0;
73  static char buf[128];
74 
75  gettimeofday(&now, NULL);
76  if (now.tv_sec != last_t) {
77  time_t *tmp = (time_t *) & now.tv_sec;
78  struct tm *tm = localtime(tmp);
79  strftime(buf, 127, "%Y/%m/%d %H:%M:%S", tm);
80  last_t = now.tv_sec;
81  }
82  return buf;
83 }
84 
85 static void
87 {
88  fprintf(stderr, "Usage: \n");
89  fprintf(stderr, "negotiate_wrapper [-h] [-d] --ntlm ntlm helper + arguments --kerberos kerberos helper + arguments\n");
90  fprintf(stderr, "-h help\n");
91  fprintf(stderr, "-d full debug\n");
92  fprintf(stderr, "--ntlm full ntlm helper path with arguments\n");
93  fprintf(stderr, "--kerberos full kerberos helper path with arguments\n");
94 }
95 
96 static void
97 closeFds(FILE *a, FILE *b, FILE *c, FILE *d)
98 {
99  if (a)
100  fclose(a);
101  if (b)
102  fclose(b);
103  if (c)
104  fclose(c);
105  if (d)
106  fclose(d);
107 }
108 
109 static int
110 processingLoop(FILE *FDKIN, FILE *FDKOUT, FILE *FDNIN, FILE *FDNOUT)
111 {
112  char buf[MAX_AUTHTOKEN_LEN];
113  char tbuff[MAX_AUTHTOKEN_LEN];
114  char buff[MAX_AUTHTOKEN_LEN+2];
115  char *c;
116  size_t length;
117  uint8_t *token = NULL;
118 
119  while (1) {
120  if (fgets(buf, sizeof(buf) - 1, stdin) == NULL) {
121  xfree(token);
122  if (ferror(stdin)) {
123  if (debug_enabled)
124  fprintf(stderr,
125  "%s| %s: fgets() failed! dying..... errno=%d (%s)\n",
126  LogTime(), PROGRAM, ferror(stdin),
127  strerror(ferror(stdin)));
128 
129  fprintf(stdout, "BH input error\n");
130  return 1; /* BIIG buffer */
131  }
132  fprintf(stdout, "BH input error\n");
133  return 0;
134  }
135  c = static_cast<char*>(memchr(buf, '\n', sizeof(buf) - 1));
136  if (c) {
137  *c = '\0';
138  length = c - buf;
139  if (debug_enabled)
140  fprintf(stderr, "%s| %s: Got '%s' from squid (length: %" PRIuSIZE ").\n",
141  LogTime(), PROGRAM, buf, length);
142  } else {
143  if (debug_enabled)
144  fprintf(stderr, "%s| %s: Oversized message\n", LogTime(),
145  PROGRAM);
146  fprintf(stdout, "BH Oversized message\n");
147  continue;
148  }
149 
150  if (buf[0] == '\0') {
151  if (debug_enabled)
152  fprintf(stderr, "%s| %s: Invalid request\n", LogTime(),
153  PROGRAM);
154  fprintf(stdout, "BH Invalid request\n");
155  continue;
156  }
157  if (strlen(buf) < 2) {
158  if (debug_enabled)
159  fprintf(stderr, "%s| %s: Invalid request [%s]\n", LogTime(),
160  PROGRAM, buf);
161  fprintf(stdout, "BH Invalid request\n");
162  continue;
163  }
164  if (!strncmp(buf, "QQ", 2)) {
165  fprintf(stdout, "BH quit command\n");
166  xfree(token);
167  return 0;
168  }
169  if (strncmp(buf, "YR", 2) && strncmp(buf, "KK", 2)) {
170  if (debug_enabled)
171  fprintf(stderr, "%s| %s: Invalid request [%s]\n", LogTime(),
172  PROGRAM, buf);
173  fprintf(stdout, "BH Invalid request\n");
174  continue;
175  }
176  if (strlen(buf) <= 3) {
177  if (debug_enabled)
178  fprintf(stderr, "%s| %s: Invalid negotiate request [%s]\n",
179  LogTime(), PROGRAM, buf);
180  fprintf(stdout, "BH Invalid negotiate request\n");
181  continue;
182  }
183  length = BASE64_DECODE_LENGTH(strlen(buf+3));
184  if (debug_enabled)
185  fprintf(stderr, "%s| %s: Decode '%s' (decoded length: %" PRIuSIZE ").\n",
186  LogTime(), PROGRAM, buf + 3, length);
187 
188  safe_free(token);
189  if (!(token = static_cast<uint8_t *>(xmalloc(length+1)))) {
190  fprintf(stderr, "%s| %s: Error allocating memory for token\n", LogTime(), PROGRAM);
191  return 1;
192  }
193 
194  struct base64_decode_ctx ctx;
195  base64_decode_init(&ctx);
196  size_t dstLen = 0;
197  if (!base64_decode_update(&ctx, &dstLen, token, strlen(buf+3), buf+3) ||
198  !base64_decode_final(&ctx)) {
199  if (debug_enabled)
200  fprintf(stderr, "%s| %s: Invalid base64 token [%s]\n", LogTime(), PROGRAM, buf+3);
201  fprintf(stdout, "BH Invalid negotiate request token\n");
202  continue;
203  }
204  assert(dstLen <= length);
205  length = dstLen;
206  token[dstLen] = '\0';
207 
208  if ((static_cast<size_t>(length) >= sizeof(ntlmProtocol) + 1) &&
209  (!memcmp(token, ntlmProtocol, sizeof ntlmProtocol))) {
210  if (debug_enabled)
211  fprintf(stderr, "%s| %s: received type %d NTLM token\n",
212  LogTime(), PROGRAM, (int) *((unsigned char *) token +
213  sizeof ntlmProtocol));
214  fprintf(FDNIN, "%s\n",buf);
215  if (fgets(tbuff, sizeof(tbuff) - 1, FDNOUT) == NULL) {
216  xfree(token);
217  if (ferror(FDNOUT)) {
218  fprintf(stderr,
219  "fgets() failed! dying..... errno=%d (%s)\n",
220  ferror(FDNOUT), strerror(ferror(FDNOUT)));
221  return 1;
222  }
223  fprintf(stderr, "%s| %s: Error reading NTLM helper response\n",
224  LogTime(), PROGRAM);
225  return 0;
226  }
227  /*
228  * Need to translate NTLM reply to Negotiate reply:
229  * AF user => AF blob user
230  * NA reason => NA blob reason
231  * Set blob to '='
232  */
233  if (strlen(tbuff) >= 3 && (!strncmp(tbuff,"AF ",3) || !strncmp(tbuff,"NA ",3))) {
234  strncpy(buff,tbuff,3);
235  buff[3]='=';
236  for (unsigned int i=2; i<=strlen(tbuff); ++i)
237  buff[i+2] = tbuff[i];
238  } else {
239  strcpy(buff,tbuff);
240  }
241  } else {
242  if (debug_enabled)
243  fprintf(stderr, "%s| %s: received Kerberos token\n",
244  LogTime(), PROGRAM);
245 
246  fprintf(FDKIN, "%s\n",buf);
247  if (fgets(buff, sizeof(buff) - 1, FDKOUT) == NULL) {
248  xfree(token);
249  if (ferror(FDKOUT)) {
250  fprintf(stderr,
251  "fgets() failed! dying..... errno=%d (%s)\n",
252  ferror(FDKOUT), strerror(ferror(FDKOUT)));
253  return 1;
254  }
255  fprintf(stderr, "%s| %s: Error reading Kerberos helper response\n",
256  LogTime(), PROGRAM);
257  return 0;
258  }
259  }
260  fprintf(stdout,"%s",buff);
261  if (debug_enabled)
262  fprintf(stderr, "%s| %s: Return '%s'\n",
263  LogTime(), PROGRAM, buff);
264  }
265 
266  xfree(token);
267  return 1;
268 }
269 
270 int
271 main(int argc, char *const argv[])
272 {
273  int nstart = 0, kstart = 0;
274  int nend = 0, kend = 0;
275  char **nargs, **kargs;
276  int fpid;
277  int pkin[2];
278  int pkout[2];
279  int pnin[2];
280  int pnout[2];
281 
282  setbuf(stdout, NULL);
283  setbuf(stdin, NULL);
284 
285  if (argc ==1 || !strncasecmp(argv[1],"-h",2)) {
286  usage();
287  exit(EXIT_SUCCESS);
288  }
289 
290  int j = 1;
291  if (!strncasecmp(argv[1],"-d",2)) {
292  debug_enabled = 1;
293  j = 2;
294  }
295 
296  for (int i=j; i<argc; ++i) {
297  if (!strncasecmp(argv[i],"--ntlm",6))
298  nstart = i;
299  if (!strncasecmp(argv[i],"--kerberos",10))
300  kstart = i;
301  }
302  if (nstart > kstart) {
303  kend = nstart-1;
304  nend = argc-1;
305  } else {
306  kend = argc-1;
307  nend = kstart-1;
308  }
309  if (nstart == 0 || kstart == 0 || kend-kstart <= 0 || nend-nstart <= 0 ) {
310  usage();
311  exit(EXIT_SUCCESS);
312  }
313 
314  if (debug_enabled)
315  fprintf(stderr, "%s| %s: Starting version %s\n", LogTime(), PROGRAM,
316  VERSION);
317 
318  if ((nargs = (char **)xmalloc((nend-nstart+1)*sizeof(char *))) == NULL) {
319  fprintf(stderr, "%s| %s: Error allocating memory for ntlm helper\n", LogTime(), PROGRAM);
320  exit(EXIT_FAILURE);
321  }
322  memcpy(nargs,argv+nstart+1,(nend-nstart)*sizeof(char *));
323  nargs[nend-nstart]=NULL;
324  if (debug_enabled) {
325  fprintf(stderr, "%s| %s: NTLM command: ", LogTime(), PROGRAM);
326  for (int i=0; i<nend-nstart; ++i)
327  fprintf(stderr, "%s ", nargs[i]);
328  fprintf(stderr, "\n");
329  }
330  if ((kargs = (char **)xmalloc((kend-kstart+1)*sizeof(char *))) == NULL) {
331  fprintf(stderr, "%s| %s: Error allocating memory for kerberos helper\n", LogTime(), PROGRAM);
332  exit(EXIT_FAILURE);
333  }
334  memcpy(kargs,argv+kstart+1,(kend-kstart)*sizeof(char *));
335  kargs[kend-kstart]=NULL;
336  if (debug_enabled) {
337  fprintf(stderr, "%s| %s: Kerberos command: ", LogTime(), PROGRAM);
338  for (int i=0; i<kend-kstart; ++i)
339  fprintf(stderr, "%s ", kargs[i]);
340  fprintf(stderr, "\n");
341  }
342  /*
343  Fork Kerberos helper and NTLM helper and manage IO to send NTLM requests
344  to the right helper. squid must keep session state
345  */
346 
347  if (pipe(pkin) < 0) {
348  fprintf(stderr, "%s| %s: Could not assign streams for pkin\n", LogTime(), PROGRAM);
349  exit(EXIT_FAILURE);
350  }
351  if (pipe(pkout) < 0) {
352  fprintf(stderr, "%s| %s: Could not assign streams for pkout\n", LogTime(), PROGRAM);
353  exit(EXIT_FAILURE);
354  }
355 
356  if (( fpid = vfork()) < 0 ) {
357  fprintf(stderr, "%s| %s: Failed first fork\n", LogTime(), PROGRAM);
358  exit(EXIT_FAILURE);
359  }
360 
361  if ( fpid == 0 ) {
362  /* First Child for Kerberos helper */
363 
364  close(pkin[1]);
365  dup2(pkin[0],STDIN_FILENO);
366  close(pkin[0]);
367 
368  close(pkout[0]);
369  dup2(pkout[1],STDOUT_FILENO);
370  close(pkout[1]);
371 
372  setbuf(stdin, NULL);
373  setbuf(stdout, NULL);
374 
375  execv(kargs[0], kargs);
376  fprintf(stderr, "%s| %s: Failed execv for %s: %s\n", LogTime(), PROGRAM, kargs[0], strerror(errno));
377  exit(EXIT_FAILURE);
378  }
379 
380  close(pkin[0]);
381  close(pkout[1]);
382 
383  if (pipe(pnin) < 0) {
384  fprintf(stderr, "%s| %s: Could not assign streams for pnin\n", LogTime(), PROGRAM);
385  exit(EXIT_FAILURE);
386  }
387  if (pipe(pnout) < 0) {
388  fprintf(stderr, "%s| %s: Could not assign streams for pnout\n", LogTime(), PROGRAM);
389  exit(EXIT_FAILURE);
390  }
391 
392  if (( fpid = vfork()) < 0 ) {
393  fprintf(stderr, "%s| %s: Failed second fork\n", LogTime(), PROGRAM);
394  exit(EXIT_FAILURE);
395  }
396 
397  if ( fpid == 0 ) {
398  /* Second Child for NTLM helper */
399 
400  close(pnin[1]);
401  dup2(pnin[0],STDIN_FILENO);
402  close(pnin[0]);
403 
404  close(pnout[0]);
405  dup2(pnout[1],STDOUT_FILENO);
406  close(pnout[1]);
407 
408  setbuf(stdin, NULL);
409  setbuf(stdout, NULL);
410 
411  execv(nargs[0], nargs);
412  fprintf(stderr, "%s| %s: Failed execv for %s: %s\n", LogTime(), PROGRAM, nargs[0], strerror(errno));
413  exit(EXIT_FAILURE);
414  }
415 
416  close(pnin[0]);
417  close(pnout[1]);
418 
419  FILE *FDKIN=fdopen(pkin[1],"w");
420  FILE *FDKOUT=fdopen(pkout[0],"r");
421 
422  FILE *FDNIN=fdopen(pnin[1],"w");
423  FILE *FDNOUT=fdopen(pnout[0],"r");
424 
425  if (!FDKIN || !FDKOUT || !FDNIN || !FDNOUT) {
426  fprintf(stderr, "%s| %s: Could not assign streams for FDKIN/FDKOUT/FDNIN/FDNOUT\n", LogTime(), PROGRAM);
427  closeFds(FDKIN, FDKOUT, FDNIN, FDNOUT);
428  exit(EXIT_FAILURE);
429  }
430 
431  setbuf(FDKIN, NULL);
432  setbuf(FDKOUT, NULL);
433  setbuf(FDNIN, NULL);
434  setbuf(FDNOUT, NULL);
435 
436  int result = processingLoop(FDKIN, FDKOUT, FDNIN, FDNOUT);
437  closeFds(FDKIN, FDKOUT, FDNIN, FDNOUT);
438  return result;
439 }
440 
#define xmalloc
static const char * LogTime()
void base64_decode_init(struct base64_decode_ctx *ctx)
Definition: base64.c:54
int main(int argc, char *const argv[])
static struct timeval now
Definition: tcp-banger2.c:97
static void usage()
char * strerror(int ern)
Definition: strerror.c:22
static void closeFds(FILE *a, FILE *b, FILE *c, FILE *d)
#define MAX_AUTHTOKEN_LEN
int base64_decode_final(struct base64_decode_ctx *ctx)
Definition: base64.c:159
#define NULL
Definition: types.h:166
int debug_enabled
Definition: debug.cc:13
static int processingLoop(FILE *FDKIN, FILE *FDKOUT, FILE *FDNIN, FILE *FDNOUT)
#define safe_free(x)
Definition: xalloc.h:73
#define assert(EX)
Definition: assert.h:19
int base64_decode_update(struct base64_decode_ctx *ctx, size_t *dst_length, uint8_t *dst, size_t src_length, const char *src)
Definition: base64.c:129
#define xfree
static const unsigned char ntlmProtocol[]
#define VERSION
#define PROGRAM
#define BASE64_DECODE_LENGTH(length)
Definition: base64.h:120

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors