--------------------- PatchSet 6062 Date: 2003/11/30 11:44:38 Author: serassio Branch: nt-2_5 Tag: (none) Log: Fixed NTLM local authentication problem Members: helpers/ntlm_auth/NTLMSSP-WIN32/libntlmssp.c:1.1.4.6->1.1.4.7 helpers/ntlm_auth/NTLMSSP-WIN32/ntlm_auth.c:1.1.4.13->1.1.4.14 include/sspwin32.h:1.1.4.3->1.1.4.4 lib/sspwin32.c:1.1.4.6->1.1.4.7 Index: squid/helpers/ntlm_auth/NTLMSSP-WIN32/libntlmssp.c =================================================================== RCS file: /cvsroot/squid-sf//squid/helpers/ntlm_auth/NTLMSSP-WIN32/Attic/libntlmssp.c,v retrieving revision 1.1.4.6 retrieving revision 1.1.4.7 diff -u -r1.1.4.6 -r1.1.4.7 --- squid/helpers/ntlm_auth/NTLMSSP-WIN32/libntlmssp.c 13 Sep 2003 16:28:06 -0000 1.1.4.6 +++ squid/helpers/ntlm_auth/NTLMSSP-WIN32/libntlmssp.c 30 Nov 2003 11:44:38 -0000 1.1.4.7 @@ -220,44 +220,45 @@ lstring tmp; - tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->domain); + if (!NTLM_LocalCall) { - if (tmp.str == NULL || tmp.l == 0) { - debug("No domain supplied. Returning no-auth\n"); - ntlm_errno = NTLM_BAD_REQUEST; - return NULL; - } - if (Use_Unicode) { - /* copy unicode buffer */ - WideCharToMultiByte(CP_ACP, 0, (LPCWSTR) tmp.str, tmp.l, domain, 256, NULL, NULL ); - /* add null termination */ - domain[tmp.l / sizeof(WCHAR)] = '\0'; - } else { - memcpy(domain, tmp.str, tmp.l); - domain[tmp.l] = '\0'; - } - tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->user); - if (tmp.str == NULL || tmp.l == 0) { - debug("No username supplied. Returning no-auth\n"); - ntlm_errno = NTLM_BAD_REQUEST; - return NULL; - } - if (Use_Unicode) { - /* copy unicode buffer */ - WideCharToMultiByte(CP_ACP, 0, (LPCWSTR) tmp.str, tmp.l, user, 256, NULL, NULL ); - /* add null termination */ - user[tmp.l / sizeof(WCHAR)] = '\0'; - } else { - memcpy(user, tmp.str, tmp.l); - user[tmp.l] = '\0'; - } + tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->domain); + + if (tmp.str == NULL || tmp.l == 0) { + debug("No domain supplied. Returning no-auth\n"); + ntlm_errno = NTLM_BAD_REQUEST; + return NULL; + } + if (Use_Unicode) { + /* copy unicode buffer */ + WideCharToMultiByte(CP_ACP, 0, (LPCWSTR) tmp.str, tmp.l, domain, 256, NULL, NULL ); + /* add null termination */ + domain[tmp.l / sizeof(WCHAR)] = '\0'; + } else { + memcpy(domain, tmp.str, tmp.l); + domain[tmp.l] = '\0'; + } + tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->user); + if (tmp.str == NULL || tmp.l == 0) { + debug("No username supplied. Returning no-auth\n"); + ntlm_errno = NTLM_BAD_REQUEST; + return NULL; + } + if (Use_Unicode) { + /* copy unicode buffer */ + WideCharToMultiByte(CP_ACP, 0, (LPCWSTR) tmp.str, tmp.l, user, 256, NULL, NULL ); + /* add null termination */ + user[tmp.l / sizeof(WCHAR)] = '\0'; + } else { + memcpy(user, tmp.str, tmp.l); + user[tmp.l] = '\0'; + } + debug("checking domain: '%s', user: '%s'\n", domain, user); - strcpy(credentials, domain); - strcat(credentials, "\\"); - strcat(credentials, user); + } else + debug("checking local user\n"); - debug("checking domain: '%s', user: '%s'\n", domain, user); - rv = SSP_ValidateCredentials(auth, auth_length); + rv = SSP_ValidateCredentials(auth, auth_length, credentials); debug("Login attempt had result %d\n", rv); Index: squid/helpers/ntlm_auth/NTLMSSP-WIN32/ntlm_auth.c =================================================================== RCS file: /cvsroot/squid-sf//squid/helpers/ntlm_auth/NTLMSSP-WIN32/Attic/ntlm_auth.c,v retrieving revision 1.1.4.13 retrieving revision 1.1.4.14 diff -u -r1.1.4.13 -r1.1.4.14 --- squid/helpers/ntlm_auth/NTLMSSP-WIN32/ntlm_auth.c 29 Nov 2003 14:25:17 -0000 1.1.4.13 +++ squid/helpers/ntlm_auth/NTLMSSP-WIN32/ntlm_auth.c 30 Nov 2003 11:44:38 -0000 1.1.4.14 @@ -91,12 +91,7 @@ void helperfail(const char *reason) { - int old_debug; - - old_debug = debug_enabled; - debug_enabled = 1; SEND2("BH %s", reason); - debug_enabled = old_debug; } /* @@ -273,6 +268,8 @@ decoded = base64_decode(c); debug("sending 'TT' to squid with data:\n"); hex_dump(decoded, (strlen(c) * 3) / 4); + if (NTLM_LocalCall) + debug("NTLM Local Call detected\n"); } else { SEND2("TT %s", c); } Index: squid/include/sspwin32.h =================================================================== RCS file: /cvsroot/squid-sf//squid/include/sspwin32.h,v retrieving revision 1.1.4.3 retrieving revision 1.1.4.4 diff -u -r1.1.4.3 -r1.1.4.4 --- squid/include/sspwin32.h 13 Sep 2003 10:44:31 -0000 1.1.4.3 +++ squid/include/sspwin32.h 30 Nov 2003 11:44:38 -0000 1.1.4.4 @@ -39,9 +39,9 @@ HMODULE LoadSecurityDll(int); void UnloadSecurityDll(void); BOOL WINAPI SSP_LogonUser(PTSTR, PTSTR, PTSTR); -BOOL WINAPI SSP_ValidateCredentials(PVOID, int); +BOOL WINAPI SSP_ValidateCredentials(PVOID, int, char *); const char * WINAPI SSP_MakeChallenge(PVOID, int); extern BOOL Use_Unicode; - +extern BOOL NTLM_LocalCall; #endif /* LIBSSPWIN32_H_ */ Index: squid/lib/sspwin32.c =================================================================== RCS file: /cvsroot/squid-sf//squid/lib/sspwin32.c,v retrieving revision 1.1.4.6 retrieving revision 1.1.4.7 diff -u -r1.1.4.6 -r1.1.4.7 --- squid/lib/sspwin32.c 14 Sep 2003 10:27:56 -0000 1.1.4.6 +++ squid/lib/sspwin32.c 30 Nov 2003 11:44:38 -0000 1.1.4.7 @@ -40,6 +40,7 @@ static AUTH_SEQ NTLM_asServer = {0}; BOOL Use_Unicode = FALSE; +BOOL NTLM_LocalCall = FALSE; /* Function pointers */ ACCEPT_SECURITY_CONTEXT_FN _AcceptSecurityContext = NULL; @@ -50,7 +51,11 @@ FREE_CREDENTIALS_HANDLE_FN _FreeCredentialsHandle = NULL; INITIALIZE_SECURITY_CONTEXT_FN _InitializeSecurityContext = NULL; QUERY_SECURITY_PACKAGE_INFO_FN _QuerySecurityPackageInfo = NULL; - +#ifdef UNICODE +QUERY_CONTEXT_ATTRIBUTES_FN_W _QueryContextAttributes = NULL; +#else +QUERY_CONTEXT_ATTRIBUTES_FN_A _QueryContextAttributes = NULL; +#endif void UnloadSecurityDll(void) { @@ -73,6 +78,7 @@ _FreeCredentialsHandle = NULL; _InitializeSecurityContext = NULL; _QuerySecurityPackageInfo = NULL; + _QueryContextAttributes = NULL; hModule = NULL; } @@ -180,6 +186,18 @@ hModule = NULL; } +#ifdef UNICODE + _QueryContextAttributes = (QUERY_CONTEXT_ATTRIBUTES_FN_W) + GetProcAddress(hModule, "QueryContextAttributesW"); +#else + _QueryContextAttributes = (QUERY_CONTEXT_ATTRIBUTES_FN_A) + GetProcAddress(hModule, "QueryContextAttributesA"); +#endif + if (!_QueryContextAttributes) { + UnloadSecurityDll(); + hModule = NULL; + } + /* Get max token size */ _QuerySecurityPackageInfo(_T("NTLM"), &pSPI); cbMaxToken = pSPI->cbMaxToken; @@ -263,7 +281,7 @@ BOOL GenServerContext(PAUTH_SEQ pAS, PVOID pIn, DWORD cbIn, PVOID pOut, - PDWORD pcbOut, PBOOL pfDone) + PDWORD pcbOut, PBOOL pfDone, char * credentials) { /* * Routine Description: @@ -282,6 +300,7 @@ SecBufferDesc sbdIn; SecBuffer sbIn; ULONG fContextAttr; + SecPkgContext_Names namebuffer; if (!pAS->fInitialized) { SecurityStatus = _AcquireCredentialsHandle(NULL, _T("NTLM"), @@ -321,6 +340,14 @@ if (SecurityStatus < 0) return FALSE; } + + if (credentials != NULL) { + SecurityStatus = _QueryContextAttributes(&pAS->hctxt, SECPKG_ATTR_NAMES, &namebuffer); + if (SecurityStatus < 0) + return FALSE; + strcpy(credentials, namebuffer.sUserName); + } + *pcbOut = sbOut.cbBuffer; if (!pAS->fInitialized) pAS->fInitialized = TRUE; @@ -368,7 +395,7 @@ cbIn = cbOut; cbOut = cbMaxToken; if (!GenServerContext(&asServer, pClientBuf, cbIn, pServerBuf, &cbOut, - &fDone)) + &fDone, NULL)) break; /* Most likely failure: AcceptServerContext fails with SEC_E_LOGON_DENIED * in the case of bad szUser or szPassword. @@ -387,7 +414,7 @@ cbIn = cbOut; cbOut = cbMaxToken; if (!GenServerContext(&asServer, pClientBuf, cbIn, pServerBuf, &cbOut, - &fDone)) + &fDone, NULL)) break; fResult = TRUE; } while(0); @@ -420,6 +447,7 @@ if (NTLM_asServer.fHaveCredHandle) _FreeCredentialsHandle(&NTLM_asServer.hcred); + NTLM_LocalCall = FALSE; Use_Unicode = FALSE; memcpy(pClientBuf, PNegotiateBuf, NegotiateLen); ZeroMemory(pServerBuf, cbMaxToken); @@ -432,20 +460,21 @@ cbIn = NegotiateLen; cbOut = cbMaxToken; if (!GenServerContext(&NTLM_asServer, pClientBuf, cbIn, pServerBuf, &cbOut, - &fDone)) + &fDone, NULL)) break; fResult = pServerBuf; } while(0); if (fResult != NULL) { challenge = (ntlm_challenge *) fResult; Use_Unicode = NEGOTIATE_UNICODE & challenge->flags; + NTLM_LocalCall = NEGOTIATE_THIS_IS_LOCAL_CALL & challenge->flags; encoded = base64_encode_bin((char *) fResult, cbOut); } return encoded; } -BOOL WINAPI SSP_ValidateCredentials(PVOID PAutenticateBuf, int AutenticateLen) +BOOL WINAPI SSP_ValidateCredentials(PVOID PAutenticateBuf, int AutenticateLen, char * credentials) { BOOL fDone = FALSE; BOOL fResult = FALSE; @@ -462,7 +491,7 @@ cbIn = AutenticateLen; cbOut = cbMaxToken; if (!GenServerContext(&NTLM_asServer, pClientBuf, cbIn, pServerBuf, &cbOut, - &fDone)) + &fDone, credentials)) break; fResult = TRUE; } while(0);