evolution-ntlm

Patch from evolution-exchange (2.10.3).  The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.

Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21.  Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.

Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.

Gbp-Pq: Name evolution-ntlm

diff --git a/include/ldap.h b/include/ldap.h
index 389441031f051dbc97aa4d3b4203965bc9009fe5..20ba87e04484d34acb494fcdbcc1f9a789e73ef0 100644 (file)
--- a/include/ldap.h
+++ b/include/ldap.h
@@ -2537,5 +2537,25 @@ ldap_parse_deref_control LDAP_P((
        LDAPControl     **ctrls,
        LDAPDerefRes    **drp ));
 
+/*
+ * hacks for NTLM
+ */
+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
+#define LDAP_AUTH_NTLM_RESPONSE  ((ber_tag_t) 0x8bU)
+LDAP_F( int )
+ldap_ntlm_bind LDAP_P((
+      LDAP    *ld,
+      LDAP_CONST char *dn,
+      ber_tag_t tag,
+      struct berval *cred,
+      LDAPControl **sctrls,
+      LDAPControl **cctrls,
+      int   *msgidp ));
+LDAP_F( int )
+ldap_parse_ntlm_bind_result LDAP_P((
+      LDAP    *ld,
+      LDAPMessage *res,
+      struct berval *challenge));
+
 LDAP_END_DECL
 #endif /* _LDAP_H */

diff --git a/libraries/libldap/Makefile.in b/libraries/libldap/Makefile.in
index 92856d2543ec4ce7d99abf04cfcaa9c008e7cba3..7a01988cd55149c69b743fa8f346d19fad7ff310 100644 (file)
--- a/libraries/libldap/Makefile.in
+++ b/libraries/libldap/Makefile.in
@@ -27,7 +27,7 @@ SRCS  = bind.c open.c result.c error.c compare.c search.c \
        init.c options.c print.c string.c util-int.c schema.c \
        charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
        tls2.c tls_o.c tls_g.c tls_m.c \
-       turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+       turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
        assertion.c deref.c ldif.c fetch.c
 
 OBJS   = bind.lo open.lo result.lo error.lo compare.lo search.lo \
@@ -40,7 +40,7 @@ OBJS  = bind.lo open.lo result.lo error.lo compare.lo search.lo \
        init.lo options.lo print.lo string.lo util-int.lo schema.lo \
        charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
        tls2.lo tls_o.lo tls_g.lo tls_m.lo \
-       turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+       turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
        assertion.lo deref.lo ldif.lo fetch.lo
 
 LDAP_INCDIR= ../../include       

diff --git a/libraries/libldap/ntlm.c b/libraries/libldap/ntlm.c
new file mode 100644 (file)
index 0000000..f40a6ed
--- /dev/null
+++ b/libraries/libldap/ntlm.c
@@ -0,0 +1,138 @@
+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
+/*
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
+
+/* Mostly copied from sasl.c */
+
+#include "portable.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/errno.h>
+
+#include "ldap-int.h"
+
+int
+ldap_ntlm_bind(
+ LDAP    *ld,
+ LDAP_CONST char *dn,
+ ber_tag_t tag,
+ struct berval *cred,
+ LDAPControl **sctrls,
+ LDAPControl **cctrls,
+ int   *msgidp )
+{
+ BerElement  *ber;
+ int rc;
+ ber_int_t id;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( msgidp != NULL );
+
+ if( msgidp == NULL ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ /* create a message to send */
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ assert( LBER_VALID( ber ) );
+
+ LDAP_NEXT_MSGID( ld, id );
+ rc = ber_printf( ber, "{it{istON}" /*}*/,
+      id, LDAP_REQ_BIND,
+      ld->ld_version, dn, tag,
+      cred );
+
+ /* Put Server Controls */
+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
+   ld->ld_errno = LDAP_ENCODING_ERROR;
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ /* send the message */
+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
+
+ if(*msgidp < 0)
+   return ld->ld_errno;
+
+ return LDAP_SUCCESS;
+}
+
+int
+ldap_parse_ntlm_bind_result(
+ LDAP    *ld,
+ LDAPMessage *res,
+ struct berval *challenge)
+{
+ ber_int_t errcode;
+ ber_tag_t tag;
+ BerElement  *ber;
+ ber_len_t len;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( res != NULL );
+
+ if ( ld == NULL || res == NULL ) {
+   return LDAP_PARAM_ERROR;
+ }
+
+ if( res->lm_msgtype != LDAP_RES_BIND ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ if ( ld->ld_error ) {
+   LDAP_FREE( ld->ld_error );
+   ld->ld_error = NULL;
+ }
+ if ( ld->ld_matched ) {
+   LDAP_FREE( ld->ld_matched );
+   ld->ld_matched = NULL;
+ }
+
+ /* parse results */
+
+ ber = ber_dup( res->lm_ber );
+
+ if( ber == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ tag = ber_scanf( ber, "{ioa" /*}*/,
+      &errcode, challenge, &ld->ld_error );
+ ber_free( ber, 0 );
+
+ if( tag == LBER_ERROR ) {
+   ld->ld_errno = LDAP_DECODING_ERROR;
+   return ld->ld_errno;
+ }
+
+ ld->ld_errno = errcode;
+
+ return( ld->ld_errno );
+}
+

diff --git a/libraries/libldap_r/Makefile.in b/libraries/libldap_r/Makefile.in
index 85eff3d6c4dac14e2905dddc6d1da3c62c1c311a..ea81783a86a823cffd952c7299bb04fddee6c800 100644 (file)
--- a/libraries/libldap_r/Makefile.in
+++ b/libraries/libldap_r/Makefile.in
@@ -29,7 +29,7 @@ XXSRCS    = apitest.c test.c \
        init.c options.c print.c string.c util-int.c schema.c \
        charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
        tls2.c tls_o.c tls_g.c tls_m.c \
-       turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+       turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
        assertion.c deref.c ldif.c fetch.c
 SRCS   = threads.c rdwr.c rmutex.c tpool.c rq.c \
        thr_posix.c thr_cthreads.c thr_thr.c thr_nt.c \
@@ -47,7 +47,7 @@ OBJS  = threads.lo rdwr.lo rmutex.lo tpool.lo  rq.lo \
        init.lo options.lo print.lo string.lo util-int.lo schema.lo \
        charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
        tls2.lo tls_o.lo tls_g.lo tls_m.lo \
-       turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+       turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
        assertion.lo deref.lo ldif.lo fetch.lo
 
 LDAP_INCDIR= ../../include