------------------------------------------------------------
revno: 12284
revision-id: squid3@treenet.co.nz-20120814120416-wp3jik4ud3uwb4co
parent: kinkie@squid-cache.org-20120814115307-npwzzackw0iu4k79
committer: Amos Jeffries <squid3@treenet.co.nz>
branch nick: trunk
timestamp: Tue 2012-08-14 06:04:16 -0600
message:
  Remove --enable-ntlm-fail-open
  
  This feature has been half missing for quite some time (10 years).
  The SMB helper sends the LD code back to Squid when the directive is
  compiled in, but there is no Squid code handling such responses, back as far
  as squid-2.
------------------------------------------------------------
# Bazaar merge directive format 2 (Bazaar 0.90)
# revision_id: squid3@treenet.co.nz-20120814120416-wp3jik4ud3uwb4co
# target_branch: http://bzr.squid-cache.org/bzr/squid3/trunk/
# testament_sha1: 04b0a57b4b27f4da160195dde6677769aaca5c9f
# timestamp: 2012-08-14 12:08:51 +0000
# source_branch: http://bzr.squid-cache.org/bzr/squid3/trunk/
# base_revision_id: kinkie@squid-cache.org-20120814115307-\
#   npwzzackw0iu4k79
# 
# Begin patch
=== modified file 'configure.ac'
--- configure.ac	2012-06-12 08:50:53 +0000
+++ configure.ac	2012-08-14 12:04:16 +0000
@@ -2013,19 +2013,6 @@
 SQUID_STATE_ROLLBACK([krbsave])
 AM_CONDITIONAL(HAVE_SPNEGO, test x"$squid_cv_have_spnego" = x"yes" )
 
-dnl Enable "NTLM fail open"
-AC_ARG_ENABLE(ntlm-fail-open,
-  AS_HELP_STRING([--enable-ntlm-fail-open],
-    [Enable NTLM fail open, where a helper that fails one of the
-     Authentication steps can allow squid to still authenticate
-     the user. This has security implications, and is deprecated]),
-[ 
-  SQUID_YESNO([$enableval],[--enable-ntlm-fail-open takes no argument])
-])
-SQUID_DEFINE_BOOL(NTLM_FAIL_OPEN,${enable_ntlm_fail_open:=no},
-  [Define if NTLM is allowed to fail gracefully when a helper has problems.])
-AC_MSG_NOTICE([ntlm-fail-open enabled: $enable_ntlm_fail_open])
-
 AC_ARG_ENABLE(external-acl-helpers,
   AS_HELP_STRING([--enable-external-acl-helpers="list of helpers"],
                  [Enable external_acl helpers support and thelpers themselves.

=== modified file 'doc/release-notes/release-3.3.sgml'
--- doc/release-notes/release-3.3.sgml	2011-05-29 12:59:25 +0000
+++ doc/release-notes/release-3.3.sgml	2012-08-14 12:04:16 +0000
@@ -105,6 +105,8 @@
 <sect1>Removed options<label id="removedoptions">
 <p>
 <descrip>
+	<tag>--enable-ntlm-fail-open</tag>
+	<p>Removed. This has not been supported by Squid for several versions.
 
 </descrip>
 

=== modified file 'helpers/ntlm_auth/smb_lm/ntlm_smb_lm_auth.cc'
--- helpers/ntlm_auth/smb_lm/ntlm_smb_lm_auth.cc	2012-07-23 15:15:27 +0000
+++ helpers/ntlm_auth/smb_lm/ntlm_smb_lm_auth.cc	2012-08-14 12:04:16 +0000
@@ -89,7 +89,6 @@
 };
 
 /* local functions */
-void send_bh_or_ld(char const *bhmessage, ntlm_authenticate * failedauth, int authlen);
 void usage(void);
 void process_options(int argc, char *argv[]);
 const char * obtain_challenge(void);
@@ -113,9 +112,6 @@
 char error_messages_buffer[NTLM_BLOB_BUFFER_SIZE];
 #endif
 char load_balance = 0, protocol_pedantic = 0;
-#if NTLM_FAIL_OPEN
-char last_ditch_enabled = 0;
-#endif
 dc *controllers = NULL;
 int numcontrollers = 0;
 dc *current_dc;
@@ -329,30 +325,6 @@
     dc_disconnect();
 }
 
-void
-send_bh_or_ld(char const *bhmessage, ntlm_authenticate * failedauth, int authlen)
-{
-#if NTLM_FAIL_OPEN
-    char user[NTLM_MAX_FIELD_LENGTH];
-    char domain[NTLM_MAX_FIELD_LENGTH];
-    if (last_ditch_enabled) {
-        user[0] = '\0';
-        domain[0] = '\0';
-        if (ntlm_unpack_auth(failedauth, user, domain, authlen) == 0) {
-            lc(domain);
-            lc(user);
-            SEND3("LD %s%s%s", domain, (domain[0]!='\0'?"//":""), user);
-        } else {
-            SEND("NA last-ditch on, but no credentials");
-        }
-    } else {
-#endif
-        SEND2("BH %s", bhmessage);
-#if NTLM_FAIL_OPEN
-    }
-#endif
-}
-
 /*
  * options:
  * -b try load-balancing the domain-controllers
@@ -370,7 +342,6 @@
             "%s usage:\n%s [-b] [-f] [-d] [-l] domain\\controller [domain\\controller ...]\n"
             "-b enables load-balancing among controllers\n"
             "-f enables failover among controllers (DEPRECATED and always active)\n"
-            "-l changes behavior on domain controller failyures to last-ditch.\n"
             "-d enables debugging statements if DEBUG was defined at build-time.\n\n"
             "You MUST specify at least one Domain Controller.\n"
             "You can use either \\ or / as separator between the domain name \n"
@@ -394,11 +365,6 @@
             fprintf(stderr,
                     "WARNING. The -f flag is DEPRECATED and always active.\n");
             break;
-#if NTLM_FAIL_OPEN
-        case 'l':
-            last_ditch_enabled = 1;
-            break;
-#endif
         case 'd':
             debug_enabled=1;
             break;
@@ -582,8 +548,7 @@
                 /* Should I use smblib_err? Actually it seems I can do as well
                  * without it.. */
                 if (nb_error != 0) {	/* netbios-level error */
-                    send_bh_or_ld("NetBios error!",
-                                  (ntlm_authenticate *) decoded, decodedLen);
+                    SEND("BH NetBios error!");
                     fprintf(stderr, "NetBios error code %d (%s)\n", nb_error,
                             RFCNB_Error_Strings[abs(nb_error)]);
                     return;
@@ -592,10 +557,6 @@
                 case SMBC_SUCCESS:
                     debug("Huh? Got a SMB success code but could check auth..");
                     SEND("NA Authentication failed");
-                    /*
-                     * send_bh_or_ld("SMB success, but no creds. Internal error?",
-                     * (ntlm_authenticate *) decoded, decodedLen);
-                     */
                     return;
                 case SMBC_ERRDOS:
                     /*this is the most important one for errors */
@@ -616,8 +577,7 @@
                         SEND("NA Bad Data");
                         return;
                     default:
-                        send_bh_or_ld("DOS Error",
-                                      (ntlm_authenticate *) decoded, decodedLen);
+                        SEND("BH DOS Error");
                         return;
                     }
                 case SMBC_ERRSRV:	/* server errors */
@@ -631,17 +591,14 @@
                         SEND("NA Server access error");
                         return;
                     default:
-                        send_bh_or_ld("Server Error",
-                                      (ntlm_authenticate *) decoded, decodedLen);
+                        SEND("BH Server Error");
                         return;
                     }
                 case SMBC_ERRHRD:	/* hardware errors don't really matter */
-                    send_bh_or_ld("Domain Controller Hardware error",
-                                  (ntlm_authenticate *) decoded, decodedLen);
+                    SEND("BH Domain Controller Hardware error");
                     return;
                 case SMBC_ERRCMD:
-                    send_bh_or_ld("Domain Controller Command Error",
-                                  (ntlm_authenticate *) decoded, decodedLen);
+                    SEND("BH Domain Controller Command Error");
                     return;
                 }
                 SEND("BH unknown internal error.");