src/auth/digest/file/text_backend.cc

   1 /*
   2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /*
  10  * AUTHOR: Robert Collins.
  11  *  Based on ncsa_auth.c by Arjan de Vet <Arjan.deVet@adv.iae.nl>
  12  *
  13  * Example digest auth text backend for Squid, based on the original
  14  * proxy_auth code from client_side.c, written by
  15  * Jon Thackray <jrmt@uk.gdscorp.com>.
  16  *
  17  * - comment lines are possible and should start with a '#';
  18  * - empty or blank lines are possible;
  19  * - file format is username:plaintext or username:realm:HA1
  20  *
  21  * To build a directory integrated backend, you need to be able to
  22  * calculate the HA1 returned to squid. To avoid storing a plaintext
  23  * password you can calculate MD5(username:realm:password) when the
  24  * user changes their password, and store the tuple username:realm:HA1.
  25  * then find the matching username:realm when squid asks for the
  26  * HA1.
  27  *
  28  * This implementation could be improved by using such a triple for
  29  * the file format.  However storing such a triple does little to
  30  * improve security: If compromised the username:realm:HA1 combination
  31  * is "plaintext equivalent" - for the purposes of digest authentication
  32  * they allow the user access. Password syncronisation is not tackled
  33  * by digest - just preventing on the wire compromise.
  34  *
  35  * Copyright (c) 2003  Robert Collins  <robertc@squid-cache.org>
  36  */
  37
  38 #include "squid.h"
  39 #include "auth/digest/file/text_backend.h"
  40
  41 static hash_table *hash = NULL;
  42 static HASHFREE my_free;
  43 static char *passwdfile = NULL;
  44 static int ha1mode = 0;
  45 static time_t change_time = 0;
  46
  47 typedef struct _user_data {
  48     hash_link hash;
  49     char *passwd;
  50     char *ha1;
  51 } user_data;
  52
  53 static void
  54 my_free(void *p)
  55 {
  56     user_data *u = static_cast<user_data*>(p);
  57     xfree(u->hash.key);
  58     xfree(u->passwd);
  59     xfree(u);
  60 }
  61
  62 static void
  63 read_passwd_file(const char *passwordFile, int isHa1Mode)
  64 {
  65     char buf[8192];
  66     user_data *u;
  67     char *user;
  68     char *passwd;
  69     char *ha1 = NULL;
  70     char *realm;
  71
  72     if (hash != NULL) {
  73         hashFreeItems(hash, my_free);
  74     }
  75     /* initial setup */
  76     hash = hash_create((HASHCMP *) strcmp, 7921, hash_string);
  77     if (NULL == hash) {
  78         fprintf(stderr, "digest_file_auth: cannot create hash table\n");
  79         exit(1);
  80     }
  81     FILE *f = fopen(passwordFile, "r");
  82     if (!f) {
  83         int xerrno = errno;
  84         fprintf(stderr, "digest_file_auth: cannot open password file: %s\n", xstrerr(xerrno));
  85         exit(1);
  86     }
  87     unsigned int lineCount = 0;
  88     while (fgets(buf, sizeof(buf), f) != NULL) {
  89         ++lineCount;
  90         if ((buf[0] == '#') || (buf[0] == ' ') || (buf[0] == '\t') ||
  91                 (buf[0] == '\n'))
  92             continue;
  93         user = strtok(buf, ":\n");
  94         if (!user) {
  95             fprintf(stderr, "digest_file_auth: missing user name at line %u in '%s'\n", lineCount, passwordFile);
  96             continue;
  97         }
  98         realm = strtok(NULL, ":\n");
  99         passwd = strtok(NULL, ":\n");
 100         if (!passwd) {
 101             passwd = realm;
 102             realm = NULL;
 103         }
 104         if ((strlen(user) > 0) && passwd) {
 105             if (strncmp(passwd, "{HHA1}", 6) == 0) {
 106                 ha1 = passwd + 6;
 107                 passwd = NULL;
 108             } else if (isHa1Mode) {
 109                 ha1 = passwd;
 110                 passwd = NULL;
 111             }
 112             if (ha1 && strlen(ha1) != 32) {
 113                 /* We cannot accept plaintext passwords when using HA1 encoding,
 114                  * as the passwords may be output to cache.log if debugging is on.
 115                  */
 116                 fprintf(stderr, "digest_file_auth: ignoring invalid password for %s\n", user);
 117                 continue;
 118             }
 119             u = static_cast<user_data*>(xcalloc(1, sizeof(*u)));
 120             if (realm) {
 121                 int len = strlen(user) + strlen(realm) + 2;
 122                 u->hash.key = xmalloc(len);
 123                 snprintf(static_cast<char*>(u->hash.key), len, "%s:%s", user, realm);
 124             } else {
 125                 u->hash.key = xstrdup(user);
 126             }
 127             if (ha1)
 128                 u->ha1 = xstrdup(ha1);
 129             else
 130                 u->passwd = xstrdup(passwd);
 131             hash_join(hash, &u->hash);
 132         }
 133     }
 134     fclose(f);
 135 }
 136
 137 /* replace when changing the backend */
 138 void
 139 TextArguments(int argc, char **argv)
 140 {
 141     struct stat sb;
 142     if (argc == 2)
 143         passwdfile = argv[1];
 144     if ((argc == 3) && !strcmp("-c", argv[1])) {
 145         ha1mode = 1;
 146         passwdfile = argv[2];
 147     }
 148     if (!passwdfile) {
 149         fprintf(stderr, "Usage: digest_file_auth [OPTIONS] <passwordfile>\n");
 150         fprintf(stderr, "  -c   accept digest hashed passwords rather than plaintext in passwordfile\n");
 151         exit(1);
 152     }
 153     if (stat(passwdfile, &sb) != 0) {
 154         fprintf(stderr, "cannot stat %s\n", passwdfile);
 155         exit(1);
 156     }
 157 }
 158
 159 static const user_data *
 160 GetPassword(RequestData * requestData)
 161 {
 162     user_data *u;
 163     struct stat sb;
 164     char buf[256];
 165     int len;
 166     if (stat(passwdfile, &sb) == 0) {
 167         if (sb.st_mtime != change_time) {
 168             read_passwd_file(passwdfile, ha1mode);
 169             change_time = sb.st_mtime;
 170         }
 171     }
 172     if (!hash)
 173         return NULL;
 174     len = snprintf(buf, sizeof(buf), "%s:%s", requestData->user, requestData->realm);
 175     if (len >= static_cast<int>(sizeof(buf)))
 176         return NULL;
 177     u = (user_data*)hash_lookup(hash, buf);
 178     if (u)
 179         return u;
 180     u = (user_data*)hash_lookup(hash, requestData->user);
 181     return u;
 182 }
 183
 184 void
 185 TextHHA1(RequestData * requestData)
 186 {
 187     const user_data *u = GetPassword(requestData);
 188     if (!u) {
 189         requestData->error = -1;
 190         return;
 191     }
 192     if (u->ha1) {
 193         xstrncpy(requestData->HHA1, u->ha1, sizeof(requestData->HHA1));
 194     } else {
 195         HASH HA1;
 196         DigestCalcHA1("md5", requestData->user, requestData->realm, u->passwd, NULL, NULL, HA1, requestData->HHA1);
 197     }
 198 }
 199