src/auth/negotiate/UserRequest.cc

   1 /*
   2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 #include "squid.h"
  10 #include "AccessLogEntry.h"
  11 #include "auth/CredentialsCache.h"
  12 #include "auth/negotiate/Config.h"
  13 #include "auth/negotiate/User.h"
  14 #include "auth/negotiate/UserRequest.h"
  15 #include "auth/State.h"
  16 #include "auth/User.h"
  17 #include "client_side.h"
  18 #include "fatal.h"
  19 #include "format/Format.h"
  20 #include "globals.h"
  21 #include "helper.h"
  22 #include "helper/Reply.h"
  23 #include "http/Stream.h"
  24 #include "HttpHeaderTools.h"
  25 #include "HttpReply.h"
  26 #include "HttpRequest.h"
  27 #include "MemBuf.h"
  28 #include "SquidTime.h"
  29
  30 Auth::Negotiate::UserRequest::UserRequest() :
  31     authserver(nullptr),
  32     server_blob(nullptr),
  33     client_blob(nullptr),
  34     waiting(0),
  35     request(nullptr)
  36 {}
  37
  38 Auth::Negotiate::UserRequest::~UserRequest()
  39 {
  40     assert(LockCount()==0);
  41     safe_free(server_blob);
  42     safe_free(client_blob);
  43
  44     releaseAuthServer();
  45
  46     if (request) {
  47         HTTPMSGUNLOCK(request);
  48         request = NULL;
  49     }
  50 }
  51
  52 const char *
  53 Auth::Negotiate::UserRequest::connLastHeader()
  54 {
  55     return NULL;
  56 }
  57
  58 int
  59 Auth::Negotiate::UserRequest::authenticated() const
  60 {
  61     if (user() != NULL && user()->credentials() == Auth::Ok) {
  62         debugs(29, 9, HERE << "user authenticated.");
  63         return 1;
  64     }
  65
  66     debugs(29, 9, HERE << "user not fully authenticated.");
  67     return 0;
  68 }
  69
  70 const char *
  71 Auth::Negotiate::UserRequest::credentialsStr()
  72 {
  73     static char buf[MAX_AUTHTOKEN_LEN];
  74     int printResult = 0;
  75     if (user()->credentials() == Auth::Pending) {
  76         printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
  77     } else {
  78         printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
  79     }
  80
  81     // truncation is OK because we are used only for logging
  82     if (printResult < 0) {
  83         debugs(29, 2, "Can not build negotiate authentication credentials.");
  84         buf[0] = '\0';
  85     } else if (printResult >= (int)sizeof(buf))
  86         debugs(29, 2, "Negotiate authentication credentials truncated.");
  87
  88     return buf;
  89 }
  90
  91 Auth::Direction
  92 Auth::Negotiate::UserRequest::module_direction()
  93 {
  94     /* null auth_user is checked for by Auth::UserRequest::direction() */
  95
  96     if (waiting || client_blob)
  97         return Auth::CRED_LOOKUP; /* need helper response to continue */
  98
  99     if (user()->auth_type != Auth::AUTH_NEGOTIATE)
 100         return Auth::CRED_ERROR;
 101
 102     switch (user()->credentials()) {
 103
 104     case Auth::Handshake:
 105         assert(server_blob);
 106         return Auth::CRED_CHALLENGE;
 107
 108     case Auth::Ok:
 109         return Auth::CRED_VALID;
 110
 111     case Auth::Failed:
 112         return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
 113
 114     default:
 115         debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication in unexpected state: " << user()->credentials());
 116         return Auth::CRED_ERROR;
 117     }
 118 }
 119
 120 void
 121 Auth::Negotiate::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
 122 {
 123     static char buf[MAX_AUTHTOKEN_LEN];
 124
 125     assert(data);
 126     assert(handler);
 127
 128     assert(user() != NULL);
 129     assert(user()->auth_type == Auth::AUTH_NEGOTIATE);
 130
 131     if (static_cast<Auth::Negotiate::Config*>(Auth::SchemeConfig::Find("negotiate"))->authenticateProgram == NULL) {
 132         debugs(29, DBG_CRITICAL, "ERROR: No Negotiate authentication program configured.");
 133         handler(data);
 134         return;
 135     }
 136
 137     debugs(29, 8, HERE << "credentials state is '" << user()->credentials() << "'");
 138
 139     const char *keyExtras = helperRequestKeyExtras(request, al);
 140     int printResult = 0;
 141     if (user()->credentials() == Auth::Pending) {
 142         if (keyExtras)
 143             printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
 144         else
 145             printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
 146     } else {
 147         if (keyExtras)
 148             printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
 149         else
 150             printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
 151     }
 152
 153     if (printResult < 0 || printResult >= (int)sizeof(buf)) {
 154         if (printResult < 0)
 155             debugs(29, DBG_CRITICAL, "ERROR: Can not build negotiate authentication helper request");
 156         else
 157             debugs(29, DBG_CRITICAL, "ERROR: Negotiate authentication helper request too big for the " << sizeof(buf) << "-byte buffer");
 158         handler(data);
 159         return;
 160     }
 161
 162     waiting = 1;
 163
 164     safe_free(client_blob);
 165
 166     helperStatefulSubmit(negotiateauthenticators, buf, Auth::Negotiate::UserRequest::HandleReply,
 167                          new Auth::StateData(this, handler, data), authserver);
 168 }
 169
 170 /**
 171  * Atomic action: properly release the Negotiate auth helpers which may have been reserved
 172  * for this request connections use.
 173  */
 174 void
 175 Auth::Negotiate::UserRequest::releaseAuthServer()
 176 {
 177     if (authserver) {
 178         debugs(29, 6, HERE << "releasing Negotiate auth server '" << authserver << "'");
 179         helperStatefulReleaseServer(authserver);
 180         authserver = NULL;
 181     } else
 182         debugs(29, 6, HERE << "No Negotiate auth server to release.");
 183 }
 184
 185 void
 186 Auth::Negotiate::UserRequest::authenticate(HttpRequest * aRequest, ConnStateData * conn, Http::HdrType type)
 187 {
 188     /* Check that we are in the client side, where we can generate
 189      * auth challenges */
 190
 191     if (conn == NULL || !cbdataReferenceValid(conn)) {
 192         user()->credentials(Auth::Failed);
 193         debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication attempt to perform authentication without a connection!");
 194         return;
 195     }
 196
 197     if (waiting) {
 198         debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication waiting for helper reply!");
 199         return;
 200     }
 201
 202     if (server_blob) {
 203         debugs(29, 2, HERE << "need to challenge client '" << server_blob << "'!");
 204         return;
 205     }
 206
 207     /* get header */
 208     const char *proxy_auth = aRequest->header.getStr(type);
 209
 210     /* locate second word */
 211     const char *blob = proxy_auth;
 212
 213     if (blob) {
 214         while (xisspace(*blob) && *blob)
 215             ++blob;
 216
 217         while (!xisspace(*blob) && *blob)
 218             ++blob;
 219
 220         while (xisspace(*blob) && *blob)
 221             ++blob;
 222     }
 223
 224     switch (user()->credentials()) {
 225
 226     case Auth::Unchecked:
 227         /* we've received a negotiate request. pass to a helper */
 228         debugs(29, 9, HERE << "auth state negotiate none. Received blob: '" << proxy_auth << "'");
 229         user()->credentials(Auth::Pending);
 230         safe_free(client_blob);
 231         client_blob=xstrdup(blob);
 232         assert(conn->getAuth() == NULL);
 233         conn->setAuth(this, "new Negotiate handshake request");
 234         request = aRequest;
 235         HTTPMSGLOCK(request);
 236         break;
 237
 238     case Auth::Pending:
 239         debugs(29, DBG_IMPORTANT, HERE << "need to ask helper");
 240         break;
 241
 242     case Auth::Handshake:
 243         /* we should have received a blob from the client. Hand it off to
 244          * some helper */
 245         safe_free(client_blob);
 246         client_blob = xstrdup(blob);
 247         if (request)
 248             HTTPMSGUNLOCK(request);
 249         request = aRequest;
 250         HTTPMSGLOCK(request);
 251         break;
 252
 253     case Auth::Ok:
 254         fatal("Auth::Negotiate::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
 255         break;
 256
 257     case Auth::Failed:
 258         /* we've failed somewhere in authentication */
 259         debugs(29, 9, HERE << "auth state negotiate failed. " << proxy_auth);
 260         break;
 261     }
 262 }
 263
 264 void
 265 Auth::Negotiate::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
 266 {
 267     Auth::StateData *r = static_cast<Auth::StateData *>(data);
 268
 269     debugs(29, 8, HERE << "helper: '" << reply.whichServer << "' sent us reply=" << reply);
 270
 271     if (!cbdataReferenceValid(r->data)) {
 272         debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication invalid callback data. helper '" << reply.whichServer << "'.");
 273         delete r;
 274         return;
 275     }
 276
 277     Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
 278     assert(auth_user_request != NULL);
 279
 280     // add new helper kv-pair notes to the credentials object
 281     // so that any transaction using those credentials can access them
 282     auth_user_request->user()->notes.appendNewOnly(&reply.notes);
 283     // remove any private credentials detail which got added.
 284     auth_user_request->user()->notes.remove("token");
 285
 286     Auth::Negotiate::UserRequest *lm_request = dynamic_cast<Auth::Negotiate::UserRequest *>(auth_user_request.getRaw());
 287     assert(lm_request != NULL);
 288     assert(lm_request->waiting);
 289
 290     lm_request->waiting = 0;
 291     safe_free(lm_request->client_blob);
 292
 293     assert(auth_user_request->user() != NULL);
 294     assert(auth_user_request->user()->auth_type == Auth::AUTH_NEGOTIATE);
 295
 296     if (lm_request->authserver == NULL)
 297         lm_request->authserver = reply.whichServer.get(); // XXX: no locking?
 298     else
 299         assert(reply.whichServer == lm_request->authserver);
 300
 301     switch (reply.result) {
 302     case Helper::TT:
 303         /* we have been given a blob to send to the client */
 304         safe_free(lm_request->server_blob);
 305         lm_request->request->flags.mustKeepalive = true;
 306         if (lm_request->request->flags.proxyKeepalive) {
 307             const char *tokenNote = reply.notes.findFirst("token");
 308             lm_request->server_blob = xstrdup(tokenNote);
 309             auth_user_request->user()->credentials(Auth::Handshake);
 310             auth_user_request->denyMessage("Authentication in progress");
 311             debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << tokenNote << "'");
 312         } else {
 313             auth_user_request->user()->credentials(Auth::Failed);
 314             auth_user_request->denyMessage("Negotiate authentication requires a persistent connection");
 315         }
 316         break;
 317
 318     case Helper::Okay: {
 319         const char *userNote = reply.notes.findFirst("user");
 320         const char *tokenNote = reply.notes.findFirst("token");
 321         if (userNote == NULL || tokenNote == NULL) {
 322             // XXX: handle a success with no username better
 323             /* protocol error */
 324             fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply.other().content());
 325             break;
 326         }
 327
 328         /* we're finished, release the helper */
 329         auth_user_request->user()->username(userNote);
 330         auth_user_request->denyMessage("Login successful");
 331         safe_free(lm_request->server_blob);
 332         lm_request->server_blob = xstrdup(tokenNote);
 333         lm_request->releaseAuthServer();
 334
 335         /* connection is authenticated */
 336         debugs(29, 4, HERE << "authenticated user " << auth_user_request->user()->username());
 337         auto local_auth_user = lm_request->user();
 338         auto cached_user = Auth::Negotiate::User::Cache()->lookup(auth_user_request->user()->userKey());
 339         if (!cached_user) {
 340             local_auth_user->addToNameCache();
 341         } else {
 342             /* we can't seamlessly recheck the username due to the
 343              * challenge-response nature of the protocol.
 344              * Just free the temporary auth_user after merging as
 345              * much of it new state into the existing one as possible */
 346             cached_user->absorb(local_auth_user);
 347             /* from here on we are working with the original cached credentials. */
 348             local_auth_user = cached_user;
 349             auth_user_request->user(local_auth_user);
 350         }
 351         /* set these to now because this is either a new login from an
 352          * existing user or a new user */
 353         local_auth_user->expiretime = current_time.tv_sec;
 354         auth_user_request->user()->credentials(Auth::Ok);
 355         debugs(29, 4, HERE << "Successfully validated user via Negotiate. Username '" << auth_user_request->user()->username() << "'");
 356     }
 357     break;
 358
 359     case Helper::Error: {
 360         const char *messageNote = reply.notes.find("message");
 361         const char *tokenNote = reply.notes.findFirst("token");
 362
 363         /* authentication failure (wrong password, etc.) */
 364         if (messageNote != NULL)
 365             auth_user_request->denyMessage(messageNote);
 366         else
 367             auth_user_request->denyMessage("Negotiate Authentication denied with no reason given");
 368         auth_user_request->user()->credentials(Auth::Failed);
 369         safe_free(lm_request->server_blob);
 370         if (tokenNote != NULL)
 371             lm_request->server_blob = xstrdup(tokenNote);
 372         lm_request->releaseAuthServer();
 373         debugs(29, 4, "Failed validating user via Negotiate. Result: " << reply);
 374     }
 375     break;
 376
 377     case Helper::Unknown:
 378         debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication Helper '" << reply.whichServer << "' crashed!.");
 379     /* continue to the next case */
 380
 381     case Helper::TimedOut:
 382     case Helper::BrokenHelper: {
 383         /* TODO kick off a refresh process. This can occur after a YR or after
 384          * a KK. If after a YR release the helper and resubmit the request via
 385          * Authenticate Negotiate start.
 386          * If after a KK deny the user's request w/ 407 and mark the helper as
 387          * Needing YR. */
 388         const char *errNote = reply.notes.find("message");
 389         if (reply.result == Helper::Unknown)
 390             auth_user_request->denyMessage("Internal Error");
 391         else if (errNote != NULL)
 392             auth_user_request->denyMessage(errNote);
 393         else
 394             auth_user_request->denyMessage("Negotiate Authentication failed with no reason given");
 395         auth_user_request->user()->credentials(Auth::Failed);
 396         safe_free(lm_request->server_blob);
 397         lm_request->releaseAuthServer();
 398         debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication validating user. Result: " << reply);
 399     } // break;
 400     }
 401
 402     if (lm_request->request) {
 403         HTTPMSGUNLOCK(lm_request->request);
 404         lm_request->request = NULL;
 405     }
 406     r->handler(r->data);
 407     delete r;
 408 }
 409