src/auth/ntlm/UserRequest.cc

   1 /*
   2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 #include "squid.h"
  10 #include "AccessLogEntry.h"
  11 #include "auth/CredentialsCache.h"
  12 #include "auth/ntlm/Config.h"
  13 #include "auth/ntlm/User.h"
  14 #include "auth/ntlm/UserRequest.h"
  15 #include "auth/State.h"
  16 #include "cbdata.h"
  17 #include "client_side.h"
  18 #include "fatal.h"
  19 #include "format/Format.h"
  20 #include "globals.h"
  21 #include "helper.h"
  22 #include "helper/Reply.h"
  23 #include "http/Stream.h"
  24 #include "HttpMsg.h"
  25 #include "HttpRequest.h"
  26 #include "MemBuf.h"
  27 #include "SquidTime.h"
  28
  29 Auth::Ntlm::UserRequest::UserRequest() :
  30     authserver(nullptr),
  31     server_blob(nullptr),
  32     client_blob(nullptr),
  33     waiting(0),
  34     request(nullptr)
  35 {}
  36
  37 Auth::Ntlm::UserRequest::~UserRequest()
  38 {
  39     assert(LockCount()==0);
  40     safe_free(server_blob);
  41     safe_free(client_blob);
  42
  43     releaseAuthServer();
  44
  45     if (request) {
  46         HTTPMSGUNLOCK(request);
  47         request = NULL;
  48     }
  49 }
  50
  51 const char *
  52 Auth::Ntlm::UserRequest::connLastHeader()
  53 {
  54     return NULL;
  55 }
  56
  57 int
  58 Auth::Ntlm::UserRequest::authenticated() const
  59 {
  60     if (user() != NULL && user()->credentials() == Auth::Ok) {
  61         debugs(29, 9, HERE << "user authenticated.");
  62         return 1;
  63     }
  64
  65     debugs(29, 9, HERE << "user not fully authenticated.");
  66     return 0;
  67 }
  68
  69 const char *
  70 Auth::Ntlm::UserRequest::credentialsStr()
  71 {
  72     static char buf[MAX_AUTHTOKEN_LEN];
  73     int printResult;
  74     if (user()->credentials() == Auth::Pending) {
  75         printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob);
  76     } else {
  77         printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
  78     }
  79
  80     // truncation is OK because we are used only for logging
  81     if (printResult < 0) {
  82         debugs(29, 2, "Can not build ntlm authentication credentials.");
  83         buf[0] = '\0';
  84     } else if (printResult >= (int)sizeof(buf))
  85         debugs(29, 2, "Ntlm authentication credentials truncated.");
  86
  87     return buf;
  88 }
  89
  90 Auth::Direction
  91 Auth::Ntlm::UserRequest::module_direction()
  92 {
  93     /* null auth_user is checked for by Auth::UserRequest::direction() */
  94
  95     if (waiting || client_blob)
  96         return Auth::CRED_LOOKUP; /* need helper response to continue */
  97
  98     if (user()->auth_type != Auth::AUTH_NTLM)
  99         return Auth::CRED_ERROR;
 100
 101     switch (user()->credentials()) {
 102
 103     case Auth::Handshake:
 104         assert(server_blob);
 105         return Auth::CRED_CHALLENGE;
 106
 107     case Auth::Ok:
 108         return Auth::CRED_VALID;
 109
 110     case Auth::Failed:
 111         return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
 112
 113     default:
 114         debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
 115         return Auth::CRED_ERROR;
 116     }
 117 }
 118
 119 void
 120 Auth::Ntlm::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
 121 {
 122     static char buf[MAX_AUTHTOKEN_LEN];
 123
 124     assert(data);
 125     assert(handler);
 126
 127     if (static_cast<Auth::Ntlm::Config*>(Auth::SchemeConfig::Find("ntlm"))->authenticateProgram == NULL) {
 128         debugs(29, DBG_CRITICAL, "ERROR: NTLM Start: no NTLM program configured.");
 129         handler(data);
 130         return;
 131     }
 132
 133     debugs(29, 8, HERE << "credentials state is '" << user()->credentials() << "'");
 134
 135     const char *keyExtras = helperRequestKeyExtras(request, al);
 136     int printResult = 0;
 137     if (user()->credentials() == Auth::Pending) {
 138         if (keyExtras)
 139             printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
 140         else
 141             printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
 142     } else {
 143         if (keyExtras)
 144             printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
 145         else
 146             printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
 147     }
 148     waiting = 1;
 149
 150     if (printResult < 0 || printResult >= (int)sizeof(buf)) {
 151         if (printResult < 0)
 152             debugs(29, DBG_CRITICAL, "ERROR: Can not build ntlm authentication helper request");
 153         else
 154             debugs(29, DBG_CRITICAL, "ERROR: Ntlm authentication helper request too big for the " << sizeof(buf) << "-byte buffer.");
 155         handler(data);
 156         return;
 157     }
 158
 159     safe_free(client_blob);
 160     helperStatefulSubmit(ntlmauthenticators, buf, Auth::Ntlm::UserRequest::HandleReply,
 161                          new Auth::StateData(this, handler, data), authserver);
 162 }
 163
 164 /**
 165  * Atomic action: properly release the NTLM auth helpers which may have been reserved
 166  * for this request connections use.
 167  */
 168 void
 169 Auth::Ntlm::UserRequest::releaseAuthServer()
 170 {
 171     if (authserver) {
 172         debugs(29, 6, HERE << "releasing NTLM auth server '" << authserver << "'");
 173         helperStatefulReleaseServer(authserver);
 174         authserver = NULL;
 175     } else
 176         debugs(29, 6, HERE << "No NTLM auth server to release.");
 177 }
 178
 179 void
 180 Auth::Ntlm::UserRequest::authenticate(HttpRequest * aRequest, ConnStateData * conn, Http::HdrType type)
 181 {
 182     /* Check that we are in the client side, where we can generate
 183      * auth challenges */
 184
 185     if (conn == NULL || !cbdataReferenceValid(conn)) {
 186         user()->credentials(Auth::Failed);
 187         debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
 188         return;
 189     }
 190
 191     if (waiting) {
 192         debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication waiting for helper reply!");
 193         return;
 194     }
 195
 196     if (server_blob) {
 197         debugs(29, 2, HERE << "need to challenge client '" << server_blob << "'!");
 198         return;
 199     }
 200
 201     /* get header */
 202     const char *proxy_auth = aRequest->header.getStr(type);
 203
 204     /* locate second word */
 205     const char *blob = proxy_auth;
 206
 207     /* if proxy_auth is actually NULL, we'd better not manipulate it. */
 208     if (blob) {
 209         while (xisspace(*blob) && *blob)
 210             ++blob;
 211
 212         while (!xisspace(*blob) && *blob)
 213             ++blob;
 214
 215         while (xisspace(*blob) && *blob)
 216             ++blob;
 217     }
 218
 219     switch (user()->credentials()) {
 220
 221     case Auth::Unchecked:
 222         /* we've received a ntlm request. pass to a helper */
 223         debugs(29, 9, HERE << "auth state ntlm none. Received blob: '" << proxy_auth << "'");
 224         user()->credentials(Auth::Pending);
 225         safe_free(client_blob);
 226         client_blob=xstrdup(blob);
 227         assert(conn->getAuth() == NULL);
 228         conn->setAuth(this, "new NTLM handshake request");
 229         request = aRequest;
 230         HTTPMSGLOCK(request);
 231         break;
 232
 233     case Auth::Pending:
 234         debugs(29, DBG_IMPORTANT, HERE << "need to ask helper");
 235         break;
 236
 237     case Auth::Handshake:
 238         /* we should have received a blob from the client. Hand it off to
 239          * some helper */
 240         safe_free(client_blob);
 241         client_blob = xstrdup(blob);
 242         if (request)
 243             HTTPMSGUNLOCK(request);
 244         request = aRequest;
 245         HTTPMSGLOCK(request);
 246         break;
 247
 248     case Auth::Ok:
 249         fatal("Auth::Ntlm::UserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
 250         break;
 251
 252     case Auth::Failed:
 253         /* we've failed somewhere in authentication */
 254         debugs(29, 9, HERE << "auth state ntlm failed. " << proxy_auth);
 255         break;
 256     }
 257 }
 258
 259 void
 260 Auth::Ntlm::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
 261 {
 262     Auth::StateData *r = static_cast<Auth::StateData *>(data);
 263
 264     debugs(29, 8, HERE << "helper: '" << reply.whichServer << "' sent us reply=" << reply);
 265
 266     if (!cbdataReferenceValid(r->data)) {
 267         debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication invalid callback data. helper '" << reply.whichServer << "'.");
 268         delete r;
 269         return;
 270     }
 271
 272     Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
 273     assert(auth_user_request != NULL);
 274
 275     // add new helper kv-pair notes to the credentials object
 276     // so that any transaction using those credentials can access them
 277     auth_user_request->user()->notes.appendNewOnly(&reply.notes);
 278     // remove any private credentials detail which got added.
 279     auth_user_request->user()->notes.remove("token");
 280
 281     Auth::Ntlm::UserRequest *lm_request = dynamic_cast<Auth::Ntlm::UserRequest *>(auth_user_request.getRaw());
 282     assert(lm_request != NULL);
 283     assert(lm_request->waiting);
 284
 285     lm_request->waiting = 0;
 286     safe_free(lm_request->client_blob);
 287
 288     assert(auth_user_request->user() != NULL);
 289     assert(auth_user_request->user()->auth_type == Auth::AUTH_NTLM);
 290
 291     if (lm_request->authserver == NULL)
 292         lm_request->authserver = reply.whichServer.get(); // XXX: no locking?
 293     else
 294         assert(reply.whichServer == lm_request->authserver);
 295
 296     switch (reply.result) {
 297     case Helper::TT:
 298         /* we have been given a blob to send to the client */
 299         safe_free(lm_request->server_blob);
 300         lm_request->request->flags.mustKeepalive = true;
 301         if (lm_request->request->flags.proxyKeepalive) {
 302             const char *serverBlob = reply.notes.findFirst("token");
 303             lm_request->server_blob = xstrdup(serverBlob);
 304             auth_user_request->user()->credentials(Auth::Handshake);
 305             auth_user_request->denyMessage("Authentication in progress");
 306             debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << serverBlob << "'");
 307         } else {
 308             auth_user_request->user()->credentials(Auth::Failed);
 309             auth_user_request->denyMessage("NTLM authentication requires a persistent connection");
 310         }
 311         break;
 312
 313     case Helper::Okay: {
 314         /* we're finished, release the helper */
 315         const char *userLabel = reply.notes.findFirst("user");
 316         if (!userLabel) {
 317             auth_user_request->user()->credentials(Auth::Failed);
 318             safe_free(lm_request->server_blob);
 319             lm_request->releaseAuthServer();
 320             debugs(29, DBG_CRITICAL, "ERROR: NTLM Authentication helper returned no username. Result: " << reply);
 321             break;
 322         }
 323         auth_user_request->user()->username(userLabel);
 324         auth_user_request->denyMessage("Login successful");
 325         safe_free(lm_request->server_blob);
 326         lm_request->releaseAuthServer();
 327
 328         debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << userLabel << "'");
 329         /* connection is authenticated */
 330         debugs(29, 4, HERE << "authenticated user " << auth_user_request->user()->username());
 331         /* see if this is an existing user */
 332         auto local_auth_user = lm_request->user();
 333         auto cached_user = Auth::Ntlm::User::Cache()->lookup(auth_user_request->user()->userKey());
 334         if (!cached_user) {
 335             local_auth_user->addToNameCache();
 336         } else {
 337             /* we can't seamlessly recheck the username due to the
 338              * challenge-response nature of the protocol.
 339              * Just free the temporary auth_user after merging as
 340              * much of it new state into the existing one as possible */
 341             cached_user->absorb(local_auth_user);
 342             /* from here on we are working with the original cached credentials. */
 343             local_auth_user = cached_user;
 344             auth_user_request->user(local_auth_user);
 345         }
 346         /* set these to now because this is either a new login from an
 347          * existing user or a new user */
 348         local_auth_user->expiretime = current_time.tv_sec;
 349         auth_user_request->user()->credentials(Auth::Ok);
 350         debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << auth_user_request->user()->username() << "'");
 351     }
 352     break;
 353
 354     case Helper::Error: {
 355         /* authentication failure (wrong password, etc.) */
 356         const char *errNote = reply.notes.find("message");
 357         if (errNote != NULL)
 358             auth_user_request->denyMessage(errNote);
 359         else
 360             auth_user_request->denyMessage("NTLM Authentication denied with no reason given");
 361         auth_user_request->user()->credentials(Auth::Failed);
 362         safe_free(lm_request->server_blob);
 363         lm_request->releaseAuthServer();
 364         debugs(29, 4, "Failed validating user via NTLM. Result: " << reply);
 365     }
 366     break;
 367
 368     case Helper::Unknown:
 369         debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication Helper '" << reply.whichServer << "' crashed!.");
 370     /* continue to the next case */
 371
 372     case Helper::TimedOut:
 373     case Helper::BrokenHelper: {
 374         /* TODO kick off a refresh process. This can occur after a YR or after
 375          * a KK. If after a YR release the helper and resubmit the request via
 376          * Authenticate NTLM start.
 377          * If after a KK deny the user's request w/ 407 and mark the helper as
 378          * Needing YR. */
 379         const char *errNote = reply.notes.find("message");
 380         if (reply.result == Helper::Unknown)
 381             auth_user_request->denyMessage("Internal Error");
 382         else if (errNote != NULL)
 383             auth_user_request->denyMessage(errNote);
 384         else
 385             auth_user_request->denyMessage("NTLM Authentication failed with no reason given");
 386         auth_user_request->user()->credentials(Auth::Failed);
 387         safe_free(lm_request->server_blob);
 388         lm_request->releaseAuthServer();
 389         debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication validating user. Result: " << reply);
 390     }
 391     break;
 392     }
 393
 394     if (lm_request->request) {
 395         HTTPMSGUNLOCK(lm_request->request);
 396         lm_request->request = NULL;
 397     }
 398     r->handler(r->data);
 399     delete r;
 400 }
 401