src/auth/digest/auth_digest.cc

   1 /*
   2  * $Id$
   3  *
   4  * DEBUG: section 29    Authenticator
   5  * AUTHOR: Robert Collins
   6  *
   7  * SQUID Internet Object Cache  http://squid.nlanr.net/Squid/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from the
  11  *  Internet community.  Development is led by Duane Wessels of the
  12  *  National Laboratory for Applied Network Research and funded by the
  13  *  National Science Foundation.  Squid is Copyrighted (C) 1998 by
  14  *  the Regents of the University of California.  Please see the
  15  *  COPYRIGHT file for full details.  Squid incorporates software
  16  *  developed and/or copyrighted by other sources.  Please see the
  17  *  CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 /* The functions in this file handle authentication.
  36  * They DO NOT perform access control or auditing.
  37  * See acl.c for access control and client_side.c for auditing */
  38
  39
  40 #include "squid.h"
  41 #include "rfc2617.h"
  42 #include "auth/digest/auth_digest.h"
  43 #include "auth/Gadgets.h"
  44 #include "event.h"
  45 #include "CacheManager.h"
  46 #include "Store.h"
  47 #include "HttpRequest.h"
  48 #include "HttpReply.h"
  49 #include "wordlist.h"
  50 #include "SquidTime.h"
  51 /* TODO don't include this */
  52 #include "auth/digest/digestScheme.h"
  53 #include "auth/digest/digestUserRequest.h"
  54
  55 /* Digest Scheme */
  56
  57 static AUTHSSTATS authenticateDigestStats;
  58
  59 helper *digestauthenticators = NULL;
  60
  61 static hash_table *digest_nonce_cache;
  62
  63 static int authdigest_initialised = 0;
  64 static MemAllocator *digest_nonce_pool = NULL;
  65
  66 // CBDATA_TYPE(DigestAuthenticateStateData);
  67
  68 enum http_digest_attr_type {
  69     DIGEST_USERNAME,
  70     DIGEST_REALM,
  71     DIGEST_QOP,
  72     DIGEST_ALGORITHM,
  73     DIGEST_URI,
  74     DIGEST_NONCE,
  75     DIGEST_NC,
  76     DIGEST_CNONCE,
  77     DIGEST_RESPONSE,
  78     DIGEST_ENUM_END
  79 };
  80
  81 static const HttpHeaderFieldAttrs DigestAttrs[DIGEST_ENUM_END] = {
  82     {"username",  (http_hdr_type)DIGEST_USERNAME},
  83     {"realm", (http_hdr_type)DIGEST_REALM},
  84     {"qop", (http_hdr_type)DIGEST_QOP},
  85     {"algorithm", (http_hdr_type)DIGEST_ALGORITHM},
  86     {"uri", (http_hdr_type)DIGEST_URI},
  87     {"nonce", (http_hdr_type)DIGEST_NONCE},
  88     {"nc", (http_hdr_type)DIGEST_NC},
  89     {"cnonce", (http_hdr_type)DIGEST_CNONCE},
  90     {"response", (http_hdr_type)DIGEST_RESPONSE},
  91 };
  92
  93 static HttpHeaderFieldInfo *DigestFieldsInfo = NULL;
  94
  95 /*
  96  *
  97  * Nonce Functions
  98  *
  99  */
 100
 101 static void authenticateDigestNonceCacheCleanup(void *data);
 102 static digest_nonce_h *authenticateDigestNonceFindNonce(const char *nonceb64);
 103 static digest_nonce_h *authenticateDigestNonceNew(void);
 104 static void authenticateDigestNonceDelete(digest_nonce_h * nonce);
 105 static void authenticateDigestNonceSetup(void);
 106 static void authenticateDigestNonceShutdown(void);
 107 static void authenticateDigestNonceReconfigure(void);
 108 static int authDigestNonceIsStale(digest_nonce_h * nonce);
 109 static void authDigestNonceEncode(digest_nonce_h * nonce);
 110 static void authDigestNonceLink(digest_nonce_h * nonce);
 111 #if NOT_USED
 112 static int authDigestNonceLinks(digest_nonce_h * nonce);
 113 #endif
 114 static void authDigestNonceUserUnlink(digest_nonce_h * nonce);
 115 static void authDigestNoncePurge(digest_nonce_h * nonce);
 116
 117 static void
 118 authDigestNonceEncode(digest_nonce_h * nonce)
 119 {
 120     if (!nonce)
 121         return;
 122
 123     if (nonce->key)
 124         xfree(nonce->key);
 125
 126     nonce->key = xstrdup(base64_encode_bin((char *) &(nonce->noncedata), sizeof(digest_nonce_data)));
 127 }
 128
 129 static digest_nonce_h *
 130 authenticateDigestNonceNew(void)
 131 {
 132     digest_nonce_h *newnonce = static_cast < digest_nonce_h * >(digest_nonce_pool->alloc());
 133     digest_nonce_h *temp;
 134
 135     /* NONCE CREATION - NOTES AND REASONING. RBC 20010108
 136      * === EXCERPT FROM RFC 2617 ===
 137      * The contents of the nonce are implementation dependent. The quality
 138      * of the implementation depends on a good choice. A nonce might, for
 139      * example, be constructed as the base 64 encoding of
 140      *
 141      * time-stamp H(time-stamp ":" ETag ":" private-key)
 142      *
 143      * where time-stamp is a server-generated time or other non-repeating
 144      * value, ETag is the value of the HTTP ETag header associated with
 145      * the requested entity, and private-key is data known only to the
 146      * server.  With a nonce of this form a server would recalculate the
 147      * hash portion after receiving the client authentication header and
 148      * reject the request if it did not match the nonce from that header
 149      * or if the time-stamp value is not recent enough. In this way the
 150      * server can limit the time of the nonce's validity. The inclusion of
 151      * the ETag prevents a replay request for an updated version of the
 152      * resource.  (Note: including the IP address of the client in the
 153      * nonce would appear to offer the server the ability to limit the
 154      * reuse of the nonce to the same client that originally got it.
 155      * However, that would break proxy farms, where requests from a single
 156      * user often go through different proxies in the farm. Also, IP
 157      * address spoofing is not that hard.)
 158      * ====
 159      *
 160      * Now for my reasoning:
 161      * We will not accept a unrecognised nonce->we have all recognisable
 162      * nonces stored. If we send out unique base64 encodings we guarantee
 163      * that a given nonce applies to only one user (barring attacks or
 164      * really bad timing with expiry and creation).  Using a random
 165      * component in the nonce allows us to loop to find a unique nonce.
 166      * We use H(nonce_data) so the nonce is meaningless to the reciever.
 167      * So our nonce looks like base64(H(timestamp,pointertohash,randomdata))
 168      * And even if our randomness is not very random (probably due to
 169      * bad coding on my part) we don't really care - the timestamp and
 170      * memory pointer also guarantee local uniqueness in the input to the hash
 171      * function.
 172      */
 173
 174     /* create a new nonce */
 175     newnonce->nc = 0;
 176     newnonce->flags.valid = 1;
 177     newnonce->noncedata.self = newnonce;
 178     newnonce->noncedata.creationtime = current_time.tv_sec;
 179     newnonce->noncedata.randomdata = squid_random();
 180
 181     authDigestNonceEncode(newnonce);
 182     /*
 183      * loop until we get a unique nonce. The nonce creation must
 184      * have a random factor
 185      */
 186
 187     while ((temp = authenticateDigestNonceFindNonce((char const *) (newnonce->key)))) {
 188         /* create a new nonce */
 189         newnonce->noncedata.randomdata = squid_random();
 190         authDigestNonceEncode(newnonce);
 191     }
 192
 193     hash_join(digest_nonce_cache, newnonce);
 194     /* the cache's link */
 195     authDigestNonceLink(newnonce);
 196     newnonce->flags.incache = 1;
 197     debugs(29, 5, "authenticateDigestNonceNew: created nonce " << newnonce << " at " << newnonce->noncedata.creationtime);
 198     return newnonce;
 199 }
 200
 201 static void
 202 authenticateDigestNonceDelete(digest_nonce_h * nonce)
 203 {
 204     if (nonce) {
 205         assert(nonce->references == 0);
 206 #if UNREACHABLECODE
 207
 208         if (nonce->flags.incache)
 209             hash_remove_link(digest_nonce_cache, nonce);
 210
 211 #endif
 212
 213         assert(nonce->flags.incache == 0);
 214
 215         safe_free(nonce->key);
 216
 217         digest_nonce_pool->freeOne(nonce);
 218     }
 219 }
 220
 221 static void
 222 authenticateDigestNonceSetup(void)
 223 {
 224     if (!digest_nonce_pool)
 225         digest_nonce_pool = memPoolCreate("Digest Scheme nonce's", sizeof(digest_nonce_h));
 226
 227     if (!digest_nonce_cache) {
 228         digest_nonce_cache = hash_create((HASHCMP *) strcmp, 7921, hash_string);
 229         assert(digest_nonce_cache);
 230         eventAdd("Digest none cache maintenance", authenticateDigestNonceCacheCleanup, NULL, static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->nonceGCInterval, 1);
 231     }
 232 }
 233
 234 static void
 235 authenticateDigestNonceShutdown(void)
 236 {
 237     /*
 238      * We empty the cache of any nonces left in there.
 239      */
 240     digest_nonce_h *nonce;
 241
 242     if (digest_nonce_cache) {
 243         debugs(29, 2, "authenticateDigestNonceShutdown: Shutting down nonce cache ");
 244         hash_first(digest_nonce_cache);
 245
 246         while ((nonce = ((digest_nonce_h *) hash_next(digest_nonce_cache)))) {
 247             assert(nonce->flags.incache);
 248             authDigestNoncePurge(nonce);
 249         }
 250     }
 251
 252 #if DEBUGSHUTDOWN
 253     if (digest_nonce_pool) {
 254         delete digest_nonce_pool;
 255         digest_nonce_pool = NULL;
 256     }
 257
 258 #endif
 259     debugs(29, 2, "authenticateDigestNonceShutdown: Nonce cache shutdown");
 260 }
 261
 262 static void
 263 authenticateDigestNonceReconfigure(void)
 264 {}
 265
 266 static void
 267 authenticateDigestNonceCacheCleanup(void *data)
 268 {
 269     /*
 270      * We walk the hash by nonceb64 as that is the unique key we
 271      * use.  For big hash tables we could consider stepping through
 272      * the cache, 100/200 entries at a time. Lets see how it flies
 273      * first.
 274      */
 275     digest_nonce_h *nonce;
 276     debugs(29, 3, "authenticateDigestNonceCacheCleanup: Cleaning the nonce cache now");
 277     debugs(29, 3, "authenticateDigestNonceCacheCleanup: Current time: " << current_time.tv_sec);
 278     hash_first(digest_nonce_cache);
 279
 280     while ((nonce = ((digest_nonce_h *) hash_next(digest_nonce_cache)))) {
 281         debugs(29, 3, "authenticateDigestNonceCacheCleanup: nonce entry  : " << nonce << " '" << (char *) nonce->key << "'");
 282         debugs(29, 4, "authenticateDigestNonceCacheCleanup: Creation time: " << nonce->noncedata.creationtime);
 283
 284         if (authDigestNonceIsStale(nonce)) {
 285             debugs(29, 4, "authenticateDigestNonceCacheCleanup: Removing nonce " << (char *) nonce->key << " from cache due to timeout.");
 286             assert(nonce->flags.incache);
 287             /* invalidate nonce so future requests fail */
 288             nonce->flags.valid = 0;
 289             /* if it is tied to a auth_user, remove the tie */
 290             authDigestNonceUserUnlink(nonce);
 291             authDigestNoncePurge(nonce);
 292         }
 293     }
 294
 295     debugs(29, 3, "authenticateDigestNonceCacheCleanup: Finished cleaning the nonce cache.");
 296
 297     if (static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->active())
 298         eventAdd("Digest none cache maintenance", authenticateDigestNonceCacheCleanup, NULL, static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->nonceGCInterval, 1);
 299 }
 300
 301 static void
 302 authDigestNonceLink(digest_nonce_h * nonce)
 303 {
 304     assert(nonce != NULL);
 305     nonce->references++;
 306     debugs(29, 9, "authDigestNonceLink: nonce '" << nonce << "' now at '" << nonce->references << "'.");
 307 }
 308
 309 #if NOT_USED
 310 static int
 311 authDigestNonceLinks(digest_nonce_h * nonce)
 312 {
 313     if (!nonce)
 314         return -1;
 315
 316     return nonce->references;
 317 }
 318
 319 #endif
 320
 321 void
 322 authDigestNonceUnlink(digest_nonce_h * nonce)
 323 {
 324     assert(nonce != NULL);
 325
 326     if (nonce->references > 0) {
 327         nonce->references--;
 328     } else {
 329         debugs(29, 1, "authDigestNonceUnlink; Attempt to lower nonce " << nonce << " refcount below 0!");
 330     }
 331
 332     debugs(29, 9, "authDigestNonceUnlink: nonce '" << nonce << "' now at '" << nonce->references << "'.");
 333
 334     if (nonce->references == 0)
 335         authenticateDigestNonceDelete(nonce);
 336 }
 337
 338 const char *
 339 authenticateDigestNonceNonceb64(const digest_nonce_h * nonce)
 340 {
 341     if (!nonce)
 342         return NULL;
 343
 344     return (char const *) nonce->key;
 345 }
 346
 347 static digest_nonce_h *
 348 authenticateDigestNonceFindNonce(const char *nonceb64)
 349 {
 350     digest_nonce_h *nonce = NULL;
 351
 352     if (nonceb64 == NULL)
 353         return NULL;
 354
 355     debugs(29, 9, "authDigestNonceFindNonce:looking for nonceb64 '" << nonceb64 << "' in the nonce cache.");
 356
 357     nonce = static_cast < digest_nonce_h * >(hash_lookup(digest_nonce_cache, nonceb64));
 358
 359     if ((nonce == NULL) || (strcmp(authenticateDigestNonceNonceb64(nonce), nonceb64)))
 360         return NULL;
 361
 362     debugs(29, 9, "authDigestNonceFindNonce: Found nonce '" << nonce << "'");
 363
 364     return nonce;
 365 }
 366
 367 int
 368 authDigestNonceIsValid(digest_nonce_h * nonce, char nc[9])
 369 {
 370     unsigned long intnc;
 371     /* do we have a nonce ? */
 372
 373     if (!nonce)
 374         return 0;
 375
 376     intnc = strtol(nc, NULL, 16);
 377
 378     /* has it already been invalidated ? */
 379     if (!nonce->flags.valid) {
 380         debugs(29, 4, "authDigestNonceIsValid: Nonce already invalidated");
 381         return 0;
 382     }
 383
 384     /* is the nonce-count ok ? */
 385     if (!static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->CheckNonceCount) {
 386         nonce->nc++;
 387         return -1;              /* forced OK by configuration */
 388     }
 389
 390     if ((static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->NonceStrictness && intnc != nonce->nc + 1) ||
 391             intnc < nonce->nc + 1) {
 392         debugs(29, 4, "authDigestNonceIsValid: Nonce count doesn't match");
 393         nonce->flags.valid = 0;
 394         return 0;
 395     }
 396
 397     /* seems ok */
 398     /* increment the nonce count - we've already checked that intnc is a
 399      *  valid representation for us, so we don't need the test here.
 400      */
 401     nonce->nc = intnc;
 402
 403     return -1;
 404 }
 405
 406 static int
 407 authDigestNonceIsStale(digest_nonce_h * nonce)
 408 {
 409     /* do we have a nonce ? */
 410
 411     if (!nonce)
 412         return -1;
 413
 414     /* has it's max duration expired? */
 415     if (nonce->noncedata.creationtime + static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->noncemaxduration < current_time.tv_sec) {
 416         debugs(29, 4, "authDigestNonceIsStale: Nonce is too old. " <<
 417                nonce->noncedata.creationtime << " " <<
 418                static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->noncemaxduration << " " <<
 419                current_time.tv_sec);
 420
 421         nonce->flags.valid = 0;
 422         return -1;
 423     }
 424
 425     if (nonce->nc > 99999998) {
 426         debugs(29, 4, "authDigestNonceIsStale: Nonce count overflow");
 427         nonce->flags.valid = 0;
 428         return -1;
 429     }
 430
 431     if (nonce->nc > static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->noncemaxuses) {
 432         debugs(29, 4, "authDigestNoncelastRequest: Nonce count over user limit");
 433         nonce->flags.valid = 0;
 434         return -1;
 435     }
 436
 437     /* seems ok */
 438     return 0;
 439 }
 440
 441 /**
 442  * \retval  0    the digest is not stale yet
 443  * \retval -1    the digest will be stale on the next request
 444  */
 445 const int
 446 authDigestNonceLastRequest(digest_nonce_h * nonce)
 447 {
 448     if (!nonce)
 449         return -1;
 450
 451     if (nonce->nc == 99999997) {
 452         debugs(29, 4, "authDigestNoncelastRequest: Nonce count about to overflow");
 453         return -1;
 454     }
 455
 456     if (nonce->nc >= static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->noncemaxuses - 1) {
 457         debugs(29, 4, "authDigestNoncelastRequest: Nonce count about to hit user limit");
 458         return -1;
 459     }
 460
 461     /* and other tests are possible. */
 462     return 0;
 463 }
 464
 465 static void
 466 authDigestNoncePurge(digest_nonce_h * nonce)
 467 {
 468     if (!nonce)
 469         return;
 470
 471     if (!nonce->flags.incache)
 472         return;
 473
 474     hash_remove_link(digest_nonce_cache, nonce);
 475
 476     nonce->flags.incache = 0;
 477
 478     /* the cache's link */
 479     authDigestNonceUnlink(nonce);
 480 }
 481
 482 /* USER related functions */
 483 static AuthUser::Pointer
 484 authDigestUserFindUsername(const char *username)
 485 {
 486     AuthUserHashPointer *usernamehash;
 487     debugs(29, 9, HERE << "Looking for user '" << username << "'");
 488
 489     if (username && (usernamehash = static_cast < auth_user_hash_pointer * >(hash_lookup(proxy_auth_username_cache, username)))) {
 490         while ((usernamehash->user()->auth_type != AUTH_DIGEST) && (usernamehash->next))
 491             usernamehash = static_cast<AuthUserHashPointer *>(usernamehash->next);
 492
 493         if (usernamehash->user()->auth_type == AUTH_DIGEST) {
 494             return usernamehash->user();
 495         }
 496     }
 497
 498     return NULL;
 499 }
 500
 501 void
 502 AuthDigestConfig::rotateHelpers()
 503 {
 504     /* schedule closure of existing helpers */
 505     if (digestauthenticators) {
 506         helperShutdown(digestauthenticators);
 507     }
 508
 509     /* NP: dynamic helper restart will ensure they start up again as needed. */
 510 }
 511
 512
 513 /** delete the digest request structure. Does NOT delete related structures */
 514 void
 515 digestScheme::done()
 516 {
 517     /** \todo this should be a Config call. */
 518
 519     if (digestauthenticators)
 520         helperShutdown(digestauthenticators);
 521
 522     if (DigestFieldsInfo) {
 523         httpHeaderDestroyFieldsInfo(DigestFieldsInfo, DIGEST_ENUM_END);
 524         DigestFieldsInfo = NULL;
 525     }
 526
 527     authdigest_initialised = 0;
 528
 529     if (!shutting_down) {
 530         authenticateDigestNonceReconfigure();
 531         return;
 532     }
 533
 534     delete digestauthenticators;
 535     digestauthenticators = NULL;
 536
 537     PurgeCredentialsCache();
 538     authenticateDigestNonceShutdown();
 539     debugs(29, 2, "authenticateDigestDone: Digest authentication shut down.");
 540
 541     /* clear the global handle to this scheme. */
 542     _instance = NULL;
 543 }
 544
 545 void
 546 AuthDigestConfig::dump(StoreEntry * entry, const char *name, AuthConfig * scheme)
 547 {
 548     wordlist *list = authenticate;
 549     debugs(29, 9, "authDigestCfgDump: Dumping configuration");
 550     storeAppendPrintf(entry, "%s %s", name, "digest");
 551
 552     while (list != NULL) {
 553         storeAppendPrintf(entry, " %s", list->key);
 554         list = list->next;
 555     }
 556
 557     storeAppendPrintf(entry, "\n%s %s realm %s\n%s %s children %d startup=%d idle=%d concurrency=%d\n%s %s nonce_max_count %d\n%s %s nonce_max_duration %d seconds\n%s %s nonce_garbage_interval %d seconds\n",
 558                       name, "digest", digestAuthRealm,
 559                       name, "digest", authenticateChildren.n_max, authenticateChildren.n_startup, authenticateChildren.n_idle, authenticateChildren.concurrency,
 560                       name, "digest", noncemaxuses,
 561                       name, "digest", (int) noncemaxduration,
 562                       name, "digest", (int) nonceGCInterval);
 563 }
 564
 565 bool
 566 AuthDigestConfig::active() const
 567 {
 568     return authdigest_initialised == 1;
 569 }
 570
 571 bool
 572 AuthDigestConfig::configured() const
 573 {
 574     if ((authenticate != NULL) &&
 575             (authenticateChildren.n_max != 0) &&
 576             (digestAuthRealm != NULL) && (noncemaxduration > -1))
 577         return true;
 578
 579     return false;
 580 }
 581
 582 /* add the [www-|Proxy-]authenticate header on a 407 or 401 reply */
 583 void
 584 AuthDigestConfig::fixHeader(AuthUserRequest::Pointer auth_user_request, HttpReply *rep, http_hdr_type hdrType, HttpRequest * request)
 585 {
 586     if (!authenticate)
 587         return;
 588
 589     int stale = 0;
 590
 591     if (auth_user_request != NULL) {
 592         AuthDigestUserRequest *digest_request;
 593         digest_request = dynamic_cast<AuthDigestUserRequest*>(auth_user_request.getRaw());
 594         assert (digest_request != NULL);
 595
 596         stale = !digest_request->flags.invalid_password;
 597     }
 598
 599     /* on a 407 or 401 we always use a new nonce */
 600     digest_nonce_h *nonce = authenticateDigestNonceNew();
 601
 602     debugs(29, 9, "authenticateFixHeader: Sending type:" << hdrType <<
 603            " header: 'Digest realm=\"" << digestAuthRealm << "\", nonce=\"" <<
 604            authenticateDigestNonceNonceb64(nonce) << "\", qop=\"" << QOP_AUTH <<
 605            "\", stale=" << (stale ? "true" : "false"));
 606
 607     /* in the future, for WWW auth we may want to support the domain entry */
 608     httpHeaderPutStrf(&rep->header, hdrType, "Digest realm=\"%s\", nonce=\"%s\", qop=\"%s\", stale=%s", digestAuthRealm, authenticateDigestNonceNonceb64(nonce), QOP_AUTH, stale ? "true" : "false");
 609 }
 610
 611 DigestUser::~DigestUser()
 612 {
 613     dlink_node *link, *tmplink;
 614     link = nonces.head;
 615
 616     while (link) {
 617         tmplink = link;
 618         link = link->next;
 619         dlinkDelete(tmplink, &nonces);
 620         authDigestNoncePurge(static_cast < digest_nonce_h * >(tmplink->data));
 621         authDigestNonceUnlink(static_cast < digest_nonce_h * >(tmplink->data));
 622         dlinkNodeDelete(tmplink);
 623     }
 624 }
 625
 626 int32_t
 627 DigestUser::ttl() const
 628 {
 629     int32_t global_ttl = static_cast<int32_t>(expiretime - squid_curtime + Config.authenticateTTL);
 630
 631     /* find the longest lasting nonce. */
 632     int32_t latest_nonce = -1;
 633     dlink_node *link = nonces.head;
 634     while (link) {
 635         digest_nonce_h *nonce = static_cast<digest_nonce_h *>(link->data);
 636         if (nonce->flags.valid && nonce->noncedata.creationtime > latest_nonce)
 637             latest_nonce = nonce->noncedata.creationtime;
 638
 639         link = link->next;
 640     }
 641     if (latest_nonce == -1)
 642         return min(-1, global_ttl);
 643
 644     int32_t nonce_ttl = latest_nonce - current_time.tv_sec + static_cast<AuthDigestConfig*>(AuthConfig::Find("digest"))->noncemaxduration;
 645
 646     return min(nonce_ttl, global_ttl);
 647 }
 648
 649
 650 /* Initialize helpers and the like for this auth scheme. Called AFTER parsing the
 651  * config file */
 652 void
 653 AuthDigestConfig::init(AuthConfig * scheme)
 654 {
 655     if (authenticate) {
 656         DigestFieldsInfo = httpHeaderBuildFieldsInfo(DigestAttrs, DIGEST_ENUM_END);
 657         authenticateDigestNonceSetup();
 658         authdigest_initialised = 1;
 659
 660         if (digestauthenticators == NULL)
 661             digestauthenticators = new helper("digestauthenticator");
 662
 663         digestauthenticators->cmdline = authenticate;
 664
 665         digestauthenticators->childs = authenticateChildren;
 666
 667         digestauthenticators->ipc_type = IPC_STREAM;
 668
 669         helperOpenServers(digestauthenticators);
 670
 671         CBDATA_INIT_TYPE(authenticateStateData);
 672     }
 673 }
 674
 675 void
 676 AuthDigestConfig::registerWithCacheManager(void)
 677 {
 678     CacheManager::GetInstance()->
 679     registerAction("digestauthenticator",
 680                    "Digest User Authenticator Stats",
 681                    authenticateDigestStats, 0, 1);
 682 }
 683
 684 /* free any allocated configuration details */
 685 void
 686 AuthDigestConfig::done()
 687 {
 688     if (authenticate)
 689         wordlistDestroy(&authenticate);
 690
 691     safe_free(digestAuthRealm);
 692 }
 693
 694 AuthDigestConfig::AuthDigestConfig()
 695 {
 696     /* TODO: move into initialisation list */
 697     /* 5 minutes */
 698     nonceGCInterval = 5 * 60;
 699     /* 30 minutes */
 700     noncemaxduration = 30 * 60;
 701     /* 50 requests */
 702     noncemaxuses = 50;
 703     /* Not strict nonce count behaviour */
 704     NonceStrictness = 0;
 705     /* Verify nonce count */
 706     CheckNonceCount = 1;
 707 }
 708
 709 void
 710 AuthDigestConfig::parse(AuthConfig * scheme, int n_configured, char *param_str)
 711 {
 712     if (strcasecmp(param_str, "program") == 0) {
 713         if (authenticate)
 714             wordlistDestroy(&authenticate);
 715
 716         parse_wordlist(&authenticate);
 717
 718         requirePathnameExists("auth_param digest program", authenticate->key);
 719     } else if (strcasecmp(param_str, "children") == 0) {
 720         authenticateChildren.parseConfig();
 721     } else if (strcasecmp(param_str, "realm") == 0) {
 722         parse_eol(&digestAuthRealm);
 723     } else if (strcasecmp(param_str, "nonce_garbage_interval") == 0) {
 724         parse_time_t(&nonceGCInterval);
 725     } else if (strcasecmp(param_str, "nonce_max_duration") == 0) {
 726         parse_time_t(&noncemaxduration);
 727     } else if (strcasecmp(param_str, "nonce_max_count") == 0) {
 728         parse_int((int *) &noncemaxuses);
 729     } else if (strcasecmp(param_str, "nonce_strictness") == 0) {
 730         parse_onoff(&NonceStrictness);
 731     } else if (strcasecmp(param_str, "check_nonce_count") == 0) {
 732         parse_onoff(&CheckNonceCount);
 733     } else if (strcasecmp(param_str, "post_workaround") == 0) {
 734         parse_onoff(&PostWorkaround);
 735     } else if (strcasecmp(param_str, "utf8") == 0) {
 736         parse_onoff(&utf8);
 737     } else {
 738         debugs(29, 0, "unrecognised digest auth scheme parameter '" << param_str << "'");
 739     }
 740 }
 741
 742 const char *
 743 AuthDigestConfig::type() const
 744 {
 745     return digestScheme::GetInstance()->type();
 746 }
 747
 748
 749 static void
 750 authenticateDigestStats(StoreEntry * sentry)
 751 {
 752     helperStats(sentry, digestauthenticators, "Digest Authenticator Statistics");
 753 }
 754
 755 /* NonceUserUnlink: remove the reference to auth_user and unlink the node from the list */
 756
 757 static void
 758 authDigestNonceUserUnlink(digest_nonce_h * nonce)
 759 {
 760     DigestUser *digest_user;
 761     dlink_node *link, *tmplink;
 762
 763     if (!nonce)
 764         return;
 765
 766     if (!nonce->user)
 767         return;
 768
 769     digest_user = nonce->user;
 770
 771     /* unlink from the user list. Yes we're crossing structures but this is the only
 772      * time this code is needed
 773      */
 774     link = digest_user->nonces.head;
 775
 776     while (link) {
 777         tmplink = link;
 778         link = link->next;
 779
 780         if (tmplink->data == nonce) {
 781             dlinkDelete(tmplink, &digest_user->nonces);
 782             authDigestNonceUnlink(static_cast < digest_nonce_h * >(tmplink->data));
 783             dlinkNodeDelete(tmplink);
 784             link = NULL;
 785         }
 786     }
 787
 788     /* this reference to user was not locked because freeeing the user frees
 789      * the nonce too.
 790      */
 791     nonce->user = NULL;
 792 }
 793
 794 /* authDigestUserLinkNonce: add a nonce to a given user's struct */
 795
 796 static void
 797 authDigestUserLinkNonce(DigestUser * user, digest_nonce_h * nonce)
 798 {
 799     dlink_node *node;
 800     DigestUser *digest_user;
 801
 802     if (!user || !nonce)
 803         return;
 804
 805     digest_user = user;
 806
 807     node = digest_user->nonces.head;
 808
 809     while (node && (node->data != nonce))
 810         node = node->next;
 811
 812     if (node)
 813         return;
 814
 815     node = dlinkNodeNew();
 816
 817     dlinkAddTail(nonce, node, &digest_user->nonces);
 818
 819     authDigestNonceLink(nonce);
 820
 821     /* ping this nonce to this auth user */
 822     assert((nonce->user == NULL) || (nonce->user == user));
 823
 824     /* we don't lock this reference because removing the user removes the
 825      * hash too. Of course if that changes we're stuffed so read the code huh?
 826      */
 827     nonce->user = user;
 828 }
 829
 830 /* setup the necessary info to log the username */
 831 static AuthUserRequest::Pointer
 832 authDigestLogUsername(char *username, AuthUserRequest::Pointer auth_user_request)
 833 {
 834     assert(auth_user_request != NULL);
 835
 836     /* log the username */
 837     debugs(29, 9, "authDigestLogUsername: Creating new user for logging '" << username << "'");
 838     AuthUser::Pointer digest_user = new DigestUser(static_cast<AuthDigestConfig*>(AuthConfig::Find("digest")));
 839     /* save the credentials */
 840     digest_user->username(username);
 841     /* set the auth_user type */
 842     digest_user->auth_type = AUTH_BROKEN;
 843     /* link the request to the user */
 844     auth_user_request->user(digest_user);
 845     return auth_user_request;
 846 }
 847
 848 /*
 849  * Decode a Digest [Proxy-]Auth string, placing the results in the passed
 850  * Auth_user structure.
 851  */
 852 AuthUserRequest::Pointer
 853 AuthDigestConfig::decode(char const *proxy_auth)
 854 {
 855     const char *item;
 856     const char *p;
 857     const char *pos = NULL;
 858     char *username = NULL;
 859     digest_nonce_h *nonce;
 860     int ilen;
 861
 862     debugs(29, 9, "authenticateDigestDecodeAuth: beginning");
 863
 864     AuthDigestUserRequest *digest_request = new AuthDigestUserRequest();
 865
 866     /* trim DIGEST from string */
 867
 868     while (xisgraph(*proxy_auth))
 869         proxy_auth++;
 870
 871     /* Trim leading whitespace before decoding */
 872     while (xisspace(*proxy_auth))
 873         proxy_auth++;
 874
 875     String temp(proxy_auth);
 876
 877     while (strListGetItem(&temp, ',', &item, &ilen, &pos)) {
 878         /* isolate directive name & value */
 879         size_t nlen;
 880         size_t vlen;
 881         if ((p = (const char *)memchr(item, '=', ilen)) && (p - item < ilen)) {
 882             nlen = p++ - item;
 883             vlen = ilen - (p - item);
 884         } else {
 885             nlen = ilen;
 886             vlen = 0;
 887         }
 888
 889         /* parse value. auth-param     = token "=" ( token | quoted-string ) */
 890         String value;
 891         if (vlen > 0) {
 892             if (*p == '"') {
 893                 if (!httpHeaderParseQuotedString(p, &value)) {
 894                     debugs(29, 9, "authDigestDecodeAuth: Failed to parse attribute '" << item << "' in '" << temp << "'");
 895                     continue;
 896                 }
 897             } else {
 898                 value.limitInit(p, vlen);
 899             }
 900         } else {
 901             debugs(29, 9, "authDigestDecodeAuth: Failed to parse attribute '" << item << "' in '" << temp << "'");
 902             continue;
 903         }
 904
 905         /* find type */
 906         http_digest_attr_type type = (http_digest_attr_type)httpHeaderIdByName(item, nlen, DigestFieldsInfo, DIGEST_ENUM_END);
 907
 908         switch (type) {
 909         case DIGEST_USERNAME:
 910             safe_free(username);
 911             username = xstrndup(value.rawBuf(), value.size() + 1);
 912             debugs(29, 9, "authDigestDecodeAuth: Found Username '" << username << "'");
 913             break;
 914
 915         case DIGEST_REALM:
 916             safe_free(digest_request->realm);
 917             digest_request->realm = xstrndup(value.rawBuf(), value.size() + 1);
 918             debugs(29, 9, "authDigestDecodeAuth: Found realm '" << digest_request->realm << "'");
 919             break;
 920
 921         case DIGEST_QOP:
 922             safe_free(digest_request->qop);
 923             digest_request->qop = xstrndup(value.rawBuf(), value.size() + 1);
 924             debugs(29, 9, "authDigestDecodeAuth: Found qop '" << digest_request->qop << "'");
 925             break;
 926
 927         case DIGEST_ALGORITHM:
 928             safe_free(digest_request->algorithm);
 929             digest_request->algorithm = xstrndup(value.rawBuf(), value.size() + 1);
 930             debugs(29, 9, "authDigestDecodeAuth: Found algorithm '" << digest_request->algorithm << "'");
 931             break;
 932
 933         case DIGEST_URI:
 934             safe_free(digest_request->uri);
 935             digest_request->uri = xstrndup(value.rawBuf(), value.size() + 1);
 936             debugs(29, 9, "authDigestDecodeAuth: Found uri '" << digest_request->uri << "'");
 937             break;
 938
 939         case DIGEST_NONCE:
 940             safe_free(digest_request->nonceb64);
 941             digest_request->nonceb64 = xstrndup(value.rawBuf(), value.size() + 1);
 942             debugs(29, 9, "authDigestDecodeAuth: Found nonce '" << digest_request->nonceb64 << "'");
 943             break;
 944
 945         case DIGEST_NC:
 946             if (value.size() != 8) {
 947                 debugs(29, 9, "authDigestDecodeAuth: Invalid nc '" << value << "' in '" << temp << "'");
 948             }
 949             xstrncpy(digest_request->nc, value.rawBuf(), value.size() + 1);
 950             debugs(29, 9, "authDigestDecodeAuth: Found noncecount '" << digest_request->nc << "'");
 951             break;
 952
 953         case DIGEST_CNONCE:
 954             safe_free(digest_request->cnonce);
 955             digest_request->cnonce = xstrndup(value.rawBuf(), value.size() + 1);
 956             debugs(29, 9, "authDigestDecodeAuth: Found cnonce '" << digest_request->cnonce << "'");
 957             break;
 958
 959         case DIGEST_RESPONSE:
 960             safe_free(digest_request->response);
 961             digest_request->response = xstrndup(value.rawBuf(), value.size() + 1);
 962             debugs(29, 9, "authDigestDecodeAuth: Found response '" << digest_request->response << "'");
 963             break;
 964
 965         default:
 966             debugs(29, 3, "authDigestDecodeAuth: Unknown attribute '" << item << "' in '" << temp << "'");
 967             break;
 968         }
 969     }
 970
 971     temp.clean();
 972
 973
 974     /* now we validate the data given to us */
 975
 976     /*
 977      * TODO: on invalid parameters we should return 400, not 407.
 978      * Find some clean way of doing this. perhaps return a valid
 979      * struct, and set the direction to clientwards combined with
 980      * a change to the clientwards handling code (ie let the
 981      * clientwards call set the error type (but limited to known
 982      * correct values - 400/401/407
 983      */
 984
 985     /* 2069 requirements */
 986
 987     /* do we have a username ? */
 988     if (!username || username[0] == '\0') {
 989         debugs(29, 2, "authenticateDigestDecode: Empty or not present username");
 990         return authDigestLogUsername(username, digest_request);
 991     }
 992
 993     /* Sanity check of the username.
 994      * " can not be allowed in usernames until * the digest helper protocol
 995      * have been redone
 996      */
 997     if (strchr(username, '"')) {
 998         debugs(29, 2, "authenticateDigestDecode: Unacceptable username '" << username << "'");
 999         return authDigestLogUsername(username, digest_request);
1000     }
1001
1002     /* do we have a realm ? */
1003     if (!digest_request->realm || digest_request->realm[0] == '\0') {
1004         debugs(29, 2, "authenticateDigestDecode: Empty or not present realm");
1005         return authDigestLogUsername(username, digest_request);
1006     }
1007
1008     /* and a nonce? */
1009     if (!digest_request->nonceb64 || digest_request->nonceb64[0] == '\0') {
1010         debugs(29, 2, "authenticateDigestDecode: Empty or not present nonce");
1011         return authDigestLogUsername(username, digest_request);
1012     }
1013
1014     /* we can't check the URI just yet. We'll check it in the
1015      * authenticate phase, but needs to be given */
1016     if (!digest_request->uri || digest_request->uri[0] == '\0') {
1017         debugs(29, 2, "authenticateDigestDecode: Missing URI field");
1018         return authDigestLogUsername(username, digest_request);
1019     }
1020
1021     /* is the response the correct length? */
1022     if (!digest_request->response || strlen(digest_request->response) != 32) {
1023         debugs(29, 2, "authenticateDigestDecode: Response length invalid");
1024         return authDigestLogUsername(username, digest_request);
1025     }
1026
1027     /* check the algorithm is present and supported */
1028     if (!digest_request->algorithm)
1029         digest_request->algorithm = xstrndup("MD5", 4);
1030     else if (strcmp(digest_request->algorithm, "MD5")
1031              && strcmp(digest_request->algorithm, "MD5-sess")) {
1032         debugs(29, 2, "authenticateDigestDecode: invalid algorithm specified!");
1033         return authDigestLogUsername(username, digest_request);
1034     }
1035
1036     /* 2617 requirements, indicated by qop */
1037     if (digest_request->qop) {
1038
1039         /* check the qop is what we expected. */
1040         if (strcmp(digest_request->qop, QOP_AUTH) != 0) {
1041             /* we received a qop option we didn't send */
1042             debugs(29, 2, "authenticateDigestDecode: Invalid qop option received");
1043             return authDigestLogUsername(username, digest_request);
1044         }
1045
1046         /* check cnonce */
1047         if (!digest_request->cnonce || digest_request->cnonce[0] == '\0') {
1048             debugs(29, 2, "authenticateDigestDecode: Missing cnonce field");
1049             return authDigestLogUsername(username, digest_request);
1050         }
1051
1052         /* check nc */
1053         if (strlen(digest_request->nc) != 8 || strspn(digest_request->nc, "0123456789abcdefABCDEF") != 8) {
1054             debugs(29, 2, "authenticateDigestDecode: invalid nonce count");
1055             return authDigestLogUsername(username, digest_request);
1056         }
1057     } else {
1058         /* cnonce and nc both require qop */
1059         if (digest_request->cnonce || digest_request->nc) {
1060             debugs(29, 2, "authenticateDigestDecode: missing qop!");
1061             return authDigestLogUsername(username, digest_request);
1062         }
1063     }
1064
1065     /** below nonce state dependent **/
1066
1067     /* now the nonce */
1068     nonce = authenticateDigestNonceFindNonce(digest_request->nonceb64);
1069     if (!nonce) {
1070         /* we couldn't find a matching nonce! */
1071         debugs(29, 2, "authenticateDigestDecode: Unexpected or invalid nonce received");
1072         digest_request->credentials(AuthDigestUserRequest::Failed);
1073         return authDigestLogUsername(username, digest_request);
1074     }
1075
1076     digest_request->nonce = nonce;
1077     authDigestNonceLink(nonce);
1078
1079     /* check that we're not being hacked / the username hasn't changed */
1080     if (nonce->user && strcmp(username, nonce->user->username())) {
1081         debugs(29, 2, "authenticateDigestDecode: Username for the nonce does not equal the username for the request");
1082         return authDigestLogUsername(username, digest_request);
1083     }
1084
1085     /* the method we'll check at the authenticate step as well */
1086
1087
1088     /* we don't send or parse opaques. Ok so we're flexable ... */
1089
1090     /* find the user */
1091     DigestUser *digest_user;
1092
1093     AuthUser::Pointer auth_user;
1094
1095     if ((auth_user = authDigestUserFindUsername(username)) == NULL) {
1096         /* the user doesn't exist in the username cache yet */
1097         debugs(29, 9, "authDigestDecodeAuth: Creating new digest user '" << username << "'");
1098         digest_user = new DigestUser(this);
1099         /* auth_user is a parent */
1100         auth_user = digest_user;
1101         /* save the username */
1102         digest_user->username(username);
1103         /* set the user type */
1104         digest_user->auth_type = AUTH_DIGEST;
1105         /* this auth_user struct is the one to get added to the
1106          * username cache */
1107         /* store user in hash's */
1108         digest_user->addToNameCache();
1109
1110         /*
1111          * Add the digest to the user so we can tell if a hacking
1112          * or spoofing attack is taking place. We do this by assuming
1113          * the user agent won't change user name without warning.
1114          */
1115         authDigestUserLinkNonce(digest_user, nonce);
1116     } else {
1117         debugs(29, 9, "authDigestDecodeAuth: Found user '" << username << "' in the user cache as '" << auth_user << "'");
1118         digest_user = static_cast<DigestUser *>(auth_user.getRaw());
1119         xfree(username);
1120     }
1121
1122     /*link the request and the user */
1123     assert(digest_request != NULL);
1124
1125     digest_request->user(digest_user);
1126     debugs(29, 9, "username = '" << digest_user->username() << "'\nrealm = '" <<
1127            digest_request->realm << "'\nqop = '" << digest_request->qop <<
1128            "'\nalgorithm = '" << digest_request->algorithm << "'\nuri = '" <<
1129            digest_request->uri << "'\nnonce = '" << digest_request->nonceb64 <<
1130            "'\nnc = '" << digest_request->nc << "'\ncnonce = '" <<
1131            digest_request->cnonce << "'\nresponse = '" <<
1132            digest_request->response << "'\ndigestnonce = '" << nonce << "'");
1133
1134     return digest_request;
1135 }
1136
1137 DigestUser::DigestUser(AuthConfig *aConfig) : AuthUser(aConfig), HA1created (0)
1138 {}