src/auth/negotiate/UserRequest.cc

   1 /*
   2  * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 #include "squid.h"
  10 #include "AccessLogEntry.h"
  11 #include "auth/negotiate/Config.h"
  12 #include "auth/negotiate/UserRequest.h"
  13 #include "auth/State.h"
  14 #include "auth/User.h"
  15 #include "client_side.h"
  16 #include "fatal.h"
  17 #include "format/Format.h"
  18 #include "globals.h"
  19 #include "helper.h"
  20 #include "helper/Reply.h"
  21 #include "HttpHeaderTools.h"
  22 #include "HttpReply.h"
  23 #include "HttpRequest.h"
  24 #include "MemBuf.h"
  25 #include "SquidTime.h"
  26
  27 Auth::Negotiate::UserRequest::UserRequest()
  28 {
  29     waiting=0;
  30     client_blob=0;
  31     server_blob=0;
  32     authserver=NULL;
  33     request=NULL;
  34 }
  35
  36 Auth::Negotiate::UserRequest::~UserRequest()
  37 {
  38     assert(LockCount()==0);
  39     safe_free(server_blob);
  40     safe_free(client_blob);
  41
  42     releaseAuthServer();
  43
  44     if (request) {
  45         HTTPMSGUNLOCK(request);
  46         request = NULL;
  47     }
  48 }
  49
  50 const char *
  51 Auth::Negotiate::UserRequest::connLastHeader()
  52 {
  53     return NULL;
  54 }
  55
  56 int
  57 Auth::Negotiate::UserRequest::authenticated() const
  58 {
  59     if (user() != NULL && user()->credentials() == Auth::Ok) {
  60         debugs(29, 9, HERE << "user authenticated.");
  61         return 1;
  62     }
  63
  64     debugs(29, 9, HERE << "user not fully authenticated.");
  65     return 0;
  66 }
  67
  68 const char *
  69 Auth::Negotiate::UserRequest::credentialsStr()
  70 {
  71     static char buf[MAX_AUTHTOKEN_LEN];
  72     if (user()->credentials() == Auth::Pending) {
  73         snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
  74     } else {
  75         snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
  76     }
  77     return buf;
  78 }
  79
  80 Auth::Direction
  81 Auth::Negotiate::UserRequest::module_direction()
  82 {
  83     /* null auth_user is checked for by Auth::UserRequest::direction() */
  84
  85     if (waiting || client_blob)
  86         return Auth::CRED_LOOKUP; /* need helper response to continue */
  87
  88     if (user()->auth_type != Auth::AUTH_NEGOTIATE)
  89         return Auth::CRED_ERROR;
  90
  91     switch (user()->credentials()) {
  92
  93     case Auth::Handshake:
  94         assert(server_blob);
  95         return Auth::CRED_CHALLENGE;
  96
  97     case Auth::Ok:
  98         return Auth::CRED_VALID;
  99
 100     case Auth::Failed:
 101         return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
 102
 103     default:
 104         debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication in unexpected state: " << user()->credentials());
 105         return Auth::CRED_ERROR;
 106     }
 107 }
 108
 109 void
 110 Auth::Negotiate::UserRequest::startHelperLookup(HttpRequest *req, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
 111 {
 112     static char buf[MAX_AUTHTOKEN_LEN];
 113
 114     assert(data);
 115     assert(handler);
 116
 117     assert(user() != NULL);
 118     assert(user()->auth_type == Auth::AUTH_NEGOTIATE);
 119
 120     if (static_cast<Auth::Negotiate::Config*>(Auth::Config::Find("negotiate"))->authenticateProgram == NULL) {
 121         debugs(29, DBG_CRITICAL, "ERROR: No Negotiate authentication program configured.");
 122         handler(data);
 123         return;
 124     }
 125
 126     debugs(29, 8, HERE << "credentials state is '" << user()->credentials() << "'");
 127
 128     const char *keyExtras = helperRequestKeyExtras(request, al);
 129     if (user()->credentials() == Auth::Pending) {
 130         if (keyExtras)
 131             snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
 132         else
 133             snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
 134     } else {
 135         if (keyExtras)
 136             snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
 137         else
 138             snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
 139     }
 140
 141     waiting = 1;
 142
 143     safe_free(client_blob);
 144
 145     helperStatefulSubmit(negotiateauthenticators, buf, Auth::Negotiate::UserRequest::HandleReply,
 146                          new Auth::StateData(this, handler, data), authserver);
 147 }
 148
 149 /**
 150  * Atomic action: properly release the Negotiate auth helpers which may have been reserved
 151  * for this request connections use.
 152  */
 153 void
 154 Auth::Negotiate::UserRequest::releaseAuthServer()
 155 {
 156     if (authserver) {
 157         debugs(29, 6, HERE << "releasing Negotiate auth server '" << authserver << "'");
 158         helperStatefulReleaseServer(authserver);
 159         authserver = NULL;
 160     } else
 161         debugs(29, 6, HERE << "No Negotiate auth server to release.");
 162 }
 163
 164 void
 165 Auth::Negotiate::UserRequest::authenticate(HttpRequest * aRequest, ConnStateData * conn, http_hdr_type type)
 166 {
 167     /* Check that we are in the client side, where we can generate
 168      * auth challenges */
 169
 170     if (conn == NULL || !cbdataReferenceValid(conn)) {
 171         user()->credentials(Auth::Failed);
 172         debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication attempt to perform authentication without a connection!");
 173         return;
 174     }
 175
 176     if (waiting) {
 177         debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication waiting for helper reply!");
 178         return;
 179     }
 180
 181     if (server_blob) {
 182         debugs(29, 2, HERE << "need to challenge client '" << server_blob << "'!");
 183         return;
 184     }
 185
 186     /* get header */
 187     const char *proxy_auth = aRequest->header.getStr(type);
 188
 189     /* locate second word */
 190     const char *blob = proxy_auth;
 191
 192     if (blob) {
 193         while (xisspace(*blob) && *blob)
 194             ++blob;
 195
 196         while (!xisspace(*blob) && *blob)
 197             ++blob;
 198
 199         while (xisspace(*blob) && *blob)
 200             ++blob;
 201     }
 202
 203     switch (user()->credentials()) {
 204
 205     case Auth::Unchecked:
 206         /* we've received a negotiate request. pass to a helper */
 207         debugs(29, 9, HERE << "auth state negotiate none. Received blob: '" << proxy_auth << "'");
 208         user()->credentials(Auth::Pending);
 209         safe_free(client_blob);
 210         client_blob=xstrdup(blob);
 211         assert(conn->getAuth() == NULL);
 212         conn->setAuth(this, "new Negotiate handshake request");
 213         request = aRequest;
 214         HTTPMSGLOCK(request);
 215         break;
 216
 217     case Auth::Pending:
 218         debugs(29, DBG_IMPORTANT, HERE << "need to ask helper");
 219         break;
 220
 221     case Auth::Handshake:
 222         /* we should have received a blob from the client. Hand it off to
 223          * some helper */
 224         safe_free(client_blob);
 225         client_blob = xstrdup(blob);
 226         if (request)
 227             HTTPMSGUNLOCK(request);
 228         request = aRequest;
 229         HTTPMSGLOCK(request);
 230         break;
 231
 232     case Auth::Ok:
 233         fatal("Auth::Negotiate::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
 234         break;
 235
 236     case Auth::Failed:
 237         /* we've failed somewhere in authentication */
 238         debugs(29, 9, HERE << "auth state negotiate failed. " << proxy_auth);
 239         break;
 240     }
 241 }
 242
 243 void
 244 Auth::Negotiate::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
 245 {
 246     Auth::StateData *r = static_cast<Auth::StateData *>(data);
 247
 248     debugs(29, 8, HERE << "helper: '" << reply.whichServer << "' sent us reply=" << reply);
 249
 250     if (!cbdataReferenceValid(r->data)) {
 251         debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication invalid callback data. helper '" << reply.whichServer << "'.");
 252         delete r;
 253         return;
 254     }
 255
 256     Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
 257     assert(auth_user_request != NULL);
 258
 259     // add new helper kv-pair notes to the credentials object
 260     // so that any transaction using those credentials can access them
 261     auth_user_request->user()->notes.appendNewOnly(&reply.notes);
 262
 263     Auth::Negotiate::UserRequest *lm_request = dynamic_cast<Auth::Negotiate::UserRequest *>(auth_user_request.getRaw());
 264     assert(lm_request != NULL);
 265     assert(lm_request->waiting);
 266
 267     lm_request->waiting = 0;
 268     safe_free(lm_request->client_blob);
 269
 270     assert(auth_user_request->user() != NULL);
 271     assert(auth_user_request->user()->auth_type == Auth::AUTH_NEGOTIATE);
 272
 273     if (lm_request->authserver == NULL)
 274         lm_request->authserver = reply.whichServer.get(); // XXX: no locking?
 275     else
 276         assert(reply.whichServer == lm_request->authserver);
 277
 278     switch (reply.result) {
 279     case Helper::TT:
 280         /* we have been given a blob to send to the client */
 281         safe_free(lm_request->server_blob);
 282         lm_request->request->flags.mustKeepalive = true;
 283         if (lm_request->request->flags.proxyKeepalive) {
 284             const char *tokenNote = reply.notes.findFirst("token");
 285             lm_request->server_blob = xstrdup(tokenNote);
 286             auth_user_request->user()->credentials(Auth::Handshake);
 287             auth_user_request->denyMessage("Authentication in progress");
 288             debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << tokenNote << "'");
 289         } else {
 290             auth_user_request->user()->credentials(Auth::Failed);
 291             auth_user_request->denyMessage("Negotiate authentication requires a persistent connection");
 292         }
 293         break;
 294
 295     case Helper::Okay: {
 296         const char *userNote = reply.notes.findFirst("user");
 297         const char *tokenNote = reply.notes.findFirst("token");
 298         if (userNote == NULL || tokenNote == NULL) {
 299             // XXX: handle a success with no username better
 300             /* protocol error */
 301             fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply.other().content());
 302             break;
 303         }
 304
 305         /* we're finished, release the helper */
 306         auth_user_request->user()->username(userNote);
 307         auth_user_request->denyMessage("Login successful");
 308         safe_free(lm_request->server_blob);
 309         lm_request->server_blob = xstrdup(tokenNote);
 310         lm_request->releaseAuthServer();
 311
 312         /* connection is authenticated */
 313         debugs(29, 4, HERE << "authenticated user " << auth_user_request->user()->username());
 314         /* see if this is an existing user with a different proxy_auth
 315          * string */
 316         AuthUserHashPointer *usernamehash = static_cast<AuthUserHashPointer *>(hash_lookup(proxy_auth_username_cache, auth_user_request->user()->userKey()));
 317         Auth::User::Pointer local_auth_user = lm_request->user();
 318         while (usernamehash && (usernamehash->user()->auth_type != Auth::AUTH_NEGOTIATE ||
 319                                 strcmp(usernamehash->user()->userKey(), auth_user_request->user()->userKey()) != 0))
 320             usernamehash = static_cast<AuthUserHashPointer *>(usernamehash->next);
 321         if (usernamehash) {
 322             /* we can't seamlessly recheck the username due to the
 323              * challenge-response nature of the protocol.
 324              * Just free the temporary auth_user after merging as
 325              * much of it new state into the existing one as possible */
 326             usernamehash->user()->absorb(local_auth_user);
 327             /* from here on we are working with the original cached credentials. */
 328             local_auth_user = usernamehash->user();
 329             auth_user_request->user(local_auth_user);
 330         } else {
 331             /* store user in hash's */
 332             local_auth_user->addToNameCache();
 333         }
 334         /* set these to now because this is either a new login from an
 335          * existing user or a new user */
 336         local_auth_user->expiretime = current_time.tv_sec;
 337         auth_user_request->user()->credentials(Auth::Ok);
 338         debugs(29, 4, HERE << "Successfully validated user via Negotiate. Username '" << auth_user_request->user()->username() << "'");
 339     }
 340     break;
 341
 342     case Helper::Error: {
 343         const char *messageNote = reply.notes.find("message");
 344         const char *tokenNote = reply.notes.findFirst("token");
 345
 346         /* authentication failure (wrong password, etc.) */
 347         if (messageNote != NULL)
 348             auth_user_request->denyMessage(messageNote);
 349         else
 350             auth_user_request->denyMessage("Negotiate Authentication denied with no reason given");
 351         auth_user_request->user()->credentials(Auth::Failed);
 352         safe_free(lm_request->server_blob);
 353         if (tokenNote != NULL)
 354             lm_request->server_blob = xstrdup(tokenNote);
 355         lm_request->releaseAuthServer();
 356         debugs(29, 4, "Failed validating user via Negotiate. Result: " << reply);
 357     }
 358     break;
 359
 360     case Helper::Unknown:
 361         debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication Helper '" << reply.whichServer << "' crashed!.");
 362     /* continue to the next case */
 363
 364     case Helper::TimedOut:
 365     case Helper::BrokenHelper: {
 366         /* TODO kick off a refresh process. This can occur after a YR or after
 367          * a KK. If after a YR release the helper and resubmit the request via
 368          * Authenticate Negotiate start.
 369          * If after a KK deny the user's request w/ 407 and mark the helper as
 370          * Needing YR. */
 371         const char *errNote = reply.notes.find("message");
 372         if (reply.result == Helper::Unknown)
 373             auth_user_request->denyMessage("Internal Error");
 374         else if (errNote != NULL)
 375             auth_user_request->denyMessage(errNote);
 376         else
 377             auth_user_request->denyMessage("Negotiate Authentication failed with no reason given");
 378         auth_user_request->user()->credentials(Auth::Failed);
 379         safe_free(lm_request->server_blob);
 380         lm_request->releaseAuthServer();
 381         debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication validating user. Result: " << reply);
 382     } // break;
 383     }
 384
 385     if (lm_request->request) {
 386         HTTPMSGUNLOCK(lm_request->request);
 387         lm_request->request = NULL;
 388     }
 389     r->handler(r->data);
 390     delete r;
 391 }
 392
 393 void
 394 Auth::Negotiate::UserRequest::addAuthenticationInfoHeader(HttpReply * rep, int accel)
 395 {
 396     http_hdr_type type;
 397
 398     if (!server_blob)
 399         return;
 400
 401     /* don't add to authentication error pages */
 402     if ((!accel && rep->sline.status() == Http::scProxyAuthenticationRequired)
 403             || (accel && rep->sline.status() == Http::scUnauthorized))
 404         return;
 405
 406     type = accel ? HDR_AUTHENTICATION_INFO : HDR_PROXY_AUTHENTICATION_INFO;
 407     httpHeaderPutStrf(&rep->header, type, "Negotiate %s", server_blob);
 408
 409     safe_free(server_blob);
 410 }
 411