2 #include "AccessLogEntry.h"
3 #include "auth/negotiate/auth_negotiate.h"
4 #include "auth/negotiate/UserRequest.h"
5 #include "auth/State.h"
7 #include "client_side.h"
8 #include "format/Format.h"
11 #include "HttpHeaderTools.h"
12 #include "HttpReply.h"
13 #include "HttpRequest.h"
15 #include "SquidTime.h"
17 Auth::Negotiate::UserRequest::UserRequest()
26 Auth::Negotiate::UserRequest::~UserRequest()
28 assert(LockCount()==0);
29 safe_free(server_blob
);
30 safe_free(client_blob
);
35 HTTPMSGUNLOCK(request
);
41 Auth::Negotiate::UserRequest::connLastHeader()
47 Auth::Negotiate::UserRequest::authenticated() const
49 if (user() != NULL
&& user()->credentials() == Auth::Ok
) {
50 debugs(29, 9, HERE
<< "user authenticated.");
54 debugs(29, 9, HERE
<< "user not fully authenticated.");
59 Auth::Negotiate::UserRequest::credentialsStr()
61 static char buf
[MAX_AUTHTOKEN_LEN
];
62 if (user()->credentials() == Auth::Pending
) {
63 snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
65 snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
71 Auth::Negotiate::UserRequest::module_direction()
73 /* null auth_user is checked for by Auth::UserRequest::direction() */
75 if (waiting
|| client_blob
)
76 return Auth::CRED_LOOKUP
; /* need helper response to continue */
78 if (user()->auth_type
!= Auth::AUTH_NEGOTIATE
)
79 return Auth::CRED_ERROR
;
81 switch (user()->credentials()) {
85 return Auth::CRED_CHALLENGE
;
88 return Auth::CRED_VALID
;
91 return Auth::CRED_ERROR
; // XXX: really? not VALID or CHALLENGE?
94 debugs(29, DBG_IMPORTANT
, "WARNING: Negotiate Authentication in unexpected state: " << user()->credentials());
95 return Auth::CRED_ERROR
;
100 Auth::Negotiate::UserRequest::startHelperLookup(HttpRequest
*req
, AccessLogEntry::Pointer
&al
, AUTHCB
* handler
, void *data
)
102 static char buf
[MAX_AUTHTOKEN_LEN
];
107 assert(user() != NULL
);
108 assert(user()->auth_type
== Auth::AUTH_NEGOTIATE
);
110 if (static_cast<Auth::Negotiate::Config
*>(Auth::Config::Find("negotiate"))->authenticateProgram
== NULL
) {
111 debugs(29, DBG_CRITICAL
, "ERROR: No Negotiate authentication program configured.");
116 debugs(29, 8, HERE
<< "credentials state is '" << user()->credentials() << "'");
118 const char *keyExtras
= helperRequestKeyExtras(request
, al
);
119 if (user()->credentials() == Auth::Pending
) {
121 snprintf(buf
, sizeof(buf
), "YR %s %s\n", client_blob
, keyExtras
);
123 snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
126 snprintf(buf
, sizeof(buf
), "KK %s %s\n", client_blob
, keyExtras
);
128 snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
133 safe_free(client_blob
);
135 helperStatefulSubmit(negotiateauthenticators
, buf
, Auth::Negotiate::UserRequest::HandleReply
,
136 new Auth::StateData(this, handler
, data
), authserver
);
140 * Atomic action: properly release the Negotiate auth helpers which may have been reserved
141 * for this request connections use.
144 Auth::Negotiate::UserRequest::releaseAuthServer()
147 debugs(29, 6, HERE
<< "releasing Negotiate auth server '" << authserver
<< "'");
148 helperStatefulReleaseServer(authserver
);
151 debugs(29, 6, HERE
<< "No Negotiate auth server to release.");
155 Auth::Negotiate::UserRequest::authenticate(HttpRequest
* aRequest
, ConnStateData
* conn
, http_hdr_type type
)
159 /* Check that we are in the client side, where we can generate
162 if (conn
== NULL
|| !cbdataReferenceValid(conn
)) {
163 user()->credentials(Auth::Failed
);
164 debugs(29, DBG_IMPORTANT
, "WARNING: Negotiate Authentication attempt to perform authentication without a connection!");
169 debugs(29, DBG_IMPORTANT
, "WARNING: Negotiate Authentication waiting for helper reply!");
174 debugs(29, 2, HERE
<< "need to challenge client '" << server_blob
<< "'!");
179 const char *proxy_auth
= aRequest
->header
.getStr(type
);
181 /* locate second word */
182 const char *blob
= proxy_auth
;
185 while (xisspace(*blob
) && *blob
)
188 while (!xisspace(*blob
) && *blob
)
191 while (xisspace(*blob
) && *blob
)
195 switch (user()->credentials()) {
197 case Auth::Unchecked
:
198 /* we've received a negotiate request. pass to a helper */
199 debugs(29, 9, HERE
<< "auth state negotiate none. Received blob: '" << proxy_auth
<< "'");
200 user()->credentials(Auth::Pending
);
201 safe_free(client_blob
);
202 client_blob
=xstrdup(blob
);
203 assert(conn
->getAuth() == NULL
);
204 conn
->setAuth(this, "new Negotiate handshake request");
206 HTTPMSGLOCK(request
);
210 debugs(29, DBG_IMPORTANT
, HERE
<< "need to ask helper");
213 case Auth::Handshake
:
214 /* we should have received a blob from the client. Hand it off to
216 safe_free(client_blob
);
217 client_blob
= xstrdup(blob
);
219 HTTPMSGUNLOCK(request
);
221 HTTPMSGLOCK(request
);
225 fatal("Auth::Negotiate::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
229 /* we've failed somewhere in authentication */
230 debugs(29, 9, HERE
<< "auth state negotiate failed. " << proxy_auth
);
236 Auth::Negotiate::UserRequest::HandleReply(void *data
, const HelperReply
&reply
)
238 Auth::StateData
*r
= static_cast<Auth::StateData
*>(data
);
240 debugs(29, 8, HERE
<< "helper: '" << reply
.whichServer
<< "' sent us reply=" << reply
);
242 if (!cbdataReferenceValid(r
->data
)) {
243 debugs(29, DBG_IMPORTANT
, "ERROR: Negotiate Authentication invalid callback data. helper '" << reply
.whichServer
<< "'.");
248 Auth::UserRequest::Pointer auth_user_request
= r
->auth_user_request
;
249 assert(auth_user_request
!= NULL
);
251 // add new helper kv-pair notes to the credentials object
252 // so that any transaction using those credentials can access them
253 auth_user_request
->user()->notes
.appendNewOnly(&reply
.notes
);
255 Auth::Negotiate::UserRequest
*lm_request
= dynamic_cast<Auth::Negotiate::UserRequest
*>(auth_user_request
.getRaw());
256 assert(lm_request
!= NULL
);
257 assert(lm_request
->waiting
);
259 lm_request
->waiting
= 0;
260 safe_free(lm_request
->client_blob
);
262 assert(auth_user_request
->user() != NULL
);
263 assert(auth_user_request
->user()->auth_type
== Auth::AUTH_NEGOTIATE
);
265 if (lm_request
->authserver
== NULL
)
266 lm_request
->authserver
= reply
.whichServer
.get(); // XXX: no locking?
268 assert(reply
.whichServer
== lm_request
->authserver
);
270 switch (reply
.result
) {
271 case HelperReply::TT
:
272 /* we have been given a blob to send to the client */
273 safe_free(lm_request
->server_blob
);
274 lm_request
->request
->flags
.mustKeepalive
= true;
275 if (lm_request
->request
->flags
.proxyKeepalive
) {
276 const char *tokenNote
= reply
.notes
.findFirst("token");
277 lm_request
->server_blob
= xstrdup(tokenNote
);
278 auth_user_request
->user()->credentials(Auth::Handshake
);
279 auth_user_request
->denyMessage("Authentication in progress");
280 debugs(29, 4, HERE
<< "Need to challenge the client with a server token: '" << tokenNote
<< "'");
282 auth_user_request
->user()->credentials(Auth::Failed
);
283 auth_user_request
->denyMessage("Negotiate authentication requires a persistent connection");
287 case HelperReply::Okay
: {
288 const char *userNote
= reply
.notes
.findFirst("user");
289 const char *tokenNote
= reply
.notes
.findFirst("token");
290 if (userNote
== NULL
|| tokenNote
== NULL
) {
291 // XXX: handle a success with no username better
293 fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply
.other().content());
297 /* we're finished, release the helper */
298 auth_user_request
->user()->username(userNote
);
299 auth_user_request
->denyMessage("Login successful");
300 safe_free(lm_request
->server_blob
);
301 lm_request
->server_blob
= xstrdup(tokenNote
);
302 lm_request
->releaseAuthServer();
304 /* connection is authenticated */
305 debugs(29, 4, HERE
<< "authenticated user " << auth_user_request
->user()->username());
306 /* see if this is an existing user with a different proxy_auth
308 AuthUserHashPointer
*usernamehash
= static_cast<AuthUserHashPointer
*>(hash_lookup(proxy_auth_username_cache
, auth_user_request
->user()->userKey()));
309 Auth::User::Pointer local_auth_user
= lm_request
->user();
310 while (usernamehash
&& (usernamehash
->user()->auth_type
!= Auth::AUTH_NEGOTIATE
||
311 strcmp(usernamehash
->user()->userKey(), auth_user_request
->user()->userKey()) != 0))
312 usernamehash
= static_cast<AuthUserHashPointer
*>(usernamehash
->next
);
314 /* we can't seamlessly recheck the username due to the
315 * challenge-response nature of the protocol.
316 * Just free the temporary auth_user after merging as
317 * much of it new state into the existing one as possible */
318 usernamehash
->user()->absorb(local_auth_user
);
319 /* from here on we are working with the original cached credentials. */
320 local_auth_user
= usernamehash
->user();
321 auth_user_request
->user(local_auth_user
);
323 /* store user in hash's */
324 local_auth_user
->addToNameCache();
326 /* set these to now because this is either a new login from an
327 * existing user or a new user */
328 local_auth_user
->expiretime
= current_time
.tv_sec
;
329 auth_user_request
->user()->credentials(Auth::Ok
);
330 debugs(29, 4, HERE
<< "Successfully validated user via Negotiate. Username '" << auth_user_request
->user()->username() << "'");
334 case HelperReply::Error
: {
335 const char *messageNote
= reply
.notes
.find("message");
336 const char *tokenNote
= reply
.notes
.findFirst("token");
338 /* authentication failure (wrong password, etc.) */
339 if (messageNote
!= NULL
)
340 auth_user_request
->denyMessage(messageNote
);
342 auth_user_request
->denyMessage("Negotiate Authentication denied with no reason given");
343 auth_user_request
->user()->credentials(Auth::Failed
);
344 safe_free(lm_request
->server_blob
);
345 if (tokenNote
!= NULL
)
346 lm_request
->server_blob
= xstrdup(tokenNote
);
347 lm_request
->releaseAuthServer();
348 debugs(29, 4, "Failed validating user via Negotiate. Result: " << reply
);
352 case HelperReply::Unknown
:
353 debugs(29, DBG_IMPORTANT
, "ERROR: Negotiate Authentication Helper '" << reply
.whichServer
<< "' crashed!.");
354 /* continue to the next case */
356 case HelperReply::BrokenHelper
: {
357 /* TODO kick off a refresh process. This can occur after a YR or after
358 * a KK. If after a YR release the helper and resubmit the request via
359 * Authenticate Negotiate start.
360 * If after a KK deny the user's request w/ 407 and mark the helper as
362 const char *errNote
= reply
.notes
.find("message");
363 if (reply
.result
== HelperReply::Unknown
)
364 auth_user_request
->denyMessage("Internal Error");
365 else if (errNote
!= NULL
)
366 auth_user_request
->denyMessage(errNote
);
368 auth_user_request
->denyMessage("Negotiate Authentication failed with no reason given");
369 auth_user_request
->user()->credentials(Auth::Failed
);
370 safe_free(lm_request
->server_blob
);
371 lm_request
->releaseAuthServer();
372 debugs(29, DBG_IMPORTANT
, "ERROR: Negotiate Authentication validating user. Result: " << reply
);
376 if (lm_request
->request
) {
377 HTTPMSGUNLOCK(lm_request
->request
);
378 lm_request
->request
= NULL
;
385 Auth::Negotiate::UserRequest::addAuthenticationInfoHeader(HttpReply
* rep
, int accel
)
392 /* don't add to authentication error pages */
393 if ((!accel
&& rep
->sline
.status() == Http::scProxyAuthenticationRequired
)
394 || (accel
&& rep
->sline
.status() == Http::scUnauthorized
))
397 type
= accel
? HDR_AUTHENTICATION_INFO
: HDR_PROXY_AUTHENTICATION_INFO
;
398 httpHeaderPutStrf(&rep
->header
, type
, "Negotiate %s", server_blob
);
400 safe_free(server_blob
);