2 * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
10 #include "AccessLogEntry.h"
11 #include "auth/CredentialsCache.h"
12 #include "auth/negotiate/Config.h"
13 #include "auth/negotiate/User.h"
14 #include "auth/negotiate/UserRequest.h"
15 #include "auth/State.h"
16 #include "auth/User.h"
17 #include "client_side.h"
19 #include "format/Format.h"
22 #include "helper/Reply.h"
23 #include "http/Stream.h"
24 #include "HttpHeaderTools.h"
25 #include "HttpReply.h"
26 #include "HttpRequest.h"
28 #include "SquidTime.h"
30 Auth::Negotiate::UserRequest::UserRequest() :
38 Auth::Negotiate::UserRequest::~UserRequest()
40 assert(LockCount()==0);
41 safe_free(server_blob
);
42 safe_free(client_blob
);
47 HTTPMSGUNLOCK(request
);
53 Auth::Negotiate::UserRequest::connLastHeader()
59 Auth::Negotiate::UserRequest::authenticated() const
61 if (user() != NULL
&& user()->credentials() == Auth::Ok
) {
62 debugs(29, 9, HERE
<< "user authenticated.");
66 debugs(29, 9, HERE
<< "user not fully authenticated.");
71 Auth::Negotiate::UserRequest::credentialsStr()
73 static char buf
[MAX_AUTHTOKEN_LEN
];
75 if (user()->credentials() == Auth::Pending
) {
76 printResult
= snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
78 printResult
= snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
81 // truncation is OK because we are used only for logging
82 if (printResult
< 0) {
83 debugs(29, 2, "Can not build negotiate authentication credentials.");
85 } else if (printResult
>= (int)sizeof(buf
))
86 debugs(29, 2, "Negotiate authentication credentials truncated.");
92 Auth::Negotiate::UserRequest::module_direction()
94 /* null auth_user is checked for by Auth::UserRequest::direction() */
96 if (waiting
|| client_blob
)
97 return Auth::CRED_LOOKUP
; /* need helper response to continue */
99 if (user()->auth_type
!= Auth::AUTH_NEGOTIATE
)
100 return Auth::CRED_ERROR
;
102 switch (user()->credentials()) {
104 case Auth::Handshake
:
106 return Auth::CRED_CHALLENGE
;
109 return Auth::CRED_VALID
;
112 return Auth::CRED_ERROR
; // XXX: really? not VALID or CHALLENGE?
115 debugs(29, DBG_IMPORTANT
, "WARNING: Negotiate Authentication in unexpected state: " << user()->credentials());
116 return Auth::CRED_ERROR
;
121 Auth::Negotiate::UserRequest::startHelperLookup(HttpRequest
*, AccessLogEntry::Pointer
&al
, AUTHCB
* handler
, void *data
)
123 static char buf
[MAX_AUTHTOKEN_LEN
];
128 assert(user() != NULL
);
129 assert(user()->auth_type
== Auth::AUTH_NEGOTIATE
);
131 if (static_cast<Auth::Negotiate::Config
*>(Auth::SchemeConfig::Find("negotiate"))->authenticateProgram
== NULL
) {
132 debugs(29, DBG_CRITICAL
, "ERROR: No Negotiate authentication program configured.");
137 debugs(29, 8, HERE
<< "credentials state is '" << user()->credentials() << "'");
139 const char *keyExtras
= helperRequestKeyExtras(request
, al
);
141 if (user()->credentials() == Auth::Pending
) {
143 printResult
= snprintf(buf
, sizeof(buf
), "YR %s %s\n", client_blob
, keyExtras
);
145 printResult
= snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
148 printResult
= snprintf(buf
, sizeof(buf
), "KK %s %s\n", client_blob
, keyExtras
);
150 printResult
= snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
153 if (printResult
< 0 || printResult
>= (int)sizeof(buf
)) {
155 debugs(29, DBG_CRITICAL
, "ERROR: Can not build negotiate authentication helper request");
157 debugs(29, DBG_CRITICAL
, "ERROR: Negotiate authentication helper request too big for the " << sizeof(buf
) << "-byte buffer");
164 safe_free(client_blob
);
166 helperStatefulSubmit(negotiateauthenticators
, buf
, Auth::Negotiate::UserRequest::HandleReply
,
167 new Auth::StateData(this, handler
, data
), authserver
);
171 * Atomic action: properly release the Negotiate auth helpers which may have been reserved
172 * for this request connections use.
175 Auth::Negotiate::UserRequest::releaseAuthServer()
178 debugs(29, 6, HERE
<< "releasing Negotiate auth server '" << authserver
<< "'");
179 helperStatefulReleaseServer(authserver
);
182 debugs(29, 6, HERE
<< "No Negotiate auth server to release.");
186 Auth::Negotiate::UserRequest::authenticate(HttpRequest
* aRequest
, ConnStateData
* conn
, Http::HdrType type
)
188 /* Check that we are in the client side, where we can generate
191 if (conn
== NULL
|| !cbdataReferenceValid(conn
)) {
192 user()->credentials(Auth::Failed
);
193 debugs(29, DBG_IMPORTANT
, "WARNING: Negotiate Authentication attempt to perform authentication without a connection!");
198 debugs(29, DBG_IMPORTANT
, "WARNING: Negotiate Authentication waiting for helper reply!");
203 debugs(29, 2, HERE
<< "need to challenge client '" << server_blob
<< "'!");
208 const char *proxy_auth
= aRequest
->header
.getStr(type
);
210 /* locate second word */
211 const char *blob
= proxy_auth
;
214 while (xisspace(*blob
) && *blob
)
217 while (!xisspace(*blob
) && *blob
)
220 while (xisspace(*blob
) && *blob
)
224 switch (user()->credentials()) {
226 case Auth::Unchecked
:
227 /* we've received a negotiate request. pass to a helper */
228 debugs(29, 9, HERE
<< "auth state negotiate none. Received blob: '" << proxy_auth
<< "'");
229 user()->credentials(Auth::Pending
);
230 safe_free(client_blob
);
231 client_blob
=xstrdup(blob
);
232 assert(conn
->getAuth() == NULL
);
233 conn
->setAuth(this, "new Negotiate handshake request");
235 HTTPMSGLOCK(request
);
239 debugs(29, DBG_IMPORTANT
, HERE
<< "need to ask helper");
242 case Auth::Handshake
:
243 /* we should have received a blob from the client. Hand it off to
245 safe_free(client_blob
);
246 client_blob
= xstrdup(blob
);
248 HTTPMSGUNLOCK(request
);
250 HTTPMSGLOCK(request
);
254 fatal("Auth::Negotiate::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
258 /* we've failed somewhere in authentication */
259 debugs(29, 9, HERE
<< "auth state negotiate failed. " << proxy_auth
);
265 Auth::Negotiate::UserRequest::HandleReply(void *data
, const Helper::Reply
&reply
)
267 Auth::StateData
*r
= static_cast<Auth::StateData
*>(data
);
269 debugs(29, 8, HERE
<< "helper: '" << reply
.whichServer
<< "' sent us reply=" << reply
);
271 if (!cbdataReferenceValid(r
->data
)) {
272 debugs(29, DBG_IMPORTANT
, "ERROR: Negotiate Authentication invalid callback data. helper '" << reply
.whichServer
<< "'.");
277 Auth::UserRequest::Pointer auth_user_request
= r
->auth_user_request
;
278 assert(auth_user_request
!= NULL
);
280 // add new helper kv-pair notes to the credentials object
281 // so that any transaction using those credentials can access them
282 auth_user_request
->user()->notes
.appendNewOnly(&reply
.notes
);
283 // remove any private credentials detail which got added.
284 auth_user_request
->user()->notes
.remove("token");
286 Auth::Negotiate::UserRequest
*lm_request
= dynamic_cast<Auth::Negotiate::UserRequest
*>(auth_user_request
.getRaw());
287 assert(lm_request
!= NULL
);
288 assert(lm_request
->waiting
);
290 lm_request
->waiting
= 0;
291 safe_free(lm_request
->client_blob
);
293 assert(auth_user_request
->user() != NULL
);
294 assert(auth_user_request
->user()->auth_type
== Auth::AUTH_NEGOTIATE
);
296 if (lm_request
->authserver
== NULL
)
297 lm_request
->authserver
= reply
.whichServer
.get(); // XXX: no locking?
299 assert(reply
.whichServer
== lm_request
->authserver
);
301 switch (reply
.result
) {
303 /* we have been given a blob to send to the client */
304 safe_free(lm_request
->server_blob
);
305 lm_request
->request
->flags
.mustKeepalive
= true;
306 if (lm_request
->request
->flags
.proxyKeepalive
) {
307 const char *tokenNote
= reply
.notes
.findFirst("token");
308 lm_request
->server_blob
= xstrdup(tokenNote
);
309 auth_user_request
->user()->credentials(Auth::Handshake
);
310 auth_user_request
->denyMessage("Authentication in progress");
311 debugs(29, 4, HERE
<< "Need to challenge the client with a server token: '" << tokenNote
<< "'");
313 auth_user_request
->user()->credentials(Auth::Failed
);
314 auth_user_request
->denyMessage("Negotiate authentication requires a persistent connection");
319 const char *userNote
= reply
.notes
.findFirst("user");
320 const char *tokenNote
= reply
.notes
.findFirst("token");
321 if (userNote
== NULL
|| tokenNote
== NULL
) {
322 // XXX: handle a success with no username better
324 fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply
.other().content());
328 /* we're finished, release the helper */
329 auth_user_request
->user()->username(userNote
);
330 auth_user_request
->denyMessage("Login successful");
331 safe_free(lm_request
->server_blob
);
332 lm_request
->server_blob
= xstrdup(tokenNote
);
333 lm_request
->releaseAuthServer();
335 /* connection is authenticated */
336 debugs(29, 4, HERE
<< "authenticated user " << auth_user_request
->user()->username());
337 auto local_auth_user
= lm_request
->user();
338 auto cached_user
= Auth::Negotiate::User::Cache()->lookup(auth_user_request
->user()->userKey());
340 local_auth_user
->addToNameCache();
342 /* we can't seamlessly recheck the username due to the
343 * challenge-response nature of the protocol.
344 * Just free the temporary auth_user after merging as
345 * much of it new state into the existing one as possible */
346 cached_user
->absorb(local_auth_user
);
347 /* from here on we are working with the original cached credentials. */
348 local_auth_user
= cached_user
;
349 auth_user_request
->user(local_auth_user
);
351 /* set these to now because this is either a new login from an
352 * existing user or a new user */
353 local_auth_user
->expiretime
= current_time
.tv_sec
;
354 auth_user_request
->user()->credentials(Auth::Ok
);
355 debugs(29, 4, HERE
<< "Successfully validated user via Negotiate. Username '" << auth_user_request
->user()->username() << "'");
359 case Helper::Error
: {
360 const char *messageNote
= reply
.notes
.find("message");
361 const char *tokenNote
= reply
.notes
.findFirst("token");
363 /* authentication failure (wrong password, etc.) */
364 if (messageNote
!= NULL
)
365 auth_user_request
->denyMessage(messageNote
);
367 auth_user_request
->denyMessage("Negotiate Authentication denied with no reason given");
368 auth_user_request
->user()->credentials(Auth::Failed
);
369 safe_free(lm_request
->server_blob
);
370 if (tokenNote
!= NULL
)
371 lm_request
->server_blob
= xstrdup(tokenNote
);
372 lm_request
->releaseAuthServer();
373 debugs(29, 4, "Failed validating user via Negotiate. Result: " << reply
);
377 case Helper::Unknown
:
378 debugs(29, DBG_IMPORTANT
, "ERROR: Negotiate Authentication Helper '" << reply
.whichServer
<< "' crashed!.");
379 /* continue to the next case */
381 case Helper::TimedOut
:
382 case Helper::BrokenHelper
: {
383 /* TODO kick off a refresh process. This can occur after a YR or after
384 * a KK. If after a YR release the helper and resubmit the request via
385 * Authenticate Negotiate start.
386 * If after a KK deny the user's request w/ 407 and mark the helper as
388 const char *errNote
= reply
.notes
.find("message");
389 if (reply
.result
== Helper::Unknown
)
390 auth_user_request
->denyMessage("Internal Error");
391 else if (errNote
!= NULL
)
392 auth_user_request
->denyMessage(errNote
);
394 auth_user_request
->denyMessage("Negotiate Authentication failed with no reason given");
395 auth_user_request
->user()->credentials(Auth::Failed
);
396 safe_free(lm_request
->server_blob
);
397 lm_request
->releaseAuthServer();
398 debugs(29, DBG_IMPORTANT
, "ERROR: Negotiate Authentication validating user. Result: " << reply
);
402 if (lm_request
->request
) {
403 HTTPMSGUNLOCK(lm_request
->request
);
404 lm_request
->request
= NULL
;