src/auth/negotiate/auth_negotiate.cc

   1 /*
   2  * $Id$
   3  *
   4  * DEBUG: section 29    Negotiate Authenticator
   5  * AUTHOR: Robert Collins, Henrik Nordstrom, Francesco Chemolli
   6  *
   7  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from
  11  *  the Internet community; see the CONTRIBUTORS file for full
  12  *  details.   Many organizations have provided support for Squid's
  13  *  development; see the SPONSORS file for full details.  Squid is
  14  *  Copyrighted (C) 2001 by the Regents of the University of
  15  *  California; see the COPYRIGHT file for full details.  Squid
  16  *  incorporates software developed and/or copyrighted by other
  17  *  sources; see the CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 /* The functions in this file handle authentication.
  36  * They DO NOT perform access control or auditing.
  37  * See acl.c for access control and client_side.c for auditing */
  38
  39
  40 #include "squid.h"
  41 #include "auth_negotiate.h"
  42 #include "auth/Gadgets.h"
  43 #include "CacheManager.h"
  44 #include "Store.h"
  45 #include "client_side.h"
  46 #include "HttpReply.h"
  47 #include "HttpRequest.h"
  48 #include "SquidTime.h"
  49 /** \todo remove this include */
  50 #include "negotiateScheme.h"
  51 #include "wordlist.h"
  52
  53 /**
  54  \defgroup AuthNegotiateInternal Negotiate Authenticator Internals
  55  \ingroup AuthNegotiateAPI
  56  */
  57
  58 /**
  59  * Maximum length (buffer size) for token strings.
  60  */
  61 // AYJ: must match re-definition in helpers/negotiate_auth/squid_kerb_auth/squid_kerb_auth.c
  62 #define MAX_AUTHTOKEN_LEN   32768
  63
  64
  65 /// \ingroup AuthNegotiateInternal
  66 static void
  67 authenticateStateFree(authenticateStateData * r)
  68 {
  69     AUTHUSERREQUESTUNLOCK(r->auth_user_request, "r");
  70     cbdataFree(r);
  71 }
  72
  73 /* Negotiate Scheme */
  74 static HLPSCB authenticateNegotiateHandleReply;
  75 static AUTHSSTATS authenticateNegotiateStats;
  76
  77 /// \ingroup AuthNegotiateInternal
  78 static statefulhelper *negotiateauthenticators = NULL;
  79
  80 CBDATA_TYPE(authenticateStateData);
  81
  82 /// \ingroup AuthNegotiateInternal
  83 static int authnegotiate_initialised = 0;
  84
  85 /// \ingroup AuthNegotiateInternal
  86 static auth_negotiate_config negotiateConfig;
  87
  88 /// \ingroup AuthNegotiateInternal
  89 static hash_table *proxy_auth_cache = NULL;
  90
  91 /*
  92  *
  93  * Private Functions
  94  *
  95  */
  96
  97 /**
  98  \ingroup AuthNegotiateInternal
  99  \todo move to negotiateScheme.cc
 100  */
 101 void
 102 negotiateScheme::done()
 103 {
 104     /* TODO: this should be a Config call. */
 105     debugs(29, 2, "negotiateScheme::done: shutting down Negotiate authentication.");
 106
 107     if (negotiateauthenticators)
 108         helperStatefulShutdown(negotiateauthenticators);
 109
 110     authnegotiate_initialised = 0;
 111
 112     if (!shutting_down)
 113         return;
 114
 115     if (negotiateauthenticators)
 116         helperStatefulFree(negotiateauthenticators);
 117
 118     negotiateauthenticators = NULL;
 119
 120     debugs(29, 2, "negotiateScheme::done: Negotiate authentication Shutdown.");
 121 }
 122
 123 void
 124 AuthNegotiateConfig::done()
 125 {
 126     if (authenticate)
 127         wordlistDestroy(&authenticate);
 128 }
 129
 130 void
 131 AuthNegotiateConfig::dump(StoreEntry * entry, const char *name, AuthConfig * scheme)
 132 {
 133     wordlist *list = authenticate;
 134     storeAppendPrintf(entry, "%s %s", name, "negotiate");
 135
 136     while (list != NULL) {
 137         storeAppendPrintf(entry, " %s", list->key);
 138         list = list->next;
 139     }
 140
 141     storeAppendPrintf(entry, "\n%s negotiate children %d\n",
 142                       name, authenticateChildren);
 143     storeAppendPrintf(entry, "%s %s keep_alive %s\n", name, "negotiate", keep_alive ? "on" : "off");
 144
 145 }
 146
 147 AuthNegotiateConfig::AuthNegotiateConfig() : authenticateChildren(5), keep_alive(1)
 148 { }
 149
 150 void
 151 AuthNegotiateConfig::parse(AuthConfig * scheme, int n_configured, char *param_str)
 152 {
 153     if (strcasecmp(param_str, "program") == 0) {
 154         if (authenticate)
 155             wordlistDestroy(&authenticate);
 156
 157         parse_wordlist(&authenticate);
 158
 159         requirePathnameExists("auth_param negotiate program", authenticate->key);
 160     } else if (strcasecmp(param_str, "children") == 0) {
 161         parse_int(&authenticateChildren);
 162     } else if (strcasecmp(param_str, "keep_alive") == 0) {
 163         parse_onoff(&keep_alive);
 164     } else {
 165         debugs(29, 0, "AuthNegotiateConfig::parse: unrecognised negotiate auth scheme parameter '" << param_str << "'");
 166     }
 167
 168     /*
 169      * disable client side request pipelining. There is a race with
 170      * Negotiate when the client sends a second request on an Negotiate
 171      * connection before the authenticate challenge is sent. With
 172      * this patch, the client may fail to authenticate, but squid's
 173      * state will be preserved.  Caveats: this should be a post-parse
 174      * test, but that can wait for the modular parser to be integrated.
 175      */
 176     if (authenticate)
 177         Config.onoff.pipeline_prefetch = 0;
 178 }
 179
 180 const char *
 181 AuthNegotiateConfig::type() const
 182 {
 183     return negotiateScheme::GetInstance().type();
 184 }
 185
 186 /**
 187  * Initialize helpers and the like for this auth scheme.
 188  * Called AFTER parsing the config file
 189  */
 190 void
 191 AuthNegotiateConfig::init(AuthConfig * scheme)
 192 {
 193     if (authenticate) {
 194
 195         authnegotiate_initialised = 1;
 196
 197         if (negotiateauthenticators == NULL)
 198             negotiateauthenticators = helperStatefulCreate("negotiateauthenticator");
 199
 200         if (!proxy_auth_cache)
 201             proxy_auth_cache = hash_create((HASHCMP *) strcmp, 7921, hash_string);
 202
 203         assert(proxy_auth_cache);
 204
 205         negotiateauthenticators->cmdline = authenticate;
 206
 207         negotiateauthenticators->n_to_start = authenticateChildren;
 208
 209         negotiateauthenticators->ipc_type = IPC_STREAM;
 210
 211         helperStatefulOpenServers(negotiateauthenticators);
 212
 213         CBDATA_INIT_TYPE(authenticateStateData);
 214     }
 215 }
 216
 217 void
 218 AuthNegotiateConfig::registerWithCacheManager(void)
 219 {
 220     CacheManager::GetInstance()->
 221     registerAction("negotiateauthenticator",
 222                    "Negotiate User Authenticator Stats",
 223                    authenticateNegotiateStats, 0, 1);
 224 }
 225
 226 bool
 227 AuthNegotiateConfig::active() const
 228 {
 229     return authnegotiate_initialised == 1;
 230 }
 231
 232 bool
 233 AuthNegotiateConfig::configured() const
 234 {
 235     if ((authenticate != NULL) && (authenticateChildren != 0)) {
 236         debugs(29, 9, "AuthNegotiateConfig::configured: returning configured");
 237         return true;
 238     }
 239
 240     debugs(29, 9, "AuthNegotiateConfig::configured: returning unconfigured");
 241     return false;
 242 }
 243
 244 /* Negotiate Scheme */
 245 /* See AuthUserRequest.cc::authenticateDirection for return values */
 246 int
 247 AuthNegotiateUserRequest::module_direction()
 248 {
 249     /* null auth_user is checked for by authenticateDirection */
 250
 251     if (waiting || client_blob)
 252         return -1; /* need helper response to continue */
 253
 254     switch (auth_state) {
 255
 256         /* no progress at all. */
 257
 258     case AUTHENTICATE_STATE_NONE:
 259         debugs(29, 1, "AuthNegotiateUserRequest::direction: called before Negotiate Authenticate for request " << this << "!. Report a bug to squid-dev.");
 260         return -2; /* error */
 261
 262     case AUTHENTICATE_STATE_FAILED:
 263         return -2; /* error */
 264
 265
 266     case AUTHENTICATE_STATE_IN_PROGRESS:
 267         assert(server_blob);
 268         return 1; /* send to client */
 269
 270     case AUTHENTICATE_STATE_DONE:
 271         return 0; /* do nothing */
 272
 273     case AUTHENTICATE_STATE_INITIAL:
 274         debugs(29, 1, "AuthNegotiateUserRequest::direction: Unexpected AUTHENTICATE_STATE_INITIAL");
 275         return -2;
 276     }
 277
 278     return -2;
 279 }
 280
 281 /* add the [proxy]authorisation header */
 282 void
 283 AuthNegotiateUserRequest::addHeader(HttpReply * rep, int accel)
 284 {
 285     http_hdr_type type;
 286
 287     if (!server_blob)
 288         return;
 289
 290     /* don't add to authentication error pages */
 291
 292     if ((!accel && rep->sline.status == HTTP_PROXY_AUTHENTICATION_REQUIRED)
 293             || (accel && rep->sline.status == HTTP_UNAUTHORIZED))
 294         return;
 295
 296     type = accel ? HDR_AUTHENTICATION_INFO : HDR_PROXY_AUTHENTICATION_INFO;
 297
 298     httpHeaderPutStrf(&rep->header, type, "Negotiate %s", server_blob);
 299
 300     safe_free(server_blob);
 301 }
 302
 303 void
 304 AuthNegotiateConfig::fixHeader(AuthUserRequest *auth_user_request, HttpReply *rep, http_hdr_type type, HttpRequest * request)
 305 {
 306     AuthNegotiateUserRequest *negotiate_request;
 307
 308     if (!authenticate)
 309         return;
 310
 311     /* Need keep-alive */
 312     if (!request->flags.proxy_keepalive && request->flags.must_keepalive)
 313         return;
 314
 315     /* New request, no user details */
 316     if (auth_user_request == NULL) {
 317         debugs(29, 9, "AuthNegotiateConfig::fixHeader: Sending type:" << type << " header: 'Negotiate'");
 318         httpHeaderPutStrf(&rep->header, type, "Negotiate");
 319
 320         if (!keep_alive) {
 321             /* drop the connection */
 322             rep->header.delByName("keep-alive");
 323             request->flags.proxy_keepalive = 0;
 324         }
 325     } else {
 326         negotiate_request = dynamic_cast<AuthNegotiateUserRequest *>(auth_user_request);
 327
 328         assert(negotiate_request != NULL);
 329
 330         switch (negotiate_request->auth_state) {
 331
 332         case AUTHENTICATE_STATE_FAILED:
 333             /* here it makes sense to drop the connection, as auth is
 334              * tied to it, even if MAYBE the client could handle it - Kinkie */
 335             rep->header.delByName("keep-alive");
 336             request->flags.proxy_keepalive = 0;
 337             /* fall through */
 338
 339         case AUTHENTICATE_STATE_DONE:
 340             /* Special case: authentication finished OK but disallowed by ACL.
 341              * Need to start over to give the client another chance.
 342              */
 343
 344             if (negotiate_request->server_blob) {
 345                 debugs(29, 9, "authenticateNegotiateFixErrorHeader: Sending type:" << type << " header: 'Negotiate " << negotiate_request->server_blob << "'");
 346                 httpHeaderPutStrf(&rep->header, type, "Negotiate %s", negotiate_request->server_blob);
 347                 safe_free(negotiate_request->server_blob);
 348             } else {
 349                 debugs(29, 9, "authenticateNegotiateFixErrorHeader: Connection authenticated");
 350                 httpHeaderPutStrf(&rep->header, type, "Negotiate");
 351             }
 352
 353             break;
 354
 355         case AUTHENTICATE_STATE_NONE:
 356             /* semantic change: do not drop the connection.
 357              * 2.5 implementation used to keep it open - Kinkie */
 358             debugs(29, 9, "AuthNegotiateConfig::fixHeader: Sending type:" << type << " header: 'Negotiate'");
 359             httpHeaderPutStrf(&rep->header, type, "Negotiate");
 360             break;
 361
 362         case AUTHENTICATE_STATE_IN_PROGRESS:
 363             /* we're waiting for a response from the client. Pass it the blob */
 364             debugs(29, 9, "AuthNegotiateConfig::fixHeader: Sending type:" << type << " header: 'Negotiate " << negotiate_request->server_blob << "'");
 365             httpHeaderPutStrf(&rep->header, type, "Negotiate %s", negotiate_request->server_blob);
 366             safe_free(negotiate_request->server_blob);
 367             break;
 368
 369
 370         default:
 371             debugs(29, 0, "AuthNegotiateConfig::fixHeader: state " << negotiate_request->auth_state << ".");
 372             fatal("unexpected state in AuthenticateNegotiateFixErrorHeader.\n");
 373         }
 374     }
 375 }
 376
 377 NegotiateUser::~NegotiateUser()
 378 {
 379     debugs(29, 5, "NegotiateUser::~NegotiateUser: doing nothing to clearNegotiate scheme data for '" << this << "'");
 380 }
 381
 382 static void
 383 authenticateNegotiateHandleReply(void *data, void *lastserver, char *reply)
 384 {
 385     authenticateStateData *r = static_cast<authenticateStateData *>(data);
 386
 387     int valid;
 388     char *blob, *arg = NULL;
 389
 390     AuthUserRequest *auth_user_request;
 391     AuthUser *auth_user;
 392     NegotiateUser *negotiate_user;
 393     AuthNegotiateUserRequest *negotiate_request;
 394
 395     debugs(29, 8, "authenticateNegotiateHandleReply: helper: '" << lastserver << "' sent us '" << (reply ? reply : "<NULL>") << "'");
 396     valid = cbdataReferenceValid(r->data);
 397
 398     if (!valid) {
 399         debugs(29, 1, "authenticateNegotiateHandleReply: invalid callback data. helper '" << lastserver << "'.");
 400         cbdataReferenceDone(r->data);
 401         authenticateStateFree(r);
 402         return;
 403     }
 404
 405     if (!reply) {
 406         debugs(29, 1, "authenticateNegotiateHandleReply: Helper '" << lastserver << "' crashed!.");
 407         reply = (char *)"BH Internal error";
 408     }
 409
 410     auth_user_request = r->auth_user_request;
 411     assert(auth_user_request != NULL);
 412     negotiate_request = dynamic_cast<AuthNegotiateUserRequest *>(auth_user_request);
 413
 414     assert(negotiate_request != NULL);
 415     assert(negotiate_request->waiting);
 416     negotiate_request->waiting = 0;
 417     safe_free(negotiate_request->client_blob);
 418
 419     auth_user = negotiate_request->user();
 420     assert(auth_user != NULL);
 421     assert(auth_user->auth_type == AUTH_NEGOTIATE);
 422     negotiate_user = dynamic_cast<negotiate_user_t *>(auth_user_request->user());
 423
 424     assert(negotiate_user != NULL);
 425
 426     if (negotiate_request->authserver == NULL)
 427         negotiate_request->authserver = static_cast<helper_stateful_server*>(lastserver);
 428     else
 429         assert(negotiate_request->authserver == lastserver);
 430
 431     /* seperate out the useful data */
 432     blob = strchr(reply, ' ');
 433
 434     if (blob) {
 435         blob++;
 436         arg = strchr(blob + 1, ' ');
 437     } else {
 438         arg = NULL;
 439     }
 440
 441     if (strncasecmp(reply, "TT ", 3) == 0) {
 442         /* we have been given a blob to send to the client */
 443         if (arg)
 444             *arg++ = '\0';
 445         safe_free(negotiate_request->server_blob);
 446         negotiate_request->request->flags.must_keepalive = 1;
 447         if (negotiate_request->request->flags.proxy_keepalive) {
 448             negotiate_request->server_blob = xstrdup(blob);
 449             negotiate_request->auth_state = AUTHENTICATE_STATE_IN_PROGRESS;
 450             auth_user_request->denyMessage("Authentication in progress");
 451             debugs(29, 4, "authenticateNegotiateHandleReply: Need to challenge the client with a server blob '" << blob << "'");
 452         } else {
 453             negotiate_request->auth_state = AUTHENTICATE_STATE_FAILED;
 454             auth_user_request->denyMessage("NTLM authentication requires a persistent connection");
 455         }
 456     } else if (strncasecmp(reply, "AF ", 3) == 0 && arg != NULL) {
 457         /* we're finished, release the helper */
 458
 459         if (arg)
 460             *arg++ = '\0';
 461
 462         negotiate_user->username(arg);
 463
 464         auth_user_request->denyMessage("Login successful");
 465
 466         safe_free(negotiate_request->server_blob);
 467
 468         negotiate_request->server_blob = xstrdup(blob);
 469
 470         negotiate_request->releaseAuthServer();
 471
 472         negotiate_request->auth_state = AUTHENTICATE_STATE_DONE;
 473
 474         debugs(29, 4, "authenticateNegotiateHandleReply: Successfully validated user via Negotiate. Username '" << blob << "'");
 475
 476         /* connection is authenticated */
 477         debugs(29, 4, "AuthNegotiateUserRequest::authenticate: authenticated user " << negotiate_user->username());
 478         /* see if this is an existing user with a different proxy_auth
 479          * string */
 480         AuthUserHashPointer *usernamehash = static_cast<AuthUserHashPointer *>(hash_lookup(proxy_auth_username_cache, negotiate_user->username()));
 481         AuthUser *local_auth_user = negotiate_request->user();
 482         while (usernamehash && (usernamehash->user()->auth_type != AUTH_NEGOTIATE || strcmp(usernamehash->user()->username(), negotiate_user->username()) != 0))
 483             usernamehash = static_cast<AuthUserHashPointer *>(usernamehash->next);
 484         if (usernamehash) {
 485             /* we can't seamlessly recheck the username due to the
 486              * challenge-response nature of the protocol.
 487              * Just free the temporary auth_user */
 488             usernamehash->user()->absorb(local_auth_user);
 489             //authenticateAuthUserMerge(local_auth_user, usernamehash->user());
 490             local_auth_user = usernamehash->user();
 491             negotiate_request->_auth_user = local_auth_user;
 492         } else {
 493             /* store user in hash's */
 494             local_auth_user->addToNameCache();
 495             // authenticateUserNameCacheAdd(local_auth_user);
 496         }
 497         /* set these to now because this is either a new login from an
 498          * existing user or a new user */
 499         local_auth_user->expiretime = current_time.tv_sec;
 500         negotiate_request->releaseAuthServer();
 501         negotiate_request->auth_state = AUTHENTICATE_STATE_DONE;
 502
 503     } else if (strncasecmp(reply, "NA ", 3) == 0 && arg != NULL) {
 504         /* authentication failure (wrong password, etc.) */
 505
 506         if (arg)
 507             *arg++ = '\0';
 508
 509         auth_user_request->denyMessage(arg);
 510
 511         negotiate_request->auth_state = AUTHENTICATE_STATE_FAILED;
 512
 513         safe_free(negotiate_request->server_blob);
 514
 515         negotiate_request->server_blob = xstrdup(blob);
 516
 517         negotiate_request->releaseAuthServer();
 518
 519         debugs(29, 4, "authenticateNegotiateHandleReply: Failed validating user via Negotiate. Error returned '" << blob << "'");
 520     } else if (strncasecmp(reply, "BH ", 3) == 0) {
 521         /* TODO kick off a refresh process. This can occur after a YR or after
 522          * a KK. If after a YR release the helper and resubmit the request via
 523          * Authenticate Negotiate start.
 524          * If after a KK deny the user's request w/ 407 and mark the helper as
 525          * Needing YR. */
 526         auth_user_request->denyMessage(blob);
 527         negotiate_request->auth_state = AUTHENTICATE_STATE_FAILED;
 528         safe_free(negotiate_request->server_blob);
 529         negotiate_request->releaseAuthServer();
 530         debugs(29, 1, "authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned '" << reply << "'");
 531     } else {
 532         /* protocol error */
 533         fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply);
 534     }
 535
 536     if (negotiate_request->request) {
 537         HTTPMSGUNLOCK(negotiate_request->request);
 538         negotiate_request->request = NULL;
 539     }
 540     r->handler(r->data, NULL);
 541     cbdataReferenceDone(r->data);
 542     authenticateStateFree(r);
 543 }
 544
 545 static void
 546 authenticateNegotiateStats(StoreEntry * sentry)
 547 {
 548     helperStatefulStats(sentry, negotiateauthenticators, "Negotiate Authenticator Statistics");
 549 }
 550
 551
 552 /** send the initial data to a stateful negotiate authenticator module */
 553 void
 554 AuthNegotiateUserRequest::module_start(RH * handler, void *data)
 555 {
 556     authenticateStateData *r = NULL;
 557     static char buf[MAX_AUTHTOKEN_LEN];
 558     negotiate_user_t *negotiate_user;
 559     AuthUser *auth_user = user();
 560
 561     assert(data);
 562     assert(handler);
 563     assert(auth_user);
 564     assert(auth_user->auth_type == AUTH_NEGOTIATE);
 565
 566     negotiate_user = dynamic_cast<negotiate_user_t *>(user());
 567
 568     debugs(29, 8, "AuthNegotiateUserRequest::module_start: auth state is '" << auth_state << "'");
 569
 570     if (negotiateConfig.authenticate == NULL) {
 571         debugs(29, 0, "AuthNegotiateUserRequest::module_start: no Negotiate program specified.");
 572         handler(data, NULL);
 573         return;
 574     }
 575
 576     r = cbdataAlloc(authenticateStateData);
 577     r->handler = handler;
 578     r->data = cbdataReference(data);
 579     r->auth_user_request = this;
 580     AUTHUSERREQUESTLOCK(r->auth_user_request, "r");
 581
 582     if (auth_state == AUTHENTICATE_STATE_INITIAL) {
 583         snprintf(buf, MAX_AUTHTOKEN_LEN, "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
 584     } else {
 585         snprintf(buf, MAX_AUTHTOKEN_LEN, "KK %s\n", client_blob);
 586     }
 587
 588     waiting = 1;
 589
 590     safe_free(client_blob);
 591     helperStatefulSubmit(negotiateauthenticators, buf, authenticateNegotiateHandleReply, r, authserver);
 592 }
 593
 594 /**
 595  * Atomic action: properly release the Negotiate auth helpers which may have been reserved
 596  * for this request connections use.
 597  */
 598 void
 599 AuthNegotiateUserRequest::releaseAuthServer()
 600 {
 601     if (authserver) {
 602         debugs(29, 6, HERE << "releasing Negotiate auth server '" << authserver << "'");
 603         helperStatefulReleaseServer(authserver);
 604         authserver = NULL;
 605     } else
 606         debugs(29, 6, HERE << "No Negotiate auth server to release.");
 607 }
 608
 609 /* clear any connection related authentication details */
 610 void
 611 AuthNegotiateUserRequest::onConnectionClose(ConnStateData *conn)
 612 {
 613     assert(conn != NULL);
 614
 615     debugs(29, 8, "AuthNegotiateUserRequest::onConnectionClose: closing connection '" << conn << "' (this is '" << this << "')");
 616
 617     if (conn->auth_user_request == NULL) {
 618         debugs(29, 8, "AuthNegotiateUserRequest::onConnectionClose: no auth_user_request");
 619         return;
 620     }
 621
 622     releaseAuthServer();
 623
 624     /* unlock the connection based lock */
 625     debugs(29, 9, "AuthNegotiateUserRequest::onConnectionClose: Unlocking auth_user from the connection '" << conn << "'.");
 626
 627     AUTHUSERREQUESTUNLOCK(conn->auth_user_request, "conn");
 628 }
 629
 630 /*
 631  * Decode a Negotiate [Proxy-]Auth string, placing the results in the passed
 632  * Auth_user structure.
 633  */
 634 AuthUserRequest *
 635 AuthNegotiateConfig::decode(char const *proxy_auth)
 636 {
 637     NegotiateUser *newUser = new NegotiateUser(&negotiateConfig);
 638     AuthNegotiateUserRequest *auth_user_request = new AuthNegotiateUserRequest ();
 639     assert(auth_user_request->user() == NULL);
 640     auth_user_request->user(newUser);
 641     auth_user_request->user()->auth_type = AUTH_NEGOTIATE;
 642     auth_user_request->user()->addRequest(auth_user_request);
 643
 644     /* all we have to do is identify that it's Negotiate - the helper does the rest */
 645     debugs(29, 9, "AuthNegotiateConfig::decode: Negotiate authentication");
 646     return auth_user_request;
 647 }
 648
 649 int
 650 AuthNegotiateUserRequest::authenticated() const
 651 {
 652     if (auth_state == AUTHENTICATE_STATE_DONE) {
 653         debugs(29, 9, "AuthNegotiateUserRequest::authenticated: user authenticated.");
 654         return 1;
 655     }
 656
 657     debugs(29, 9, "AuthNegotiateUserRequest::authenticated: user not fully authenticated.");
 658
 659     return 0;
 660 }
 661
 662 void
 663 AuthNegotiateUserRequest::authenticate(HttpRequest * request, ConnStateData * conn, http_hdr_type type)
 664 {
 665     const char *proxy_auth, *blob;
 666
 667     /** \todo rename this!! */
 668     AuthUser *local_auth_user;
 669     negotiate_user_t *negotiate_user;
 670
 671     local_auth_user = user();
 672     assert(local_auth_user);
 673     assert(local_auth_user->auth_type == AUTH_NEGOTIATE);
 674     negotiate_user = dynamic_cast<negotiate_user_t *>(local_auth_user);
 675     assert (this);
 676
 677     /** Check that we are in the client side, where we can generate
 678      * auth challenges */
 679
 680     if (conn == NULL) {
 681         auth_state = AUTHENTICATE_STATE_FAILED;
 682         debugs(29, 1, "AuthNegotiateUserRequest::authenticate: attempt to perform authentication without a connection!");
 683         return;
 684     }
 685
 686     if (waiting) {
 687         debugs(29, 1, "AuthNegotiateUserRequest::authenticate: waiting for helper reply!");
 688         return;
 689     }
 690
 691     if (server_blob) {
 692         debugs(29, 2, "AuthNegotiateUserRequest::authenticate: need to challenge client '" << server_blob << "'!");
 693         return;
 694     }
 695
 696     /* get header */
 697     proxy_auth = request->header.getStr(type);
 698
 699     /* locate second word */
 700     blob = proxy_auth;
 701
 702     if (blob) {
 703         while (xisspace(*blob) && *blob)
 704             blob++;
 705
 706         while (!xisspace(*blob) && *blob)
 707             blob++;
 708
 709         while (xisspace(*blob) && *blob)
 710             blob++;
 711     }
 712
 713     switch (auth_state) {
 714
 715     case AUTHENTICATE_STATE_NONE:
 716         /* we've received a negotiate request. pass to a helper */
 717         debugs(29, 9, "AuthNegotiateUserRequest::authenticate: auth state negotiate none. Received blob: '" << proxy_auth << "'");
 718         auth_state = AUTHENTICATE_STATE_INITIAL;
 719         safe_free(client_blob);
 720         client_blob=xstrdup(blob);
 721         conn->auth_type = AUTH_NEGOTIATE;
 722         assert(conn->auth_user_request == NULL);
 723         conn->auth_user_request = this;
 724         AUTHUSERREQUESTLOCK(conn->auth_user_request, "conn");
 725         this->request = request;
 726         HTTPMSGLOCK(this->request);
 727         return;
 728
 729         break;
 730
 731     case AUTHENTICATE_STATE_INITIAL:
 732         debugs(29, 1, "AuthNegotiateUserRequest::authenticate: need to ask helper");
 733
 734         return;
 735
 736         break;
 737
 738
 739     case AUTHENTICATE_STATE_IN_PROGRESS:
 740         /* we should have received a blob from the client. Hand it off to
 741          * some helper */
 742         safe_free(client_blob);
 743
 744         client_blob = xstrdup (blob);
 745
 746         if (this->request)
 747             HTTPMSGUNLOCK(this->request);
 748         this->request = request;
 749         HTTPMSGLOCK(this->request);
 750         return;
 751
 752         break;
 753
 754     case AUTHENTICATE_STATE_DONE:
 755         fatal("AuthNegotiateUserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
 756
 757         break;
 758
 759     case AUTHENTICATE_STATE_FAILED:
 760         /* we've failed somewhere in authentication */
 761         debugs(29, 9, "AuthNegotiateUserRequest::authenticate: auth state negotiate failed. " << proxy_auth);
 762
 763         return;
 764
 765         break;
 766     }
 767
 768     return;
 769 }
 770
 771 AuthNegotiateUserRequest::AuthNegotiateUserRequest() :
 772         /*conn(NULL),*/ auth_state(AUTHENTICATE_STATE_NONE),
 773         _theUser(NULL)
 774 {
 775     waiting=0;
 776     client_blob=0;
 777     server_blob=0;
 778     authserver=NULL;
 779     request=NULL;
 780 }
 781
 782 AuthNegotiateUserRequest::~AuthNegotiateUserRequest()
 783 {
 784     safe_free(server_blob);
 785     safe_free(client_blob);
 786
 787     if (authserver != NULL) {
 788         debugs(29, 9, "AuthNegotiateUserRequest::~AuthNegotiateUserRequest: releasing server '" << authserver << "'");
 789         helperStatefulReleaseServer(authserver);
 790         authserver = NULL;
 791     }
 792     if (request) {
 793         HTTPMSGUNLOCK(request);
 794         request = NULL;
 795     }
 796 }
 797
 798 void
 799 NegotiateUser::deleteSelf() const
 800 {
 801     delete this;
 802 }
 803
 804 NegotiateUser::NegotiateUser (AuthConfig *config) : AuthUser (config)
 805 {
 806     proxy_auth_list.head = proxy_auth_list.tail = NULL;
 807 }
 808
 809 AuthConfig *
 810 negotiateScheme::createConfig()
 811 {
 812     return &negotiateConfig;
 813 }
 814
 815 const char *
 816 AuthNegotiateUserRequest::connLastHeader()
 817 {
 818     return NULL;
 819 }
 820