src/auth/ntlm/UserRequest.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 #include "squid.h"
  10 #include "AccessLogEntry.h"
  11 #include "auth/ntlm/Config.h"
  12 #include "auth/ntlm/UserRequest.h"
  13 #include "auth/State.h"
  14 #include "cbdata.h"
  15 #include "client_side.h"
  16 #include "fatal.h"
  17 #include "format/Format.h"
  18 #include "globals.h"
  19 #include "helper.h"
  20 #include "helper/Reply.h"
  21 #include "HttpMsg.h"
  22 #include "HttpRequest.h"
  23 #include "MemBuf.h"
  24 #include "SquidTime.h"
  25
  26 Auth::Ntlm::UserRequest::UserRequest()
  27 {
  28     waiting=0;
  29     client_blob=0;
  30     server_blob=0;
  31     authserver=NULL;
  32     request=NULL;
  33 }
  34
  35 Auth::Ntlm::UserRequest::~UserRequest()
  36 {
  37     assert(LockCount()==0);
  38     safe_free(server_blob);
  39     safe_free(client_blob);
  40
  41     releaseAuthServer();
  42
  43     if (request) {
  44         HTTPMSGUNLOCK(request);
  45         request = NULL;
  46     }
  47 }
  48
  49 const char *
  50 Auth::Ntlm::UserRequest::connLastHeader()
  51 {
  52     return NULL;
  53 }
  54
  55 int
  56 Auth::Ntlm::UserRequest::authenticated() const
  57 {
  58     if (user() != NULL && user()->credentials() == Auth::Ok) {
  59         debugs(29, 9, HERE << "user authenticated.");
  60         return 1;
  61     }
  62
  63     debugs(29, 9, HERE << "user not fully authenticated.");
  64     return 0;
  65 }
  66
  67 const char *
  68 Auth::Ntlm::UserRequest::credentialsStr()
  69 {
  70     static char buf[MAX_AUTHTOKEN_LEN];
  71     int printResult;
  72     if (user()->credentials() == Auth::Pending) {
  73         printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob);
  74     } else {
  75         printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
  76     }
  77
  78     // truncation is OK because we are used only for logging
  79     if (printResult < 0) {
  80         debugs(29, 2, "Can not build ntlm authentication credentials.");
  81         buf[0] = '\0';
  82     } else if (printResult >= (int)sizeof(buf))
  83         debugs(29, 2, "Ntlm authentication credentials truncated.");
  84
  85     return buf;
  86 }
  87
  88 Auth::Direction
  89 Auth::Ntlm::UserRequest::module_direction()
  90 {
  91     /* null auth_user is checked for by Auth::UserRequest::direction() */
  92
  93     if (waiting || client_blob)
  94         return Auth::CRED_LOOKUP; /* need helper response to continue */
  95
  96     if (user()->auth_type != Auth::AUTH_NTLM)
  97         return Auth::CRED_ERROR;
  98
  99     switch (user()->credentials()) {
 100
 101     case Auth::Handshake:
 102         assert(server_blob);
 103         return Auth::CRED_CHALLENGE;
 104
 105     case Auth::Ok:
 106         return Auth::CRED_VALID;
 107
 108     case Auth::Failed:
 109         return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
 110
 111     default:
 112         debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
 113         return Auth::CRED_ERROR;
 114     }
 115 }
 116
 117 void
 118 Auth::Ntlm::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
 119 {
 120     static char buf[MAX_AUTHTOKEN_LEN];
 121
 122     assert(data);
 123     assert(handler);
 124
 125     if (static_cast<Auth::Ntlm::Config*>(Auth::Config::Find("ntlm"))->authenticateProgram == NULL) {
 126         debugs(29, DBG_CRITICAL, "ERROR: NTLM Start: no NTLM program configured.");
 127         handler(data);
 128         return;
 129     }
 130
 131     debugs(29, 8, HERE << "credentials state is '" << user()->credentials() << "'");
 132
 133     const char *keyExtras = helperRequestKeyExtras(request, al);
 134     int printResult = 0;
 135     if (user()->credentials() == Auth::Pending) {
 136         if (keyExtras)
 137             printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
 138         else
 139             printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
 140     } else {
 141         if (keyExtras)
 142             printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
 143         else
 144             printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
 145     }
 146     waiting = 1;
 147
 148     if (printResult < 0 || printResult >= (int)sizeof(buf)) {
 149         if (printResult < 0)
 150             debugs(29, DBG_CRITICAL, "ERROR: Can not build ntlm authentication helper request");
 151         else
 152             debugs(29, DBG_CRITICAL, "ERROR: Ntlm authentication helper request too big for the " << sizeof(buf) << "-byte buffer.");
 153         handler(data);
 154         return;
 155     }
 156
 157     safe_free(client_blob);
 158     helperStatefulSubmit(ntlmauthenticators, buf, Auth::Ntlm::UserRequest::HandleReply,
 159                          new Auth::StateData(this, handler, data), authserver);
 160 }
 161
 162 /**
 163  * Atomic action: properly release the NTLM auth helpers which may have been reserved
 164  * for this request connections use.
 165  */
 166 void
 167 Auth::Ntlm::UserRequest::releaseAuthServer()
 168 {
 169     if (authserver) {
 170         debugs(29, 6, HERE << "releasing NTLM auth server '" << authserver << "'");
 171         helperStatefulReleaseServer(authserver);
 172         authserver = NULL;
 173     } else
 174         debugs(29, 6, HERE << "No NTLM auth server to release.");
 175 }
 176
 177 void
 178 Auth::Ntlm::UserRequest::authenticate(HttpRequest * aRequest, ConnStateData * conn, http_hdr_type type)
 179 {
 180     /* Check that we are in the client side, where we can generate
 181      * auth challenges */
 182
 183     if (conn == NULL || !cbdataReferenceValid(conn)) {
 184         user()->credentials(Auth::Failed);
 185         debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
 186         return;
 187     }
 188
 189     if (waiting) {
 190         debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication waiting for helper reply!");
 191         return;
 192     }
 193
 194     if (server_blob) {
 195         debugs(29, 2, HERE << "need to challenge client '" << server_blob << "'!");
 196         return;
 197     }
 198
 199     /* get header */
 200     const char *proxy_auth = aRequest->header.getStr(type);
 201
 202     /* locate second word */
 203     const char *blob = proxy_auth;
 204
 205     /* if proxy_auth is actually NULL, we'd better not manipulate it. */
 206     if (blob) {
 207         while (xisspace(*blob) && *blob)
 208             ++blob;
 209
 210         while (!xisspace(*blob) && *blob)
 211             ++blob;
 212
 213         while (xisspace(*blob) && *blob)
 214             ++blob;
 215     }
 216
 217     switch (user()->credentials()) {
 218
 219     case Auth::Unchecked:
 220         /* we've received a ntlm request. pass to a helper */
 221         debugs(29, 9, HERE << "auth state ntlm none. Received blob: '" << proxy_auth << "'");
 222         user()->credentials(Auth::Pending);
 223         safe_free(client_blob);
 224         client_blob=xstrdup(blob);
 225         assert(conn->getAuth() == NULL);
 226         conn->setAuth(this, "new NTLM handshake request");
 227         request = aRequest;
 228         HTTPMSGLOCK(request);
 229         break;
 230
 231     case Auth::Pending:
 232         debugs(29, DBG_IMPORTANT, HERE << "need to ask helper");
 233         break;
 234
 235     case Auth::Handshake:
 236         /* we should have received a blob from the client. Hand it off to
 237          * some helper */
 238         safe_free(client_blob);
 239         client_blob = xstrdup(blob);
 240         if (request)
 241             HTTPMSGUNLOCK(request);
 242         request = aRequest;
 243         HTTPMSGLOCK(request);
 244         break;
 245
 246     case Auth::Ok:
 247         fatal("Auth::Ntlm::UserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
 248         break;
 249
 250     case Auth::Failed:
 251         /* we've failed somewhere in authentication */
 252         debugs(29, 9, HERE << "auth state ntlm failed. " << proxy_auth);
 253         break;
 254     }
 255 }
 256
 257 void
 258 Auth::Ntlm::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
 259 {
 260     Auth::StateData *r = static_cast<Auth::StateData *>(data);
 261
 262     debugs(29, 8, HERE << "helper: '" << reply.whichServer << "' sent us reply=" << reply);
 263
 264     if (!cbdataReferenceValid(r->data)) {
 265         debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication invalid callback data. helper '" << reply.whichServer << "'.");
 266         delete r;
 267         return;
 268     }
 269
 270     Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
 271     assert(auth_user_request != NULL);
 272
 273     // add new helper kv-pair notes to the credentials object
 274     // so that any transaction using those credentials can access them
 275     auth_user_request->user()->notes.appendNewOnly(&reply.notes);
 276     // remove any private credentials detail which got added.
 277     auth_user_request->user()->notes.remove("token");
 278
 279     Auth::Ntlm::UserRequest *lm_request = dynamic_cast<Auth::Ntlm::UserRequest *>(auth_user_request.getRaw());
 280     assert(lm_request != NULL);
 281     assert(lm_request->waiting);
 282
 283     lm_request->waiting = 0;
 284     safe_free(lm_request->client_blob);
 285
 286     assert(auth_user_request->user() != NULL);
 287     assert(auth_user_request->user()->auth_type == Auth::AUTH_NTLM);
 288
 289     if (lm_request->authserver == NULL)
 290         lm_request->authserver = reply.whichServer.get(); // XXX: no locking?
 291     else
 292         assert(reply.whichServer == lm_request->authserver);
 293
 294     switch (reply.result) {
 295     case Helper::TT:
 296         /* we have been given a blob to send to the client */
 297         safe_free(lm_request->server_blob);
 298         lm_request->request->flags.mustKeepalive = true;
 299         if (lm_request->request->flags.proxyKeepalive) {
 300             const char *serverBlob = reply.notes.findFirst("token");
 301             lm_request->server_blob = xstrdup(serverBlob);
 302             auth_user_request->user()->credentials(Auth::Handshake);
 303             auth_user_request->denyMessage("Authentication in progress");
 304             debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << serverBlob << "'");
 305         } else {
 306             auth_user_request->user()->credentials(Auth::Failed);
 307             auth_user_request->denyMessage("NTLM authentication requires a persistent connection");
 308         }
 309         break;
 310
 311     case Helper::Okay: {
 312         /* we're finished, release the helper */
 313         const char *userLabel = reply.notes.findFirst("user");
 314         if (!userLabel) {
 315             auth_user_request->user()->credentials(Auth::Failed);
 316             safe_free(lm_request->server_blob);
 317             lm_request->releaseAuthServer();
 318             debugs(29, DBG_CRITICAL, "ERROR: NTLM Authentication helper returned no username. Result: " << reply);
 319             break;
 320         }
 321         auth_user_request->user()->username(userLabel);
 322         auth_user_request->denyMessage("Login successful");
 323         safe_free(lm_request->server_blob);
 324         lm_request->releaseAuthServer();
 325
 326         debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << userLabel << "'");
 327         /* connection is authenticated */
 328         debugs(29, 4, HERE << "authenticated user " << auth_user_request->user()->username());
 329         /* see if this is an existing user */
 330         AuthUserHashPointer *usernamehash = static_cast<AuthUserHashPointer *>(hash_lookup(proxy_auth_username_cache, auth_user_request->user()->userKey()));
 331         Auth::User::Pointer local_auth_user = lm_request->user();
 332         while (usernamehash && (usernamehash->user()->auth_type != Auth::AUTH_NTLM ||
 333                                 strcmp(usernamehash->user()->userKey(), auth_user_request->user()->userKey()) != 0))
 334             usernamehash = static_cast<AuthUserHashPointer *>(usernamehash->next);
 335         if (usernamehash) {
 336             /* we can't seamlessly recheck the username due to the
 337              * challenge-response nature of the protocol.
 338              * Just free the temporary auth_user after merging as
 339              * much of it new state into the existing one as possible */
 340             usernamehash->user()->absorb(local_auth_user);
 341             /* from here on we are working with the original cached credentials. */
 342             local_auth_user = usernamehash->user();
 343             auth_user_request->user(local_auth_user);
 344         } else {
 345             /* store user in hash's */
 346             local_auth_user->addToNameCache();
 347         }
 348         /* set these to now because this is either a new login from an
 349          * existing user or a new user */
 350         local_auth_user->expiretime = current_time.tv_sec;
 351         auth_user_request->user()->credentials(Auth::Ok);
 352         debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << auth_user_request->user()->username() << "'");
 353     }
 354     break;
 355
 356     case Helper::Error: {
 357         /* authentication failure (wrong password, etc.) */
 358         const char *errNote = reply.notes.find("message");
 359         if (errNote != NULL)
 360             auth_user_request->denyMessage(errNote);
 361         else
 362             auth_user_request->denyMessage("NTLM Authentication denied with no reason given");
 363         auth_user_request->user()->credentials(Auth::Failed);
 364         safe_free(lm_request->server_blob);
 365         lm_request->releaseAuthServer();
 366         debugs(29, 4, "Failed validating user via NTLM. Result: " << reply);
 367     }
 368     break;
 369
 370     case Helper::Unknown:
 371         debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication Helper '" << reply.whichServer << "' crashed!.");
 372     /* continue to the next case */
 373
 374     case Helper::TimedOut:
 375     case Helper::BrokenHelper: {
 376         /* TODO kick off a refresh process. This can occur after a YR or after
 377          * a KK. If after a YR release the helper and resubmit the request via
 378          * Authenticate NTLM start.
 379          * If after a KK deny the user's request w/ 407 and mark the helper as
 380          * Needing YR. */
 381         const char *errNote = reply.notes.find("message");
 382         if (reply.result == Helper::Unknown)
 383             auth_user_request->denyMessage("Internal Error");
 384         else if (errNote != NULL)
 385             auth_user_request->denyMessage(errNote);
 386         else
 387             auth_user_request->denyMessage("NTLM Authentication failed with no reason given");
 388         auth_user_request->user()->credentials(Auth::Failed);
 389         safe_free(lm_request->server_blob);
 390         lm_request->releaseAuthServer();
 391         debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication validating user. Result: " << reply);
 392     }
 393     break;
 394     }
 395
 396     if (lm_request->request) {
 397         HTTPMSGUNLOCK(lm_request->request);
 398         lm_request->request = NULL;
 399     }
 400     r->handler(r->data);
 401     delete r;
 402 }
 403