2 * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
10 #include "AccessLogEntry.h"
11 #include "auth/ntlm/Config.h"
12 #include "auth/ntlm/UserRequest.h"
13 #include "auth/State.h"
15 #include "client_side.h"
17 #include "format/Format.h"
20 #include "helper/Reply.h"
22 #include "HttpRequest.h"
24 #include "SquidTime.h"
26 Auth::Ntlm::UserRequest::UserRequest()
35 Auth::Ntlm::UserRequest::~UserRequest()
37 assert(LockCount()==0);
38 safe_free(server_blob
);
39 safe_free(client_blob
);
44 HTTPMSGUNLOCK(request
);
50 Auth::Ntlm::UserRequest::connLastHeader()
56 Auth::Ntlm::UserRequest::authenticated() const
58 if (user() != NULL
&& user()->credentials() == Auth::Ok
) {
59 debugs(29, 9, HERE
<< "user authenticated.");
63 debugs(29, 9, HERE
<< "user not fully authenticated.");
68 Auth::Ntlm::UserRequest::credentialsStr()
70 static char buf
[MAX_AUTHTOKEN_LEN
];
71 if (user()->credentials() == Auth::Pending
) {
72 snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
);
74 snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
80 Auth::Ntlm::UserRequest::module_direction()
82 /* null auth_user is checked for by Auth::UserRequest::direction() */
84 if (waiting
|| client_blob
)
85 return Auth::CRED_LOOKUP
; /* need helper response to continue */
87 if (user()->auth_type
!= Auth::AUTH_NTLM
)
88 return Auth::CRED_ERROR
;
90 switch (user()->credentials()) {
94 return Auth::CRED_CHALLENGE
;
97 return Auth::CRED_VALID
;
100 return Auth::CRED_ERROR
; // XXX: really? not VALID or CHALLENGE?
103 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
104 return Auth::CRED_ERROR
;
109 Auth::Ntlm::UserRequest::startHelperLookup(HttpRequest
*, AccessLogEntry::Pointer
&al
, AUTHCB
* handler
, void *data
)
111 static char buf
[MAX_AUTHTOKEN_LEN
];
116 if (static_cast<Auth::Ntlm::Config
*>(Auth::Config::Find("ntlm"))->authenticateProgram
== NULL
) {
117 debugs(29, DBG_CRITICAL
, "ERROR: NTLM Start: no NTLM program configured.");
122 debugs(29, 8, HERE
<< "credentials state is '" << user()->credentials() << "'");
124 const char *keyExtras
= helperRequestKeyExtras(request
, al
);
125 if (user()->credentials() == Auth::Pending
) {
127 snprintf(buf
, sizeof(buf
), "YR %s %s\n", client_blob
, keyExtras
);
129 snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
132 snprintf(buf
, sizeof(buf
), "KK %s %s\n", client_blob
, keyExtras
);
134 snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
138 safe_free(client_blob
);
139 helperStatefulSubmit(ntlmauthenticators
, buf
, Auth::Ntlm::UserRequest::HandleReply
,
140 new Auth::StateData(this, handler
, data
), authserver
);
144 * Atomic action: properly release the NTLM auth helpers which may have been reserved
145 * for this request connections use.
148 Auth::Ntlm::UserRequest::releaseAuthServer()
151 debugs(29, 6, HERE
<< "releasing NTLM auth server '" << authserver
<< "'");
152 helperStatefulReleaseServer(authserver
);
155 debugs(29, 6, HERE
<< "No NTLM auth server to release.");
159 Auth::Ntlm::UserRequest::authenticate(HttpRequest
* aRequest
, ConnStateData
* conn
, http_hdr_type type
)
161 /* Check that we are in the client side, where we can generate
164 if (conn
== NULL
|| !cbdataReferenceValid(conn
)) {
165 user()->credentials(Auth::Failed
);
166 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
171 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication waiting for helper reply!");
176 debugs(29, 2, HERE
<< "need to challenge client '" << server_blob
<< "'!");
181 const char *proxy_auth
= aRequest
->header
.getStr(type
);
183 /* locate second word */
184 const char *blob
= proxy_auth
;
186 /* if proxy_auth is actually NULL, we'd better not manipulate it. */
188 while (xisspace(*blob
) && *blob
)
191 while (!xisspace(*blob
) && *blob
)
194 while (xisspace(*blob
) && *blob
)
198 switch (user()->credentials()) {
200 case Auth::Unchecked
:
201 /* we've received a ntlm request. pass to a helper */
202 debugs(29, 9, HERE
<< "auth state ntlm none. Received blob: '" << proxy_auth
<< "'");
203 user()->credentials(Auth::Pending
);
204 safe_free(client_blob
);
205 client_blob
=xstrdup(blob
);
206 assert(conn
->getAuth() == NULL
);
207 conn
->setAuth(this, "new NTLM handshake request");
209 HTTPMSGLOCK(request
);
213 debugs(29, DBG_IMPORTANT
, HERE
<< "need to ask helper");
216 case Auth::Handshake
:
217 /* we should have received a blob from the client. Hand it off to
219 safe_free(client_blob
);
220 client_blob
= xstrdup(blob
);
222 HTTPMSGUNLOCK(request
);
224 HTTPMSGLOCK(request
);
228 fatal("Auth::Ntlm::UserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
232 /* we've failed somewhere in authentication */
233 debugs(29, 9, HERE
<< "auth state ntlm failed. " << proxy_auth
);
239 Auth::Ntlm::UserRequest::HandleReply(void *data
, const Helper::Reply
&reply
)
241 Auth::StateData
*r
= static_cast<Auth::StateData
*>(data
);
243 debugs(29, 8, HERE
<< "helper: '" << reply
.whichServer
<< "' sent us reply=" << reply
);
245 if (!cbdataReferenceValid(r
->data
)) {
246 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication invalid callback data. helper '" << reply
.whichServer
<< "'.");
251 Auth::UserRequest::Pointer auth_user_request
= r
->auth_user_request
;
252 assert(auth_user_request
!= NULL
);
254 // add new helper kv-pair notes to the credentials object
255 // so that any transaction using those credentials can access them
256 auth_user_request
->user()->notes
.appendNewOnly(&reply
.notes
);
257 // remove any private credentials detail which got added.
258 auth_user_request
->user()->notes
.remove("token");
260 Auth::Ntlm::UserRequest
*lm_request
= dynamic_cast<Auth::Ntlm::UserRequest
*>(auth_user_request
.getRaw());
261 assert(lm_request
!= NULL
);
262 assert(lm_request
->waiting
);
264 lm_request
->waiting
= 0;
265 safe_free(lm_request
->client_blob
);
267 assert(auth_user_request
->user() != NULL
);
268 assert(auth_user_request
->user()->auth_type
== Auth::AUTH_NTLM
);
270 if (lm_request
->authserver
== NULL
)
271 lm_request
->authserver
= reply
.whichServer
.get(); // XXX: no locking?
273 assert(reply
.whichServer
== lm_request
->authserver
);
275 switch (reply
.result
) {
277 /* we have been given a blob to send to the client */
278 safe_free(lm_request
->server_blob
);
279 lm_request
->request
->flags
.mustKeepalive
= true;
280 if (lm_request
->request
->flags
.proxyKeepalive
) {
281 const char *serverBlob
= reply
.notes
.findFirst("token");
282 lm_request
->server_blob
= xstrdup(serverBlob
);
283 auth_user_request
->user()->credentials(Auth::Handshake
);
284 auth_user_request
->denyMessage("Authentication in progress");
285 debugs(29, 4, HERE
<< "Need to challenge the client with a server token: '" << serverBlob
<< "'");
287 auth_user_request
->user()->credentials(Auth::Failed
);
288 auth_user_request
->denyMessage("NTLM authentication requires a persistent connection");
293 /* we're finished, release the helper */
294 const char *userLabel
= reply
.notes
.findFirst("user");
296 auth_user_request
->user()->credentials(Auth::Failed
);
297 safe_free(lm_request
->server_blob
);
298 lm_request
->releaseAuthServer();
299 debugs(29, DBG_CRITICAL
, "ERROR: NTLM Authentication helper returned no username. Result: " << reply
);
302 auth_user_request
->user()->username(userLabel
);
303 auth_user_request
->denyMessage("Login successful");
304 safe_free(lm_request
->server_blob
);
305 lm_request
->releaseAuthServer();
307 debugs(29, 4, HERE
<< "Successfully validated user via NTLM. Username '" << userLabel
<< "'");
308 /* connection is authenticated */
309 debugs(29, 4, HERE
<< "authenticated user " << auth_user_request
->user()->username());
310 /* see if this is an existing user */
311 AuthUserHashPointer
*usernamehash
= static_cast<AuthUserHashPointer
*>(hash_lookup(proxy_auth_username_cache
, auth_user_request
->user()->userKey()));
312 Auth::User::Pointer local_auth_user
= lm_request
->user();
313 while (usernamehash
&& (usernamehash
->user()->auth_type
!= Auth::AUTH_NTLM
||
314 strcmp(usernamehash
->user()->userKey(), auth_user_request
->user()->userKey()) != 0))
315 usernamehash
= static_cast<AuthUserHashPointer
*>(usernamehash
->next
);
317 /* we can't seamlessly recheck the username due to the
318 * challenge-response nature of the protocol.
319 * Just free the temporary auth_user after merging as
320 * much of it new state into the existing one as possible */
321 usernamehash
->user()->absorb(local_auth_user
);
322 /* from here on we are working with the original cached credentials. */
323 local_auth_user
= usernamehash
->user();
324 auth_user_request
->user(local_auth_user
);
326 /* store user in hash's */
327 local_auth_user
->addToNameCache();
329 /* set these to now because this is either a new login from an
330 * existing user or a new user */
331 local_auth_user
->expiretime
= current_time
.tv_sec
;
332 auth_user_request
->user()->credentials(Auth::Ok
);
333 debugs(29, 4, HERE
<< "Successfully validated user via NTLM. Username '" << auth_user_request
->user()->username() << "'");
337 case Helper::Error
: {
338 /* authentication failure (wrong password, etc.) */
339 const char *errNote
= reply
.notes
.find("message");
341 auth_user_request
->denyMessage(errNote
);
343 auth_user_request
->denyMessage("NTLM Authentication denied with no reason given");
344 auth_user_request
->user()->credentials(Auth::Failed
);
345 safe_free(lm_request
->server_blob
);
346 lm_request
->releaseAuthServer();
347 debugs(29, 4, "Failed validating user via NTLM. Result: " << reply
);
351 case Helper::Unknown
:
352 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication Helper '" << reply
.whichServer
<< "' crashed!.");
353 /* continue to the next case */
355 case Helper::TimedOut
:
356 case Helper::BrokenHelper
: {
357 /* TODO kick off a refresh process. This can occur after a YR or after
358 * a KK. If after a YR release the helper and resubmit the request via
359 * Authenticate NTLM start.
360 * If after a KK deny the user's request w/ 407 and mark the helper as
362 const char *errNote
= reply
.notes
.find("message");
363 if (reply
.result
== Helper::Unknown
)
364 auth_user_request
->denyMessage("Internal Error");
365 else if (errNote
!= NULL
)
366 auth_user_request
->denyMessage(errNote
);
368 auth_user_request
->denyMessage("NTLM Authentication failed with no reason given");
369 auth_user_request
->user()->credentials(Auth::Failed
);
370 safe_free(lm_request
->server_blob
);
371 lm_request
->releaseAuthServer();
372 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication validating user. Result: " << reply
);
377 if (lm_request
->request
) {
378 HTTPMSGUNLOCK(lm_request
->request
);
379 lm_request
->request
= NULL
;