2 #include "auth/ntlm/auth_ntlm.h"
3 #include "auth/ntlm/UserRequest.h"
4 #include "auth/State.h"
6 #include "HttpRequest.h"
9 /* state wrapper functions */
11 AuthNTLMUserRequest::AuthNTLMUserRequest()
20 AuthNTLMUserRequest::~AuthNTLMUserRequest()
22 assert(RefCountCount()==0);
23 safe_free(server_blob
);
24 safe_free(client_blob
);
29 HTTPMSGUNLOCK(request
);
35 AuthNTLMUserRequest::connLastHeader()
40 /* See AuthUserRequest.cc::authenticateDirection for return values */
42 AuthNTLMUserRequest::module_direction()
44 /* null auth_user is checked for by authenticateDirection */
46 if (waiting
|| client_blob
)
47 return -1; /* need helper response to continue */
49 if (user()->auth_type
!= Auth::AUTH_NTLM
)
52 switch (user()->credentials()) {
56 return 1; /* send to client */
59 return 0; /* do nothing */
65 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
70 /* send the initial data to a stateful ntlm authenticator module */
72 AuthNTLMUserRequest::module_start(RH
* handler
, void *data
)
74 authenticateStateData
*r
= NULL
;
75 static char buf
[8192];
80 debugs(29, 8, HERE
<< "credentials state is '" << user()->credentials() << "'");
82 if (static_cast<Auth::Ntlm::Config
*>(Auth::Config::Find("ntlm"))->authenticateProgram
== NULL
) {
83 debugs(29, DBG_CRITICAL
, "ERROR: NTLM Start: no NTLM program configured.");
88 r
= cbdataAlloc(authenticateStateData
);
90 r
->data
= cbdataReference(data
);
91 r
->auth_user_request
= this;
93 if (user()->credentials() == Auth::Pending
) {
94 snprintf(buf
, 8192, "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
96 snprintf(buf
, 8192, "KK %s\n", client_blob
);
101 safe_free(client_blob
);
102 helperStatefulSubmit(ntlmauthenticators
, buf
, AuthNTLMUserRequest::HandleReply
, r
, authserver
);
106 * Atomic action: properly release the NTLM auth helpers which may have been reserved
107 * for this request connections use.
110 AuthNTLMUserRequest::releaseAuthServer()
113 debugs(29, 6, HERE
<< "releasing NTLM auth server '" << authserver
<< "'");
114 helperStatefulReleaseServer(authserver
);
117 debugs(29, 6, HERE
<< "No NTLM auth server to release.");
121 AuthNTLMUserRequest::onConnectionClose(ConnStateData
*conn
)
123 assert(conn
!= NULL
);
125 debugs(29, 8, "AuthNTLMUserRequest::onConnectionClose: closing connection '" << conn
<< "' (this is '" << this << "')");
127 if (conn
->auth_user_request
== NULL
) {
128 debugs(29, 8, "AuthNTLMUserRequest::onConnectionClose: no auth_user_request");
132 // unlock / un-reserve the helpers
135 /* unlock the connection based lock */
136 debugs(29, 9, "AuthNTLMUserRequest::onConnectionClose: Unlocking auth_user from the connection '" << conn
<< "'.");
138 conn
->auth_user_request
= NULL
;
142 AuthNTLMUserRequest::authenticated() const
144 if (user()->credentials() == Auth::Ok
) {
145 debugs(29, 9, "AuthNTLMUserRequest::authenticated: user authenticated.");
149 debugs(29, 9, "AuthNTLMUserRequest::authenticated: user not fully authenticated.");
155 AuthNTLMUserRequest::authenticate(HttpRequest
* aRequest
, ConnStateData
* conn
, http_hdr_type type
)
157 const char *proxy_auth
, *blob
;
161 /* Check that we are in the client side, where we can generate
164 if (conn
== NULL
|| !cbdataReferenceValid(conn
)) {
165 user()->credentials(Auth::Failed
);
166 debugs(29, 1, "AuthNTLMUserRequest::authenticate: attempt to perform authentication without a connection!");
171 debugs(29, 1, "AuthNTLMUserRequest::authenticate: waiting for helper reply!");
176 debugs(29, 2, "AuthNTLMUserRequest::authenticate: need to challenge client '" << server_blob
<< "'!");
181 proxy_auth
= aRequest
->header
.getStr(type
);
183 /* locate second word */
186 /* if proxy_auth is actually NULL, we'd better not manipulate it. */
188 while (xisspace(*blob
) && *blob
)
191 while (!xisspace(*blob
) && *blob
)
194 while (xisspace(*blob
) && *blob
)
198 switch (user()->credentials()) {
200 case Auth::Unchecked
:
201 /* we've received a ntlm request. pass to a helper */
202 debugs(29, 9, "AuthNTLMUserRequest::authenticate: auth state ntlm none. Received blob: '" << proxy_auth
<< "'");
203 user()->credentials(Auth::Pending
);
204 safe_free(client_blob
);
205 client_blob
=xstrdup(blob
);
206 assert(conn
->auth_user_request
== NULL
);
207 conn
->auth_user_request
= this;
209 HTTPMSGLOCK(request
);
213 debugs(29, 1, "AuthNTLMUserRequest::authenticate: need to ask helper");
216 case Auth::Handshake
:
217 /* we should have received a blob from the client. Hand it off to
219 safe_free(client_blob
);
220 client_blob
= xstrdup (blob
);
223 HTTPMSGUNLOCK(request
);
225 HTTPMSGLOCK(request
);
229 fatal("AuthNTLMUserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
233 /* we've failed somewhere in authentication */
234 debugs(29, 9, "AuthNTLMUserRequest::authenticate: auth state ntlm failed. " << proxy_auth
);
240 AuthNTLMUserRequest::HandleReply(void *data
, void *lastserver
, char *reply
)
242 authenticateStateData
*r
= static_cast<authenticateStateData
*>(data
);
247 debugs(29, 8, "authenticateNTLMHandleReply: helper: '" << lastserver
<< "' sent us '" << (reply
? reply
: "<NULL>") << "'");
248 valid
= cbdataReferenceValid(r
->data
);
251 debugs(29, 1, "authenticateNTLMHandleReply: invalid callback data. helper '" << lastserver
<< "'.");
252 cbdataReferenceDone(r
->data
);
253 authenticateStateFree(r
);
258 debugs(29, 1, "authenticateNTLMHandleReply: Helper '" << lastserver
<< "' crashed!.");
259 reply
= (char *)"BH Internal error";
262 AuthUserRequest::Pointer auth_user_request
= r
->auth_user_request
;
263 assert(auth_user_request
!= NULL
);
265 AuthNTLMUserRequest
*ntlm_request
= dynamic_cast<AuthNTLMUserRequest
*>(auth_user_request
.getRaw());
266 assert(ntlm_request
!= NULL
);
267 assert(ntlm_request
->waiting
);
268 assert(ntlm_request
->user() != NULL
);
269 assert(ntlm_request
->user()->auth_type
== Auth::AUTH_NTLM
);
271 ntlm_request
->waiting
= 0;
272 safe_free(ntlm_request
->client_blob
);
274 if (ntlm_request
->authserver
== NULL
)
275 ntlm_request
->authserver
= static_cast<helper_stateful_server
*>(lastserver
);
277 assert(ntlm_request
->authserver
== lastserver
);
279 /* seperate out the useful data */
280 blob
= strchr(reply
, ' ');
284 if (strncasecmp(reply
, "TT ", 3) == 0) {
285 /* we have been given a blob to send to the client */
286 safe_free(ntlm_request
->server_blob
);
287 ntlm_request
->request
->flags
.must_keepalive
= 1;
288 if (ntlm_request
->request
->flags
.proxy_keepalive
) {
289 ntlm_request
->server_blob
= xstrdup(blob
);
290 ntlm_request
->user()->credentials(Auth::Handshake
);
291 auth_user_request
->denyMessage("Authentication in progress");
292 debugs(29, 4, "authenticateNTLMHandleReply: Need to challenge the client with a server blob '" << blob
<< "'");
294 ntlm_request
->user()->credentials(Auth::Failed
);
295 auth_user_request
->denyMessage("NTLM authentication requires a persistent connection");
297 } else if (strncasecmp(reply
, "AF ", 3) == 0) {
298 /* we're finished, release the helper */
299 auth_user_request
->user()->username(blob
);
300 auth_user_request
->denyMessage("Login successful");
301 safe_free(ntlm_request
->server_blob
);
303 debugs(29, 4, "authenticateNTLMHandleReply: Successfully validated user via NTLM. Username '" << blob
<< "'");
304 /* connection is authenticated */
305 debugs(29, 4, "AuthNTLMUserRequest::authenticate: authenticated user " << auth_user_request
->user()->username());
306 /* see if this is an existing user with a different proxy_auth
308 auth_user_hash_pointer
*usernamehash
= static_cast<AuthUserHashPointer
*>(hash_lookup(proxy_auth_username_cache
, auth_user_request
->user()->username()));
309 Auth::User::Pointer local_auth_user
= ntlm_request
->user();
310 while (usernamehash
&& (usernamehash
->user()->auth_type
!= Auth::AUTH_NTLM
||
311 strcmp(usernamehash
->user()->username(), auth_user_request
->user()->username()) != 0))
312 usernamehash
= static_cast<AuthUserHashPointer
*>(usernamehash
->next
);
314 /* we can't seamlessly recheck the username due to the
315 * challenge-response nature of the protocol.
316 * Just free the temporary auth_user after merging as
317 * much of it new state into the existing one as possible */
318 usernamehash
->user()->absorb(local_auth_user
);
319 local_auth_user
= usernamehash
->user();
320 auth_user_request
->user(local_auth_user
);
322 /* store user in hash's */
323 local_auth_user
->addToNameCache();
325 /* set these to now because this is either a new login from an
326 * existing user or a new user */
327 local_auth_user
->expiretime
= current_time
.tv_sec
;
328 ntlm_request
->releaseAuthServer();
329 local_auth_user
->credentials(Auth::Ok
);
330 } else if (strncasecmp(reply
, "NA ", 3) == 0) {
331 /* authentication failure (wrong password, etc.) */
332 auth_user_request
->denyMessage(blob
);
333 ntlm_request
->user()->credentials(Auth::Failed
);
334 safe_free(ntlm_request
->server_blob
);
335 ntlm_request
->releaseAuthServer();
336 debugs(29, 4, "authenticateNTLMHandleReply: Failed validating user via NTLM. Error returned '" << blob
<< "'");
337 } else if (strncasecmp(reply
, "BH ", 3) == 0) {
338 /* TODO kick off a refresh process. This can occur after a YR or after
339 * a KK. If after a YR release the helper and resubmit the request via
340 * Authenticate NTLM start.
341 * If after a KK deny the user's request w/ 407 and mark the helper as
343 auth_user_request
->denyMessage(blob
);
344 auth_user_request
->user()->credentials(Auth::Failed
);
345 safe_free(ntlm_request
->server_blob
);
346 ntlm_request
->releaseAuthServer();
347 debugs(29, 1, "authenticateNTLMHandleReply: Error validating user via NTLM. Error returned '" << reply
<< "'");
350 fatalf("authenticateNTLMHandleReply: *** Unsupported helper response ***, '%s'\n", reply
);
353 if (ntlm_request
->request
) {
354 HTTPMSGUNLOCK(ntlm_request
->request
);
355 ntlm_request
->request
= NULL
;
357 r
->handler(r
->data
, NULL
);
358 cbdataReferenceDone(r
->data
);
359 authenticateStateFree(r
);