2 #include "auth/ntlm/auth_ntlm.h"
3 #include "auth/ntlm/UserRequest.h"
4 #include "auth/State.h"
6 #include "client_side.h"
8 #include "HttpRequest.h"
11 Auth::Ntlm::UserRequest::UserRequest()
20 Auth::Ntlm::UserRequest::~UserRequest()
22 assert(LockCount()==0);
23 safe_free(server_blob
);
24 safe_free(client_blob
);
29 HTTPMSGUNLOCK(request
);
35 Auth::Ntlm::UserRequest::connLastHeader()
41 Auth::Ntlm::UserRequest::authenticated() const
43 if (user() != NULL
&& user()->credentials() == Auth::Ok
) {
44 debugs(29, 9, HERE
<< "user authenticated.");
48 debugs(29, 9, HERE
<< "user not fully authenticated.");
53 Auth::Ntlm::UserRequest::module_direction()
55 /* null auth_user is checked for by Auth::UserRequest::direction() */
57 if (waiting
|| client_blob
)
58 return Auth::CRED_LOOKUP
; /* need helper response to continue */
60 if (user()->auth_type
!= Auth::AUTH_NTLM
)
61 return Auth::CRED_ERROR
;
63 switch (user()->credentials()) {
67 return Auth::CRED_CHALLENGE
;
70 return Auth::CRED_VALID
;
73 return Auth::CRED_ERROR
; // XXX: really? not VALID or CHALLENGE?
76 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
77 return Auth::CRED_ERROR
;
82 Auth::Ntlm::UserRequest::module_start(AUTHCB
* handler
, void *data
)
84 static char buf
[MAX_AUTHTOKEN_LEN
];
89 if (static_cast<Auth::Ntlm::Config
*>(Auth::Config::Find("ntlm"))->authenticateProgram
== NULL
) {
90 debugs(29, DBG_CRITICAL
, "ERROR: NTLM Start: no NTLM program configured.");
95 debugs(29, 8, HERE
<< "credentials state is '" << user()->credentials() << "'");
97 if (user()->credentials() == Auth::Pending
) {
98 snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
100 snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
105 safe_free(client_blob
);
106 helperStatefulSubmit(ntlmauthenticators
, buf
, Auth::Ntlm::UserRequest::HandleReply
,
107 new Auth::StateData(this, handler
, data
), authserver
);
111 * Atomic action: properly release the NTLM auth helpers which may have been reserved
112 * for this request connections use.
115 Auth::Ntlm::UserRequest::releaseAuthServer()
118 debugs(29, 6, HERE
<< "releasing NTLM auth server '" << authserver
<< "'");
119 helperStatefulReleaseServer(authserver
);
122 debugs(29, 6, HERE
<< "No NTLM auth server to release.");
126 Auth::Ntlm::UserRequest::onConnectionClose(ConnStateData
*conn
)
128 assert(conn
!= NULL
);
130 debugs(29, 8, HERE
<< "closing connection '" << conn
<< "' (this is '" << this << "')");
132 if (conn
->auth_user_request
== NULL
) {
133 debugs(29, 8, HERE
<< "no auth_user_request");
139 /* unlock the connection based lock */
140 debugs(29, 9, HERE
<< "Unlocking auth_user from the connection '" << conn
<< "'.");
142 conn
->auth_user_request
= NULL
;
146 Auth::Ntlm::UserRequest::authenticate(HttpRequest
* aRequest
, ConnStateData
* conn
, http_hdr_type type
)
150 /* Check that we are in the client side, where we can generate
153 if (conn
== NULL
|| !cbdataReferenceValid(conn
)) {
154 user()->credentials(Auth::Failed
);
155 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
160 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication waiting for helper reply!");
165 debugs(29, 2, HERE
<< "need to challenge client '" << server_blob
<< "'!");
170 const char *proxy_auth
= aRequest
->header
.getStr(type
);
172 /* locate second word */
173 const char *blob
= proxy_auth
;
175 /* if proxy_auth is actually NULL, we'd better not manipulate it. */
177 while (xisspace(*blob
) && *blob
)
180 while (!xisspace(*blob
) && *blob
)
183 while (xisspace(*blob
) && *blob
)
187 switch (user()->credentials()) {
189 case Auth::Unchecked
:
190 /* we've received a ntlm request. pass to a helper */
191 debugs(29, 9, HERE
<< "auth state ntlm none. Received blob: '" << proxy_auth
<< "'");
192 user()->credentials(Auth::Pending
);
193 safe_free(client_blob
);
194 client_blob
=xstrdup(blob
);
195 assert(conn
->auth_user_request
== NULL
);
196 conn
->auth_user_request
= this;
198 HTTPMSGLOCK(request
);
202 debugs(29, DBG_IMPORTANT
, HERE
<< "need to ask helper");
205 case Auth::Handshake
:
206 /* we should have received a blob from the client. Hand it off to
208 safe_free(client_blob
);
209 client_blob
= xstrdup(blob
);
211 HTTPMSGUNLOCK(request
);
213 HTTPMSGLOCK(request
);
217 fatal("Auth::Ntlm::UserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
221 /* we've failed somewhere in authentication */
222 debugs(29, 9, HERE
<< "auth state ntlm failed. " << proxy_auth
);
228 Auth::Ntlm::UserRequest::HandleReply(void *data
, const HelperReply
&reply
)
230 Auth::StateData
*r
= static_cast<Auth::StateData
*>(data
);
232 debugs(29, 8, HERE
<< "helper: '" << reply
.whichServer
<< "' sent us reply=" << reply
);
234 if (!cbdataReferenceValid(r
->data
)) {
235 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication invalid callback data. helper '" << reply
.whichServer
<< "'.");
240 Auth::UserRequest::Pointer auth_user_request
= r
->auth_user_request
;
241 assert(auth_user_request
!= NULL
);
243 Auth::Ntlm::UserRequest
*lm_request
= dynamic_cast<Auth::Ntlm::UserRequest
*>(auth_user_request
.getRaw());
244 assert(lm_request
!= NULL
);
245 assert(lm_request
->waiting
);
247 lm_request
->waiting
= 0;
248 safe_free(lm_request
->client_blob
);
250 assert(auth_user_request
->user() != NULL
);
251 assert(auth_user_request
->user()->auth_type
== Auth::AUTH_NTLM
);
253 if (lm_request
->authserver
== NULL
)
254 lm_request
->authserver
= reply
.whichServer
.get(); // XXX: no locking?
256 assert(reply
.whichServer
== lm_request
->authserver
);
258 switch (reply
.result
) {
259 case HelperReply::TT
:
260 /* we have been given a blob to send to the client */
261 safe_free(lm_request
->server_blob
);
262 lm_request
->request
->flags
.mustKeepalive
= 1;
263 if (lm_request
->request
->flags
.proxyKeepalive
) {
264 Note::Pointer serverBlob
= reply
.responseKeys
.findByName("token");
265 lm_request
->server_blob
= xstrdup(serverBlob
->values
[0]->value
.termedBuf());
266 auth_user_request
->user()->credentials(Auth::Handshake
);
267 auth_user_request
->denyMessage("Authentication in progress");
268 debugs(29, 4, HERE
<< "Need to challenge the client with a server token: '" << serverBlob
->values
[0]->value
<< "'");
270 auth_user_request
->user()->credentials(Auth::Failed
);
271 auth_user_request
->denyMessage("NTLM authentication requires a persistent connection");
275 case HelperReply::Okay
: {
276 /* we're finished, release the helper */
277 Note::Pointer userLabel
= reply
.responseKeys
.findByName("user");
278 auth_user_request
->user()->username(userLabel
->values
[0]->value
.termedBuf());
279 auth_user_request
->denyMessage("Login successful");
280 safe_free(lm_request
->server_blob
);
281 lm_request
->releaseAuthServer();
283 debugs(29, 4, HERE
<< "Successfully validated user via NTLM. Username '" << userLabel
->values
[0]->value
<< "'");
284 /* connection is authenticated */
285 debugs(29, 4, HERE
<< "authenticated user " << auth_user_request
->user()->username());
286 /* see if this is an existing user with a different proxy_auth
288 AuthUserHashPointer
*usernamehash
= static_cast<AuthUserHashPointer
*>(hash_lookup(proxy_auth_username_cache
, auth_user_request
->user()->username()));
289 Auth::User::Pointer local_auth_user
= lm_request
->user();
290 while (usernamehash
&& (usernamehash
->user()->auth_type
!= Auth::AUTH_NTLM
||
291 strcmp(usernamehash
->user()->username(), auth_user_request
->user()->username()) != 0))
292 usernamehash
= static_cast<AuthUserHashPointer
*>(usernamehash
->next
);
294 /* we can't seamlessly recheck the username due to the
295 * challenge-response nature of the protocol.
296 * Just free the temporary auth_user after merging as
297 * much of it new state into the existing one as possible */
298 usernamehash
->user()->absorb(local_auth_user
);
299 /* from here on we are working with the original cached credentials. */
300 local_auth_user
= usernamehash
->user();
301 auth_user_request
->user(local_auth_user
);
303 /* store user in hash's */
304 local_auth_user
->addToNameCache();
306 /* set these to now because this is either a new login from an
307 * existing user or a new user */
308 local_auth_user
->expiretime
= current_time
.tv_sec
;
309 auth_user_request
->user()->credentials(Auth::Ok
);
310 debugs(29, 4, HERE
<< "Successfully validated user via NTLM. Username '" << auth_user_request
->user()->username() << "'");
314 case HelperReply::Error
: {
315 /* authentication failure (wrong password, etc.) */
316 Note::Pointer errNote
= reply
.responseKeys
.findByName("message");
318 auth_user_request
->denyMessage(errNote
->values
[0]->value
.termedBuf());
320 auth_user_request
->denyMessage("NTLM Authentication denied with no reason given");
321 auth_user_request
->user()->credentials(Auth::Failed
);
322 safe_free(lm_request
->server_blob
);
323 lm_request
->releaseAuthServer();
324 debugs(29, 4, HERE
<< "Failed validating user via NTLM. Error returned '" << errNote
->values
[0]->value
<< "'");
328 case HelperReply::Unknown
:
329 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication Helper '" << reply
.whichServer
<< "' crashed!.");
330 /* continue to the next case */
332 case HelperReply::BrokenHelper
: {
333 /* TODO kick off a refresh process. This can occur after a YR or after
334 * a KK. If after a YR release the helper and resubmit the request via
335 * Authenticate NTLM start.
336 * If after a KK deny the user's request w/ 407 and mark the helper as
338 Note::Pointer errNote
= reply
.responseKeys
.findByName("message");
339 if (reply
.result
== HelperReply::Unknown
)
340 auth_user_request
->denyMessage("Internal Error");
341 else if (errNote
!= NULL
)
342 auth_user_request
->denyMessage(errNote
->values
[0]->value
.termedBuf());
344 auth_user_request
->denyMessage("NTLM Authentication failed with no reason given");
345 auth_user_request
->user()->credentials(Auth::Failed
);
346 safe_free(lm_request
->server_blob
);
347 lm_request
->releaseAuthServer();
348 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication validating user. Error returned '" << reply
<< "'");
353 if (lm_request
->request
) {
354 HTTPMSGUNLOCK(lm_request
->request
);
355 lm_request
->request
= NULL
;