2 * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
10 #include "AccessLogEntry.h"
11 #include "auth/CredentialsCache.h"
12 #include "auth/ntlm/Config.h"
13 #include "auth/ntlm/User.h"
14 #include "auth/ntlm/UserRequest.h"
15 #include "auth/State.h"
17 #include "client_side.h"
19 #include "format/Format.h"
22 #include "helper/Reply.h"
23 #include "http/Stream.h"
24 #include "HttpRequest.h"
26 #include "SquidTime.h"
28 Auth::Ntlm::UserRequest::UserRequest() :
35 Auth::Ntlm::UserRequest::~UserRequest()
37 assert(LockCount()==0);
38 safe_free(server_blob
);
39 safe_free(client_blob
);
44 HTTPMSGUNLOCK(request
);
50 Auth::Ntlm::UserRequest::connLastHeader()
56 Auth::Ntlm::UserRequest::authenticated() const
58 if (user() != NULL
&& user()->credentials() == Auth::Ok
) {
59 debugs(29, 9, HERE
<< "user authenticated.");
63 debugs(29, 9, HERE
<< "user not fully authenticated.");
68 Auth::Ntlm::UserRequest::credentialsStr()
70 static char buf
[MAX_AUTHTOKEN_LEN
];
72 if (user()->credentials() == Auth::Pending
) {
73 printResult
= snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
);
75 printResult
= snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
78 // truncation is OK because we are used only for logging
79 if (printResult
< 0) {
80 debugs(29, 2, "Can not build ntlm authentication credentials.");
82 } else if (printResult
>= (int)sizeof(buf
))
83 debugs(29, 2, "Ntlm authentication credentials truncated.");
89 Auth::Ntlm::UserRequest::module_direction()
91 /* null auth_user is checked for by Auth::UserRequest::direction() */
93 if (waiting
|| client_blob
)
94 return Auth::CRED_LOOKUP
; /* need helper response to continue */
96 if (user()->auth_type
!= Auth::AUTH_NTLM
)
97 return Auth::CRED_ERROR
;
99 switch (user()->credentials()) {
101 case Auth::Handshake
:
103 return Auth::CRED_CHALLENGE
;
106 return Auth::CRED_VALID
;
109 return Auth::CRED_ERROR
; // XXX: really? not VALID or CHALLENGE?
112 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
113 return Auth::CRED_ERROR
;
118 Auth::Ntlm::UserRequest::startHelperLookup(HttpRequest
*, AccessLogEntry::Pointer
&al
, AUTHCB
* handler
, void *data
)
120 static char buf
[MAX_AUTHTOKEN_LEN
];
125 if (static_cast<Auth::Ntlm::Config
*>(Auth::SchemeConfig::Find("ntlm"))->authenticateProgram
== NULL
) {
126 debugs(29, DBG_CRITICAL
, "ERROR: NTLM Start: no NTLM program configured.");
131 debugs(29, 8, HERE
<< "credentials state is '" << user()->credentials() << "'");
133 const char *keyExtras
= helperRequestKeyExtras(request
, al
);
135 if (user()->credentials() == Auth::Pending
) {
137 printResult
= snprintf(buf
, sizeof(buf
), "YR %s %s\n", client_blob
, keyExtras
);
139 printResult
= snprintf(buf
, sizeof(buf
), "YR %s\n", client_blob
); //CHECKME: can ever client_blob be 0 here?
142 printResult
= snprintf(buf
, sizeof(buf
), "KK %s %s\n", client_blob
, keyExtras
);
144 printResult
= snprintf(buf
, sizeof(buf
), "KK %s\n", client_blob
);
148 if (printResult
< 0 || printResult
>= (int)sizeof(buf
)) {
150 debugs(29, DBG_CRITICAL
, "ERROR: Can not build ntlm authentication helper request");
152 debugs(29, DBG_CRITICAL
, "ERROR: Ntlm authentication helper request too big for the " << sizeof(buf
) << "-byte buffer.");
157 safe_free(client_blob
);
158 helperStatefulSubmit(ntlmauthenticators
, buf
, Auth::Ntlm::UserRequest::HandleReply
,
159 new Auth::StateData(this, handler
, data
), reservationId
);
163 * Atomic action: properly release the NTLM auth helpers which may have been reserved
164 * for this request connections use.
167 Auth::Ntlm::UserRequest::releaseAuthServer()
170 debugs(29, 6, reservationId
);
171 ntlmauthenticators
->cancelReservation(reservationId
);
172 reservationId
.clear();
174 debugs(29, 6, HERE
<< "No NTLM auth server to release.");
178 Auth::Ntlm::UserRequest::authenticate(HttpRequest
* aRequest
, ConnStateData
* conn
, Http::HdrType type
)
180 /* Check that we are in the client side, where we can generate
183 if (conn
== NULL
|| !cbdataReferenceValid(conn
)) {
184 user()->credentials(Auth::Failed
);
185 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
190 debugs(29, DBG_IMPORTANT
, "WARNING: NTLM Authentication waiting for helper reply!");
195 debugs(29, 2, HERE
<< "need to challenge client '" << server_blob
<< "'!");
200 const char *proxy_auth
= aRequest
->header
.getStr(type
);
202 /* locate second word */
203 const char *blob
= proxy_auth
;
205 /* if proxy_auth is actually NULL, we'd better not manipulate it. */
207 while (xisspace(*blob
) && *blob
)
210 while (!xisspace(*blob
) && *blob
)
213 while (xisspace(*blob
) && *blob
)
217 switch (user()->credentials()) {
219 case Auth::Unchecked
:
220 /* we've received a ntlm request. pass to a helper */
221 debugs(29, 9, HERE
<< "auth state ntlm none. Received blob: '" << proxy_auth
<< "'");
222 user()->credentials(Auth::Pending
);
223 safe_free(client_blob
);
224 client_blob
=xstrdup(blob
);
225 assert(conn
->getAuth() == NULL
);
226 conn
->setAuth(this, "new NTLM handshake request");
228 HTTPMSGLOCK(request
);
232 debugs(29, DBG_IMPORTANT
, HERE
<< "need to ask helper");
235 case Auth::Handshake
:
236 /* we should have received a blob from the client. Hand it off to
238 safe_free(client_blob
);
239 client_blob
= xstrdup(blob
);
241 HTTPMSGUNLOCK(request
);
243 HTTPMSGLOCK(request
);
247 fatal("Auth::Ntlm::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
251 /* we've failed somewhere in authentication */
252 debugs(29, 9, HERE
<< "auth state ntlm failed. " << proxy_auth
);
258 Auth::Ntlm::UserRequest::HandleReply(void *data
, const Helper::Reply
&reply
)
260 Auth::StateData
*r
= static_cast<Auth::StateData
*>(data
);
262 debugs(29, 8, reply
.reservationId
<< " got reply=" << reply
);
264 if (!cbdataReferenceValid(r
->data
)) {
265 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication invalid callback data(" << reply
.reservationId
<<")");
270 Auth::UserRequest::Pointer auth_user_request
= r
->auth_user_request
;
271 assert(auth_user_request
!= NULL
);
273 // add new helper kv-pair notes to the credentials object
274 // so that any transaction using those credentials can access them
275 static const NotePairs::Names appendables
= { SBuf("group"), SBuf("tag") };
276 auth_user_request
->user()->notes
.replaceOrAddOrAppend(&reply
.notes
, appendables
);
277 // remove any private credentials detail which got added.
278 auth_user_request
->user()->notes
.remove("token");
280 Auth::Ntlm::UserRequest
*lm_request
= dynamic_cast<Auth::Ntlm::UserRequest
*>(auth_user_request
.getRaw());
281 assert(lm_request
!= NULL
);
282 assert(lm_request
->waiting
);
284 lm_request
->waiting
= 0;
285 safe_free(lm_request
->client_blob
);
287 assert(auth_user_request
->user() != NULL
);
288 assert(auth_user_request
->user()->auth_type
== Auth::AUTH_NTLM
);
290 if (!lm_request
->reservationId
)
291 lm_request
->reservationId
= reply
.reservationId
;
293 assert(lm_request
->reservationId
== reply
.reservationId
);
295 switch (reply
.result
) {
297 /* we have been given a blob to send to the client */
298 safe_free(lm_request
->server_blob
);
299 lm_request
->request
->flags
.mustKeepalive
= true;
300 if (lm_request
->request
->flags
.proxyKeepalive
) {
301 const char *serverBlob
= reply
.notes
.findFirst("token");
302 lm_request
->server_blob
= xstrdup(serverBlob
);
303 auth_user_request
->user()->credentials(Auth::Handshake
);
304 auth_user_request
->setDenyMessage("Authentication in progress");
305 debugs(29, 4, HERE
<< "Need to challenge the client with a server token: '" << serverBlob
<< "'");
307 auth_user_request
->user()->credentials(Auth::Failed
);
308 auth_user_request
->setDenyMessage("NTLM authentication requires a persistent connection");
313 /* we're finished, release the helper */
314 const char *userLabel
= reply
.notes
.findFirst("user");
316 auth_user_request
->user()->credentials(Auth::Failed
);
317 safe_free(lm_request
->server_blob
);
318 lm_request
->releaseAuthServer();
319 debugs(29, DBG_CRITICAL
, "ERROR: NTLM Authentication helper returned no username. Result: " << reply
);
322 auth_user_request
->user()->username(userLabel
);
323 auth_user_request
->setDenyMessage("Login successful");
324 safe_free(lm_request
->server_blob
);
325 lm_request
->releaseAuthServer();
327 debugs(29, 4, HERE
<< "Successfully validated user via NTLM. Username '" << userLabel
<< "'");
328 /* connection is authenticated */
329 debugs(29, 4, HERE
<< "authenticated user " << auth_user_request
->user()->username());
330 /* see if this is an existing user */
331 auto local_auth_user
= lm_request
->user();
332 auto cached_user
= Auth::Ntlm::User::Cache()->lookup(auth_user_request
->user()->userKey());
334 local_auth_user
->addToNameCache();
336 /* we can't seamlessly recheck the username due to the
337 * challenge-response nature of the protocol.
338 * Just free the temporary auth_user after merging as
339 * much of it new state into the existing one as possible */
340 cached_user
->absorb(local_auth_user
);
341 /* from here on we are working with the original cached credentials. */
342 local_auth_user
= cached_user
;
343 auth_user_request
->user(local_auth_user
);
345 /* set these to now because this is either a new login from an
346 * existing user or a new user */
347 local_auth_user
->expiretime
= current_time
.tv_sec
;
348 auth_user_request
->user()->credentials(Auth::Ok
);
349 debugs(29, 4, HERE
<< "Successfully validated user via NTLM. Username '" << auth_user_request
->user()->username() << "'");
354 /* authentication failure (wrong password, etc.) */
355 auth_user_request
->denyMessageFromHelper("NTLM", reply
);
356 auth_user_request
->user()->credentials(Auth::Failed
);
357 safe_free(lm_request
->server_blob
);
358 lm_request
->releaseAuthServer();
359 debugs(29, 4, "Failed validating user via NTLM. Result: " << reply
);
362 case Helper::Unknown
:
363 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication Helper crashed (" << reply
.reservationId
<< ")");
364 /* continue to the next case */
366 case Helper::TimedOut
:
367 case Helper::BrokenHelper
:
368 /* TODO kick off a refresh process. This can occur after a YR or after
369 * a KK. If after a YR release the helper and resubmit the request via
370 * Authenticate NTLM start.
371 * If after a KK deny the user's request w/ 407 and mark the helper as
373 if (reply
.result
== Helper::Unknown
)
374 auth_user_request
->setDenyMessage("Internal Error");
376 auth_user_request
->denyMessageFromHelper("NTLM", reply
);
377 auth_user_request
->user()->credentials(Auth::Failed
);
378 safe_free(lm_request
->server_blob
);
379 lm_request
->releaseAuthServer();
380 debugs(29, DBG_IMPORTANT
, "ERROR: NTLM Authentication validating user. Result: " << reply
);
384 if (lm_request
->request
) {
385 HTTPMSGUNLOCK(lm_request
->request
);
386 lm_request
->request
= NULL
;