src/auth/ntlm/auth_ntlm.cc

   1 /*
   2  * $Id: auth_ntlm.cc,v 1.79 2008/02/12 23:17:53 rousskov Exp $
   3  *
   4  * DEBUG: section 29    NTLM Authenticator
   5  * AUTHOR: Robert Collins, Henrik Nordstrom, Francesco Chemolli
   6  *
   7  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from
  11  *  the Internet community; see the CONTRIBUTORS file for full
  12  *  details.   Many organizations have provided support for Squid's
  13  *  development; see the SPONSORS file for full details.  Squid is
  14  *  Copyrighted (C) 2001 by the Regents of the University of
  15  *  California; see the COPYRIGHT file for full details.  Squid
  16  *  incorporates software developed and/or copyrighted by other
  17  *  sources; see the CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 /* The functions in this file handle authentication.
  36  * They DO NOT perform access control or auditing.
  37  * See acl.c for access control and client_side.c for auditing */
  38
  39
  40 #include "squid.h"
  41 #include "auth_ntlm.h"
  42 #include "authenticate.h"
  43 #include "CacheManager.h"
  44 #include "Store.h"
  45 #include "client_side.h"
  46 #include "HttpReply.h"
  47 #include "HttpRequest.h"
  48 /* TODO remove this include */
  49 #include "ntlmScheme.h"
  50 #include "wordlist.h"
  51 #include "SquidTime.h"
  52
  53 static void
  54 authenticateNTLMReleaseServer(AuthUserRequest * auth_user_request);
  55
  56
  57 static void
  58 authenticateStateFree(authenticateStateData * r)
  59 {
  60     AUTHUSERREQUESTUNLOCK(r->auth_user_request, "r");
  61     cbdataFree(r);
  62 }
  63
  64 /* NTLM Scheme */
  65 static HLPSCB authenticateNTLMHandleReply;
  66 static AUTHSSTATS authenticateNTLMStats;
  67
  68 static statefulhelper *ntlmauthenticators = NULL;
  69
  70 CBDATA_TYPE(authenticateStateData);
  71
  72 static int authntlm_initialised = 0;
  73
  74 static auth_ntlm_config ntlmConfig;
  75
  76 static hash_table *proxy_auth_cache = NULL;
  77
  78 /*
  79  *
  80  * Private Functions
  81  *
  82  */
  83
  84 /* move to ntlmScheme.cc */
  85 void
  86 ntlmScheme::done()
  87 {
  88     /* TODO: this should be a Config call. */
  89     debugs(29, 2, "ntlmScheme::done: shutting down NTLM authentication.");
  90
  91     if (ntlmauthenticators)
  92         helperStatefulShutdown(ntlmauthenticators);
  93
  94     authntlm_initialised = 0;
  95
  96     if (!shutting_down)
  97         return;
  98
  99     if (ntlmauthenticators)
 100         helperStatefulFree(ntlmauthenticators);
 101
 102     ntlmauthenticators = NULL;
 103
 104     debugs(29, 2, "ntlmScheme::done: NTLM authentication Shutdown.");
 105 }
 106
 107 /* free any allocated configuration details */
 108 void
 109 AuthNTLMConfig::done()
 110 {
 111     if (authenticate)
 112         wordlistDestroy(&authenticate);
 113 }
 114
 115 void
 116 AuthNTLMConfig::dump(StoreEntry * entry, const char *name, AuthConfig * scheme)
 117 {
 118     wordlist *list = authenticate;
 119     storeAppendPrintf(entry, "%s %s", name, "ntlm");
 120
 121     while (list != NULL) {
 122         storeAppendPrintf(entry, " %s", list->key);
 123         list = list->next;
 124     }
 125
 126     storeAppendPrintf(entry, "\n%s ntlm children %d\n",
 127                       name, authenticateChildren);
 128     storeAppendPrintf(entry, "%s %s keep_alive %s\n", name, "ntlm", keep_alive ? "on" : "off");
 129
 130 }
 131
 132 AuthNTLMConfig::AuthNTLMConfig() : authenticateChildren(5), keep_alive(1)
 133 { }
 134
 135 void
 136 AuthNTLMConfig::parse(AuthConfig * scheme, int n_configured, char *param_str)
 137 {
 138     if (strcasecmp(param_str, "program") == 0) {
 139         if (authenticate)
 140             wordlistDestroy(&authenticate);
 141
 142         parse_wordlist(&authenticate);
 143
 144         requirePathnameExists("authparam ntlm program", authenticate->key);
 145     } else if (strcasecmp(param_str, "children") == 0) {
 146         parse_int(&authenticateChildren);
 147     } else if (strcasecmp(param_str, "keep_alive") == 0) {
 148         parse_onoff(&keep_alive);
 149     } else {
 150         debugs(29, 0, "AuthNTLMConfig::parse: unrecognised ntlm auth scheme parameter '" << param_str << "'");
 151     }
 152
 153     /*
 154      * disable client side request pipelining. There is a race with
 155      * NTLM when the client sends a second request on an NTLM
 156      * connection before the authenticate challenge is sent. With
 157      * this patch, the client may fail to authenticate, but squid's
 158      * state will be preserved.  Caveats: this should be a post-parse
 159      * test, but that can wait for the modular parser to be integrated.
 160      */
 161     if (authenticate)
 162         Config.onoff.pipeline_prefetch = 0;
 163 }
 164
 165 const char *
 166 AuthNTLMConfig::type() const
 167 {
 168     return ntlmScheme::GetInstance().type();
 169 }
 170
 171 /* Initialize helpers and the like for this auth scheme. Called AFTER parsing the
 172  * config file */
 173 void
 174 AuthNTLMConfig::init(AuthConfig * scheme)
 175 {
 176     if (authenticate) {
 177
 178         authntlm_initialised = 1;
 179
 180         if (ntlmauthenticators == NULL)
 181             ntlmauthenticators = helperStatefulCreate("ntlmauthenticator");
 182
 183         if (!proxy_auth_cache)
 184             proxy_auth_cache = hash_create((HASHCMP *) strcmp, 7921, hash_string);
 185
 186         assert(proxy_auth_cache);
 187
 188         ntlmauthenticators->cmdline = authenticate;
 189
 190         ntlmauthenticators->n_to_start = authenticateChildren;
 191
 192         ntlmauthenticators->ipc_type = IPC_STREAM;
 193
 194         helperStatefulOpenServers(ntlmauthenticators);
 195
 196         CBDATA_INIT_TYPE(authenticateStateData);
 197     }
 198 }
 199
 200 void
 201 AuthNTLMConfig::registerWithCacheManager(void)
 202 {
 203     CacheManager::GetInstance()->
 204             registerAction("ntlmauthenticator",
 205                            "NTLM User Authenticator Stats",
 206                            authenticateNTLMStats, 0, 1);
 207 }
 208
 209 bool
 210 AuthNTLMConfig::active() const
 211 {
 212     return authntlm_initialised == 1;
 213 }
 214
 215 bool
 216 AuthNTLMConfig::configured() const
 217 {
 218     if ((authenticate != NULL) && (authenticateChildren != 0)) {
 219         debugs(29, 9, "AuthNTLMConfig::configured: returning configured");
 220         return true;
 221     }
 222
 223     debugs(29, 9, "AuthNTLMConfig::configured: returning unconfigured");
 224     return false;
 225 }
 226
 227 /* NTLM Scheme */
 228 /* See AuthUserRequest.cc::authenticateDirection for return values */
 229 int
 230 AuthNTLMUserRequest::module_direction()
 231 {
 232     /* null auth_user is checked for by authenticateDirection */
 233
 234     if (waiting || client_blob)
 235         return -1; /* need helper response to continue */
 236
 237     switch (auth_state) {
 238
 239         /* no progress at all. */
 240
 241     case AUTHENTICATE_STATE_NONE:
 242         debugs(29, 1, "AuthNTLMUserRequest::direction: called before NTLM Authenticate for request " << this << "!. Report a bug to squid-dev.");
 243         return -2; /* error */
 244
 245     case AUTHENTICATE_STATE_FAILED:
 246         return -2; /* error */
 247
 248
 249     case AUTHENTICATE_STATE_IN_PROGRESS:
 250         assert(server_blob);
 251         return 1; /* send to client */
 252
 253     case AUTHENTICATE_STATE_DONE:
 254         return 0; /* do nothing */
 255
 256     case AUTHENTICATE_STATE_INITIAL:
 257         debugs(29, 1, "AuthNTLMUserRequest::direction: Unexpected AUTHENTICATE_STATE_INITIAL");
 258         return -2;
 259     }
 260
 261     return -2;
 262 }
 263
 264 void
 265 AuthNTLMConfig::fixHeader(AuthUserRequest *auth_user_request, HttpReply *rep, http_hdr_type type, HttpRequest * request)
 266 {
 267     AuthNTLMUserRequest *ntlm_request;
 268
 269     if (!authenticate)
 270         return;
 271
 272     /* Need keep-alive */
 273     if (!request->flags.proxy_keepalive && request->flags.must_keepalive)
 274         return;
 275
 276     /* New request, no user details */
 277     if (auth_user_request == NULL) {
 278         debugs(29, 9, "AuthNTLMConfig::fixHeader: Sending type:" << type << " header: 'NTLM'");
 279         httpHeaderPutStrf(&rep->header, type, "NTLM");
 280
 281         if (!keep_alive) {
 282             /* drop the connection */
 283             request->flags.proxy_keepalive = 0;
 284         }
 285     } else {
 286         ntlm_request = dynamic_cast<AuthNTLMUserRequest *>(auth_user_request);
 287
 288         assert(ntlm_request != NULL);
 289
 290         switch (ntlm_request->auth_state) {
 291
 292         case AUTHENTICATE_STATE_FAILED:
 293             /* here it makes sense to drop the connection, as auth is
 294              * tied to it, even if MAYBE the client could handle it - Kinkie */
 295             request->flags.proxy_keepalive = 0;
 296             /* fall through */
 297
 298         case AUTHENTICATE_STATE_DONE:
 299             /* Special case: authentication finished OK but disallowed by ACL.
 300              * Need to start over to give the client another chance.
 301              */
 302             /* fall through */
 303
 304         case AUTHENTICATE_STATE_NONE:
 305             /* semantic change: do not drop the connection.
 306              * 2.5 implementation used to keep it open - Kinkie */
 307             debugs(29, 9, "AuthNTLMConfig::fixHeader: Sending type:" << type << " header: 'NTLM'");
 308             httpHeaderPutStrf(&rep->header, type, "NTLM");
 309             break;
 310
 311         case AUTHENTICATE_STATE_IN_PROGRESS:
 312             /* we're waiting for a response from the client. Pass it the blob */
 313             debugs(29, 9, "AuthNTLMConfig::fixHeader: Sending type:" << type << " header: 'NTLM " << ntlm_request->server_blob << "'");
 314             httpHeaderPutStrf(&rep->header, type, "NTLM %s", ntlm_request->server_blob);
 315             safe_free(ntlm_request->server_blob);
 316             break;
 317
 318
 319         default:
 320             debugs(29, 0, "AuthNTLMConfig::fixHeader: state " << ntlm_request->auth_state << ".");
 321             fatal("unexpected state in AuthenticateNTLMFixErrorHeader.\n");
 322         }
 323     }
 324 }
 325
 326 NTLMUser::~NTLMUser()
 327 {
 328     debugs(29, 5, "NTLMUser::~NTLMUser: doing nothing to clearNTLM scheme data for '" << this << "'");
 329 }
 330
 331 static stateful_helper_callback_t
 332 authenticateNTLMHandleReply(void *data, void *lastserver, char *reply)
 333 {
 334     authenticateStateData *r = static_cast<authenticateStateData *>(data);
 335
 336     int valid;
 337     stateful_helper_callback_t result = S_HELPER_UNKNOWN;
 338     char *blob;
 339
 340     AuthUserRequest *auth_user_request;
 341     AuthUser *auth_user;
 342     NTLMUser *ntlm_user;
 343     AuthNTLMUserRequest *ntlm_request;
 344
 345     debugs(29, 8, "authenticateNTLMHandleReply: helper: '" << lastserver << "' sent us '" << (reply ? reply : "<NULL>") << "'");
 346     valid = cbdataReferenceValid(r->data);
 347
 348     if (!valid) {
 349         debugs(29, 1, "authenticateNTLMHandleReply: invalid callback data. Releasing helper '" << lastserver << "'.");
 350         cbdataReferenceDone(r->data);
 351         authenticateStateFree(r);
 352         debugs(29, 9, "authenticateNTLMHandleReply: telling stateful helper : " << S_HELPER_RELEASE);
 353         return S_HELPER_RELEASE;
 354     }
 355
 356     if (!reply) {
 357         debugs(29, 1, "authenticateNTLMHandleReply: Helper '" << lastserver << "' crashed!.");
 358         reply = (char *)"BH Internal error";
 359     }
 360
 361     auth_user_request = r->auth_user_request;
 362     assert(auth_user_request != NULL);
 363     ntlm_request = dynamic_cast<AuthNTLMUserRequest *>(auth_user_request);
 364
 365     assert(ntlm_request != NULL);
 366     assert(ntlm_request->waiting);
 367     ntlm_request->waiting = 0;
 368     safe_free(ntlm_request->client_blob);
 369
 370     auth_user = ntlm_request->user();
 371     assert(auth_user != NULL);
 372     assert(auth_user->auth_type == AUTH_NTLM);
 373     ntlm_user = dynamic_cast<ntlm_user_t *>(auth_user_request->user());
 374
 375     assert(ntlm_user != NULL);
 376
 377     if (ntlm_request->authserver == NULL)
 378         ntlm_request->authserver = static_cast<helper_stateful_server*>(lastserver);
 379     else
 380         assert(ntlm_request->authserver == lastserver);
 381
 382     /* seperate out the useful data */
 383     blob = strchr(reply, ' ');
 384
 385     if (blob)
 386         blob++;
 387
 388     if (strncasecmp(reply, "TT ", 3) == 0) {
 389         /* we have been given a blob to send to the client */
 390         safe_free(ntlm_request->server_blob);
 391         ntlm_request->request->flags.must_keepalive = 1;
 392         if (ntlm_request->request->flags.proxy_keepalive) {
 393             ntlm_request->server_blob = xstrdup(blob);
 394             ntlm_request->auth_state = AUTHENTICATE_STATE_IN_PROGRESS;
 395             auth_user_request->denyMessage("Authentication in progress");
 396             debugs(29, 4, "authenticateNTLMHandleReply: Need to challenge the client with a server blob '" << blob << "'");
 397             result = S_HELPER_RESERVE;
 398         } else {
 399             ntlm_request->auth_state = AUTHENTICATE_STATE_FAILED;
 400             auth_user_request->denyMessage("NTLM authentication requires a persistent connection");
 401             result = S_HELPER_RELEASE;
 402         }
 403     } else if (strncasecmp(reply, "AF ", 3) == 0) {
 404         /* we're finished, release the helper */
 405         ntlm_user->username(blob);
 406         auth_user_request->denyMessage("Login successful");
 407         safe_free(ntlm_request->server_blob);
 408
 409         result = S_HELPER_RELEASE;
 410         debugs(29, 4, "authenticateNTLMHandleReply: Successfully validated user via NTLM. Username '" << blob << "'");
 411         /* connection is authenticated */
 412         debugs(29, 4, "AuthNTLMUserRequest::authenticate: authenticated user " << ntlm_user->username());
 413         /* see if this is an existing user with a different proxy_auth
 414          * string */
 415         auth_user_hash_pointer *usernamehash = static_cast<AuthUserHashPointer *>(hash_lookup(proxy_auth_username_cache, ntlm_user->username()));
 416         AuthUser *local_auth_user = ntlm_request->user();
 417         while (usernamehash && (usernamehash->user()->auth_type != AUTH_NTLM || strcmp(usernamehash->user()->username(), ntlm_user->username()) != 0))
 418             usernamehash = static_cast<AuthUserHashPointer *>(usernamehash->next);
 419         if (usernamehash) {
 420             /* we can't seamlessly recheck the username due to the
 421              * challenge-response nature of the protocol.
 422              * Just free the temporary auth_user */
 423             usernamehash->user()->absorb(local_auth_user);
 424             //authenticateAuthUserMerge(local_auth_user, usernamehash->user());
 425             local_auth_user = usernamehash->user();
 426             ntlm_request->_auth_user = local_auth_user;
 427         } else {
 428             /* store user in hash's */
 429             local_auth_user->addToNameCache();
 430             // authenticateUserNameCacheAdd(local_auth_user);
 431         }
 432         /* set these to now because this is either a new login from an
 433          * existing user or a new user */
 434         local_auth_user->expiretime = current_time.tv_sec;
 435         authenticateNTLMReleaseServer(ntlm_request);
 436         ntlm_request->auth_state = AUTHENTICATE_STATE_DONE;
 437     } else if (strncasecmp(reply, "NA ", 3) == 0) {
 438         /* authentication failure (wrong password, etc.) */
 439         auth_user_request->denyMessage(blob);
 440         ntlm_request->auth_state = AUTHENTICATE_STATE_FAILED;
 441         safe_free(ntlm_request->server_blob);
 442         authenticateNTLMReleaseServer(ntlm_request);
 443         result = S_HELPER_RELEASE;
 444         debugs(29, 4, "authenticateNTLMHandleReply: Failed validating user via NTLM. Error returned '" << blob << "'");
 445     } else if (strncasecmp(reply, "BH ", 3) == 0) {
 446         /* TODO kick off a refresh process. This can occur after a YR or after
 447          * a KK. If after a YR release the helper and resubmit the request via
 448          * Authenticate NTLM start.
 449          * If after a KK deny the user's request w/ 407 and mark the helper as
 450          * Needing YR. */
 451         auth_user_request->denyMessage(blob);
 452         ntlm_request->auth_state = AUTHENTICATE_STATE_FAILED;
 453         safe_free(ntlm_request->server_blob);
 454         authenticateNTLMReleaseServer(ntlm_request);
 455         result = S_HELPER_RELEASE;
 456         debugs(29, 1, "authenticateNTLMHandleReply: Error validating user via NTLM. Error returned '" << reply << "'");
 457     } else {
 458         /* protocol error */
 459         fatalf("authenticateNTLMHandleReply: *** Unsupported helper response ***, '%s'\n", reply);
 460     }
 461
 462     if (ntlm_request->request) {
 463         HTTPMSGUNLOCK(ntlm_request->request);
 464         ntlm_request->request = NULL;
 465     }
 466     r->handler(r->data, NULL);
 467     cbdataReferenceDone(r->data);
 468     authenticateStateFree(r);
 469     debugs(29, 9, "authenticateNTLMHandleReply: telling stateful helper : " << result);
 470     return result;
 471 }
 472
 473 static void
 474 authenticateNTLMStats(StoreEntry * sentry)
 475 {
 476     helperStatefulStats(sentry, ntlmauthenticators, "NTLM Authenticator Statistics");
 477 }
 478
 479
 480 /* send the initial data to a stateful ntlm authenticator module */
 481 void
 482 AuthNTLMUserRequest::module_start(RH * handler, void *data)
 483 {
 484     authenticateStateData *r = NULL;
 485     static char buf[8192];
 486     ntlm_user_t *ntlm_user;
 487     AuthUser *auth_user = user();
 488
 489     assert(data);
 490     assert(handler);
 491     assert(auth_user);
 492     assert(auth_user->auth_type == AUTH_NTLM);
 493
 494     ntlm_user = dynamic_cast<ntlm_user_t *>(user());
 495
 496     debugs(29, 8, "AuthNTLMUserRequest::module_start: auth state is '" << auth_state << "'");
 497
 498     if (ntlmConfig.authenticate == NULL) {
 499         debugs(29, 0, "AuthNTLMUserRequest::module_start: no NTLM program specified.");
 500         handler(data, NULL);
 501         return;
 502     }
 503
 504     r = cbdataAlloc(authenticateStateData);
 505     r->handler = handler;
 506     r->data = cbdataReference(data);
 507     r->auth_user_request = this;
 508     AUTHUSERREQUESTLOCK(r->auth_user_request, "r");
 509
 510     if (auth_state == AUTHENTICATE_STATE_INITIAL) {
 511         snprintf(buf, 8192, "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
 512     } else {
 513         snprintf(buf, 8192, "KK %s\n", client_blob);
 514     }
 515
 516     waiting = 1;
 517
 518     safe_free(client_blob);
 519     helperStatefulSubmit(ntlmauthenticators, buf, authenticateNTLMHandleReply, r, authserver);
 520 }
 521
 522 /* clear the NTLM helper of being reserved for future requests */
 523 static void
 524 authenticateNTLMReleaseServer(AuthUserRequest * auth_user_request)
 525 {
 526     AuthNTLMUserRequest *ntlm_request;
 527     assert(auth_user_request->user()->auth_type == AUTH_NTLM);
 528     ntlm_request = dynamic_cast< AuthNTLMUserRequest *>(auth_user_request);
 529     debugs(29, 9, "authenticateNTLMReleaseServer: releasing server '" << ntlm_request->authserver << "'");
 530     /* is it possible for the server to be NULL? hno seems to think so.
 531      * Let's see what happens, might segfault in helperStatefulReleaseServer
 532      * if it does. I leave it like this not to cover possibly problematic
 533      * code-paths. Kinkie */
 534     /* DPW 2007-05-07
 535      * yes, it is possible */
 536     assert(ntlm_request != NULL);
 537     if (ntlm_request->authserver) {
 538         helperStatefulReleaseServer(ntlm_request->authserver);
 539         ntlm_request->authserver = NULL;
 540     }
 541 }
 542
 543 /* clear any connection related authentication details */
 544 void
 545 AuthNTLMUserRequest::onConnectionClose(ConnStateData *conn)
 546 {
 547     assert(conn != NULL);
 548
 549     debugs(29, 8, "AuthNTLMUserRequest::onConnectionClose: closing connection '" << conn << "' (this is '" << this << "')");
 550
 551     if (conn->auth_user_request == NULL) {
 552         debugs(29, 8, "AuthNTLMUserRequest::onConnectionClose: no auth_user_request");
 553         return;
 554     }
 555
 556     if (authserver != NULL)
 557         authenticateNTLMReleaseServer(this);
 558
 559     /* unlock the connection based lock */
 560     debugs(29, 9, "AuthNTLMUserRequest::onConnectionClose: Unlocking auth_user from the connection '" << conn << "'.");
 561
 562     AUTHUSERREQUESTUNLOCK(conn->auth_user_request, "conn");
 563 }
 564
 565 /*
 566  * Decode a NTLM [Proxy-]Auth string, placing the results in the passed
 567  * Auth_user structure.
 568  */
 569 AuthUserRequest *
 570 AuthNTLMConfig::decode(char const *proxy_auth)
 571 {
 572     NTLMUser *newUser = new NTLMUser(&ntlmConfig);
 573     AuthNTLMUserRequest *auth_user_request = new AuthNTLMUserRequest ();
 574     assert(auth_user_request->user() == NULL);
 575     auth_user_request->user(newUser);
 576     auth_user_request->user()->auth_type = AUTH_NTLM;
 577     auth_user_request->user()->addRequest(auth_user_request);
 578
 579     /* all we have to do is identify that it's NTLM - the helper does the rest */
 580     debugs(29, 9, "AuthNTLMConfig::decode: NTLM authentication");
 581     return auth_user_request;
 582 }
 583
 584 int
 585 AuthNTLMUserRequest::authenticated() const
 586 {
 587     if (auth_state == AUTHENTICATE_STATE_DONE) {
 588         debugs(29, 9, "AuthNTLMUserRequest::authenticated: user authenticated.");
 589         return 1;
 590     }
 591
 592     debugs(29, 9, "AuthNTLMUserRequest::authenticated: user not fully authenticated.");
 593
 594     return 0;
 595 }
 596
 597 void
 598 AuthNTLMUserRequest::authenticate(HttpRequest * request, ConnStateData * conn, http_hdr_type type)
 599 {
 600     const char *proxy_auth, *blob;
 601
 602     /* TODO: rename this!! */
 603     AuthUser *local_auth_user;
 604     ntlm_user_t *ntlm_user;
 605
 606     local_auth_user = user();
 607     assert(local_auth_user);
 608     assert(local_auth_user->auth_type == AUTH_NTLM);
 609     ntlm_user = dynamic_cast<ntlm_user_t *>(local_auth_user);
 610     assert (this);
 611
 612     /* Check that we are in the client side, where we can generate
 613      * auth challenges */
 614
 615     if (conn == NULL || !cbdataReferenceValid(conn)) {
 616         auth_state = AUTHENTICATE_STATE_FAILED;
 617         debugs(29, 1, "AuthNTLMUserRequest::authenticate: attempt to perform authentication without a connection!");
 618         return;
 619     }
 620
 621     if (waiting) {
 622         debugs(29, 1, "AuthNTLMUserRequest::authenticate: waiting for helper reply!");
 623         return;
 624     }
 625
 626     if (server_blob) {
 627         debugs(29, 2, "AuthNTLMUserRequest::authenticate: need to challenge client '" << server_blob << "'!");
 628         return;
 629     }
 630
 631     /* get header */
 632     proxy_auth = request->header.getStr(type);
 633
 634     /* locate second word */
 635     blob = proxy_auth;
 636
 637     /* if proxy_auth is actually NULL, we'd better not manipulate it. */
 638     if(blob) {
 639         while (xisspace(*blob) && *blob)
 640             blob++;
 641
 642         while (!xisspace(*blob) && *blob)
 643             blob++;
 644
 645         while (xisspace(*blob) && *blob)
 646             blob++;
 647     }
 648
 649     switch (auth_state) {
 650
 651     case AUTHENTICATE_STATE_NONE:
 652         /* we've received a ntlm request. pass to a helper */
 653         debugs(29, 9, "AuthNTLMUserRequest::authenticate: auth state ntlm none. Received blob: '" << proxy_auth << "'");
 654         auth_state = AUTHENTICATE_STATE_INITIAL;
 655         safe_free(client_blob);
 656         client_blob=xstrdup(blob);
 657         conn->auth_type = AUTH_NTLM;
 658         assert(conn->auth_user_request == NULL);
 659         conn->auth_user_request = this;
 660         AUTHUSERREQUESTLOCK(conn->auth_user_request, "conn");
 661         this->request = request;
 662         HTTPMSGLOCK(this->request);
 663         return;
 664
 665         break;
 666
 667     case AUTHENTICATE_STATE_INITIAL:
 668         debugs(29, 1, "AuthNTLMUserRequest::authenticate: need to ask helper");
 669
 670         return;
 671
 672         break;
 673
 674
 675     case AUTHENTICATE_STATE_IN_PROGRESS:
 676         /* we should have received a blob from the client. Hand it off to
 677          * some helper */
 678         safe_free(client_blob);
 679
 680         client_blob = xstrdup (blob);
 681
 682         if (this->request)
 683             HTTPMSGUNLOCK(this->request);
 684         this->request = request;
 685         HTTPMSGLOCK(this->request);
 686         return;
 687
 688         break;
 689
 690     case AUTHENTICATE_STATE_DONE:
 691         fatal("AuthNTLMUserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
 692
 693         break;
 694
 695     case AUTHENTICATE_STATE_FAILED:
 696         /* we've failed somewhere in authentication */
 697         debugs(29, 9, "AuthNTLMUserRequest::authenticate: auth state ntlm failed. " << proxy_auth);
 698
 699         return;
 700
 701         break;
 702     }
 703
 704     return;
 705 }
 706
 707 AuthNTLMUserRequest::AuthNTLMUserRequest() :
 708     /*conn(NULL),*/ auth_state(AUTHENTICATE_STATE_NONE),
 709         _theUser(NULL)
 710 {
 711     waiting=0;
 712     client_blob=0;
 713     server_blob=0;
 714     authserver=NULL;
 715     request = NULL;
 716 }
 717
 718 AuthNTLMUserRequest::~AuthNTLMUserRequest()
 719 {
 720     safe_free(server_blob);
 721     safe_free(client_blob);
 722
 723     if (authserver != NULL) {
 724         debugs(29, 9, "AuthNTLMUserRequest::~AuthNTLMUserRequest: releasing server '" << authserver << "'");
 725         helperStatefulReleaseServer(authserver);
 726         authserver = NULL;
 727     }
 728     if (request) {
 729         HTTPMSGUNLOCK(request);
 730         request = NULL;
 731     }
 732 }
 733
 734 void
 735 NTLMUser::deleteSelf() const
 736 {
 737     delete this;
 738 }
 739
 740 NTLMUser::NTLMUser (AuthConfig *config) : AuthUser (config)
 741 {
 742     proxy_auth_list.head = proxy_auth_list.tail = NULL;
 743 }
 744
 745 AuthConfig *
 746 ntlmScheme::createConfig()
 747 {
 748     return &ntlmConfig;
 749 }
 750
 751 const char *
 752 AuthNTLMUserRequest::connLastHeader()
 753 {
 754     return NULL;
 755 }
 756