/*
- * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+ * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
*
* Squid software is distributed under GPLv2+ license and includes
* contributions from numerous individuals and organizations.
/**
* Maximum length (buffer size) for token strings.
*/
-// AYJ: must match re-definition in helpers/negotiate_auth/kerberos/negotiate_kerb_auth.cc
-#define MAX_AUTHTOKEN_LEN 32768
+// XXX: Keep in sync with all others: bzr grep 'define MAX_AUTHTOKEN_LEN'
+#define MAX_AUTHTOKEN_LEN 65535
/**
* Node used to link an IP address to some user credentials
*/
class AuthUserIP
{
+ MEMPROXY_CLASS(AuthUserIP);
+
public:
AuthUserIP(const Ip::Address &ip, time_t t) : ipaddr(ip), ip_expiretime(t) {}
* (user,IP) pair plus authenticate_ip_ttl seconds
*/
time_t ip_expiretime;
-
- MEMPROXY_CLASS(AuthUserIP);
};
-MEMPROXY_CLASS_INLINE(AuthUserIP);
-
// TODO: make auth schedule AsyncCalls?
typedef void AUTHCB(void*);
/**
* Used by squid to determine what the next step in performing authentication for a given scheme is.
*
- * \retval CRED_ERROR ERROR in the auth module. Cannot determine request direction.
- * \retval CRED_LOOKUP The auth module needs to send data to an external helper.
- * Squid will prepare for a callback on the request and call the AUTHSSTART function.
- * \retval CRED_VALID The auth module has all the information it needs to perform the authentication
- * and provide a succeed/fail result.
- * \retval CRED_CHALLENGE The auth module needs to send a new challenge to the request originator.
- * Squid will return the appropriate status code (401 or 407) and call the registered
- * FixError function to allow the auth module to insert it's challenge.
+ * \retval CRED_ERROR ERROR in the auth module. Cannot determine request direction.
+ * \retval CRED_LOOKUP The auth module needs to send data to an external helper.
+ * Squid will prepare for a callback on the request and call the AUTHSSTART function.
+ * \retval CRED_VALID The auth module has all the information it needs to perform the authentication
+ * and provide a succeed/fail result.
+ * \retval CRED_CHALLENGE The auth module needs to send a new challenge to the request originator.
+ * Squid will return the appropriate status code (401 or 407) and call the registered
+ * FixError function to allow the auth module to insert it's challenge.
*/
Direction direction();
/**
* Used by squid to determine whether the auth scheme has successfully authenticated the user request.
*
- \retval true User has successfully been authenticated.
- \retval false Timeouts on cached credentials have occurred or for any reason the credentials are not valid.
+ \retval true User has successfully been authenticated.
+ \retval false Timeouts on cached credentials have occurred or for any reason the credentials are not valid.
*/
virtual int authenticated() const = 0;
* \retval false User credentials use an unknown scheme type.
* \retval false User credentials are broken for their scheme.
*
- * \retval true User credentials exist and may be able to authenticate.
+ * \retval true User credentials exist and may be able to authenticate.
*/
bool valid() const;
- virtual void authenticate(HttpRequest * request, ConnStateData * conn, http_hdr_type type) = 0;
+ virtual void authenticate(HttpRequest * request, ConnStateData * conn, Http::HdrType type) = 0;
/* template method - what needs to be done next? advertise schemes, challenge, handle error, nothing? */
virtual Direction module_direction() = 0;
* Credentials may be found in one of the following locations (listed by order of preference):
* - the source passed as parameter aUR
* - cached in the HttpRequest parameter from a previous authentication of this request
- * - cached in the ConnStateData paremeter from a previous authentication of this connection
+ * - cached in the ConnStateData parameter from a previous authentication of this connection
* (only applies to some situations. ie NTLM, Negotiate, Kerberos auth schemes,
* or decrypted SSL requests from inside an authenticated CONNECT tunnel)
* - cached in the user credentials cache from a previous authentication of the same credentials
*
* \return Some AUTH_ACL_* state
*/
- static AuthAclState tryToAuthenticateAndSetAuthUser(UserRequest::Pointer *aUR, http_hdr_type, HttpRequest *, ConnStateData *, Ip::Address &, AccessLogEntry::Pointer &);
+ static AuthAclState tryToAuthenticateAndSetAuthUser(UserRequest::Pointer *aUR, Http::HdrType, HttpRequest *, ConnStateData *, Ip::Address &, AccessLogEntry::Pointer &);
/// Add the appropriate [Proxy-]Authenticate header to the given reply
- static void addReplyAuthHeader(HttpReply * rep, UserRequest::Pointer auth_user_request, HttpRequest * request, int accelerated, int internal);
+ static void AddReplyAuthHeader(HttpReply * rep, UserRequest::Pointer auth_user_request, HttpRequest * request, int accelerated, int internal);
/** Start an asynchronous helper lookup to verify the user credentials
*
* The given callback will be called when the auth module has performed
* it's external activities.
*
- * \param handler Handler to process the callback when its run
- * \param data CBDATA for handler
+ * \param handler Handler to process the callback when its run
+ * \param data CBDATA for handler
*/
void start(HttpRequest *request, AccessLogEntry::Pointer &al, AUTHCB *handler, void *data);
- char const * denyMessage(char const * const default_message = NULL);
+ char const * denyMessage(char const * const default_message = NULL) const;
- /** Possibly overrideable in future */
+ /** Possibly overridable in future */
void setDenyMessage(char const *);
- /** Possibly overrideable in future */
- char const * getDenyMessage();
+ /** Possibly overridable in future */
+ char const * getDenyMessage() const;
/**
* Squid does not make assumptions about where the username is stored.
* This function must return a pointer to a NULL terminated string to be used in logging the request.
* The string should NOT be allocated each time this function is called.
*
- \retval NULL No username/usercode is known.
- \retval * Null-terminated username string.
+ \retval NULL No username/usercode is known.
+ \retval * Null-terminated username string.
*/
char const *username() const;
const char *helperRequestKeyExtras(HttpRequest *, AccessLogEntry::Pointer &al);
+ /// Sets the reason of 'authentication denied' helper response.
+ void denyMessageFromHelper(char const *proto, const Helper::Reply &reply);
+
protected:
/**
* The scheme-specific actions to be performed when sending helper lookup.
private:
- static AuthAclState authenticate(UserRequest::Pointer * auth_user_request, http_hdr_type headertype, HttpRequest * request, ConnStateData * conn, Ip::Address &src_addr, AccessLogEntry::Pointer &al);
+ static AuthAclState authenticate(UserRequest::Pointer * auth_user_request, Http::HdrType headertype, HttpRequest * request, ConnStateData * conn, Ip::Address &src_addr, AccessLogEntry::Pointer &al);
/** return a message on the 407 error pages */
char *message;
/* AuthUserRequest */
-/// \ingroup AuthAPI
-void authenticateFixHeader(HttpReply *, Auth::UserRequest::Pointer, HttpRequest *, int, int);
-/// \ingroup AuthAPI
-void authenticateAddTrailer(HttpReply *, Auth::UserRequest::Pointer, HttpRequest *, int);
-
/// \ingroup AuthAPI
void authenticateAuthUserRequestRemoveIp(Auth::UserRequest::Pointer, Ip::Address const &);
/// \ingroup AuthAPI
#endif /* USE_AUTH */
#endif /* SQUID_AUTHUSERREQUEST_H */
+
projects / thirdparty / squid.git / blobdiff