+/*
+ * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
#include "squid.h"
-#include "auth/basic/auth_basic.h"
+#include "auth/basic/Config.h"
#include "auth/basic/User.h"
#include "auth/basic/UserRequest.h"
#include "auth/QueueNode.h"
#include "auth/State.h"
-#include "charset.h"
#include "Debug.h"
-#include "HelperReply.h"
+#include "format/Format.h"
+#include "helper.h"
+#include "helper/Reply.h"
+#include "HttpRequest.h"
+#include "MemBuf.h"
#include "rfc1738.h"
#include "SquidTime.h"
return 0;
}
+const char *
+Auth::Basic::UserRequest::credentialsStr()
+{
+ Auth::Basic::User const *basic_auth = dynamic_cast<Auth::Basic::User const *>(user().getRaw());
+ if (basic_auth)
+ return basic_auth->passwd;
+ return NULL;
+}
+
/* log a basic user in
*/
void
-Auth::Basic::UserRequest::authenticate(HttpRequest * request, ConnStateData * conn, http_hdr_type type)
+Auth::Basic::UserRequest::authenticate(HttpRequest *, ConnStateData *, Http::HdrType)
{
assert(user() != NULL);
return;
/* are we about to recheck the credentials externally? */
- if ((user()->expiretime + static_cast<Auth::Basic::Config*>(Auth::Config::Find("basic"))->credentialsTTL) <= squid_curtime) {
+ if ((user()->expiretime + static_cast<Auth::Basic::Config*>(Auth::SchemeConfig::Find("basic"))->credentialsTTL) <= squid_curtime) {
debugs(29, 4, HERE << "credentials expired - rechecking");
return;
}
/* Decode now takes care of finding the AuthUser struct in the cache */
/* after external auth occurs anyway */
user()->expiretime = current_time.tv_sec;
-
- return;
}
Auth::Direction
return Auth::CRED_LOOKUP;
case Auth::Ok:
- if (user()->expiretime + static_cast<Auth::Basic::Config*>(Auth::Config::Find("basic"))->credentialsTTL <= squid_curtime)
+ if (user()->expiretime + static_cast<Auth::Basic::Config*>(Auth::SchemeConfig::Find("basic"))->credentialsTTL <= squid_curtime)
return Auth::CRED_LOOKUP;
return Auth::CRED_VALID;
/* send the initial data to a basic authenticator module */
void
-Auth::Basic::UserRequest::module_start(AUTHCB * handler, void *data)
+Auth::Basic::UserRequest::startHelperLookup(HttpRequest *request, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
{
assert(user()->auth_type == Auth::AUTH_BASIC);
Auth::Basic::User *basic_auth = dynamic_cast<Auth::Basic::User *>(user().getRaw());
assert(basic_auth != NULL);
debugs(29, 9, HERE << "'" << basic_auth->username() << ":" << basic_auth->passwd << "'");
- if (static_cast<Auth::Basic::Config*>(Auth::Config::Find("basic"))->authenticateProgram == NULL) {
+ if (static_cast<Auth::Basic::Config*>(Auth::SchemeConfig::Find("basic"))->authenticateProgram == NULL) {
debugs(29, DBG_CRITICAL, "ERROR: No Basic authentication program configured.");
handler(data);
return;
char buf[HELPER_INPUT_BUFFER];
static char usern[HELPER_INPUT_BUFFER];
static char pass[HELPER_INPUT_BUFFER];
- if (static_cast<Auth::Basic::Config*>(user()->config)->utf8) {
- latin1_to_utf8(usern, sizeof(usern), user()->username());
- latin1_to_utf8(pass, sizeof(pass), basic_auth->passwd);
- xstrncpy(usern, rfc1738_escape(usern), sizeof(usern));
- xstrncpy(pass, rfc1738_escape(pass), sizeof(pass));
- } else {
- xstrncpy(usern, rfc1738_escape(user()->username()), sizeof(usern));
- xstrncpy(pass, rfc1738_escape(basic_auth->passwd), sizeof(pass));
- }
- int sz = snprintf(buf, sizeof(buf), "%s %s\n", usern, pass);
+
+ xstrncpy(usern, rfc1738_escape(user()->username()), sizeof(usern));
+ xstrncpy(pass, rfc1738_escape(basic_auth->passwd), sizeof(pass));
+
+ int sz = 0;
+ if (const char *keyExtras = helperRequestKeyExtras(request, al))
+ sz = snprintf(buf, sizeof(buf), "%s %s %s\n", usern, pass, keyExtras);
+ else
+ sz = snprintf(buf, sizeof(buf), "%s %s\n", usern, pass);
+
if (sz<=0) {
debugs(9, DBG_CRITICAL, "ERROR: Basic Authentication Failure. Can not build helper validation request.");
handler(data);
}
void
-Auth::Basic::UserRequest::HandleReply(void *data, const HelperReply &reply)
+Auth::Basic::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
{
Auth::StateData *r = static_cast<Auth::StateData *>(data);
void *cbdata;
assert(r->auth_user_request != NULL);
assert(r->auth_user_request->user()->auth_type == Auth::AUTH_BASIC);
+ // add new helper kv-pair notes to the credentials object
+ // so that any transaction using those credentials can access them
+ static const NotePairs::Names appendables = { SBuf("group"), SBuf("tag") };
+ r->auth_user_request->user()->notes.replaceOrAddOrAppend(&reply.notes, appendables);
+
/* this is okay since we only play with the Auth::Basic::User child fields below
- * and dont pass the pointer itself anywhere */
+ * and do not pass the pointer itself anywhere */
Auth::Basic::User *basic_auth = dynamic_cast<Auth::Basic::User *>(r->auth_user_request->user().getRaw());
assert(basic_auth != NULL);
- if (reply.result == HelperReply::Okay)
+ if (reply.result == Helper::Okay)
basic_auth->credentials(Auth::Ok);
else {
basic_auth->credentials(Auth::Failed);
delete r;
}
+