Bug 2519: ssl_bump + Authentication (LDAP Digest) issues

When the ssl_bump and authentication iare both enabled for an ssl-bumped port
all SSL enabled websites prompt the user for authentication information once
per FQDN.

This patch inherits the authentication info from the CONNECT request to the
sslbumped requests.

diff --git a/src/acl/FilledChecklist.cc b/src/acl/FilledChecklist.cc
index e061e8c638cd6a159875590bd38b3e506f3203f2..4c0fdb53799a5d82bee7480e8034d8541debb6ab 100644 (file)
--- a/src/acl/FilledChecklist.cc
+++ b/src/acl/FilledChecklist.cc
@@ -24,8 +24,9 @@ ACLFilledChecklist::checkCallback(allow_t answer)
     if (auth_user_request != NULL) {
         /* the filled_checklist lock */
         auth_user_request = NULL;
-        /* it might have been connection based */
-        if (conn()) {
+        // It might have been connection based
+        // In the case of sslBump we need to preserve authentication info
+        if (conn() && !conn()->switchedToHttps()) {
             conn()->auth_user_request = NULL;
         }
     }

diff --git a/src/auth/Acl.cc b/src/auth/Acl.cc
index 0974f94a795752e724c6910c407ef98867281625..aa8f5946fa112a5ece38744e192148a5ebb32ee9 100644 (file)
--- a/src/auth/Acl.cc
+++ b/src/auth/Acl.cc
@@ -19,6 +19,13 @@ AuthenticateAcl(ACLChecklist *ch)
     if (NULL == request) {
         fatal ("requiresRequest SHOULD have been true for this ACL!!");
         return 0;
+    } else if (request->flags.sslBumped) {
+        debugs(28, 5, "SslBumped request: It is an encapsulated request do not authenticate");
+        checklist->auth_user_request = checklist->conn() != NULL ? checklist->conn()->auth_user_request : request->auth_user_request;
+        if (checklist->auth_user_request != NULL)
+            return 1;
+        else
+            return 0;
     } else if (request->flags.accelerated) {
         /* WWW authorization on accelerated requests */
         headertype = HDR_AUTHORIZATION;

diff --git a/src/client_side.cc b/src/client_side.cc
index 4b3b6f5f79cad842d1b5f1090e9eb90b3998ecb4..8d90adfc57e983e51ec42b57d00557d8c0943ace 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -2547,6 +2547,12 @@ clientProcessRequest(ConnStateData *conn, HttpParser *hp, ClientSocketContext *c
     request->flags.sslBumped = conn->switchedToHttps();
     request->flags.ignore_cc = conn->port->ignore_cc;
     request->flags.no_direct = request->flags.accelerated ? !conn->port->allow_direct : 0;
+#if USE_AUTH
+    if (request->flags.sslBumped) {
+        if (conn->auth_user_request != NULL)
+            request->auth_user_request = conn->auth_user_request;
+    }
+#endif
 
     /** \par
      * If transparent or interception mode is working clone the transparent and interception flags

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index 95934aaaa49564cccfc4f34de8ebef0ca8d9d6f1..80cb800cfbf239acecce0aab94a2e1d32aba3e70 100644 (file)
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -764,7 +764,10 @@ ClientRequestContext::clientAccessCheckDone(const allow_t &answer)
 
         if (require_auth) {
 #if USE_AUTH
-            if (!http->flags.accel) {
+            if (http->request->flags.sslBumped) {
+                /*SSL Bumped request, authentication is not possible*/
+                status = HTTP_FORBIDDEN;
+            } else if (!http->flags.accel) {
                 /* Proxy authorisation needed */
                 status = HTTP_PROXY_AUTHENTICATION_REQUIRED;
             } else {
@@ -1369,6 +1372,11 @@ ClientHttpRequest::sslBumpEstablish(comm_err_t errflag)
         return;
     }
 
+#if USE_AUTH
+    // Preserve authentication info for the ssl-bumped request
+    if (request->auth_user_request != NULL)
+        getConn()->auth_user_request = request->auth_user_request;
+#endif
     getConn()->switchToHttps(request->GetHost());
 }