UserRequest.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 #include "squid.h"
10 #include "AccessLogEntry.h"
11 #include "auth/CredentialsCache.h"
12 #include "auth/negotiate/Config.h"
13 #include "auth/negotiate/User.h"
15 #include "auth/State.h"
16 #include "auth/User.h"
17 #include "client_side.h"
18 #include "fatal.h"
19 #include "format/Format.h"
20 #include "globals.h"
21 #include "helper.h"
22 #include "helper/Reply.h"
23 #include "http/Stream.h"
24 #include "HttpHeaderTools.h"
25 #include "HttpReply.h"
26 #include "HttpRequest.h"
27 #include "MemBuf.h"
28 #include "SquidTime.h"
29 
30 Auth::Negotiate::UserRequest::UserRequest() :
31  authserver(nullptr),
32  server_blob(nullptr),
33  client_blob(nullptr),
34  waiting(0),
35  request(nullptr)
36 {}
37 
38 Auth::Negotiate::UserRequest::~UserRequest()
39 {
40  assert(LockCount()==0);
41  safe_free(server_blob);
42  safe_free(client_blob);
43 
44  releaseAuthServer();
45 
46  if (request) {
48  request = NULL;
49  }
50 }
51 
52 const char *
53 Auth::Negotiate::UserRequest::connLastHeader()
54 {
55  return NULL;
56 }
57 
58 int
59 Auth::Negotiate::UserRequest::authenticated() const
60 {
61  if (user() != NULL && user()->credentials() == Auth::Ok) {
62  debugs(29, 9, HERE << "user authenticated.");
63  return 1;
64  }
65 
66  debugs(29, 9, HERE << "user not fully authenticated.");
67  return 0;
68 }
69 
70 const char *
71 Auth::Negotiate::UserRequest::credentialsStr()
72 {
73  static char buf[MAX_AUTHTOKEN_LEN];
74  int printResult = 0;
75  if (user()->credentials() == Auth::Pending) {
76  printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
77  } else {
78  printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
79  }
80 
81  // truncation is OK because we are used only for logging
82  if (printResult < 0) {
83  debugs(29, 2, "Can not build negotiate authentication credentials.");
84  buf[0] = '\0';
85  } else if (printResult >= (int)sizeof(buf))
86  debugs(29, 2, "Negotiate authentication credentials truncated.");
87 
88  return buf;
89 }
90 
92 Auth::Negotiate::UserRequest::module_direction()
93 {
94  /* null auth_user is checked for by Auth::UserRequest::direction() */
95 
96  if (waiting || client_blob)
97  return Auth::CRED_LOOKUP; /* need helper response to continue */
98 
99  if (user()->auth_type != Auth::AUTH_NEGOTIATE)
100  return Auth::CRED_ERROR;
101 
102  switch (user()->credentials()) {
103 
104  case Auth::Handshake:
105  assert(server_blob);
106  return Auth::CRED_CHALLENGE;
107 
108  case Auth::Ok:
109  return Auth::CRED_VALID;
110 
111  case Auth::Failed:
112  return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
113 
114  default:
115  debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication in unexpected state: " << user()->credentials());
116  return Auth::CRED_ERROR;
117  }
118 }
119 
120 void
121 Auth::Negotiate::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
122 {
123  static char buf[MAX_AUTHTOKEN_LEN];
124 
125  assert(data);
126  assert(handler);
127 
128  assert(user() != NULL);
129  assert(user()->auth_type == Auth::AUTH_NEGOTIATE);
130 
131  if (static_cast<Auth::Negotiate::Config*>(Auth::SchemeConfig::Find("negotiate"))->authenticateProgram == NULL) {
132  debugs(29, DBG_CRITICAL, "ERROR: No Negotiate authentication program configured.");
133  handler(data);
134  return;
135  }
136 
137  debugs(29, 8, HERE << "credentials state is '" << user()->credentials() << "'");
138 
139  const char *keyExtras = helperRequestKeyExtras(request, al);
140  int printResult = 0;
141  if (user()->credentials() == Auth::Pending) {
142  if (keyExtras)
143  printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
144  else
145  printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
146  } else {
147  if (keyExtras)
148  printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
149  else
150  printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
151  }
152 
153  if (printResult < 0 || printResult >= (int)sizeof(buf)) {
154  if (printResult < 0)
155  debugs(29, DBG_CRITICAL, "ERROR: Can not build negotiate authentication helper request");
156  else
157  debugs(29, DBG_CRITICAL, "ERROR: Negotiate authentication helper request too big for the " << sizeof(buf) << "-byte buffer");
158  handler(data);
159  return;
160  }
161 
162  waiting = 1;
163 
164  safe_free(client_blob);
165 
166  helperStatefulSubmit(negotiateauthenticators, buf, Auth::Negotiate::UserRequest::HandleReply,
167  new Auth::StateData(this, handler, data), authserver);
168 }
169 
174 void
175 Auth::Negotiate::UserRequest::releaseAuthServer()
176 {
177  if (authserver) {
178  debugs(29, 6, HERE << "releasing Negotiate auth server '" << authserver << "'");
179  helperStatefulReleaseServer(authserver);
180  authserver = NULL;
181  } else
182  debugs(29, 6, HERE << "No Negotiate auth server to release.");
183 }
184 
185 void
187 {
188  /* Check that we are in the client side, where we can generate
189  * auth challenges */
190 
191  if (conn == NULL || !cbdataReferenceValid(conn)) {
192  user()->credentials(Auth::Failed);
193  debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication attempt to perform authentication without a connection!");
194  return;
195  }
196 
197  if (waiting) {
198  debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication waiting for helper reply!");
199  return;
200  }
201 
202  if (server_blob) {
203  debugs(29, 2, HERE << "need to challenge client '" << server_blob << "'!");
204  return;
205  }
206 
207  /* get header */
208  const char *proxy_auth = aRequest->header.getStr(type);
209 
210  /* locate second word */
211  const char *blob = proxy_auth;
212 
213  if (blob) {
214  while (xisspace(*blob) && *blob)
215  ++blob;
216 
217  while (!xisspace(*blob) && *blob)
218  ++blob;
219 
220  while (xisspace(*blob) && *blob)
221  ++blob;
222  }
223 
224  switch (user()->credentials()) {
225 
226  case Auth::Unchecked:
227  /* we've received a negotiate request. pass to a helper */
228  debugs(29, 9, HERE << "auth state negotiate none. Received blob: '" << proxy_auth << "'");
229  user()->credentials(Auth::Pending);
230  safe_free(client_blob);
231  client_blob=xstrdup(blob);
232  assert(conn->getAuth() == NULL);
233  conn->setAuth(this, "new Negotiate handshake request");
234  request = aRequest;
236  break;
237 
238  case Auth::Pending:
239  debugs(29, DBG_IMPORTANT, HERE << "need to ask helper");
240  break;
241 
242  case Auth::Handshake:
243  /* we should have received a blob from the client. Hand it off to
244  * some helper */
245  safe_free(client_blob);
246  client_blob = xstrdup(blob);
247  if (request)
249  request = aRequest;
251  break;
252 
253  case Auth::Ok:
254  fatal("Auth::Negotiate::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
255  break;
256 
257  case Auth::Failed:
258  /* we've failed somewhere in authentication */
259  debugs(29, 9, HERE << "auth state negotiate failed. " << proxy_auth);
260  break;
261  }
262 }
263 
264 void
265 Auth::Negotiate::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
266 {
267  Auth::StateData *r = static_cast<Auth::StateData *>(data);
268 
269  debugs(29, 8, HERE << "helper: '" << reply.whichServer << "' sent us reply=" << reply);
270 
271  if (!cbdataReferenceValid(r->data)) {
272  debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication invalid callback data. helper '" << reply.whichServer << "'.");
273  delete r;
274  return;
275  }
276 
277  Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
278  assert(auth_user_request != NULL);
279 
280  // add new helper kv-pair notes to the credentials object
281  // so that any transaction using those credentials can access them
282  auth_user_request->user()->notes.appendNewOnly(&reply.notes);
283  // remove any private credentials detail which got added.
284  auth_user_request->user()->notes.remove("token");
285 
286  Auth::Negotiate::UserRequest *lm_request = dynamic_cast<Auth::Negotiate::UserRequest *>(auth_user_request.getRaw());
287  assert(lm_request != NULL);
288  assert(lm_request->waiting);
289 
290  lm_request->waiting = 0;
291  safe_free(lm_request->client_blob);
292 
293  assert(auth_user_request->user() != NULL);
294  assert(auth_user_request->user()->auth_type == Auth::AUTH_NEGOTIATE);
295 
296  if (lm_request->authserver == NULL)
297  lm_request->authserver = reply.whichServer.get(); // XXX: no locking?
298  else
299  assert(reply.whichServer == lm_request->authserver);
300 
301  switch (reply.result) {
302  case Helper::TT:
303  /* we have been given a blob to send to the client */
304  safe_free(lm_request->server_blob);
305  lm_request->request->flags.mustKeepalive = true;
306  if (lm_request->request->flags.proxyKeepalive) {
307  const char *tokenNote = reply.notes.findFirst("token");
308  lm_request->server_blob = xstrdup(tokenNote);
309  auth_user_request->user()->credentials(Auth::Handshake);
310  auth_user_request->setDenyMessage("Authentication in progress");
311  debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << tokenNote << "'");
312  } else {
313  auth_user_request->user()->credentials(Auth::Failed);
314  auth_user_request->setDenyMessage("Negotiate authentication requires a persistent connection");
315  }
316  break;
317 
318  case Helper::Okay: {
319  const char *userNote = reply.notes.findFirst("user");
320  const char *tokenNote = reply.notes.findFirst("token");
321  if (userNote == NULL || tokenNote == NULL) {
322  // XXX: handle a success with no username better
323  /* protocol error */
324  fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply.other().content());
325  break;
326  }
327 
328  /* we're finished, release the helper */
329  auth_user_request->user()->username(userNote);
330  auth_user_request->setDenyMessage("Login successful");
331  safe_free(lm_request->server_blob);
332  lm_request->server_blob = xstrdup(tokenNote);
333  lm_request->releaseAuthServer();
334 
335  /* connection is authenticated */
336  debugs(29, 4, HERE << "authenticated user " << auth_user_request->user()->username());
337  auto local_auth_user = lm_request->user();
338  auto cached_user = Auth::Negotiate::User::Cache()->lookup(auth_user_request->user()->userKey());
339  if (!cached_user) {
340  local_auth_user->addToNameCache();
341  } else {
342  /* we can't seamlessly recheck the username due to the
343  * challenge-response nature of the protocol.
344  * Just free the temporary auth_user after merging as
345  * much of it new state into the existing one as possible */
346  cached_user->absorb(local_auth_user);
347  /* from here on we are working with the original cached credentials. */
348  local_auth_user = cached_user;
349  auth_user_request->user(local_auth_user);
350  }
351  /* set these to now because this is either a new login from an
352  * existing user or a new user */
353  local_auth_user->expiretime = current_time.tv_sec;
354  auth_user_request->user()->credentials(Auth::Ok);
355  debugs(29, 4, HERE << "Successfully validated user via Negotiate. Username '" << auth_user_request->user()->username() << "'");
356  }
357  break;
358 
359  case Helper::Error:
360  /* authentication failure (wrong password, etc.) */
361  auth_user_request->denyMessageFromHelper("Negotiate", reply);
362  auth_user_request->user()->credentials(Auth::Failed);
363  safe_free(lm_request->server_blob);
364  if (const char *tokenNote = reply.notes.findFirst("token"))
365  lm_request->server_blob = xstrdup(tokenNote);
366  lm_request->releaseAuthServer();
367  debugs(29, 4, "Failed validating user via Negotiate. Result: " << reply);
368  break;
369 
370  case Helper::Unknown:
371  debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication Helper '" << reply.whichServer << "' crashed!.");
372  /* continue to the next case */
373 
374  case Helper::TimedOut:
376  /* TODO kick off a refresh process. This can occur after a YR or after
377  * a KK. If after a YR release the helper and resubmit the request via
378  * Authenticate Negotiate start.
379  * If after a KK deny the user's request w/ 407 and mark the helper as
380  * Needing YR. */
381  if (reply.result == Helper::Unknown)
382  auth_user_request->setDenyMessage("Internal Error");
383  else
384  auth_user_request->denyMessageFromHelper("Negotiate", reply);
385  auth_user_request->user()->credentials(Auth::Failed);
386  safe_free(lm_request->server_blob);
387  lm_request->releaseAuthServer();
388  debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication validating user. Result: " << reply);
389  break;
390  }
391 
392  if (lm_request->request) {
393  HTTPMSGUNLOCK(lm_request->request);
394  lm_request->request = NULL;
395  }
396  r->handler(r->data);
397  delete r;
398 }
399 
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:503
void helperStatefulSubmit(statefulhelper *hlp, const char *buf, HLPCB *callback, void *data, helper_stateful_server *lastserver)
lastserver = "server last used as part of a reserved request sequence"
Definition: helper.cc:490
#define assert(EX)
Definition: assert.h:17
static void authenticate(int socket_fd, const char *username, const char *passwd)
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
#define xstrdup
#define safe_free(x)
Definition: xalloc.h:73
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:154
#define xisspace(x)
Definition: xis.h:17
struct _Cache Cache
Direction
Definition: UserRequest.h:64
#define DBG_CRITICAL
Definition: Debug.h:44
struct timeval current_time
Definition: stub_time.cc:15
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:58
void fatalf(const char *fmt,...)
Definition: fatal.cc:79
Client needs to be challenged. secure token.
Definition: UserRequest.h:65
void const char HLPCB void * data
Definition: stub_helper.cc:16
NotePairs notes
Definition: Reply.h:61
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Debug.h:123
#define DBG_IMPORTANT
Definition: Debug.h:45
ERROR in the auth module. Cannot determine the state of this request.
Definition: UserRequest.h:68
#define MAX_AUTHTOKEN_LEN
void fatal(const char *message)
Definition: fatal.cc:39
CbcPointer< helper_stateful_server > whichServer
for stateful replies the responding helper 'server' needs to be preserved across callbacks ...
Definition: Reply.h:64
static void handler(int signo)
Definition: purge.cc:860
char * content()
start of the added data
Definition: MemBuf.h:41
void const char * buf
Definition: stub_helper.cc:16
std::ostream & HERE(std::ostream &s)
Definition: Debug.h:147
static SchemeConfig * Find(const char *proxy_auth)
Definition: SchemeConfig.cc:58
HttpHeader header
Definition: Message.h:74
void helperStatefulReleaseServer(helper_stateful_server *srv)
Definition: helper.cc:539
const MemBuf & other() const
Definition: Reply.h:41
Credentials are valid and a up to date. The OK/Failed state is accurate.
Definition: UserRequest.h:66
void * data
Definition: State.h:38
static char credentials[MAX_USERNAME_LEN+MAX_DOMAIN_LEN+2]
AUTHCB * handler
Definition: State.h:40
UserRequest::Pointer auth_user_request
Definition: State.h:39
Credentials need to be validated with the backend helper.
Definition: UserRequest.h:67
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:412
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1203
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:263
void AUTHCB(void *)
Definition: UserRequest.h:57
C * getRaw() const
Definition: RefCount.h:74
statefulhelper * negotiateauthenticators
Definition: Config.cc:36
#define NULL
Definition: types.h:166
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:114
Cbc * get() const
a temporary valid raw Cbc pointer or NULL
Definition: CbcPointer.h:162
void HTTPMSGUNLOCK(Http::Message *a)
Definition: Message.h:144

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors