UserRequest.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2022 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9#include "squid.h"
10#include "AccessLogEntry.h"
13#include "auth/negotiate/User.h"
15#include "auth/State.h"
16#include "auth/User.h"
17#include "client_side.h"
18#include "fatal.h"
19#include "format/Format.h"
20#include "globals.h"
21#include "helper.h"
22#include "helper/Reply.h"
23#include "http/Stream.h"
24#include "HttpHeaderTools.h"
25#include "HttpReply.h"
26#include "HttpRequest.h"
27#include "MemBuf.h"
28
29Auth::Negotiate::UserRequest::UserRequest() :
30 server_blob(nullptr),
31 client_blob(nullptr),
32 waiting(0),
33 request(nullptr)
34{}
35
36Auth::Negotiate::UserRequest::~UserRequest()
37{
38 assert(LockCount()==0);
39 safe_free(server_blob);
40 safe_free(client_blob);
41
42 releaseAuthServer();
43
44 if (request) {
46 request = nullptr;
47 }
48}
49
50const char *
51Auth::Negotiate::UserRequest::connLastHeader()
52{
53 return nullptr;
54}
55
56int
57Auth::Negotiate::UserRequest::authenticated() const
58{
59 if (user() != nullptr && user()->credentials() == Auth::Ok) {
60 debugs(29, 9, "user authenticated.");
61 return 1;
62 }
63
64 debugs(29, 9, "user not fully authenticated.");
65 return 0;
66}
67
68const char *
69Auth::Negotiate::UserRequest::credentialsStr()
70{
71 static char buf[MAX_AUTHTOKEN_LEN];
72 int printResult = 0;
73 if (user()->credentials() == Auth::Pending) {
74 printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
75 } else {
76 printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
77 }
78
79 // truncation is OK because we are used only for logging
80 if (printResult < 0) {
81 debugs(29, 2, "Can not build negotiate authentication credentials.");
82 buf[0] = '\0';
83 } else if (printResult >= (int)sizeof(buf))
84 debugs(29, 2, "Negotiate authentication credentials truncated.");
85
86 return buf;
87}
88
90Auth::Negotiate::UserRequest::module_direction()
91{
92 /* null auth_user is checked for by Auth::UserRequest::direction() */
93
94 if (waiting || client_blob)
95 return Auth::CRED_LOOKUP; /* need helper response to continue */
96
97 if (user()->auth_type != Auth::AUTH_NEGOTIATE)
98 return Auth::CRED_ERROR;
99
100 switch (user()->credentials()) {
101
102 case Auth::Handshake:
103 assert(server_blob);
105
106 case Auth::Ok:
107 return Auth::CRED_VALID;
108
109 case Auth::Failed:
110 return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
111
112 default:
113 debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication in unexpected state: " << user()->credentials());
114 return Auth::CRED_ERROR;
115 }
116}
117
118void
119Auth::Negotiate::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
120{
121 static char buf[MAX_AUTHTOKEN_LEN];
122
123 assert(data);
125
126 assert(user() != nullptr);
127 assert(user()->auth_type == Auth::AUTH_NEGOTIATE);
128
129 if (static_cast<Auth::Negotiate::Config*>(Auth::SchemeConfig::Find("negotiate"))->authenticateProgram == nullptr) {
130 debugs(29, DBG_CRITICAL, "ERROR: No Negotiate authentication program configured.");
131 handler(data);
132 return;
133 }
134
135 debugs(29, 8, "credentials state is '" << user()->credentials() << "'");
136
137 const char *keyExtras = helperRequestKeyExtras(request, al);
138 int printResult = 0;
139 if (user()->credentials() == Auth::Pending) {
140 if (keyExtras)
141 printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
142 else
143 printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
144 } else {
145 if (keyExtras)
146 printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
147 else
148 printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
149 }
150
151 if (printResult < 0 || printResult >= (int)sizeof(buf)) {
152 if (printResult < 0)
153 debugs(29, DBG_CRITICAL, "ERROR: Can not build negotiate authentication helper request");
154 else
155 debugs(29, DBG_CRITICAL, "ERROR: Negotiate authentication helper request too big for the " << sizeof(buf) << "-byte buffer");
156 handler(data);
157 return;
158 }
159
160 waiting = 1;
161
162 safe_free(client_blob);
163
164 helperStatefulSubmit(negotiateauthenticators, buf, Auth::Negotiate::UserRequest::HandleReply,
165 new Auth::StateData(this, handler, data), reservationId);
166}
167
172void
173Auth::Negotiate::UserRequest::releaseAuthServer()
174{
175 if (reservationId) {
176 debugs(29, 6, reservationId);
178 reservationId.clear();
179 } else
180 debugs(29, 6, "No Negotiate auth server to release.");
181}
182
183void
185{
186 /* Check that we are in the client side, where we can generate
187 * auth challenges */
188
189 if (conn == nullptr || !cbdataReferenceValid(conn)) {
190 user()->credentials(Auth::Failed);
191 debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication attempt to perform authentication without a connection!");
192 return;
193 }
194
195 if (waiting) {
196 debugs(29, DBG_IMPORTANT, "WARNING: Negotiate Authentication waiting for helper reply!");
197 return;
198 }
199
200 if (server_blob) {
201 debugs(29, 2, "need to challenge client '" << server_blob << "'!");
202 return;
203 }
204
205 /* get header */
206 const char *proxy_auth = aRequest->header.getStr(type);
207
208 /* locate second word */
209 const char *blob = proxy_auth;
210
211 if (blob) {
212 while (xisspace(*blob) && *blob)
213 ++blob;
214
215 while (!xisspace(*blob) && *blob)
216 ++blob;
217
218 while (xisspace(*blob) && *blob)
219 ++blob;
220 }
221
222 switch (user()->credentials()) {
223
224 case Auth::Unchecked:
225 /* we've received a negotiate request. pass to a helper */
226 debugs(29, 9, "auth state negotiate none. Received blob: '" << proxy_auth << "'");
227 user()->credentials(Auth::Pending);
228 safe_free(client_blob);
229 client_blob=xstrdup(blob);
230 assert(conn->getAuth() == nullptr);
231 conn->setAuth(this, "new Negotiate handshake request");
232 request = aRequest;
234 break;
235
236 case Auth::Pending:
237 debugs(29, DBG_IMPORTANT, "need to ask helper");
238 break;
239
240 case Auth::Handshake:
241 /* we should have received a blob from the client. Hand it off to
242 * some helper */
243 safe_free(client_blob);
244 client_blob = xstrdup(blob);
245 if (request)
247 request = aRequest;
249 break;
250
251 case Auth::Ok:
252 fatal("Auth::Negotiate::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
253 break;
254
255 case Auth::Failed:
256 /* we've failed somewhere in authentication */
257 debugs(29, 9, "auth state negotiate failed. " << proxy_auth);
258 break;
259 }
260}
261
262void
263Auth::Negotiate::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
264{
265 Auth::StateData *r = static_cast<Auth::StateData *>(data);
266
267 debugs(29, 8, reply.reservationId << " got reply=" << reply);
268
269 if (!cbdataReferenceValid(r->data)) {
270 debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication invalid callback data (" << reply.reservationId << ")");
271 delete r;
272 return;
273 }
274
275 Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
276 assert(auth_user_request != nullptr);
277
278 // add new helper kv-pair notes to the credentials object
279 // so that any transaction using those credentials can access them
280 static const NotePairs::Names appendables = { SBuf("group"), SBuf("tag") };
281 auth_user_request->user()->notes.replaceOrAddOrAppend(&reply.notes, appendables);
282 // remove any private credentials detail which got added.
283 auth_user_request->user()->notes.remove("token");
284
285 Auth::Negotiate::UserRequest *lm_request = dynamic_cast<Auth::Negotiate::UserRequest *>(auth_user_request.getRaw());
286 assert(lm_request != nullptr);
287 assert(lm_request->waiting);
288
289 lm_request->waiting = 0;
290 safe_free(lm_request->client_blob);
291
292 assert(auth_user_request->user() != nullptr);
293 assert(auth_user_request->user()->auth_type == Auth::AUTH_NEGOTIATE);
294
295 if (!lm_request->reservationId)
296 lm_request->reservationId = reply.reservationId;
297 else
298 assert(reply.reservationId == lm_request->reservationId);
299
300 switch (reply.result) {
301 case Helper::TT:
302 /* we have been given a blob to send to the client */
303 safe_free(lm_request->server_blob);
304 lm_request->request->flags.mustKeepalive = true;
305 if (lm_request->request->flags.proxyKeepalive) {
306 const char *tokenNote = reply.notes.findFirst("token");
307 lm_request->server_blob = xstrdup(tokenNote);
308 auth_user_request->user()->credentials(Auth::Handshake);
309 auth_user_request->setDenyMessage("Authentication in progress");
310 debugs(29, 4, "Need to challenge the client with a server token: '" << tokenNote << "'");
311 } else {
312 auth_user_request->user()->credentials(Auth::Failed);
313 auth_user_request->setDenyMessage("Negotiate authentication requires a persistent connection");
314 }
315 break;
316
317 case Helper::Okay: {
318 const char *userNote = reply.notes.findFirst("user");
319 const char *tokenNote = reply.notes.findFirst("token");
320 if (userNote == nullptr || tokenNote == nullptr) {
321 // XXX: handle a success with no username better
322 /* protocol error */
323 fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply.other().content());
324 break;
325 }
326
327 /* we're finished, release the helper */
328 auth_user_request->user()->username(userNote);
329 auth_user_request->setDenyMessage("Login successful");
330 safe_free(lm_request->server_blob);
331 lm_request->server_blob = xstrdup(tokenNote);
332 lm_request->releaseAuthServer();
333
334 /* connection is authenticated */
335 debugs(29, 4, "authenticated user " << auth_user_request->user()->username());
336 auto local_auth_user = lm_request->user();
337 auto cached_user = Auth::Negotiate::User::Cache()->lookup(auth_user_request->user()->userKey());
338 if (!cached_user) {
339 local_auth_user->addToNameCache();
340 } else {
341 /* we can't seamlessly recheck the username due to the
342 * challenge-response nature of the protocol.
343 * Just free the temporary auth_user after merging as
344 * much of it new state into the existing one as possible */
345 cached_user->absorb(local_auth_user);
346 /* from here on we are working with the original cached credentials. */
347 local_auth_user = cached_user;
348 auth_user_request->user(local_auth_user);
349 }
350 /* set these to now because this is either a new login from an
351 * existing user or a new user */
352 local_auth_user->expiretime = current_time.tv_sec;
353 auth_user_request->user()->credentials(Auth::Ok);
354 debugs(29, 4, "Successfully validated user via Negotiate. Username '" << auth_user_request->user()->username() << "'");
355 }
356 break;
357
358 case Helper::Error:
359 /* authentication failure (wrong password, etc.) */
360 auth_user_request->denyMessageFromHelper("Negotiate", reply);
361 auth_user_request->user()->credentials(Auth::Failed);
362 safe_free(lm_request->server_blob);
363 if (const char *tokenNote = reply.notes.findFirst("token"))
364 lm_request->server_blob = xstrdup(tokenNote);
365 lm_request->releaseAuthServer();
366 debugs(29, 4, "Failed validating user via Negotiate. Result: " << reply);
367 break;
368
369 case Helper::Unknown:
370 debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication Helper crashed (" << reply.reservationId << ")");
371 /* [[fallthrough]] */
372
373 case Helper::TimedOut:
375 /* TODO kick off a refresh process. This can occur after a YR or after
376 * a KK. If after a YR release the helper and resubmit the request via
377 * Authenticate Negotiate start.
378 * If after a KK deny the user's request w/ 407 and mark the helper as
379 * Needing YR. */
380 if (reply.result == Helper::Unknown)
381 auth_user_request->setDenyMessage("Internal Error");
382 else
383 auth_user_request->denyMessageFromHelper("Negotiate", reply);
384 auth_user_request->user()->credentials(Auth::Failed);
385 safe_free(lm_request->server_blob);
386 lm_request->releaseAuthServer();
387 debugs(29, DBG_IMPORTANT, "ERROR: Negotiate Authentication validating user. Result: " << reply);
388 break;
389 }
390
391 if (lm_request->request) {
392 HTTPMSGUNLOCK(lm_request->request);
393 lm_request->request = nullptr;
394 }
395 r->handler(r->data);
396 delete r;
397}
398
class SquidConfig Config
Definition: SquidConfig.cc:12
int conn
the current server connection FD
Definition: Transport.cc:26
void AUTHCB(void *)
Definition: UserRequest.h:57
#define assert(EX)
Definition: assert.h:19
statefulhelper * negotiateauthenticators
Definition: Config.cc:35
static void authenticate(int socket_fd, const char *username, const char *passwd)
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:398
static SchemeConfig * Find(const char *proxy_auth)
Definition: SchemeConfig.cc:59
UserRequest::Pointer auth_user_request
Definition: State.h:39
AUTHCB * handler
Definition: State.h:40
void * data
Definition: State.h:38
void setDenyMessage(char const *)
Definition: UserRequest.cc:114
void denyMessageFromHelper(char const *proto, const Helper::Reply &reply)
Sets the reason of 'authentication denied' helper response.
Definition: UserRequest.cc:564
virtual User::Pointer user()
Definition: UserRequest.h:143
NotePairs notes
Definition: Reply.h:62
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
const MemBuf & other() const
Definition: Reply.h:42
Helper::ReservationId reservationId
The stateful replies should include the reservation ID.
Definition: Reply.h:65
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1160
HttpHeader header
Definition: Message.h:74
char * content()
start of the added data
Definition: MemBuf.h:41
std::vector< SBuf > Names
Definition: Notes.h:199
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:297
C * getRaw() const
Definition: RefCount.h:80
Definition: SBuf.h:94
void cancelReservation(const Helper::ReservationId reservation)
undo reserveServer(), clear the reservation and kick the queue
Definition: helper.cc:598
#define DBG_IMPORTANT
Definition: Stream.h:41
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Stream.h:196
#define DBG_CRITICAL
Definition: Stream.h:40
int type
Definition: errorpage.cc:152
void fatal(const char *message)
Definition: fatal.cc:28
void fatalf(const char *fmt,...)
Definition: fatal.cc:68
void helperStatefulSubmit(statefulhelper *hlp, const char *buf, HLPCB *callback, void *data, const Helper::ReservationId &reservation)
Definition: helper.cc:567
void HTTPMSGUNLOCK(M *&a)
Definition: Message.h:149
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:160
@ AUTH_NEGOTIATE
Definition: Type.h:22
Direction
Definition: UserRequest.h:64
@ CRED_ERROR
ERROR in the auth module. Cannot determine the state of this request.
Definition: UserRequest.h:68
@ CRED_CHALLENGE
Client needs to be challenged. secure token.
Definition: UserRequest.h:65
@ CRED_LOOKUP
Credentials need to be validated with the backend helper.
Definition: UserRequest.h:67
@ CRED_VALID
Credentials are valid and a up to date. The OK/Failed state is accurate.
Definition: UserRequest.h:66
@ Unknown
Definition: ResultCode.h:17
@ BrokenHelper
Definition: ResultCode.h:20
@ Error
Definition: ResultCode.h:19
@ TimedOut
Definition: ResultCode.h:21
@ Okay
Definition: ResultCode.h:18
#define MAX_AUTHTOKEN_LEN
#define xstrdup
static char credentials[MAX_USERNAME_LEN+MAX_DOMAIN_LEN+2]
static void handler(int signo)
Definition: purge.cc:854
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
struct _Cache Cache
struct timeval current_time
the current UNIX time in timeval {seconds, microseconds} format
Definition: gadgets.cc:17
#define safe_free(x)
Definition: xalloc.h:73
#define xisspace(x)
Definition: xis.h:17

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors