UserRequest.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 #include "squid.h"
10 #include "AccessLogEntry.h"
11 #include "auth/CredentialsCache.h"
12 #include "auth/ntlm/Config.h"
13 #include "auth/ntlm/User.h"
14 #include "auth/ntlm/UserRequest.h"
15 #include "auth/State.h"
16 #include "cbdata.h"
17 #include "client_side.h"
18 #include "fatal.h"
19 #include "format/Format.h"
20 #include "globals.h"
21 #include "helper.h"
22 #include "helper/Reply.h"
23 #include "http/Stream.h"
24 #include "HttpRequest.h"
25 #include "MemBuf.h"
26 #include "SquidTime.h"
27 
28 Auth::Ntlm::UserRequest::UserRequest() :
29  authserver(nullptr),
30  server_blob(nullptr),
31  client_blob(nullptr),
32  waiting(0),
33  request(nullptr)
34 {}
35 
36 Auth::Ntlm::UserRequest::~UserRequest()
37 {
38  assert(LockCount()==0);
39  safe_free(server_blob);
40  safe_free(client_blob);
41 
42  releaseAuthServer();
43 
44  if (request) {
46  request = NULL;
47  }
48 }
49 
50 const char *
51 Auth::Ntlm::UserRequest::connLastHeader()
52 {
53  return NULL;
54 }
55 
56 int
57 Auth::Ntlm::UserRequest::authenticated() const
58 {
59  if (user() != NULL && user()->credentials() == Auth::Ok) {
60  debugs(29, 9, HERE << "user authenticated.");
61  return 1;
62  }
63 
64  debugs(29, 9, HERE << "user not fully authenticated.");
65  return 0;
66 }
67 
68 const char *
69 Auth::Ntlm::UserRequest::credentialsStr()
70 {
71  static char buf[MAX_AUTHTOKEN_LEN];
72  int printResult;
73  if (user()->credentials() == Auth::Pending) {
74  printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob);
75  } else {
76  printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
77  }
78 
79  // truncation is OK because we are used only for logging
80  if (printResult < 0) {
81  debugs(29, 2, "Can not build ntlm authentication credentials.");
82  buf[0] = '\0';
83  } else if (printResult >= (int)sizeof(buf))
84  debugs(29, 2, "Ntlm authentication credentials truncated.");
85 
86  return buf;
87 }
88 
90 Auth::Ntlm::UserRequest::module_direction()
91 {
92  /* null auth_user is checked for by Auth::UserRequest::direction() */
93 
94  if (waiting || client_blob)
95  return Auth::CRED_LOOKUP; /* need helper response to continue */
96 
97  if (user()->auth_type != Auth::AUTH_NTLM)
98  return Auth::CRED_ERROR;
99 
100  switch (user()->credentials()) {
101 
102  case Auth::Handshake:
103  assert(server_blob);
104  return Auth::CRED_CHALLENGE;
105 
106  case Auth::Ok:
107  return Auth::CRED_VALID;
108 
109  case Auth::Failed:
110  return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
111 
112  default:
113  debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
114  return Auth::CRED_ERROR;
115  }
116 }
117 
118 void
119 Auth::Ntlm::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
120 {
121  static char buf[MAX_AUTHTOKEN_LEN];
122 
123  assert(data);
124  assert(handler);
125 
126  if (static_cast<Auth::Ntlm::Config*>(Auth::SchemeConfig::Find("ntlm"))->authenticateProgram == NULL) {
127  debugs(29, DBG_CRITICAL, "ERROR: NTLM Start: no NTLM program configured.");
128  handler(data);
129  return;
130  }
131 
132  debugs(29, 8, HERE << "credentials state is '" << user()->credentials() << "'");
133 
134  const char *keyExtras = helperRequestKeyExtras(request, al);
135  int printResult = 0;
136  if (user()->credentials() == Auth::Pending) {
137  if (keyExtras)
138  printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
139  else
140  printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
141  } else {
142  if (keyExtras)
143  printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
144  else
145  printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
146  }
147  waiting = 1;
148 
149  if (printResult < 0 || printResult >= (int)sizeof(buf)) {
150  if (printResult < 0)
151  debugs(29, DBG_CRITICAL, "ERROR: Can not build ntlm authentication helper request");
152  else
153  debugs(29, DBG_CRITICAL, "ERROR: Ntlm authentication helper request too big for the " << sizeof(buf) << "-byte buffer.");
154  handler(data);
155  return;
156  }
157 
158  safe_free(client_blob);
159  helperStatefulSubmit(ntlmauthenticators, buf, Auth::Ntlm::UserRequest::HandleReply,
160  new Auth::StateData(this, handler, data), authserver);
161 }
162 
167 void
168 Auth::Ntlm::UserRequest::releaseAuthServer()
169 {
170  if (authserver) {
171  debugs(29, 6, HERE << "releasing NTLM auth server '" << authserver << "'");
172  helperStatefulReleaseServer(authserver);
173  authserver = NULL;
174  } else
175  debugs(29, 6, HERE << "No NTLM auth server to release.");
176 }
177 
178 void
180 {
181  /* Check that we are in the client side, where we can generate
182  * auth challenges */
183 
184  if (conn == NULL || !cbdataReferenceValid(conn)) {
185  user()->credentials(Auth::Failed);
186  debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
187  return;
188  }
189 
190  if (waiting) {
191  debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication waiting for helper reply!");
192  return;
193  }
194 
195  if (server_blob) {
196  debugs(29, 2, HERE << "need to challenge client '" << server_blob << "'!");
197  return;
198  }
199 
200  /* get header */
201  const char *proxy_auth = aRequest->header.getStr(type);
202 
203  /* locate second word */
204  const char *blob = proxy_auth;
205 
206  /* if proxy_auth is actually NULL, we'd better not manipulate it. */
207  if (blob) {
208  while (xisspace(*blob) && *blob)
209  ++blob;
210 
211  while (!xisspace(*blob) && *blob)
212  ++blob;
213 
214  while (xisspace(*blob) && *blob)
215  ++blob;
216  }
217 
218  switch (user()->credentials()) {
219 
220  case Auth::Unchecked:
221  /* we've received a ntlm request. pass to a helper */
222  debugs(29, 9, HERE << "auth state ntlm none. Received blob: '" << proxy_auth << "'");
223  user()->credentials(Auth::Pending);
224  safe_free(client_blob);
225  client_blob=xstrdup(blob);
226  assert(conn->getAuth() == NULL);
227  conn->setAuth(this, "new NTLM handshake request");
228  request = aRequest;
230  break;
231 
232  case Auth::Pending:
233  debugs(29, DBG_IMPORTANT, HERE << "need to ask helper");
234  break;
235 
236  case Auth::Handshake:
237  /* we should have received a blob from the client. Hand it off to
238  * some helper */
239  safe_free(client_blob);
240  client_blob = xstrdup(blob);
241  if (request)
243  request = aRequest;
245  break;
246 
247  case Auth::Ok:
248  fatal("Auth::Ntlm::UserRequest::authenticate: unexpect auth state DONE! Report a bug to the squid developers.\n");
249  break;
250 
251  case Auth::Failed:
252  /* we've failed somewhere in authentication */
253  debugs(29, 9, HERE << "auth state ntlm failed. " << proxy_auth);
254  break;
255  }
256 }
257 
258 void
259 Auth::Ntlm::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
260 {
261  Auth::StateData *r = static_cast<Auth::StateData *>(data);
262 
263  debugs(29, 8, HERE << "helper: '" << reply.whichServer << "' sent us reply=" << reply);
264 
265  if (!cbdataReferenceValid(r->data)) {
266  debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication invalid callback data. helper '" << reply.whichServer << "'.");
267  delete r;
268  return;
269  }
270 
271  Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
272  assert(auth_user_request != NULL);
273 
274  // add new helper kv-pair notes to the credentials object
275  // so that any transaction using those credentials can access them
276  auth_user_request->user()->notes.appendNewOnly(&reply.notes);
277  // remove any private credentials detail which got added.
278  auth_user_request->user()->notes.remove("token");
279 
280  Auth::Ntlm::UserRequest *lm_request = dynamic_cast<Auth::Ntlm::UserRequest *>(auth_user_request.getRaw());
281  assert(lm_request != NULL);
282  assert(lm_request->waiting);
283 
284  lm_request->waiting = 0;
285  safe_free(lm_request->client_blob);
286 
287  assert(auth_user_request->user() != NULL);
288  assert(auth_user_request->user()->auth_type == Auth::AUTH_NTLM);
289 
290  if (lm_request->authserver == NULL)
291  lm_request->authserver = reply.whichServer.get(); // XXX: no locking?
292  else
293  assert(reply.whichServer == lm_request->authserver);
294 
295  switch (reply.result) {
296  case Helper::TT:
297  /* we have been given a blob to send to the client */
298  safe_free(lm_request->server_blob);
299  lm_request->request->flags.mustKeepalive = true;
300  if (lm_request->request->flags.proxyKeepalive) {
301  const char *serverBlob = reply.notes.findFirst("token");
302  lm_request->server_blob = xstrdup(serverBlob);
303  auth_user_request->user()->credentials(Auth::Handshake);
304  auth_user_request->setDenyMessage("Authentication in progress");
305  debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << serverBlob << "'");
306  } else {
307  auth_user_request->user()->credentials(Auth::Failed);
308  auth_user_request->setDenyMessage("NTLM authentication requires a persistent connection");
309  }
310  break;
311 
312  case Helper::Okay: {
313  /* we're finished, release the helper */
314  const char *userLabel = reply.notes.findFirst("user");
315  if (!userLabel) {
316  auth_user_request->user()->credentials(Auth::Failed);
317  safe_free(lm_request->server_blob);
318  lm_request->releaseAuthServer();
319  debugs(29, DBG_CRITICAL, "ERROR: NTLM Authentication helper returned no username. Result: " << reply);
320  break;
321  }
322  auth_user_request->user()->username(userLabel);
323  auth_user_request->setDenyMessage("Login successful");
324  safe_free(lm_request->server_blob);
325  lm_request->releaseAuthServer();
326 
327  debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << userLabel << "'");
328  /* connection is authenticated */
329  debugs(29, 4, HERE << "authenticated user " << auth_user_request->user()->username());
330  /* see if this is an existing user */
331  auto local_auth_user = lm_request->user();
332  auto cached_user = Auth::Ntlm::User::Cache()->lookup(auth_user_request->user()->userKey());
333  if (!cached_user) {
334  local_auth_user->addToNameCache();
335  } else {
336  /* we can't seamlessly recheck the username due to the
337  * challenge-response nature of the protocol.
338  * Just free the temporary auth_user after merging as
339  * much of it new state into the existing one as possible */
340  cached_user->absorb(local_auth_user);
341  /* from here on we are working with the original cached credentials. */
342  local_auth_user = cached_user;
343  auth_user_request->user(local_auth_user);
344  }
345  /* set these to now because this is either a new login from an
346  * existing user or a new user */
347  local_auth_user->expiretime = current_time.tv_sec;
348  auth_user_request->user()->credentials(Auth::Ok);
349  debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << auth_user_request->user()->username() << "'");
350  }
351  break;
352 
353  case Helper::Error:
354  /* authentication failure (wrong password, etc.) */
355  auth_user_request->denyMessageFromHelper("NTLM", reply);
356  auth_user_request->user()->credentials(Auth::Failed);
357  safe_free(lm_request->server_blob);
358  lm_request->releaseAuthServer();
359  debugs(29, 4, "Failed validating user via NTLM. Result: " << reply);
360  break;
361 
362  case Helper::Unknown:
363  debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication Helper '" << reply.whichServer << "' crashed!.");
364  /* continue to the next case */
365 
366  case Helper::TimedOut:
368  /* TODO kick off a refresh process. This can occur after a YR or after
369  * a KK. If after a YR release the helper and resubmit the request via
370  * Authenticate NTLM start.
371  * If after a KK deny the user's request w/ 407 and mark the helper as
372  * Needing YR. */
373  if (reply.result == Helper::Unknown)
374  auth_user_request->setDenyMessage("Internal Error");
375  else
376  auth_user_request->denyMessageFromHelper("NTLM", reply);
377  auth_user_request->user()->credentials(Auth::Failed);
378  safe_free(lm_request->server_blob);
379  lm_request->releaseAuthServer();
380  debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication validating user. Result: " << reply);
381  break;
382  }
383 
384  if (lm_request->request) {
385  HTTPMSGUNLOCK(lm_request->request);
386  lm_request->request = NULL;
387  }
388  r->handler(r->data);
389  delete r;
390 }
391 
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:503
void helperStatefulSubmit(statefulhelper *hlp, const char *buf, HLPCB *callback, void *data, helper_stateful_server *lastserver)
lastserver = "server last used as part of a reserved request sequence"
Definition: helper.cc:490
#define assert(EX)
Definition: assert.h:17
static void authenticate(int socket_fd, const char *username, const char *passwd)
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
#define xstrdup
#define safe_free(x)
Definition: xalloc.h:73
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:154
#define xisspace(x)
Definition: xis.h:17
struct _Cache Cache
Direction
Definition: UserRequest.h:64
#define DBG_CRITICAL
Definition: Debug.h:44
struct timeval current_time
Definition: stub_time.cc:15
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:58
Client needs to be challenged. secure token.
Definition: UserRequest.h:65
void const char HLPCB void * data
Definition: stub_helper.cc:16
NotePairs notes
Definition: Reply.h:61
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Debug.h:123
#define DBG_IMPORTANT
Definition: Debug.h:45
ERROR in the auth module. Cannot determine the state of this request.
Definition: UserRequest.h:68
statefulhelper * ntlmauthenticators
Definition: Config.cc:37
#define MAX_AUTHTOKEN_LEN
void fatal(const char *message)
Definition: fatal.cc:39
CbcPointer< helper_stateful_server > whichServer
for stateful replies the responding helper 'server' needs to be preserved across callbacks ...
Definition: Reply.h:64
static void handler(int signo)
Definition: purge.cc:860
void const char * buf
Definition: stub_helper.cc:16
std::ostream & HERE(std::ostream &s)
Definition: Debug.h:147
static SchemeConfig * Find(const char *proxy_auth)
Definition: SchemeConfig.cc:58
HttpHeader header
Definition: Message.h:74
void helperStatefulReleaseServer(helper_stateful_server *srv)
Definition: helper.cc:539
Credentials are valid and a up to date. The OK/Failed state is accurate.
Definition: UserRequest.h:66
void * data
Definition: State.h:38
static char credentials[MAX_USERNAME_LEN+MAX_DOMAIN_LEN+2]
AUTHCB * handler
Definition: State.h:40
UserRequest::Pointer auth_user_request
Definition: State.h:39
Credentials need to be validated with the backend helper.
Definition: UserRequest.h:67
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:412
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1203
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:263
void AUTHCB(void *)
Definition: UserRequest.h:57
C * getRaw() const
Definition: RefCount.h:74
#define NULL
Definition: types.h:166
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:114
Cbc * get() const
a temporary valid raw Cbc pointer or NULL
Definition: CbcPointer.h:162
void HTTPMSGUNLOCK(Http::Message *a)
Definition: Message.h:144

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors