UserRequest.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9#include "squid.h"
10#include "AccessLogEntry.h"
12#include "auth/ntlm/Config.h"
13#include "auth/ntlm/User.h"
15#include "auth/State.h"
16#include "cbdata.h"
17#include "client_side.h"
18#include "fatal.h"
19#include "format/Format.h"
20#include "globals.h"
21#include "helper.h"
22#include "helper/Reply.h"
23#include "http/Stream.h"
24#include "HttpRequest.h"
25#include "MemBuf.h"
26
27Auth::Ntlm::UserRequest::UserRequest() :
28 server_blob(nullptr),
29 client_blob(nullptr),
30 waiting(0),
31 request(nullptr)
32{}
33
34Auth::Ntlm::UserRequest::~UserRequest()
35{
36 assert(LockCount()==0);
37 safe_free(server_blob);
38 safe_free(client_blob);
39
40 releaseAuthServer();
41
42 if (request) {
43 HTTPMSGUNLOCK(request);
44 request = nullptr;
45 }
46}
47
48const char *
49Auth::Ntlm::UserRequest::connLastHeader()
50{
51 return nullptr;
52}
53
54int
55Auth::Ntlm::UserRequest::authenticated() const
56{
57 if (user() != nullptr && user()->credentials() == Auth::Ok) {
58 debugs(29, 9, "user authenticated.");
59 return 1;
60 }
61
62 debugs(29, 9, "user not fully authenticated.");
63 return 0;
64}
65
66const char *
67Auth::Ntlm::UserRequest::credentialsStr()
68{
69 static char buf[MAX_AUTHTOKEN_LEN];
70 int printResult;
71 if (user()->credentials() == Auth::Pending) {
72 printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob);
73 } else {
74 printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
75 }
76
77 // truncation is OK because we are used only for logging
78 if (printResult < 0) {
79 debugs(29, 2, "Can not build ntlm authentication credentials.");
80 buf[0] = '\0';
81 } else if (printResult >= (int)sizeof(buf))
82 debugs(29, 2, "Ntlm authentication credentials truncated.");
83
84 return buf;
85}
86
88Auth::Ntlm::UserRequest::module_direction()
89{
90 /* null auth_user is checked for by Auth::UserRequest::direction() */
91
92 if (waiting || client_blob)
93 return Auth::CRED_LOOKUP; /* need helper response to continue */
94
95 if (user()->auth_type != Auth::AUTH_NTLM)
96 return Auth::CRED_ERROR;
97
98 switch (user()->credentials()) {
99
100 case Auth::Handshake:
101 assert(server_blob);
103
104 case Auth::Ok:
105 return Auth::CRED_VALID;
106
107 case Auth::Failed:
108 return Auth::CRED_ERROR; // XXX: really? not VALID or CHALLENGE?
109
110 default:
111 debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication in unexpected state: " << user()->credentials());
112 return Auth::CRED_ERROR;
113 }
114}
115
116void
117Auth::Ntlm::UserRequest::startHelperLookup(HttpRequest *, AccessLogEntry::Pointer &al, AUTHCB * handler, void *data)
118{
119 static char buf[MAX_AUTHTOKEN_LEN];
120
121 assert(data);
123
124 if (static_cast<Auth::Ntlm::Config*>(Auth::SchemeConfig::Find("ntlm"))->authenticateProgram == nullptr) {
125 debugs(29, DBG_CRITICAL, "ERROR: NTLM Start: no NTLM program configured.");
126 handler(data);
127 return;
128 }
129
130 debugs(29, 8, "credentials state is '" << user()->credentials() << "'");
131
132 const char *keyExtras = helperRequestKeyExtras(request, al);
133 int printResult = 0;
134 if (user()->credentials() == Auth::Pending) {
135 if (keyExtras)
136 printResult = snprintf(buf, sizeof(buf), "YR %s %s\n", client_blob, keyExtras);
137 else
138 printResult = snprintf(buf, sizeof(buf), "YR %s\n", client_blob); //CHECKME: can ever client_blob be 0 here?
139 } else {
140 if (keyExtras)
141 printResult = snprintf(buf, sizeof(buf), "KK %s %s\n", client_blob, keyExtras);
142 else
143 printResult = snprintf(buf, sizeof(buf), "KK %s\n", client_blob);
144 }
145 waiting = 1;
146
147 if (printResult < 0 || printResult >= (int)sizeof(buf)) {
148 if (printResult < 0)
149 debugs(29, DBG_CRITICAL, "ERROR: Can not build ntlm authentication helper request");
150 else
151 debugs(29, DBG_CRITICAL, "ERROR: Ntlm authentication helper request too big for the " << sizeof(buf) << "-byte buffer.");
152 handler(data);
153 return;
154 }
155
156 safe_free(client_blob);
157 helperStatefulSubmit(ntlmauthenticators, buf, Auth::Ntlm::UserRequest::HandleReply,
158 new Auth::StateData(this, handler, data), reservationId);
159}
160
165void
166Auth::Ntlm::UserRequest::releaseAuthServer()
167{
168 if (reservationId) {
169 debugs(29, 6, reservationId);
171 reservationId.clear();
172 } else
173 debugs(29, 6, "No NTLM auth server to release.");
174}
175
176void
178{
179 /* Check that we are in the client side, where we can generate
180 * auth challenges */
181
182 if (conn == nullptr || !cbdataReferenceValid(conn)) {
183 user()->credentials(Auth::Failed);
184 debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication attempt to perform authentication without a connection!");
185 return;
186 }
187
188 if (waiting) {
189 debugs(29, DBG_IMPORTANT, "WARNING: NTLM Authentication waiting for helper reply!");
190 return;
191 }
192
193 if (server_blob) {
194 debugs(29, 2, "need to challenge client '" << server_blob << "'!");
195 return;
196 }
197
198 /* get header */
199 const char *proxy_auth = aRequest->header.getStr(type);
200
201 /* locate second word */
202 const char *blob = proxy_auth;
203
204 /* if proxy_auth is actually NULL, we'd better not manipulate it. */
205 if (blob) {
206 while (xisspace(*blob) && *blob)
207 ++blob;
208
209 while (!xisspace(*blob) && *blob)
210 ++blob;
211
212 while (xisspace(*blob) && *blob)
213 ++blob;
214 }
215
216 switch (user()->credentials()) {
217
218 case Auth::Unchecked:
219 /* we've received a ntlm request. pass to a helper */
220 debugs(29, 9, "auth state ntlm none. Received blob: '" << proxy_auth << "'");
221 user()->credentials(Auth::Pending);
222 safe_free(client_blob);
223 client_blob=xstrdup(blob);
224 assert(conn->getAuth() == nullptr);
225 conn->setAuth(this, "new NTLM handshake request");
226 request = aRequest;
227 HTTPMSGLOCK(request);
228 break;
229
230 case Auth::Pending:
231 debugs(29, DBG_IMPORTANT, "need to ask helper");
232 break;
233
234 case Auth::Handshake:
235 /* we should have received a blob from the client. Hand it off to
236 * some helper */
237 safe_free(client_blob);
238 client_blob = xstrdup(blob);
239 if (request)
240 HTTPMSGUNLOCK(request);
241 request = aRequest;
242 HTTPMSGLOCK(request);
243 break;
244
245 case Auth::Ok:
246 fatal("Auth::Ntlm::UserRequest::authenticate: unexpected auth state DONE! Report a bug to the squid developers.\n");
247 break;
248
249 case Auth::Failed:
250 /* we've failed somewhere in authentication */
251 debugs(29, 9, "auth state ntlm failed. " << proxy_auth);
252 break;
253 }
254}
255
256void
257Auth::Ntlm::UserRequest::HandleReply(void *data, const Helper::Reply &reply)
258{
259 Auth::StateData *r = static_cast<Auth::StateData *>(data);
260
261 debugs(29, 8, reply.reservationId << " got reply=" << reply);
262
263 if (!cbdataReferenceValid(r->data)) {
264 debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication invalid callback data(" << reply.reservationId <<")");
265 delete r;
266 return;
267 }
268
269 Auth::UserRequest::Pointer auth_user_request = r->auth_user_request;
270 assert(auth_user_request != nullptr);
271
272 // add new helper kv-pair notes to the credentials object
273 // so that any transaction using those credentials can access them
274 static const NotePairs::Names appendables = { SBuf("group"), SBuf("tag") };
275 auth_user_request->user()->notes.replaceOrAddOrAppend(&reply.notes, appendables);
276 // remove any private credentials detail which got added.
277 auth_user_request->user()->notes.remove("token");
278
279 Auth::Ntlm::UserRequest *lm_request = dynamic_cast<Auth::Ntlm::UserRequest *>(auth_user_request.getRaw());
280 assert(lm_request != nullptr);
281 assert(lm_request->waiting);
282
283 lm_request->waiting = 0;
284 safe_free(lm_request->client_blob);
285
286 assert(auth_user_request->user() != nullptr);
287 assert(auth_user_request->user()->auth_type == Auth::AUTH_NTLM);
288
289 if (!lm_request->reservationId)
290 lm_request->reservationId = reply.reservationId;
291 else
292 assert(lm_request->reservationId == reply.reservationId);
293
294 switch (reply.result) {
295 case Helper::TT:
296 /* we have been given a blob to send to the client */
297 safe_free(lm_request->server_blob);
298 lm_request->request->flags.mustKeepalive = true;
299 if (lm_request->request->flags.proxyKeepalive) {
300 const char *serverBlob = reply.notes.findFirst("token");
301 lm_request->server_blob = xstrdup(serverBlob);
302 auth_user_request->user()->credentials(Auth::Handshake);
303 auth_user_request->setDenyMessage("Authentication in progress");
304 debugs(29, 4, "Need to challenge the client with a server token: '" << serverBlob << "'");
305 } else {
306 auth_user_request->user()->credentials(Auth::Failed);
307 auth_user_request->setDenyMessage("NTLM authentication requires a persistent connection");
308 }
309 break;
310
311 case Helper::Okay: {
312 /* we're finished, release the helper */
313 const char *userLabel = reply.notes.findFirst("user");
314 if (!userLabel) {
315 auth_user_request->user()->credentials(Auth::Failed);
316 safe_free(lm_request->server_blob);
317 lm_request->releaseAuthServer();
318 debugs(29, DBG_CRITICAL, "ERROR: NTLM Authentication helper returned no username. Result: " << reply);
319 break;
320 }
321 auth_user_request->user()->username(userLabel);
322 auth_user_request->setDenyMessage("Login successful");
323 safe_free(lm_request->server_blob);
324 lm_request->releaseAuthServer();
325
326 debugs(29, 4, "Successfully validated user via NTLM. Username '" << userLabel << "'");
327 /* connection is authenticated */
328 debugs(29, 4, "authenticated user " << auth_user_request->user()->username());
329 /* see if this is an existing user */
330 auto local_auth_user = lm_request->user();
331 auto cached_user = Auth::Ntlm::User::Cache()->lookup(auth_user_request->user()->userKey());
332 if (!cached_user) {
333 local_auth_user->addToNameCache();
334 } else {
335 /* we can't seamlessly recheck the username due to the
336 * challenge-response nature of the protocol.
337 * Just free the temporary auth_user after merging as
338 * much of it new state into the existing one as possible */
339 cached_user->absorb(local_auth_user);
340 /* from here on we are working with the original cached credentials. */
341 local_auth_user = cached_user;
342 auth_user_request->user(local_auth_user);
343 }
344 /* set these to now because this is either a new login from an
345 * existing user or a new user */
346 local_auth_user->expiretime = current_time.tv_sec;
347 auth_user_request->user()->credentials(Auth::Ok);
348 debugs(29, 4, "Successfully validated user via NTLM. Username '" << auth_user_request->user()->username() << "'");
349 }
350 break;
351
352 case Helper::Error:
353 /* authentication failure (wrong password, etc.) */
354 auth_user_request->denyMessageFromHelper("NTLM", reply);
355 auth_user_request->user()->credentials(Auth::Failed);
356 safe_free(lm_request->server_blob);
357 lm_request->releaseAuthServer();
358 debugs(29, 4, "Failed validating user via NTLM. Result: " << reply);
359 break;
360
361 case Helper::Unknown:
362 debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication Helper crashed (" << reply.reservationId << ")");
363 [[fallthrough]];
364
365 case Helper::TimedOut:
367 /* TODO kick off a refresh process. This can occur after a YR or after
368 * a KK. If after a YR release the helper and resubmit the request via
369 * Authenticate NTLM start.
370 * If after a KK deny the user's request w/ 407 and mark the helper as
371 * Needing YR. */
372 if (reply.result == Helper::Unknown)
373 auth_user_request->setDenyMessage("Internal Error");
374 else
375 auth_user_request->denyMessageFromHelper("NTLM", reply);
376 auth_user_request->user()->credentials(Auth::Failed);
377 safe_free(lm_request->server_blob);
378 lm_request->releaseAuthServer();
379 debugs(29, DBG_IMPORTANT, "ERROR: NTLM Authentication validating user. Result: " << reply);
380 break;
381 }
382
383 if (lm_request->request) {
384 HTTPMSGUNLOCK(lm_request->request);
385 lm_request->request = nullptr;
386 }
387 r->handler(r->data);
388 delete r;
389}
390
class SquidConfig Config
Definition: SquidConfig.cc:12
int conn
the current server connection FD
Definition: Transport.cc:26
void AUTHCB(void *)
Definition: UserRequest.h:57
#define assert(EX)
Definition: assert.h:17
Helper::StatefulClientPointer ntlmauthenticators
Definition: Config.cc:36
static void authenticate(int socket_fd, const char *username, const char *passwd)
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:265
static SchemeConfig * Find(const char *proxy_auth)
Definition: SchemeConfig.cc:59
UserRequest::Pointer auth_user_request
Definition: State.h:39
AUTHCB * handler
Definition: State.h:40
void * data
Definition: State.h:38
void setDenyMessage(char const *)
Definition: UserRequest.cc:114
void denyMessageFromHelper(char const *proto, const Helper::Reply &reply)
Sets the reason of 'authentication denied' helper response.
Definition: UserRequest.cc:564
virtual User::Pointer user()
Definition: UserRequest.h:143
NotePairs notes
Definition: Reply.h:62
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
Helper::ReservationId reservationId
The stateful replies should include the reservation ID.
Definition: Reply.h:65
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1164
HttpHeader header
Definition: Message.h:74
std::vector< SBuf > Names
Definition: Notes.h:199
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:297
C * getRaw() const
Definition: RefCount.h:89
Definition: SBuf.h:94
void cancelReservation(const Helper::ReservationId reservation)
undo reserveServer(), clear the reservation and kick the queue
Definition: helper.cc:617
#define DBG_IMPORTANT
Definition: Stream.h:38
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Stream.h:194
#define DBG_CRITICAL
Definition: Stream.h:37
void fatal(const char *message)
Definition: fatal.cc:28
void helperStatefulSubmit(const statefulhelper::Pointer &hlp, const char *buf, HLPCB *callback, void *data, const Helper::ReservationId &reservation)
Definition: helper.cc:586
void HTTPMSGUNLOCK(M *&a)
Definition: Message.h:150
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:161
@ AUTH_NTLM
Definition: Type.h:20
Direction
Definition: UserRequest.h:64
@ CRED_ERROR
ERROR in the auth module. Cannot determine the state of this request.
Definition: UserRequest.h:68
@ CRED_CHALLENGE
Client needs to be challenged. secure token.
Definition: UserRequest.h:65
@ CRED_LOOKUP
Credentials need to be validated with the backend helper.
Definition: UserRequest.h:67
@ CRED_VALID
Credentials are valid and a up to date. The OK/Failed state is accurate.
Definition: UserRequest.h:66
@ Unknown
Definition: ResultCode.h:17
@ BrokenHelper
Definition: ResultCode.h:20
@ Error
Definition: ResultCode.h:19
@ TimedOut
Definition: ResultCode.h:21
@ Okay
Definition: ResultCode.h:18
#define MAX_AUTHTOKEN_LEN
#define xstrdup
static char credentials[MAX_USERNAME_LEN+MAX_DOMAIN_LEN+2]
static void handler(int signo)
Definition: purge.cc:858
struct _Cache Cache
struct timeval current_time
the current UNIX time in timeval {seconds, microseconds} format
Definition: gadgets.cc:17
#define safe_free(x)
Definition: xalloc.h:73
#define xisspace(x)
Definition: xis.h:15

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors