auth_basic.c

一个功能非常全面的代理服务器源代码程序,

/*
 * $Id: auth_basic.c,v 1.25 2006/07/30 23:27:04 hno Exp $
 *
 * DEBUG: section 29    Authenticator
 * AUTHOR: Duane Wessels
 *
 * SQUID Web Proxy Cache          http://www.squid-cache.org/
 * ----------------------------------------------------------
 *
 *  Squid is the result of efforts by numerous individuals from
 *  the Internet community; see the CONTRIBUTORS file for full
 *  details.   Many organizations have provided support for Squid's
 *  development; see the SPONSORS file for full details.  Squid is
 *  Copyrighted (C) 2001 by the Regents of the University of
 *  California; see the COPYRIGHT file for full details.  Squid
 *  incorporates software developed and/or copyrighted by other
 *  sources; see the CREDITS file for full details.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *  
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *  
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
 *
 */

/* The functions in this file handle authentication.
 * They DO NOT perform access control or auditing.
 * See acl.c for access control and client_side.c for auditing */


#include "squid.h"
#include "auth_basic.h"

static void
authenticateStateFree(authenticateStateData * r)
{
    if (r->auth_user_request) {
	authenticateAuthUserRequestUnlock(r->auth_user_request);
	r->auth_user_request = NULL;
    }
    cbdataFree(r);
}

/* Basic Scheme */

static HLPCB authenticateBasicHandleReply;
static AUTHSACTIVE authenticateBasicActive;
static AUTHSAUTHED authenticateBasicAuthenticated;
static AUTHSAUTHUSER authenticateBasicAuthenticateUser;
static AUTHSCONFIGURED authBasicConfigured;
static AUTHSDIRECTION authenticateBasicDirection;
static AUTHSDECODE authenticateBasicDecodeAuth;
static AUTHSDUMP authBasicCfgDump;
static AUTHSFIXERR authenticateBasicFixErrorHeader;
static AUTHSFREE authenticateBasicFreeUser;
static AUTHSFREECONFIG authBasicFreeConfig;
static AUTHSPARSE authBasicParse;
static AUTHSCHECKCONFIG authBasicCheckConfig;
static AUTHSINIT authBasicInit;
static AUTHSSTART authenticateBasicStart;
static AUTHSSTATS authenticateBasicStats;
static AUTHSUSERNAME authenticateBasicUsername;
static AUTHSSHUTDOWN authBasicDone;

static helper *basicauthenticators = NULL;

static auth_basic_config *basicConfig = NULL;

static int authbasic_initialised = 0;
MemPool *basic_data_pool = NULL;


/*
 *
 * Public Functions
 *
 */

AUTHSSETUP authSchemeSetup_basic;

void
authSchemeSetup_basic(authscheme_entry_t * authscheme)
{
    assert(!authbasic_initialised);
    authscheme->Active = authenticateBasicActive;
    authscheme->parse = authBasicParse;
    authscheme->checkconfig = authBasicCheckConfig;
    authscheme->dump = authBasicCfgDump;
    authscheme->init = authBasicInit;
    authscheme->authAuthenticate = authenticateBasicAuthenticateUser;
    authscheme->authenticated = authenticateBasicAuthenticated;
    authscheme->configured = authBasicConfigured;
    authscheme->authFixHeader = authenticateBasicFixErrorHeader;
    authscheme->FreeUser = authenticateBasicFreeUser;
    authscheme->freeconfig = authBasicFreeConfig;
    authscheme->authStart = authenticateBasicStart;
    authscheme->authStats = authenticateBasicStats;
    authscheme->authUserUsername = authenticateBasicUsername;
    authscheme->getdirection = authenticateBasicDirection;
    authscheme->oncloseconnection = NULL;
    authscheme->decodeauth = authenticateBasicDecodeAuth;
    authscheme->donefunc = authBasicDone;
    authscheme->authConnLastHeader = NULL;
}

/* internal functions */

static void
authBasicDone(void)
{
    if (basicauthenticators)
	helperShutdown(basicauthenticators);
    authbasic_initialised = 0;
    if (!shutting_down)
	return;
    if (basicauthenticators)
	helperFree(basicauthenticators);
    basicauthenticators = NULL;
    if (basic_data_pool) {
	memPoolDestroy(basic_data_pool);
	basic_data_pool = NULL;
    }
    debug(29, 2) ("authBasicDone: Basic authentication Shutdown.\n");
}

static int
authenticateBasicActive()
{
    return (authbasic_initialised == 1) ? 1 : 0;
}

static int
authBasicConfigured()
{
    if ((basicConfig != NULL) && (basicConfig->authenticate != NULL) &&
	(basicConfig->authenticateChildren != 0) &&
	(basicConfig->basicAuthRealm != NULL)) {
	debug(29, 9) ("authBasicConfigured: returning configured\n");
	return 1;
    }
    debug(29, 9) ("authBasicConfigured: returning unconfigured\n");
    return 0;
}

static int
authenticateBasicAuthenticated(auth_user_request_t * auth_user_request)
{
    basic_data *basic_auth = auth_user_request->auth_user->scheme_data;
    if ((basic_auth->flags.credentials_ok == 1) && (basic_auth->credentials_checkedtime + basicConfig->credentialsTTL > squid_curtime))
	return 1;
    debug(29, 4) ("User not authenticated or credentials need rechecking.\n");
    return 0;
}

#if UNUSED_CODE
static int
authenticateBasiccmpUsername(basic_data * u1, basic_data * u2)
{
    return strcmp(u1->username, u2->username);
}
#endif

/* log a basic user in
 */
static void
authenticateBasicAuthenticateUser(auth_user_request_t * auth_user_request, request_t * request, ConnStateData * conn, http_hdr_type type)
{
    auth_user_t *auth_user;
    basic_data *basic_auth;

    assert(auth_user_request->auth_user != NULL);
    auth_user = auth_user_request->auth_user;

    assert(auth_user->scheme_data != NULL);
    basic_auth = auth_user->scheme_data;

    /* if the password is not ok, do an identity */
    if (basic_auth->flags.credentials_ok != 1)
	return;

    /* are we about to recheck the credentials externally? */
    if ((basic_auth->credentials_checkedtime + basicConfig->credentialsTTL) <= squid_curtime) {
	debug(29, 4) ("authBasicAuthenticate: credentials expired - rechecking\n");
	return;
    }
    /* we have been through the external helper, and the credentials haven't expired */
    debug(29, 9) ("authenticateBasicAuthenticateuser: user '%s' authenticated\n",
	basic_auth->username);

    /* Decode now takes care of finding the auth_user struct in the cache */
    /* after external auth occurs anyway */
    auth_user->expiretime = current_time.tv_sec;
    return;
}

int
authenticateBasicDirection(auth_user_request_t * auth_user_request)
{
/* null auth_user is checked for by authenticateDirection */
    auth_user_t *auth_user = auth_user_request->auth_user;
    basic_data *basic_auth = auth_user->scheme_data;
    switch (basic_auth->flags.credentials_ok) {
    case 0:			/* not checked */
	return -1;
    case 1:			/* checked & ok */
	if (basic_auth->credentials_checkedtime + basicConfig->credentialsTTL <= squid_curtime)
	    return -1;
	return 0;
    case 2:			/* paused while waiting for a username:password check on another request */
	return -1;
    case 3:			/* authentication process failed. */
	return 0;
    }
    return -2;
}

void
authenticateBasicFixErrorHeader(auth_user_request_t * auth_user_request, HttpReply * rep, http_hdr_type type, request_t * request)
{
    if (basicConfig->authenticate) {
	debug(29, 9) ("authenticateFixErrorHeader: Sending type:%d header: 'Basic realm=\"%s\"'\n", type, basicConfig->basicAuthRealm);
	httpHeaderPutStrf(&rep->header, type, "Basic realm=\"%s\"", basicConfig->basicAuthRealm);
    }
}

/* free any allocated configuration details */
void
authBasicFreeConfig(authScheme * scheme)
{
    if (basicConfig == NULL)
	return;
    assert(basicConfig == scheme->scheme_data);
    if (basicConfig->authenticate)
	wordlistDestroy(&basicConfig->authenticate);
    if (basicConfig->basicAuthRealm)
	safe_free(basicConfig->basicAuthRealm);
    xfree(basicConfig);
    basicConfig = NULL;
}

void
authenticateBasicFreeUser(auth_user_t * auth_user)
{
    basic_data *basic_auth = auth_user->scheme_data;
    debug(29, 5) ("authenticateBasicFreeUser: Clearing Basic scheme data\n");
    if (basic_auth->username)
	xfree(basic_auth->username);
    if (basic_auth->passwd)
	xfree(basic_auth->passwd);
    memPoolFree(basic_data_pool, auth_user->scheme_data);
    auth_user->scheme_data = NULL;
}

static void
authenticateBasicHandleReply(void *data, char *reply)
{
    authenticateStateData *r = data;
    auth_user_t *auth_user;
    basic_data *basic_auth;
    auth_basic_queue_node *tmpnode;
    int valid;
    char *t = NULL;
    debug(29, 9) ("authenticateBasicHandleReply: {%s}\n", reply ? reply : "<NULL>");
    if (reply) {
	if ((t = strchr(reply, ' ')))
	    *t++ = '\0';
	if (*reply == '\0')
	    reply = NULL;
    }
    assert(r->auth_user_request != NULL);
    assert(r->auth_user_request->auth_user->auth_type == AUTH_BASIC);
    auth_user = r->auth_user_request->auth_user;
    basic_auth = auth_user->scheme_data;
    if (reply && (strncasecmp(reply, "OK", 2) == 0))
	basic_auth->flags.credentials_ok = 1;
    else {
	basic_auth->flags.credentials_ok = 3;
	safe_free(r->auth_user_request->message);
	if (t && *t)
	    r->auth_user_request->message = xstrdup(t);
    }
    basic_auth->credentials_checkedtime = squid_curtime;
    valid = cbdataValid(r->data);
    if (valid)
	r->handler(r->data, NULL);
    cbdataUnlock(r->data);
    while (basic_auth->auth_queue) {
	tmpnode = basic_auth->auth_queue->next;
	valid = cbdataValid(basic_auth->auth_queue->data);
	if (valid)
	    basic_auth->auth_queue->handler(basic_auth->auth_queue->data, NULL);
	cbdataUnlock(basic_auth->auth_queue->data);
	xfree(basic_auth->auth_queue);
	basic_auth->auth_queue = tmpnode;
    }
    authenticateStateFree(r);
}

static void
authBasicCfgDump(StoreEntry * entry, const char *name, authScheme * scheme)
{
    auth_basic_config *config = scheme->scheme_data;
    wordlist *list = config->authenticate;
    storeAppendPrintf(entry, "%s %s", name, "basic");
    while (list != NULL) {
	storeAppendPrintf(entry, " %s", list->key);
	list = list->next;
    }
    storeAppendPrintf(entry, "\n%s %s realm %s\n", name, "basic", config->basicAuthRealm);