Annotation of embedaddon/lighttpd/src/http_auth.c, revision 1.1
1.1 ! misho 1: #include "server.h"
! 2: #include "log.h"
! 3: #include "http_auth.h"
! 4: #include "inet_ntop_cache.h"
! 5: #include "stream.h"
! 6:
! 7: #ifdef HAVE_CRYPT_H
! 8: # include <crypt.h>
! 9: #elif defined(__linux__)
! 10: /* linux needs _XOPEN_SOURCE */
! 11: # define _XOPEN_SOURCE
! 12: #endif
! 13:
! 14: #ifdef HAVE_LIBCRYPT
! 15: # define HAVE_CRYPT
! 16: #endif
! 17:
! 18: #include <sys/types.h>
! 19: #include <sys/stat.h>
! 20:
! 21: #include <fcntl.h>
! 22: #include <stdlib.h>
! 23: #include <stdio.h>
! 24: #include <string.h>
! 25: #include <time.h>
! 26: #include <errno.h>
! 27: #include <unistd.h>
! 28: #include <ctype.h>
! 29:
! 30: #include "md5.h"
! 31:
! 32: #ifdef USE_OPENSSL
! 33: #include <openssl/sha.h>
! 34: #endif
! 35:
! 36: #define HASHLEN 16
! 37: #define HASHHEXLEN 32
! 38: typedef unsigned char HASH[HASHLEN];
! 39: typedef char HASHHEX[HASHHEXLEN+1];
! 40:
! 41: static void CvtHex(const HASH Bin, char Hex[33]) {
! 42: unsigned short i;
! 43:
! 44: for (i = 0; i < 16; i++) {
! 45: Hex[i*2] = int2hex((Bin[i] >> 4) & 0xf);
! 46: Hex[i*2+1] = int2hex(Bin[i] & 0xf);
! 47: }
! 48: Hex[32] = '\0';
! 49: }
! 50:
! 51: /**
! 52: * the $apr1$ handling is taken from apache 1.3.x
! 53: */
! 54:
! 55: /*
! 56: * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
! 57: * MD5 crypt() function, which is licenced as follows:
! 58: * ----------------------------------------------------------------------------
! 59: * "THE BEER-WARE LICENSE" (Revision 42):
! 60: * <phk@login.dknet.dk> wrote this file. As long as you retain this notice you
! 61: * can do whatever you want with this stuff. If we meet some day, and you think
! 62: * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
! 63: * ----------------------------------------------------------------------------
! 64: */
! 65:
! 66: handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
! 67:
! 68: static const char base64_pad = '=';
! 69:
! 70: /* "A-Z a-z 0-9 + /" maps to 0-63 */
! 71: static const short base64_reverse_table[256] = {
! 72: /* 0 1 2 3 4 5 6 7 8 9 A B C D E F */
! 73: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x00 - 0x0F */
! 74: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x10 - 0x1F */
! 75: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, /* 0x20 - 0x2F */
! 76: 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, /* 0x30 - 0x3F */
! 77: -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, /* 0x40 - 0x4F */
! 78: 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, /* 0x50 - 0x5F */
! 79: -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, /* 0x60 - 0x6F */
! 80: 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1, /* 0x70 - 0x7F */
! 81: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x80 - 0x8F */
! 82: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x90 - 0x9F */
! 83: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xA0 - 0xAF */
! 84: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xB0 - 0xBF */
! 85: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xC0 - 0xCF */
! 86: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xD0 - 0xDF */
! 87: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xE0 - 0xEF */
! 88: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xF0 - 0xFF */
! 89: };
! 90:
! 91:
! 92: static unsigned char * base64_decode(buffer *out, const char *in) {
! 93: unsigned char *result;
! 94: unsigned int j = 0; /* current output character (position) that is decoded. can contain partial result */
! 95: unsigned int group = 0; /* how many base64 digits in the current group were decoded already. each group has up to 4 digits */
! 96: size_t i;
! 97:
! 98: size_t in_len = strlen(in);
! 99:
! 100: buffer_prepare_copy(out, in_len);
! 101:
! 102: result = (unsigned char *)out->ptr;
! 103:
! 104: /* run through the whole string, converting as we go */
! 105: for (i = 0; i < in_len; i++) {
! 106: unsigned char c = (unsigned char) in[i];
! 107: short ch;
! 108:
! 109: if (c == '\0') break;
! 110:
! 111: if (c == base64_pad) {
! 112: /* pad character can only come after 2 base64 digits in a group */
! 113: if (group < 2) return NULL;
! 114: break;
! 115: }
! 116:
! 117: ch = base64_reverse_table[c];
! 118: if (ch < 0) continue; /* skip invalid characters */
! 119:
! 120: switch(group) {
! 121: case 0:
! 122: result[j] = ch << 2;
! 123: group = 1;
! 124: break;
! 125: case 1:
! 126: result[j++] |= ch >> 4;
! 127: result[j] = (ch & 0x0f) << 4;
! 128: group = 2;
! 129: break;
! 130: case 2:
! 131: result[j++] |= ch >>2;
! 132: result[j] = (ch & 0x03) << 6;
! 133: group = 3;
! 134: break;
! 135: case 3:
! 136: result[j++] |= ch;
! 137: group = 0;
! 138: break;
! 139: }
! 140: }
! 141:
! 142: switch(group) {
! 143: case 0:
! 144: /* ended on boundary */
! 145: break;
! 146: case 1:
! 147: /* need at least 2 base64 digits per group */
! 148: return NULL;
! 149: case 2:
! 150: /* have 2 base64 digits in last group => one real octect, two zeroes padded */
! 151: case 3:
! 152: /* have 3 base64 digits in last group => two real octects, one zero padded */
! 153:
! 154: /* for both cases the current index already is on the first zero padded octet
! 155: * - check it really is zero (overlapping bits) */
! 156: if (0 != result[j]) return NULL;
! 157: break;
! 158: }
! 159:
! 160: result[j] = '\0';
! 161: out->used = j;
! 162:
! 163: return result;
! 164: }
! 165:
! 166: static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) {
! 167: int ret = -1;
! 168:
! 169: if (!username->used|| !realm->used) return -1;
! 170:
! 171: if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
! 172: stream f;
! 173: char * f_line;
! 174:
! 175: if (buffer_is_empty(p->conf.auth_htdigest_userfile)) return -1;
! 176:
! 177: if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) {
! 178: log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno));
! 179:
! 180: return -1;
! 181: }
! 182:
! 183: f_line = f.start;
! 184:
! 185: while (f_line - f.start != f.size) {
! 186: char *f_user, *f_pwd, *e, *f_realm;
! 187: size_t u_len, pwd_len, r_len;
! 188:
! 189: f_user = f_line;
! 190:
! 191: /*
! 192: * htdigest format
! 193: *
! 194: * user:realm:md5(user:realm:password)
! 195: */
! 196:
! 197: if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
! 198: log_error_write(srv, __FILE__, __LINE__, "sbs",
! 199: "parsed error in", p->conf.auth_htdigest_userfile,
! 200: "expected 'username:realm:hashed password'");
! 201:
! 202: stream_close(&f);
! 203:
! 204: return -1;
! 205: }
! 206:
! 207: if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) {
! 208: log_error_write(srv, __FILE__, __LINE__, "sbs",
! 209: "parsed error in", p->conf.auth_plain_userfile,
! 210: "expected 'username:realm:hashed password'");
! 211:
! 212: stream_close(&f);
! 213:
! 214: return -1;
! 215: }
! 216:
! 217: /* get pointers to the fields */
! 218: u_len = f_realm - f_user;
! 219: f_realm++;
! 220: r_len = f_pwd - f_realm;
! 221: f_pwd++;
! 222:
! 223: if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
! 224: pwd_len = e - f_pwd;
! 225: } else {
! 226: pwd_len = f.size - (f_pwd - f.start);
! 227: }
! 228:
! 229: if (username->used - 1 == u_len &&
! 230: (realm->used - 1 == r_len) &&
! 231: (0 == strncmp(username->ptr, f_user, u_len)) &&
! 232: (0 == strncmp(realm->ptr, f_realm, r_len))) {
! 233: /* found */
! 234:
! 235: buffer_copy_string_len(password, f_pwd, pwd_len);
! 236:
! 237: ret = 0;
! 238: break;
! 239: }
! 240:
! 241: /* EOL */
! 242: if (!e) break;
! 243:
! 244: f_line = e + 1;
! 245: }
! 246:
! 247: stream_close(&f);
! 248: } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD ||
! 249: p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
! 250: stream f;
! 251: char * f_line;
! 252: buffer *auth_fn;
! 253:
! 254: auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile;
! 255:
! 256: if (buffer_is_empty(auth_fn)) return -1;
! 257:
! 258: if (0 != stream_open(&f, auth_fn)) {
! 259: log_error_write(srv, __FILE__, __LINE__, "sbss",
! 260: "opening plain-userfile", auth_fn, "failed:", strerror(errno));
! 261:
! 262: return -1;
! 263: }
! 264:
! 265: f_line = f.start;
! 266:
! 267: while (f_line - f.start != f.size) {
! 268: char *f_user, *f_pwd, *e;
! 269: size_t u_len, pwd_len;
! 270:
! 271: f_user = f_line;
! 272:
! 273: /*
! 274: * htpasswd format
! 275: *
! 276: * user:crypted passwd
! 277: */
! 278:
! 279: if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
! 280: log_error_write(srv, __FILE__, __LINE__, "sbs",
! 281: "parsed error in", auth_fn,
! 282: "expected 'username:hashed password'");
! 283:
! 284: stream_close(&f);
! 285:
! 286: return -1;
! 287: }
! 288:
! 289: /* get pointers to the fields */
! 290: u_len = f_pwd - f_user;
! 291: f_pwd++;
! 292:
! 293: if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
! 294: pwd_len = e - f_pwd;
! 295: } else {
! 296: pwd_len = f.size - (f_pwd - f.start);
! 297: }
! 298:
! 299: if (username->used - 1 == u_len &&
! 300: (0 == strncmp(username->ptr, f_user, u_len))) {
! 301: /* found */
! 302:
! 303: buffer_copy_string_len(password, f_pwd, pwd_len);
! 304:
! 305: ret = 0;
! 306: break;
! 307: }
! 308:
! 309: /* EOL */
! 310: if (!e) break;
! 311:
! 312: f_line = e + 1;
! 313: }
! 314:
! 315: stream_close(&f);
! 316: } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
! 317: ret = 0;
! 318: } else {
! 319: return -1;
! 320: }
! 321:
! 322: return ret;
! 323: }
! 324:
! 325: int http_auth_match_rules(server *srv, array *req, const char *username, const char *group, const char *host) {
! 326: const char *r = NULL, *rules = NULL;
! 327: int username_len;
! 328: data_string *require;
! 329:
! 330: UNUSED(group);
! 331: UNUSED(host);
! 332:
! 333: require = (data_string *)array_get_element(req, "require");
! 334:
! 335: /* if we get here, the user we got a authed user */
! 336: if (0 == strcmp(require->value->ptr, "valid-user")) {
! 337: return 0;
! 338: }
! 339:
! 340: /* user=name1|group=name3|host=name4 */
! 341:
! 342: /* seperate the string by | */
! 343: #if 0
! 344: log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value);
! 345: #endif
! 346:
! 347: username_len = username ? strlen(username) : 0;
! 348:
! 349: r = rules = require->value->ptr;
! 350:
! 351: while (1) {
! 352: const char *eq;
! 353: const char *k, *v, *e;
! 354: int k_len, v_len, r_len;
! 355:
! 356: e = strchr(r, '|');
! 357:
! 358: if (e) {
! 359: r_len = e - r;
! 360: } else {
! 361: r_len = strlen(rules) - (r - rules);
! 362: }
! 363:
! 364: /* from r to r + r_len is a rule */
! 365:
! 366: if (0 == strncmp(r, "valid-user", r_len)) {
! 367: log_error_write(srv, __FILE__, __LINE__, "sb",
! 368: "parsing the 'require' section in 'auth.require' failed: valid-user cannot be combined with other require rules",
! 369: require->value);
! 370: return -1;
! 371: }
! 372:
! 373: /* search for = in the rules */
! 374: if (NULL == (eq = strchr(r, '='))) {
! 375: log_error_write(srv, __FILE__, __LINE__, "sb",
! 376: "parsing the 'require' section in 'auth.require' failed: a = is missing",
! 377: require->value);
! 378: return -1;
! 379: }
! 380:
! 381: /* = out of range */
! 382: if (eq > r + r_len) {
! 383: log_error_write(srv, __FILE__, __LINE__, "sb",
! 384: "parsing the 'require' section in 'auth.require' failed: = out of range",
! 385: require->value);
! 386:
! 387: return -1;
! 388: }
! 389:
! 390: /* the part before the = is user|group|host */
! 391:
! 392: k = r;
! 393: k_len = eq - r;
! 394: v = eq + 1;
! 395: v_len = r_len - k_len - 1;
! 396:
! 397: if (k_len == 4) {
! 398: if (0 == strncmp(k, "user", k_len)) {
! 399: if (username &&
! 400: username_len == v_len &&
! 401: 0 == strncmp(username, v, v_len)) {
! 402: return 0;
! 403: }
! 404: } else if (0 == strncmp(k, "host", k_len)) {
! 405: log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)");
! 406: } else {
! 407: log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
! 408: return -1;
! 409: }
! 410: } else if (k_len == 5) {
! 411: if (0 == strncmp(k, "group", k_len)) {
! 412: log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)");
! 413: } else {
! 414: log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k);
! 415: return -1;
! 416: }
! 417: } else {
! 418: log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
! 419: return -1;
! 420: }
! 421:
! 422: if (!e) break;
! 423: r = e + 1;
! 424: }
! 425:
! 426: log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched");
! 427:
! 428: return -1;
! 429: }
! 430:
! 431: #define APR_MD5_DIGESTSIZE 16
! 432: #define APR1_ID "$apr1$"
! 433:
! 434: /*
! 435: * The following MD5 password encryption code was largely borrowed from
! 436: * the FreeBSD 3.0 /usr/src/lib/libcrypt/crypt.c file, which is
! 437: * licenced as stated at the top of this file.
! 438: */
! 439:
! 440: static void to64(char *s, unsigned long v, int n)
! 441: {
! 442: static const unsigned char itoa64[] = /* 0 ... 63 => ASCII - 64 */
! 443: "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
! 444:
! 445: while (--n >= 0) {
! 446: *s++ = itoa64[v&0x3f];
! 447: v >>= 6;
! 448: }
! 449: }
! 450:
! 451: static void apr_md5_encode(const char *pw, const char *salt, char *result, size_t nbytes) {
! 452: /*
! 453: * Minimum size is 8 bytes for salt, plus 1 for the trailing NUL,
! 454: * plus 4 for the '$' separators, plus the password hash itself.
! 455: * Let's leave a goodly amount of leeway.
! 456: */
! 457:
! 458: char passwd[120], *p;
! 459: const char *sp, *ep;
! 460: unsigned char final[APR_MD5_DIGESTSIZE];
! 461: ssize_t sl, pl, i;
! 462: li_MD5_CTX ctx, ctx1;
! 463: unsigned long l;
! 464:
! 465: /*
! 466: * Refine the salt first. It's possible we were given an already-hashed
! 467: * string as the salt argument, so extract the actual salt value from it
! 468: * if so. Otherwise just use the string up to the first '$' as the salt.
! 469: */
! 470: sp = salt;
! 471:
! 472: /*
! 473: * If it starts with the magic string, then skip that.
! 474: */
! 475: if (!strncmp(sp, APR1_ID, strlen(APR1_ID))) {
! 476: sp += strlen(APR1_ID);
! 477: }
! 478:
! 479: /*
! 480: * It stops at the first '$' or 8 chars, whichever comes first
! 481: */
! 482: for (ep = sp; (*ep != '\0') && (*ep != '$') && (ep < (sp + 8)); ep++) {
! 483: continue;
! 484: }
! 485:
! 486: /*
! 487: * Get the length of the true salt
! 488: */
! 489: sl = ep - sp;
! 490:
! 491: /*
! 492: * 'Time to make the doughnuts..'
! 493: */
! 494: li_MD5_Init(&ctx);
! 495:
! 496: /*
! 497: * The password first, since that is what is most unknown
! 498: */
! 499: li_MD5_Update(&ctx, pw, strlen(pw));
! 500:
! 501: /*
! 502: * Then our magic string
! 503: */
! 504: li_MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
! 505:
! 506: /*
! 507: * Then the raw salt
! 508: */
! 509: li_MD5_Update(&ctx, sp, sl);
! 510:
! 511: /*
! 512: * Then just as many characters of the MD5(pw, salt, pw)
! 513: */
! 514: li_MD5_Init(&ctx1);
! 515: li_MD5_Update(&ctx1, pw, strlen(pw));
! 516: li_MD5_Update(&ctx1, sp, sl);
! 517: li_MD5_Update(&ctx1, pw, strlen(pw));
! 518: li_MD5_Final(final, &ctx1);
! 519: for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) {
! 520: li_MD5_Update(&ctx, final,
! 521: (pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl);
! 522: }
! 523:
! 524: /*
! 525: * Don't leave anything around in vm they could use.
! 526: */
! 527: memset(final, 0, sizeof(final));
! 528:
! 529: /*
! 530: * Then something really weird...
! 531: */
! 532: for (i = strlen(pw); i != 0; i >>= 1) {
! 533: if (i & 1) {
! 534: li_MD5_Update(&ctx, final, 1);
! 535: }
! 536: else {
! 537: li_MD5_Update(&ctx, pw, 1);
! 538: }
! 539: }
! 540:
! 541: /*
! 542: * Now make the output string. We know our limitations, so we
! 543: * can use the string routines without bounds checking.
! 544: */
! 545: strcpy(passwd, APR1_ID);
! 546: strncat(passwd, sp, sl);
! 547: strcat(passwd, "$");
! 548:
! 549: li_MD5_Final(final, &ctx);
! 550:
! 551: /*
! 552: * And now, just to make sure things don't run too fast..
! 553: * On a 60 Mhz Pentium this takes 34 msec, so you would
! 554: * need 30 seconds to build a 1000 entry dictionary...
! 555: */
! 556: for (i = 0; i < 1000; i++) {
! 557: li_MD5_Init(&ctx1);
! 558: if (i & 1) {
! 559: li_MD5_Update(&ctx1, pw, strlen(pw));
! 560: }
! 561: else {
! 562: li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
! 563: }
! 564: if (i % 3) {
! 565: li_MD5_Update(&ctx1, sp, sl);
! 566: }
! 567:
! 568: if (i % 7) {
! 569: li_MD5_Update(&ctx1, pw, strlen(pw));
! 570: }
! 571:
! 572: if (i & 1) {
! 573: li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
! 574: }
! 575: else {
! 576: li_MD5_Update(&ctx1, pw, strlen(pw));
! 577: }
! 578: li_MD5_Final(final,&ctx1);
! 579: }
! 580:
! 581: p = passwd + strlen(passwd);
! 582:
! 583: l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p, l, 4); p += 4;
! 584: l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p, l, 4); p += 4;
! 585: l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p, l, 4); p += 4;
! 586: l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p, l, 4); p += 4;
! 587: l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p, l, 4); p += 4;
! 588: l = final[11] ; to64(p, l, 2); p += 2;
! 589: *p = '\0';
! 590:
! 591: /*
! 592: * Don't leave anything around in vm they could use.
! 593: */
! 594: memset(final, 0, sizeof(final));
! 595:
! 596: /* FIXME
! 597: */
! 598: #define apr_cpystrn strncpy
! 599: apr_cpystrn(result, passwd, nbytes - 1);
! 600: }
! 601:
! 602: #ifdef USE_OPENSSL
! 603: static void apr_sha_encode(const char *pw, char *result, size_t nbytes) {
! 604: static const unsigned char base64_data[65] =
! 605: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
! 606: unsigned char digest[21]; /* multiple of 3 for base64 encoding */
! 607: int i;
! 608:
! 609: memset(result, 0, nbytes);
! 610:
! 611: /* need 5 bytes for "{SHA}", 28 for base64 (3 bytes -> 4 bytes) of SHA1 (20 bytes), 1 terminating */
! 612: if (nbytes < 5 + 28 + 1) return;
! 613:
! 614: SHA1((const unsigned char*) pw, strlen(pw), digest);
! 615: digest[20] = 0;
! 616:
! 617: strcpy(result, "{SHA}");
! 618: result = result + 5;
! 619: for (i = 0; i < 21; i += 3) {
! 620: unsigned int v = (digest[i] << 16) | (digest[i+1] << 8) | digest[i+2];
! 621: result[3] = base64_data[v & 0x3f]; v >>= 6;
! 622: result[2] = base64_data[v & 0x3f]; v >>= 6;
! 623: result[1] = base64_data[v & 0x3f]; v >>= 6;
! 624: result[0] = base64_data[v & 0x3f];
! 625: result += 4;
! 626: }
! 627: result[-1] = '='; /* last digest character was already end of string, pad it */
! 628: *result = '\0';
! 629: }
! 630: #endif
! 631:
! 632: /**
! 633: *
! 634: *
! 635: * @param password password-string from the auth-backend
! 636: * @param pw password-string from the client
! 637: */
! 638:
! 639: static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) {
! 640: UNUSED(srv);
! 641: UNUSED(req);
! 642:
! 643: if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
! 644: /*
! 645: * htdigest format
! 646: *
! 647: * user:realm:md5(user:realm:password)
! 648: */
! 649:
! 650: li_MD5_CTX Md5Ctx;
! 651: HASH HA1;
! 652: char a1[256];
! 653:
! 654: li_MD5_Init(&Md5Ctx);
! 655: li_MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
! 656: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 657: li_MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
! 658: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 659: li_MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
! 660: li_MD5_Final(HA1, &Md5Ctx);
! 661:
! 662: CvtHex(HA1, a1);
! 663:
! 664: if (0 == strcmp(password->ptr, a1)) {
! 665: return 0;
! 666: }
! 667: } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) {
! 668: char sample[120];
! 669: if (!strncmp(password->ptr, APR1_ID, strlen(APR1_ID))) {
! 670: /*
! 671: * The hash was created using $apr1$ custom algorithm.
! 672: */
! 673: apr_md5_encode(pw, password->ptr, sample, sizeof(sample));
! 674: return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
! 675: #ifdef USE_OPENSSL
! 676: } else if (0 == strncmp(password->ptr, "{SHA}", 5)) {
! 677: apr_sha_encode(pw, sample, sizeof(sample));
! 678: return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
! 679: #endif
! 680: } else {
! 681: #ifdef HAVE_CRYPT
! 682: char *crypted;
! 683:
! 684: /* a simple DES password is 2 + 11 characters. everything else should be longer. */
! 685: if (password->used < 13 + 1) {
! 686: return -1;
! 687: }
! 688:
! 689: if (0 == (crypted = crypt(pw, password->ptr))) {
! 690: /* crypt failed. */
! 691: return -1;
! 692: }
! 693:
! 694: if (0 == strcmp(password->ptr, crypted)) {
! 695: return 0;
! 696: }
! 697: #endif
! 698: }
! 699: } else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
! 700: if (0 == strcmp(password->ptr, pw)) {
! 701: return 0;
! 702: }
! 703: } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
! 704: #ifdef USE_LDAP
! 705: LDAP *ldap;
! 706: LDAPMessage *lm, *first;
! 707: char *dn;
! 708: int ret;
! 709: char *attrs[] = { LDAP_NO_ATTRS, NULL };
! 710: size_t i;
! 711:
! 712: /* for now we stay synchronous */
! 713:
! 714: /*
! 715: * 1. connect anonymously (done in plugin init)
! 716: * 2. get DN for uid = username
! 717: * 3. auth against ldap server
! 718: * 4. (optional) check a field
! 719: * 5. disconnect
! 720: *
! 721: */
! 722:
! 723: /* check username
! 724: *
! 725: * we have to protect us againt username which modifies out filter in
! 726: * a unpleasant way
! 727: */
! 728:
! 729: for (i = 0; i < username->used - 1; i++) {
! 730: char c = username->ptr[i];
! 731:
! 732: if (!isalpha(c) &&
! 733: !isdigit(c) &&
! 734: (c != ' ') &&
! 735: (c != '@') &&
! 736: (c != '-') &&
! 737: (c != '_') &&
! 738: (c != '.') ) {
! 739:
! 740: log_error_write(srv, __FILE__, __LINE__, "sbd",
! 741: "ldap: invalid character (- _.@a-zA-Z0-9 allowed) in username:", username, i);
! 742:
! 743: return -1;
! 744: }
! 745: }
! 746:
! 747: if (p->conf.auth_ldap_allow_empty_pw != 1 && pw[0] == '\0')
! 748: return -1;
! 749:
! 750: /* build filter */
! 751: buffer_copy_string_buffer(p->ldap_filter, p->conf.ldap_filter_pre);
! 752: buffer_append_string_buffer(p->ldap_filter, username);
! 753: buffer_append_string_buffer(p->ldap_filter, p->conf.ldap_filter_post);
! 754:
! 755:
! 756: /* 2. */
! 757: if (p->anon_conf->ldap == NULL ||
! 758: LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
! 759:
! 760: /* try again; the ldap library sometimes fails for the first call but reconnects */
! 761: if (p->anon_conf->ldap == NULL || ret != LDAP_SERVER_DOWN ||
! 762: LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
! 763:
! 764: if (auth_ldap_init(srv, p->anon_conf) != HANDLER_GO_ON)
! 765: return -1;
! 766:
! 767: if (p->anon_conf->ldap == NULL ||
! 768: LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
! 769: log_error_write(srv, __FILE__, __LINE__, "sssb",
! 770: "ldap:", ldap_err2string(ret), "filter:", p->ldap_filter);
! 771: return -1;
! 772: }
! 773: }
! 774: }
! 775:
! 776: if (NULL == (first = ldap_first_entry(p->anon_conf->ldap, lm))) {
! 777: log_error_write(srv, __FILE__, __LINE__, "s", "ldap ...");
! 778:
! 779: ldap_msgfree(lm);
! 780:
! 781: return -1;
! 782: }
! 783:
! 784: if (NULL == (dn = ldap_get_dn(p->anon_conf->ldap, first))) {
! 785: log_error_write(srv, __FILE__, __LINE__, "s", "ldap ...");
! 786:
! 787: ldap_msgfree(lm);
! 788:
! 789: return -1;
! 790: }
! 791:
! 792: ldap_msgfree(lm);
! 793:
! 794:
! 795: /* 3. */
! 796: if (NULL == (ldap = ldap_init(p->conf.auth_ldap_hostname->ptr, LDAP_PORT))) {
! 797: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
! 798: return -1;
! 799: }
! 800:
! 801: ret = LDAP_VERSION3;
! 802: if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
! 803: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
! 804:
! 805: ldap_unbind_s(ldap);
! 806:
! 807: return -1;
! 808: }
! 809:
! 810: if (p->conf.auth_ldap_starttls == 1) {
! 811: if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(ldap, NULL, NULL))) {
! 812: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
! 813:
! 814: ldap_unbind_s(ldap);
! 815:
! 816: return -1;
! 817: }
! 818: }
! 819:
! 820:
! 821: if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(ldap, dn, pw))) {
! 822: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
! 823:
! 824: ldap_unbind_s(ldap);
! 825:
! 826: return -1;
! 827: }
! 828:
! 829: /* 5. */
! 830: ldap_unbind_s(ldap);
! 831:
! 832: /* everything worked, good, access granted */
! 833:
! 834: return 0;
! 835: #endif
! 836: }
! 837: return -1;
! 838: }
! 839:
! 840: int http_auth_basic_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, const char *realm_str) {
! 841: buffer *username, *password;
! 842: char *pw;
! 843:
! 844: data_string *realm;
! 845:
! 846: realm = (data_string *)array_get_element(req, "realm");
! 847:
! 848: username = buffer_init();
! 849:
! 850: if (!base64_decode(username, realm_str)) {
! 851: log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username);
! 852:
! 853: buffer_free(username);
! 854: return 0;
! 855: }
! 856:
! 857: /* r2 == user:password */
! 858: if (NULL == (pw = strchr(username->ptr, ':'))) {
! 859: log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username);
! 860:
! 861: buffer_free(username);
! 862: return 0;
! 863: }
! 864:
! 865: *pw++ = '\0';
! 866:
! 867: username->used = pw - username->ptr;
! 868:
! 869: password = buffer_init();
! 870: /* copy password to r1 */
! 871: if (http_auth_get_password(srv, p, username, realm->value, password)) {
! 872: buffer_free(username);
! 873: buffer_free(password);
! 874:
! 875: if (AUTH_BACKEND_UNSET == p->conf.auth_backend) {
! 876: log_error_write(srv, __FILE__, __LINE__, "s", "auth.backend is not set");
! 877: } else {
! 878: log_error_write(srv, __FILE__, __LINE__, "ss", "get_password failed, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
! 879: }
! 880:
! 881: return 0;
! 882: }
! 883:
! 884: /* password doesn't match */
! 885: if (http_auth_basic_password_compare(srv, p, req, username, realm->value, password, pw)) {
! 886: log_error_write(srv, __FILE__, __LINE__, "sbsBss", "password doesn't match for", con->uri.path, "username:", username, ", IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
! 887:
! 888: buffer_free(username);
! 889: buffer_free(password);
! 890:
! 891: return 0;
! 892: }
! 893:
! 894: /* value is our allow-rules */
! 895: if (http_auth_match_rules(srv, req, username->ptr, NULL, NULL)) {
! 896: buffer_free(username);
! 897: buffer_free(password);
! 898:
! 899: log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match");
! 900:
! 901: return 0;
! 902: }
! 903:
! 904: /* remember the username */
! 905: buffer_copy_string_buffer(p->auth_user, username);
! 906:
! 907: buffer_free(username);
! 908: buffer_free(password);
! 909:
! 910: return 1;
! 911: }
! 912:
! 913: typedef struct {
! 914: const char *key;
! 915: int key_len;
! 916: char **ptr;
! 917: } digest_kv;
! 918:
! 919: /* return values: -1: error/bad request, 0: failed, 1: success */
! 920: int http_auth_digest_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, const char *realm_str) {
! 921: char a1[256];
! 922: char a2[256];
! 923:
! 924: char *username = NULL;
! 925: char *realm = NULL;
! 926: char *nonce = NULL;
! 927: char *uri = NULL;
! 928: char *algorithm = NULL;
! 929: char *qop = NULL;
! 930: char *cnonce = NULL;
! 931: char *nc = NULL;
! 932: char *respons = NULL;
! 933:
! 934: char *e, *c;
! 935: const char *m = NULL;
! 936: int i;
! 937: buffer *password, *b, *username_buf, *realm_buf;
! 938:
! 939: li_MD5_CTX Md5Ctx;
! 940: HASH HA1;
! 941: HASH HA2;
! 942: HASH RespHash;
! 943: HASHHEX HA2Hex;
! 944:
! 945:
! 946: /* init pointers */
! 947: #define S(x) \
! 948: x, sizeof(x)-1, NULL
! 949: digest_kv dkv[10] = {
! 950: { S("username=") },
! 951: { S("realm=") },
! 952: { S("nonce=") },
! 953: { S("uri=") },
! 954: { S("algorithm=") },
! 955: { S("qop=") },
! 956: { S("cnonce=") },
! 957: { S("nc=") },
! 958: { S("response=") },
! 959:
! 960: { NULL, 0, NULL }
! 961: };
! 962: #undef S
! 963:
! 964: dkv[0].ptr = &username;
! 965: dkv[1].ptr = &realm;
! 966: dkv[2].ptr = &nonce;
! 967: dkv[3].ptr = &uri;
! 968: dkv[4].ptr = &algorithm;
! 969: dkv[5].ptr = &qop;
! 970: dkv[6].ptr = &cnonce;
! 971: dkv[7].ptr = &nc;
! 972: dkv[8].ptr = &respons;
! 973:
! 974: UNUSED(req);
! 975:
! 976: if (p->conf.auth_backend != AUTH_BACKEND_HTDIGEST &&
! 977: p->conf.auth_backend != AUTH_BACKEND_PLAIN) {
! 978: log_error_write(srv, __FILE__, __LINE__, "s",
! 979: "digest: unsupported backend (only htdigest or plain)");
! 980:
! 981: return -1;
! 982: }
! 983:
! 984: b = buffer_init_string(realm_str);
! 985:
! 986: /* parse credentials from client */
! 987: for (c = b->ptr; *c; c++) {
! 988: /* skip whitespaces */
! 989: while (*c == ' ' || *c == '\t') c++;
! 990: if (!*c) break;
! 991:
! 992: for (i = 0; dkv[i].key; i++) {
! 993: if ((0 == strncmp(c, dkv[i].key, dkv[i].key_len))) {
! 994: if ((c[dkv[i].key_len] == '"') &&
! 995: (NULL != (e = strchr(c + dkv[i].key_len + 1, '"')))) {
! 996: /* value with "..." */
! 997: *(dkv[i].ptr) = c + dkv[i].key_len + 1;
! 998: c = e;
! 999:
! 1000: *e = '\0';
! 1001: } else if (NULL != (e = strchr(c + dkv[i].key_len, ','))) {
! 1002: /* value without "...", terminated by ',' */
! 1003: *(dkv[i].ptr) = c + dkv[i].key_len;
! 1004: c = e;
! 1005:
! 1006: *e = '\0';
! 1007: } else {
! 1008: /* value without "...", terminated by EOL */
! 1009: *(dkv[i].ptr) = c + dkv[i].key_len;
! 1010: c += strlen(c) - 1;
! 1011: }
! 1012: }
! 1013: }
! 1014: }
! 1015:
! 1016: if (p->conf.auth_debug > 1) {
! 1017: log_error_write(srv, __FILE__, __LINE__, "ss", "username", username);
! 1018: log_error_write(srv, __FILE__, __LINE__, "ss", "realm", realm);
! 1019: log_error_write(srv, __FILE__, __LINE__, "ss", "nonce", nonce);
! 1020: log_error_write(srv, __FILE__, __LINE__, "ss", "uri", uri);
! 1021: log_error_write(srv, __FILE__, __LINE__, "ss", "algorithm", algorithm);
! 1022: log_error_write(srv, __FILE__, __LINE__, "ss", "qop", qop);
! 1023: log_error_write(srv, __FILE__, __LINE__, "ss", "cnonce", cnonce);
! 1024: log_error_write(srv, __FILE__, __LINE__, "ss", "nc", nc);
! 1025: log_error_write(srv, __FILE__, __LINE__, "ss", "response", respons);
! 1026: }
! 1027:
! 1028: /* check if everything is transmitted */
! 1029: if (!username ||
! 1030: !realm ||
! 1031: !nonce ||
! 1032: !uri ||
! 1033: (qop && (!nc || !cnonce)) ||
! 1034: !respons ) {
! 1035: /* missing field */
! 1036:
! 1037: log_error_write(srv, __FILE__, __LINE__, "s",
! 1038: "digest: missing field");
! 1039:
! 1040: buffer_free(b);
! 1041: return -1;
! 1042: }
! 1043:
! 1044: /**
! 1045: * protect the md5-sess against missing cnonce and nonce
! 1046: */
! 1047: if (algorithm &&
! 1048: 0 == strcasecmp(algorithm, "md5-sess") &&
! 1049: (!nonce || !cnonce)) {
! 1050: log_error_write(srv, __FILE__, __LINE__, "s",
! 1051: "digest: (md5-sess: missing field");
! 1052:
! 1053: buffer_free(b);
! 1054: return -1;
! 1055: }
! 1056:
! 1057: if (qop && strcasecmp(qop, "auth-int") == 0) {
! 1058: log_error_write(srv, __FILE__, __LINE__, "s",
! 1059: "digest: qop=auth-int not supported");
! 1060:
! 1061: buffer_free(b);
! 1062: return -1;
! 1063: }
! 1064:
! 1065: m = get_http_method_name(con->request.http_method);
! 1066:
! 1067: /* password-string == HA1 */
! 1068: password = buffer_init();
! 1069: username_buf = buffer_init_string(username);
! 1070: realm_buf = buffer_init_string(realm);
! 1071: if (http_auth_get_password(srv, p, username_buf, realm_buf, password)) {
! 1072: buffer_free(password);
! 1073: buffer_free(b);
! 1074: buffer_free(username_buf);
! 1075: buffer_free(realm_buf);
! 1076: return 0;
! 1077: }
! 1078:
! 1079: buffer_free(username_buf);
! 1080: buffer_free(realm_buf);
! 1081:
! 1082: if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
! 1083: /* generate password from plain-text */
! 1084: li_MD5_Init(&Md5Ctx);
! 1085: li_MD5_Update(&Md5Ctx, (unsigned char *)username, strlen(username));
! 1086: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1087: li_MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm));
! 1088: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1089: li_MD5_Update(&Md5Ctx, (unsigned char *)password->ptr, password->used - 1);
! 1090: li_MD5_Final(HA1, &Md5Ctx);
! 1091: } else if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
! 1092: /* HA1 */
! 1093: /* transform the 32-byte-hex-md5 to a 16-byte-md5 */
! 1094: for (i = 0; i < HASHLEN; i++) {
! 1095: HA1[i] = hex2int(password->ptr[i*2]) << 4;
! 1096: HA1[i] |= hex2int(password->ptr[i*2+1]);
! 1097: }
! 1098: } else {
! 1099: /* we already check that above */
! 1100: SEGFAULT();
! 1101: }
! 1102:
! 1103: buffer_free(password);
! 1104:
! 1105: if (algorithm &&
! 1106: strcasecmp(algorithm, "md5-sess") == 0) {
! 1107: li_MD5_Init(&Md5Ctx);
! 1108: /* Errata ID 1649: http://www.rfc-editor.org/errata_search.php?rfc=2617 */
! 1109: CvtHex(HA1, a1);
! 1110: li_MD5_Update(&Md5Ctx, (unsigned char *)a1, 32);
! 1111: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1112: li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
! 1113: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1114: li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
! 1115: li_MD5_Final(HA1, &Md5Ctx);
! 1116: }
! 1117:
! 1118: CvtHex(HA1, a1);
! 1119:
! 1120: /* calculate H(A2) */
! 1121: li_MD5_Init(&Md5Ctx);
! 1122: li_MD5_Update(&Md5Ctx, (unsigned char *)m, strlen(m));
! 1123: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1124: li_MD5_Update(&Md5Ctx, (unsigned char *)uri, strlen(uri));
! 1125: /* qop=auth-int not supported, already checked above */
! 1126: /*
! 1127: if (qop && strcasecmp(qop, "auth-int") == 0) {
! 1128: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1129: li_MD5_Update(&Md5Ctx, (unsigned char *) [body checksum], HASHHEXLEN);
! 1130: }
! 1131: */
! 1132: li_MD5_Final(HA2, &Md5Ctx);
! 1133: CvtHex(HA2, HA2Hex);
! 1134:
! 1135: /* calculate response */
! 1136: li_MD5_Init(&Md5Ctx);
! 1137: li_MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN);
! 1138: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1139: li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
! 1140: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1141: if (qop && *qop) {
! 1142: li_MD5_Update(&Md5Ctx, (unsigned char *)nc, strlen(nc));
! 1143: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1144: li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
! 1145: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1146: li_MD5_Update(&Md5Ctx, (unsigned char *)qop, strlen(qop));
! 1147: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
! 1148: };
! 1149: li_MD5_Update(&Md5Ctx, (unsigned char *)HA2Hex, HASHHEXLEN);
! 1150: li_MD5_Final(RespHash, &Md5Ctx);
! 1151: CvtHex(RespHash, a2);
! 1152:
! 1153: if (0 != strcmp(a2, respons)) {
! 1154: /* digest not ok */
! 1155:
! 1156: if (p->conf.auth_debug) {
! 1157: log_error_write(srv, __FILE__, __LINE__, "sss",
! 1158: "digest: digest mismatch", a2, respons);
! 1159: }
! 1160:
! 1161: log_error_write(srv, __FILE__, __LINE__, "ssss",
! 1162: "digest: auth failed for ", username, ": wrong password, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
! 1163:
! 1164: buffer_free(b);
! 1165: return 0;
! 1166: }
! 1167:
! 1168: /* value is our allow-rules */
! 1169: if (http_auth_match_rules(srv, req, username, NULL, NULL)) {
! 1170: buffer_free(b);
! 1171:
! 1172: log_error_write(srv, __FILE__, __LINE__, "s",
! 1173: "digest: rules did match");
! 1174:
! 1175: return 0;
! 1176: }
! 1177:
! 1178: /* remember the username */
! 1179: buffer_copy_string(p->auth_user, username);
! 1180:
! 1181: buffer_free(b);
! 1182:
! 1183: if (p->conf.auth_debug) {
! 1184: log_error_write(srv, __FILE__, __LINE__, "s",
! 1185: "digest: auth ok");
! 1186: }
! 1187: return 1;
! 1188: }
! 1189:
! 1190:
! 1191: int http_auth_digest_generate_nonce(server *srv, mod_auth_plugin_data *p, buffer *fn, char out[33]) {
! 1192: HASH h;
! 1193: li_MD5_CTX Md5Ctx;
! 1194: char hh[32];
! 1195:
! 1196: UNUSED(p);
! 1197:
! 1198: /* generate shared-secret */
! 1199: li_MD5_Init(&Md5Ctx);
! 1200: li_MD5_Update(&Md5Ctx, (unsigned char *)fn->ptr, fn->used - 1);
! 1201: li_MD5_Update(&Md5Ctx, (unsigned char *)"+", 1);
! 1202:
! 1203: /* we assume sizeof(time_t) == 4 here, but if not it ain't a problem at all */
! 1204: LI_ltostr(hh, srv->cur_ts);
! 1205: li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
! 1206: li_MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
! 1207: LI_ltostr(hh, rand());
! 1208: li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
! 1209:
! 1210: li_MD5_Final(h, &Md5Ctx);
! 1211:
! 1212: CvtHex(h, out);
! 1213:
! 1214: return 0;
! 1215: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to http_auth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / src