![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to http_auth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / src|
Return to http_auth.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / src |
1.1 misho 1: #include "server.h"
2: #include "log.h"
3: #include "http_auth.h"
4: #include "inet_ntop_cache.h"
5: #include "stream.h"
6:
7: #ifdef HAVE_CRYPT_H
8: # include <crypt.h>
9: #elif defined(__linux__)
10: /* linux needs _XOPEN_SOURCE */
11: # define _XOPEN_SOURCE
12: #endif
13:
14: #ifdef HAVE_LIBCRYPT
15: # define HAVE_CRYPT
16: #endif
17:
18: #include <sys/types.h>
19: #include <sys/stat.h>
20:
21: #include <fcntl.h>
22: #include <stdlib.h>
23: #include <stdio.h>
24: #include <string.h>
25: #include <time.h>
26: #include <errno.h>
27: #include <unistd.h>
28: #include <ctype.h>
29:
30: #include "md5.h"
31:
32: #ifdef USE_OPENSSL
33: #include <openssl/sha.h>
34: #endif
35:
36: #define HASHLEN 16
37: #define HASHHEXLEN 32
38: typedef unsigned char HASH[HASHLEN];
39: typedef char HASHHEX[HASHHEXLEN+1];
40:
41: static void CvtHex(const HASH Bin, char Hex[33]) {
42: unsigned short i;
43:
44: for (i = 0; i < 16; i++) {
45: Hex[i*2] = int2hex((Bin[i] >> 4) & 0xf);
46: Hex[i*2+1] = int2hex(Bin[i] & 0xf);
47: }
48: Hex[32] = '\0';
49: }
50:
51: /**
52: * the $apr1$ handling is taken from apache 1.3.x
53: */
54:
55: /*
56: * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
57: * MD5 crypt() function, which is licenced as follows:
58: * ----------------------------------------------------------------------------
59: * "THE BEER-WARE LICENSE" (Revision 42):
60: * <phk@login.dknet.dk> wrote this file. As long as you retain this notice you
61: * can do whatever you want with this stuff. If we meet some day, and you think
62: * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
63: * ----------------------------------------------------------------------------
64: */
65:
66: handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
67:
68: static const char base64_pad = '=';
69:
70: /* "A-Z a-z 0-9 + /" maps to 0-63 */
71: static const short base64_reverse_table[256] = {
72: /* 0 1 2 3 4 5 6 7 8 9 A B C D E F */
73: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x00 - 0x0F */
74: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x10 - 0x1F */
75: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, /* 0x20 - 0x2F */
76: 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, /* 0x30 - 0x3F */
77: -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, /* 0x40 - 0x4F */
78: 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, /* 0x50 - 0x5F */
79: -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, /* 0x60 - 0x6F */
80: 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1, /* 0x70 - 0x7F */
81: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x80 - 0x8F */
82: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x90 - 0x9F */
83: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xA0 - 0xAF */
84: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xB0 - 0xBF */
85: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xC0 - 0xCF */
86: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xD0 - 0xDF */
87: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xE0 - 0xEF */
88: -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xF0 - 0xFF */
89: };
90:
91:
92: static unsigned char * base64_decode(buffer *out, const char *in) {
93: unsigned char *result;
94: unsigned int j = 0; /* current output character (position) that is decoded. can contain partial result */
95: unsigned int group = 0; /* how many base64 digits in the current group were decoded already. each group has up to 4 digits */
96: size_t i;
97:
98: size_t in_len = strlen(in);
99:
100: buffer_prepare_copy(out, in_len);
101:
102: result = (unsigned char *)out->ptr;
103:
104: /* run through the whole string, converting as we go */
105: for (i = 0; i < in_len; i++) {
106: unsigned char c = (unsigned char) in[i];
107: short ch;
108:
109: if (c == '\0') break;
110:
111: if (c == base64_pad) {
112: /* pad character can only come after 2 base64 digits in a group */
113: if (group < 2) return NULL;
114: break;
115: }
116:
117: ch = base64_reverse_table[c];
118: if (ch < 0) continue; /* skip invalid characters */
119:
120: switch(group) {
121: case 0:
122: result[j] = ch << 2;
123: group = 1;
124: break;
125: case 1:
126: result[j++] |= ch >> 4;
127: result[j] = (ch & 0x0f) << 4;
128: group = 2;
129: break;
130: case 2:
131: result[j++] |= ch >>2;
132: result[j] = (ch & 0x03) << 6;
133: group = 3;
134: break;
135: case 3:
136: result[j++] |= ch;
137: group = 0;
138: break;
139: }
140: }
141:
142: switch(group) {
143: case 0:
144: /* ended on boundary */
145: break;
146: case 1:
147: /* need at least 2 base64 digits per group */
148: return NULL;
149: case 2:
150: /* have 2 base64 digits in last group => one real octect, two zeroes padded */
151: case 3:
152: /* have 3 base64 digits in last group => two real octects, one zero padded */
153:
154: /* for both cases the current index already is on the first zero padded octet
155: * - check it really is zero (overlapping bits) */
156: if (0 != result[j]) return NULL;
157: break;
158: }
159:
160: result[j] = '\0';
161: out->used = j;
162:
163: return result;
164: }
165:
166: static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) {
167: int ret = -1;
168:
169: if (!username->used|| !realm->used) return -1;
170:
171: if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
172: stream f;
173: char * f_line;
174:
175: if (buffer_is_empty(p->conf.auth_htdigest_userfile)) return -1;
176:
177: if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) {
178: log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno));
179:
180: return -1;
181: }
182:
183: f_line = f.start;
184:
185: while (f_line - f.start != f.size) {
186: char *f_user, *f_pwd, *e, *f_realm;
187: size_t u_len, pwd_len, r_len;
188:
189: f_user = f_line;
190:
191: /*
192: * htdigest format
193: *
194: * user:realm:md5(user:realm:password)
195: */
196:
197: if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
198: log_error_write(srv, __FILE__, __LINE__, "sbs",
199: "parsed error in", p->conf.auth_htdigest_userfile,
200: "expected 'username:realm:hashed password'");
201:
202: stream_close(&f);
203:
204: return -1;
205: }
206:
207: if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) {
208: log_error_write(srv, __FILE__, __LINE__, "sbs",
209: "parsed error in", p->conf.auth_plain_userfile,
210: "expected 'username:realm:hashed password'");
211:
212: stream_close(&f);
213:
214: return -1;
215: }
216:
217: /* get pointers to the fields */
218: u_len = f_realm - f_user;
219: f_realm++;
220: r_len = f_pwd - f_realm;
221: f_pwd++;
222:
223: if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
224: pwd_len = e - f_pwd;
225: } else {
226: pwd_len = f.size - (f_pwd - f.start);
227: }
228:
229: if (username->used - 1 == u_len &&
230: (realm->used - 1 == r_len) &&
231: (0 == strncmp(username->ptr, f_user, u_len)) &&
232: (0 == strncmp(realm->ptr, f_realm, r_len))) {
233: /* found */
234:
235: buffer_copy_string_len(password, f_pwd, pwd_len);
236:
237: ret = 0;
238: break;
239: }
240:
241: /* EOL */
242: if (!e) break;
243:
244: f_line = e + 1;
245: }
246:
247: stream_close(&f);
248: } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD ||
249: p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
250: stream f;
251: char * f_line;
252: buffer *auth_fn;
253:
254: auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile;
255:
256: if (buffer_is_empty(auth_fn)) return -1;
257:
258: if (0 != stream_open(&f, auth_fn)) {
259: log_error_write(srv, __FILE__, __LINE__, "sbss",
260: "opening plain-userfile", auth_fn, "failed:", strerror(errno));
261:
262: return -1;
263: }
264:
265: f_line = f.start;
266:
267: while (f_line - f.start != f.size) {
268: char *f_user, *f_pwd, *e;
269: size_t u_len, pwd_len;
270:
271: f_user = f_line;
272:
273: /*
274: * htpasswd format
275: *
276: * user:crypted passwd
277: */
278:
279: if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
280: log_error_write(srv, __FILE__, __LINE__, "sbs",
281: "parsed error in", auth_fn,
282: "expected 'username:hashed password'");
283:
284: stream_close(&f);
285:
286: return -1;
287: }
288:
289: /* get pointers to the fields */
290: u_len = f_pwd - f_user;
291: f_pwd++;
292:
293: if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
294: pwd_len = e - f_pwd;
295: } else {
296: pwd_len = f.size - (f_pwd - f.start);
297: }
298:
299: if (username->used - 1 == u_len &&
300: (0 == strncmp(username->ptr, f_user, u_len))) {
301: /* found */
302:
303: buffer_copy_string_len(password, f_pwd, pwd_len);
304:
305: ret = 0;
306: break;
307: }
308:
309: /* EOL */
310: if (!e) break;
311:
312: f_line = e + 1;
313: }
314:
315: stream_close(&f);
316: } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
317: ret = 0;
318: } else {
319: return -1;
320: }
321:
322: return ret;
323: }
324:
325: int http_auth_match_rules(server *srv, array *req, const char *username, const char *group, const char *host) {
326: const char *r = NULL, *rules = NULL;
327: int username_len;
328: data_string *require;
329:
330: UNUSED(group);
331: UNUSED(host);
332:
333: require = (data_string *)array_get_element(req, "require");
334:
335: /* if we get here, the user we got a authed user */
336: if (0 == strcmp(require->value->ptr, "valid-user")) {
337: return 0;
338: }
339:
340: /* user=name1|group=name3|host=name4 */
341:
342: /* seperate the string by | */
343: #if 0
344: log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value);
345: #endif
346:
347: username_len = username ? strlen(username) : 0;
348:
349: r = rules = require->value->ptr;
350:
351: while (1) {
352: const char *eq;
353: const char *k, *v, *e;
354: int k_len, v_len, r_len;
355:
356: e = strchr(r, '|');
357:
358: if (e) {
359: r_len = e - r;
360: } else {
361: r_len = strlen(rules) - (r - rules);
362: }
363:
364: /* from r to r + r_len is a rule */
365:
366: if (0 == strncmp(r, "valid-user", r_len)) {
367: log_error_write(srv, __FILE__, __LINE__, "sb",
368: "parsing the 'require' section in 'auth.require' failed: valid-user cannot be combined with other require rules",
369: require->value);
370: return -1;
371: }
372:
373: /* search for = in the rules */
374: if (NULL == (eq = strchr(r, '='))) {
375: log_error_write(srv, __FILE__, __LINE__, "sb",
376: "parsing the 'require' section in 'auth.require' failed: a = is missing",
377: require->value);
378: return -1;
379: }
380:
381: /* = out of range */
382: if (eq > r + r_len) {
383: log_error_write(srv, __FILE__, __LINE__, "sb",
384: "parsing the 'require' section in 'auth.require' failed: = out of range",
385: require->value);
386:
387: return -1;
388: }
389:
390: /* the part before the = is user|group|host */
391:
392: k = r;
393: k_len = eq - r;
394: v = eq + 1;
395: v_len = r_len - k_len - 1;
396:
397: if (k_len == 4) {
398: if (0 == strncmp(k, "user", k_len)) {
399: if (username &&
400: username_len == v_len &&
401: 0 == strncmp(username, v, v_len)) {
402: return 0;
403: }
404: } else if (0 == strncmp(k, "host", k_len)) {
405: log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)");
406: } else {
407: log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
408: return -1;
409: }
410: } else if (k_len == 5) {
411: if (0 == strncmp(k, "group", k_len)) {
412: log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)");
413: } else {
414: log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k);
415: return -1;
416: }
417: } else {
418: log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
419: return -1;
420: }
421:
422: if (!e) break;
423: r = e + 1;
424: }
425:
426: log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched");
427:
428: return -1;
429: }
430:
431: #define APR_MD5_DIGESTSIZE 16
432: #define APR1_ID "$apr1$"
433:
434: /*
435: * The following MD5 password encryption code was largely borrowed from
436: * the FreeBSD 3.0 /usr/src/lib/libcrypt/crypt.c file, which is
437: * licenced as stated at the top of this file.
438: */
439:
440: static void to64(char *s, unsigned long v, int n)
441: {
442: static const unsigned char itoa64[] = /* 0 ... 63 => ASCII - 64 */
443: "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
444:
445: while (--n >= 0) {
446: *s++ = itoa64[v&0x3f];
447: v >>= 6;
448: }
449: }
450:
451: static void apr_md5_encode(const char *pw, const char *salt, char *result, size_t nbytes) {
452: /*
453: * Minimum size is 8 bytes for salt, plus 1 for the trailing NUL,
454: * plus 4 for the '$' separators, plus the password hash itself.
455: * Let's leave a goodly amount of leeway.
456: */
457:
458: char passwd[120], *p;
459: const char *sp, *ep;
460: unsigned char final[APR_MD5_DIGESTSIZE];
461: ssize_t sl, pl, i;
462: li_MD5_CTX ctx, ctx1;
463: unsigned long l;
464:
465: /*
466: * Refine the salt first. It's possible we were given an already-hashed
467: * string as the salt argument, so extract the actual salt value from it
468: * if so. Otherwise just use the string up to the first '$' as the salt.
469: */
470: sp = salt;
471:
472: /*
473: * If it starts with the magic string, then skip that.
474: */
475: if (!strncmp(sp, APR1_ID, strlen(APR1_ID))) {
476: sp += strlen(APR1_ID);
477: }
478:
479: /*
480: * It stops at the first '$' or 8 chars, whichever comes first
481: */
482: for (ep = sp; (*ep != '\0') && (*ep != '$') && (ep < (sp + 8)); ep++) {
483: continue;
484: }
485:
486: /*
487: * Get the length of the true salt
488: */
489: sl = ep - sp;
490:
491: /*
492: * 'Time to make the doughnuts..'
493: */
494: li_MD5_Init(&ctx);
495:
496: /*
497: * The password first, since that is what is most unknown
498: */
499: li_MD5_Update(&ctx, pw, strlen(pw));
500:
501: /*
502: * Then our magic string
503: */
504: li_MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
505:
506: /*
507: * Then the raw salt
508: */
509: li_MD5_Update(&ctx, sp, sl);
510:
511: /*
512: * Then just as many characters of the MD5(pw, salt, pw)
513: */
514: li_MD5_Init(&ctx1);
515: li_MD5_Update(&ctx1, pw, strlen(pw));
516: li_MD5_Update(&ctx1, sp, sl);
517: li_MD5_Update(&ctx1, pw, strlen(pw));
518: li_MD5_Final(final, &ctx1);
519: for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) {
520: li_MD5_Update(&ctx, final,
521: (pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl);
522: }
523:
524: /*
525: * Don't leave anything around in vm they could use.
526: */
527: memset(final, 0, sizeof(final));
528:
529: /*
530: * Then something really weird...
531: */
532: for (i = strlen(pw); i != 0; i >>= 1) {
533: if (i & 1) {
534: li_MD5_Update(&ctx, final, 1);
535: }
536: else {
537: li_MD5_Update(&ctx, pw, 1);
538: }
539: }
540:
541: /*
542: * Now make the output string. We know our limitations, so we
543: * can use the string routines without bounds checking.
544: */
545: strcpy(passwd, APR1_ID);
546: strncat(passwd, sp, sl);
547: strcat(passwd, "$");
548:
549: li_MD5_Final(final, &ctx);
550:
551: /*
552: * And now, just to make sure things don't run too fast..
553: * On a 60 Mhz Pentium this takes 34 msec, so you would
554: * need 30 seconds to build a 1000 entry dictionary...
555: */
556: for (i = 0; i < 1000; i++) {
557: li_MD5_Init(&ctx1);
558: if (i & 1) {
559: li_MD5_Update(&ctx1, pw, strlen(pw));
560: }
561: else {
562: li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
563: }
564: if (i % 3) {
565: li_MD5_Update(&ctx1, sp, sl);
566: }
567:
568: if (i % 7) {
569: li_MD5_Update(&ctx1, pw, strlen(pw));
570: }
571:
572: if (i & 1) {
573: li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
574: }
575: else {
576: li_MD5_Update(&ctx1, pw, strlen(pw));
577: }
578: li_MD5_Final(final,&ctx1);
579: }
580:
581: p = passwd + strlen(passwd);
582:
583: l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p, l, 4); p += 4;
584: l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p, l, 4); p += 4;
585: l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p, l, 4); p += 4;
586: l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p, l, 4); p += 4;
587: l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p, l, 4); p += 4;
588: l = final[11] ; to64(p, l, 2); p += 2;
589: *p = '\0';
590:
591: /*
592: * Don't leave anything around in vm they could use.
593: */
594: memset(final, 0, sizeof(final));
595:
596: /* FIXME
597: */
598: #define apr_cpystrn strncpy
599: apr_cpystrn(result, passwd, nbytes - 1);
600: }
601:
602: #ifdef USE_OPENSSL
603: static void apr_sha_encode(const char *pw, char *result, size_t nbytes) {
604: static const unsigned char base64_data[65] =
605: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
606: unsigned char digest[21]; /* multiple of 3 for base64 encoding */
607: int i;
608:
609: memset(result, 0, nbytes);
610:
611: /* need 5 bytes for "{SHA}", 28 for base64 (3 bytes -> 4 bytes) of SHA1 (20 bytes), 1 terminating */
612: if (nbytes < 5 + 28 + 1) return;
613:
614: SHA1((const unsigned char*) pw, strlen(pw), digest);
615: digest[20] = 0;
616:
617: strcpy(result, "{SHA}");
618: result = result + 5;
619: for (i = 0; i < 21; i += 3) {
620: unsigned int v = (digest[i] << 16) | (digest[i+1] << 8) | digest[i+2];
621: result[3] = base64_data[v & 0x3f]; v >>= 6;
622: result[2] = base64_data[v & 0x3f]; v >>= 6;
623: result[1] = base64_data[v & 0x3f]; v >>= 6;
624: result[0] = base64_data[v & 0x3f];
625: result += 4;
626: }
627: result[-1] = '='; /* last digest character was already end of string, pad it */
628: *result = '\0';
629: }
630: #endif
631:
632: /**
633: *
634: *
635: * @param password password-string from the auth-backend
636: * @param pw password-string from the client
637: */
638:
639: static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) {
640: UNUSED(srv);
641: UNUSED(req);
642:
643: if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
644: /*
645: * htdigest format
646: *
647: * user:realm:md5(user:realm:password)
648: */
649:
650: li_MD5_CTX Md5Ctx;
651: HASH HA1;
652: char a1[256];
653:
654: li_MD5_Init(&Md5Ctx);
655: li_MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
656: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
657: li_MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
658: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
659: li_MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
660: li_MD5_Final(HA1, &Md5Ctx);
661:
662: CvtHex(HA1, a1);
663:
664: if (0 == strcmp(password->ptr, a1)) {
665: return 0;
666: }
667: } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) {
668: char sample[120];
669: if (!strncmp(password->ptr, APR1_ID, strlen(APR1_ID))) {
670: /*
671: * The hash was created using $apr1$ custom algorithm.
672: */
673: apr_md5_encode(pw, password->ptr, sample, sizeof(sample));
674: return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
675: #ifdef USE_OPENSSL
676: } else if (0 == strncmp(password->ptr, "{SHA}", 5)) {
677: apr_sha_encode(pw, sample, sizeof(sample));
678: return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
679: #endif
680: } else {
681: #ifdef HAVE_CRYPT
682: char *crypted;
683:
684: /* a simple DES password is 2 + 11 characters. everything else should be longer. */
685: if (password->used < 13 + 1) {
686: return -1;
687: }
688:
689: if (0 == (crypted = crypt(pw, password->ptr))) {
690: /* crypt failed. */
691: return -1;
692: }
693:
694: if (0 == strcmp(password->ptr, crypted)) {
695: return 0;
696: }
697: #endif
698: }
699: } else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
700: if (0 == strcmp(password->ptr, pw)) {
701: return 0;
702: }
703: } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
704: #ifdef USE_LDAP
705: LDAP *ldap;
706: LDAPMessage *lm, *first;
707: char *dn;
708: int ret;
709: char *attrs[] = { LDAP_NO_ATTRS, NULL };
710: size_t i;
711:
712: /* for now we stay synchronous */
713:
714: /*
715: * 1. connect anonymously (done in plugin init)
716: * 2. get DN for uid = username
717: * 3. auth against ldap server
718: * 4. (optional) check a field
719: * 5. disconnect
720: *
721: */
722:
723: /* check username
724: *
725: * we have to protect us againt username which modifies out filter in
726: * a unpleasant way
727: */
728:
729: for (i = 0; i < username->used - 1; i++) {
730: char c = username->ptr[i];
731:
732: if (!isalpha(c) &&
733: !isdigit(c) &&
734: (c != ' ') &&
735: (c != '@') &&
736: (c != '-') &&
737: (c != '_') &&
738: (c != '.') ) {
739:
740: log_error_write(srv, __FILE__, __LINE__, "sbd",
741: "ldap: invalid character (- _.@a-zA-Z0-9 allowed) in username:", username, i);
742:
743: return -1;
744: }
745: }
746:
747: if (p->conf.auth_ldap_allow_empty_pw != 1 && pw[0] == '\0')
748: return -1;
749:
750: /* build filter */
751: buffer_copy_string_buffer(p->ldap_filter, p->conf.ldap_filter_pre);
752: buffer_append_string_buffer(p->ldap_filter, username);
753: buffer_append_string_buffer(p->ldap_filter, p->conf.ldap_filter_post);
754:
755:
756: /* 2. */
757: if (p->anon_conf->ldap == NULL ||
758: LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
759:
760: /* try again; the ldap library sometimes fails for the first call but reconnects */
761: if (p->anon_conf->ldap == NULL || ret != LDAP_SERVER_DOWN ||
762: LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
763:
764: if (auth_ldap_init(srv, p->anon_conf) != HANDLER_GO_ON)
765: return -1;
766:
767: if (p->anon_conf->ldap == NULL ||
768: LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
769: log_error_write(srv, __FILE__, __LINE__, "sssb",
770: "ldap:", ldap_err2string(ret), "filter:", p->ldap_filter);
771: return -1;
772: }
773: }
774: }
775:
776: if (NULL == (first = ldap_first_entry(p->anon_conf->ldap, lm))) {
777: log_error_write(srv, __FILE__, __LINE__, "s", "ldap ...");
778:
779: ldap_msgfree(lm);
780:
781: return -1;
782: }
783:
784: if (NULL == (dn = ldap_get_dn(p->anon_conf->ldap, first))) {
785: log_error_write(srv, __FILE__, __LINE__, "s", "ldap ...");
786:
787: ldap_msgfree(lm);
788:
789: return -1;
790: }
791:
792: ldap_msgfree(lm);
793:
794:
795: /* 3. */
796: if (NULL == (ldap = ldap_init(p->conf.auth_ldap_hostname->ptr, LDAP_PORT))) {
797: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
798: return -1;
799: }
800:
801: ret = LDAP_VERSION3;
802: if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
803: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
804:
805: ldap_unbind_s(ldap);
806:
807: return -1;
808: }
809:
810: if (p->conf.auth_ldap_starttls == 1) {
811: if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(ldap, NULL, NULL))) {
812: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
813:
814: ldap_unbind_s(ldap);
815:
816: return -1;
817: }
818: }
819:
820:
821: if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(ldap, dn, pw))) {
822: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
823:
824: ldap_unbind_s(ldap);
825:
826: return -1;
827: }
828:
829: /* 5. */
830: ldap_unbind_s(ldap);
831:
832: /* everything worked, good, access granted */
833:
834: return 0;
835: #endif
836: }
837: return -1;
838: }
839:
840: int http_auth_basic_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, const char *realm_str) {
841: buffer *username, *password;
842: char *pw;
843:
844: data_string *realm;
845:
846: realm = (data_string *)array_get_element(req, "realm");
847:
848: username = buffer_init();
849:
850: if (!base64_decode(username, realm_str)) {
851: log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username);
852:
853: buffer_free(username);
854: return 0;
855: }
856:
857: /* r2 == user:password */
858: if (NULL == (pw = strchr(username->ptr, ':'))) {
859: log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username);
860:
861: buffer_free(username);
862: return 0;
863: }
864:
865: *pw++ = '\0';
866:
867: username->used = pw - username->ptr;
868:
869: password = buffer_init();
870: /* copy password to r1 */
871: if (http_auth_get_password(srv, p, username, realm->value, password)) {
872: buffer_free(username);
873: buffer_free(password);
874:
875: if (AUTH_BACKEND_UNSET == p->conf.auth_backend) {
876: log_error_write(srv, __FILE__, __LINE__, "s", "auth.backend is not set");
877: } else {
878: log_error_write(srv, __FILE__, __LINE__, "ss", "get_password failed, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
879: }
880:
881: return 0;
882: }
883:
884: /* password doesn't match */
885: if (http_auth_basic_password_compare(srv, p, req, username, realm->value, password, pw)) {
886: log_error_write(srv, __FILE__, __LINE__, "sbsBss", "password doesn't match for", con->uri.path, "username:", username, ", IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
887:
888: buffer_free(username);
889: buffer_free(password);
890:
891: return 0;
892: }
893:
894: /* value is our allow-rules */
895: if (http_auth_match_rules(srv, req, username->ptr, NULL, NULL)) {
896: buffer_free(username);
897: buffer_free(password);
898:
899: log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match");
900:
901: return 0;
902: }
903:
904: /* remember the username */
905: buffer_copy_string_buffer(p->auth_user, username);
906:
907: buffer_free(username);
908: buffer_free(password);
909:
910: return 1;
911: }
912:
913: typedef struct {
914: const char *key;
915: int key_len;
916: char **ptr;
917: } digest_kv;
918:
919: /* return values: -1: error/bad request, 0: failed, 1: success */
920: int http_auth_digest_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, const char *realm_str) {
921: char a1[256];
922: char a2[256];
923:
924: char *username = NULL;
925: char *realm = NULL;
926: char *nonce = NULL;
927: char *uri = NULL;
928: char *algorithm = NULL;
929: char *qop = NULL;
930: char *cnonce = NULL;
931: char *nc = NULL;
932: char *respons = NULL;
933:
934: char *e, *c;
935: const char *m = NULL;
936: int i;
937: buffer *password, *b, *username_buf, *realm_buf;
938:
939: li_MD5_CTX Md5Ctx;
940: HASH HA1;
941: HASH HA2;
942: HASH RespHash;
943: HASHHEX HA2Hex;
944:
945:
946: /* init pointers */
947: #define S(x) \
948: x, sizeof(x)-1, NULL
949: digest_kv dkv[10] = {
950: { S("username=") },
951: { S("realm=") },
952: { S("nonce=") },
953: { S("uri=") },
954: { S("algorithm=") },
955: { S("qop=") },
956: { S("cnonce=") },
957: { S("nc=") },
958: { S("response=") },
959:
960: { NULL, 0, NULL }
961: };
962: #undef S
963:
964: dkv[0].ptr = &username;
965: dkv[1].ptr = &realm;
966: dkv[2].ptr = &nonce;
967: dkv[3].ptr = &uri;
968: dkv[4].ptr = &algorithm;
969: dkv[5].ptr = &qop;
970: dkv[6].ptr = &cnonce;
971: dkv[7].ptr = &nc;
972: dkv[8].ptr = &respons;
973:
974: UNUSED(req);
975:
976: if (p->conf.auth_backend != AUTH_BACKEND_HTDIGEST &&
977: p->conf.auth_backend != AUTH_BACKEND_PLAIN) {
978: log_error_write(srv, __FILE__, __LINE__, "s",
979: "digest: unsupported backend (only htdigest or plain)");
980:
981: return -1;
982: }
983:
984: b = buffer_init_string(realm_str);
985:
986: /* parse credentials from client */
987: for (c = b->ptr; *c; c++) {
988: /* skip whitespaces */
989: while (*c == ' ' || *c == '\t') c++;
990: if (!*c) break;
991:
992: for (i = 0; dkv[i].key; i++) {
993: if ((0 == strncmp(c, dkv[i].key, dkv[i].key_len))) {
994: if ((c[dkv[i].key_len] == '"') &&
995: (NULL != (e = strchr(c + dkv[i].key_len + 1, '"')))) {
996: /* value with "..." */
997: *(dkv[i].ptr) = c + dkv[i].key_len + 1;
998: c = e;
999:
1000: *e = '\0';
1001: } else if (NULL != (e = strchr(c + dkv[i].key_len, ','))) {
1002: /* value without "...", terminated by ',' */
1003: *(dkv[i].ptr) = c + dkv[i].key_len;
1004: c = e;
1005:
1006: *e = '\0';
1007: } else {
1008: /* value without "...", terminated by EOL */
1009: *(dkv[i].ptr) = c + dkv[i].key_len;
1010: c += strlen(c) - 1;
1011: }
1012: }
1013: }
1014: }
1015:
1016: if (p->conf.auth_debug > 1) {
1017: log_error_write(srv, __FILE__, __LINE__, "ss", "username", username);
1018: log_error_write(srv, __FILE__, __LINE__, "ss", "realm", realm);
1019: log_error_write(srv, __FILE__, __LINE__, "ss", "nonce", nonce);
1020: log_error_write(srv, __FILE__, __LINE__, "ss", "uri", uri);
1021: log_error_write(srv, __FILE__, __LINE__, "ss", "algorithm", algorithm);
1022: log_error_write(srv, __FILE__, __LINE__, "ss", "qop", qop);
1023: log_error_write(srv, __FILE__, __LINE__, "ss", "cnonce", cnonce);
1024: log_error_write(srv, __FILE__, __LINE__, "ss", "nc", nc);
1025: log_error_write(srv, __FILE__, __LINE__, "ss", "response", respons);
1026: }
1027:
1028: /* check if everything is transmitted */
1029: if (!username ||
1030: !realm ||
1031: !nonce ||
1032: !uri ||
1033: (qop && (!nc || !cnonce)) ||
1034: !respons ) {
1035: /* missing field */
1036:
1037: log_error_write(srv, __FILE__, __LINE__, "s",
1038: "digest: missing field");
1039:
1040: buffer_free(b);
1041: return -1;
1042: }
1043:
1044: /**
1045: * protect the md5-sess against missing cnonce and nonce
1046: */
1047: if (algorithm &&
1048: 0 == strcasecmp(algorithm, "md5-sess") &&
1049: (!nonce || !cnonce)) {
1050: log_error_write(srv, __FILE__, __LINE__, "s",
1051: "digest: (md5-sess: missing field");
1052:
1053: buffer_free(b);
1054: return -1;
1055: }
1056:
1057: if (qop && strcasecmp(qop, "auth-int") == 0) {
1058: log_error_write(srv, __FILE__, __LINE__, "s",
1059: "digest: qop=auth-int not supported");
1060:
1061: buffer_free(b);
1062: return -1;
1063: }
1064:
1065: m = get_http_method_name(con->request.http_method);
1066:
1067: /* password-string == HA1 */
1068: password = buffer_init();
1069: username_buf = buffer_init_string(username);
1070: realm_buf = buffer_init_string(realm);
1071: if (http_auth_get_password(srv, p, username_buf, realm_buf, password)) {
1072: buffer_free(password);
1073: buffer_free(b);
1074: buffer_free(username_buf);
1075: buffer_free(realm_buf);
1076: return 0;
1077: }
1078:
1079: buffer_free(username_buf);
1080: buffer_free(realm_buf);
1081:
1082: if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
1083: /* generate password from plain-text */
1084: li_MD5_Init(&Md5Ctx);
1085: li_MD5_Update(&Md5Ctx, (unsigned char *)username, strlen(username));
1086: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1087: li_MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm));
1088: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1089: li_MD5_Update(&Md5Ctx, (unsigned char *)password->ptr, password->used - 1);
1090: li_MD5_Final(HA1, &Md5Ctx);
1091: } else if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
1092: /* HA1 */
1093: /* transform the 32-byte-hex-md5 to a 16-byte-md5 */
1094: for (i = 0; i < HASHLEN; i++) {
1095: HA1[i] = hex2int(password->ptr[i*2]) << 4;
1096: HA1[i] |= hex2int(password->ptr[i*2+1]);
1097: }
1098: } else {
1099: /* we already check that above */
1100: SEGFAULT();
1101: }
1102:
1103: buffer_free(password);
1104:
1105: if (algorithm &&
1106: strcasecmp(algorithm, "md5-sess") == 0) {
1107: li_MD5_Init(&Md5Ctx);
1108: /* Errata ID 1649: http://www.rfc-editor.org/errata_search.php?rfc=2617 */
1109: CvtHex(HA1, a1);
1110: li_MD5_Update(&Md5Ctx, (unsigned char *)a1, 32);
1111: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1112: li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
1113: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1114: li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
1115: li_MD5_Final(HA1, &Md5Ctx);
1116: }
1117:
1118: CvtHex(HA1, a1);
1119:
1120: /* calculate H(A2) */
1121: li_MD5_Init(&Md5Ctx);
1122: li_MD5_Update(&Md5Ctx, (unsigned char *)m, strlen(m));
1123: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1124: li_MD5_Update(&Md5Ctx, (unsigned char *)uri, strlen(uri));
1125: /* qop=auth-int not supported, already checked above */
1126: /*
1127: if (qop && strcasecmp(qop, "auth-int") == 0) {
1128: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1129: li_MD5_Update(&Md5Ctx, (unsigned char *) [body checksum], HASHHEXLEN);
1130: }
1131: */
1132: li_MD5_Final(HA2, &Md5Ctx);
1133: CvtHex(HA2, HA2Hex);
1134:
1135: /* calculate response */
1136: li_MD5_Init(&Md5Ctx);
1137: li_MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN);
1138: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1139: li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
1140: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1141: if (qop && *qop) {
1142: li_MD5_Update(&Md5Ctx, (unsigned char *)nc, strlen(nc));
1143: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1144: li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
1145: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1146: li_MD5_Update(&Md5Ctx, (unsigned char *)qop, strlen(qop));
1147: li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
1148: };
1149: li_MD5_Update(&Md5Ctx, (unsigned char *)HA2Hex, HASHHEXLEN);
1150: li_MD5_Final(RespHash, &Md5Ctx);
1151: CvtHex(RespHash, a2);
1152:
1153: if (0 != strcmp(a2, respons)) {
1154: /* digest not ok */
1155:
1156: if (p->conf.auth_debug) {
1157: log_error_write(srv, __FILE__, __LINE__, "sss",
1158: "digest: digest mismatch", a2, respons);
1159: }
1160:
1161: log_error_write(srv, __FILE__, __LINE__, "ssss",
1162: "digest: auth failed for ", username, ": wrong password, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
1163:
1164: buffer_free(b);
1165: return 0;
1166: }
1167:
1168: /* value is our allow-rules */
1169: if (http_auth_match_rules(srv, req, username, NULL, NULL)) {
1170: buffer_free(b);
1171:
1172: log_error_write(srv, __FILE__, __LINE__, "s",
1173: "digest: rules did match");
1174:
1175: return 0;
1176: }
1177:
1178: /* remember the username */
1179: buffer_copy_string(p->auth_user, username);
1180:
1181: buffer_free(b);
1182:
1183: if (p->conf.auth_debug) {
1184: log_error_write(srv, __FILE__, __LINE__, "s",
1185: "digest: auth ok");
1186: }
1187: return 1;
1188: }
1189:
1190:
1191: int http_auth_digest_generate_nonce(server *srv, mod_auth_plugin_data *p, buffer *fn, char out[33]) {
1192: HASH h;
1193: li_MD5_CTX Md5Ctx;
1194: char hh[32];
1195:
1196: UNUSED(p);
1197:
1198: /* generate shared-secret */
1199: li_MD5_Init(&Md5Ctx);
1200: li_MD5_Update(&Md5Ctx, (unsigned char *)fn->ptr, fn->used - 1);
1201: li_MD5_Update(&Md5Ctx, (unsigned char *)"+", 1);
1202:
1203: /* we assume sizeof(time_t) == 4 here, but if not it ain't a problem at all */
1204: LI_ltostr(hh, srv->cur_ts);
1205: li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
1206: li_MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
1207: LI_ltostr(hh, rand());
1208: li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
1209:
1210: li_MD5_Final(h, &Md5Ctx);
1211:
1212: CvtHex(h, out);
1213:
1214: return 0;
1215: }