lighttpd 1.4.x https://www.lighttpd.net/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1208 lines
31 KiB

#include "server.h"
#include "log.h"
#include "http_auth.h"
#include "inet_ntop_cache.h"
#include "stream.h"
#ifdef HAVE_CRYPT_H
# include <crypt.h>
#elif defined(__linux__)
/* linux needs _XOPEN_SOURCE */
# define _XOPEN_SOURCE
#endif
#ifdef HAVE_LIBCRYPT
# define HAVE_CRYPT
#endif
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <unistd.h>
#include <ctype.h>
#include "md5.h"
#ifdef USE_OPENSSL
#include <openssl/sha.h>
#endif
#define HASHLEN 16
#define HASHHEXLEN 32
typedef unsigned char HASH[HASHLEN];
typedef char HASHHEX[HASHHEXLEN+1];
static void CvtHex(const HASH Bin, char Hex[33]) {
unsigned short i;
for (i = 0; i < 16; i++) {
Hex[i*2] = int2hex((Bin[i] >> 4) & 0xf);
Hex[i*2+1] = int2hex(Bin[i] & 0xf);
}
Hex[32] = '\0';
}
/**
* the $apr1$ handling is taken from apache 1.3.x
*/
/*
* The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
* MD5 crypt() function, which is licenced as follows:
* ----------------------------------------------------------------------------
* "THE BEER-WARE LICENSE" (Revision 42):
* <phk@login.dknet.dk> wrote this file. As long as you retain this notice you
* can do whatever you want with this stuff. If we meet some day, and you think
* this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
* ----------------------------------------------------------------------------
*/
handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
static const char base64_pad = '=';
/* "A-Z a-z 0-9 + /" maps to 0-63 */
static const short base64_reverse_table[256] = {
/* 0 1 2 3 4 5 6 7 8 9 A B C D E F */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x00 - 0x0F */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x10 - 0x1F */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, /* 0x20 - 0x2F */
52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, /* 0x30 - 0x3F */
-1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, /* 0x40 - 0x4F */
15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, /* 0x50 - 0x5F */
-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, /* 0x60 - 0x6F */
41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1, /* 0x70 - 0x7F */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x80 - 0x8F */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x90 - 0x9F */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xA0 - 0xAF */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xB0 - 0xBF */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xC0 - 0xCF */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xD0 - 0xDF */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xE0 - 0xEF */
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xF0 - 0xFF */
};
static unsigned char * base64_decode(buffer *out, const char *in) {
unsigned char *result;
int ch, j = 0, k;
size_t i;
size_t in_len = strlen(in);
buffer_prepare_copy(out, in_len);
result = (unsigned char *)out->ptr;
ch = in[0];
/* run through the whole string, converting as we go */
for (i = 0; i < in_len; i++) {
ch = (unsigned char) in[i];
if (ch == '\0') break;
if (ch == base64_pad) break;
ch = base64_reverse_table[ch];
if (ch < 0) continue;
switch(i % 4) {
case 0:
result[j] = ch << 2;
break;
case 1:
result[j++] |= ch >> 4;
result[j] = (ch & 0x0f) << 4;
break;
case 2:
result[j++] |= ch >>2;
result[j] = (ch & 0x03) << 6;
break;
case 3:
result[j++] |= ch;
break;
}
}
k = j;
/* mop things up if we ended on a boundary */
if (ch == base64_pad) {
switch(i % 4) {
case 0:
case 1:
return NULL;
case 2:
k++;
case 3:
result[k++] = 0;
}
}
result[k] = '\0';
out->used = k;
return result;
}
static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) {
int ret = -1;
if (!username->used|| !realm->used) return -1;
if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
stream f;
char * f_line;
if (buffer_is_empty(p->conf.auth_htdigest_userfile)) return -1;
if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) {
log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno));
return -1;
}
f_line = f.start;
while (f_line - f.start != f.size) {
char *f_user, *f_pwd, *e, *f_realm;
size_t u_len, pwd_len, r_len;
f_user = f_line;
/*
* htdigest format
*
* user:realm:md5(user:realm:password)
*/
if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
log_error_write(srv, __FILE__, __LINE__, "sbs",
"parsed error in", p->conf.auth_htdigest_userfile,
"expected 'username:realm:hashed password'");
stream_close(&f);
return -1;
}
if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) {
log_error_write(srv, __FILE__, __LINE__, "sbs",
"parsed error in", p->conf.auth_plain_userfile,
"expected 'username:realm:hashed password'");
stream_close(&f);
return -1;
}
/* get pointers to the fields */
u_len = f_realm - f_user;
f_realm++;
r_len = f_pwd - f_realm;
f_pwd++;
if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
pwd_len = e - f_pwd;
} else {
pwd_len = f.size - (f_pwd - f.start);
}
if (username->used - 1 == u_len &&
(realm->used - 1 == r_len) &&
(0 == strncmp(username->ptr, f_user, u_len)) &&
(0 == strncmp(realm->ptr, f_realm, r_len))) {
/* found */
buffer_copy_string_len(password, f_pwd, pwd_len);
ret = 0;
break;
}
/* EOL */
if (!e) break;
f_line = e + 1;
}
stream_close(&f);
} else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD ||
p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
stream f;
char * f_line;
buffer *auth_fn;
auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile;
if (buffer_is_empty(auth_fn)) return -1;
if (0 != stream_open(&f, auth_fn)) {
log_error_write(srv, __FILE__, __LINE__, "sbss",
"opening plain-userfile", auth_fn, "failed:", strerror(errno));
return -1;
}
f_line = f.start;
while (f_line - f.start != f.size) {
char *f_user, *f_pwd, *e;
size_t u_len, pwd_len;
f_user = f_line;
/*
* htpasswd format
*
* user:crypted passwd
*/
if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
log_error_write(srv, __FILE__, __LINE__, "sbs",
"parsed error in", auth_fn,
"expected 'username:hashed password'");
stream_close(&f);
return -1;
}
/* get pointers to the fields */
u_len = f_pwd - f_user;
f_pwd++;
if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
pwd_len = e - f_pwd;
} else {
pwd_len = f.size - (f_pwd - f.start);
}
if (username->used - 1 == u_len &&
(0 == strncmp(username->ptr, f_user, u_len))) {
/* found */
buffer_copy_string_len(password, f_pwd, pwd_len);
ret = 0;
break;
}
/* EOL */
if (!e) break;
f_line = e + 1;
}
stream_close(&f);
} else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
ret = 0;
} else {
return -1;
}
return ret;
}
static int http_auth_match_rules(server *srv, mod_auth_plugin_data *p, const char *url, const char *username, const char *group, const char *host) {
const char *r = NULL, *rules = NULL;
size_t i;
int username_len;
data_string *require;
array *req;
UNUSED(group);
UNUSED(host);
/* check what has to be match to fullfil the request */
/* search auth-directives for path */
for (i = 0; i < p->conf.auth_require->used; i++) {
if (p->conf.auth_require->data[i]->key->used == 0) continue;
if (0 == strncmp(url, p->conf.auth_require->data[i]->key->ptr, p->conf.auth_require->data[i]->key->used - 1)) {
break;
}
}
if (i == p->conf.auth_require->used) {
return -1;
}
req = ((data_array *)(p->conf.auth_require->data[i]))->value;
require = (data_string *)array_get_element(req, "require");
/* if we get here, the user we got a authed user */
if (0 == strcmp(require->value->ptr, "valid-user")) {
return 0;
}
/* user=name1|group=name3|host=name4 */
/* seperate the string by | */
#if 0
log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value);
#endif
username_len = username ? strlen(username) : 0;
r = rules = require->value->ptr;
while (1) {
const char *eq;
const char *k, *v, *e;
int k_len, v_len, r_len;
e = strchr(r, '|');
if (e) {
r_len = e - r;
} else {
r_len = strlen(rules) - (r - rules);
}
/* from r to r + r_len is a rule */
if (0 == strncmp(r, "valid-user", r_len)) {
log_error_write(srv, __FILE__, __LINE__, "sb",
"parsing the 'require' section in 'auth.require' failed: valid-user cannot be combined with other require rules",
require->value);
return -1;
}
/* search for = in the rules */
if (NULL == (eq = strchr(r, '='))) {
log_error_write(srv, __FILE__, __LINE__, "sb",
"parsing the 'require' section in 'auth.require' failed: a = is missing",
require->value);
return -1;
}
/* = out of range */
if (eq > r + r_len) {
log_error_write(srv, __FILE__, __LINE__, "sb",
"parsing the 'require' section in 'auth.require' failed: = out of range",
require->value);
return -1;
}
/* the part before the = is user|group|host */
k = r;
k_len = eq - r;
v = eq + 1;
v_len = r_len - k_len - 1;
if (k_len == 4) {
if (0 == strncmp(k, "user", k_len)) {
if (username &&
username_len == v_len &&
0 == strncmp(username, v, v_len)) {
return 0;
}
} else if (0 == strncmp(k, "host", k_len)) {
log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)");
} else {
log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
return -1;
}
} else if (k_len == 5) {
if (0 == strncmp(k, "group", k_len)) {
log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)");
} else {
log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k);
return -1;
}
} else {
log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
return -1;
}
if (!e) break;
r = e + 1;
}
log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched");
return -1;
}
#define APR_MD5_DIGESTSIZE 16
#define APR1_ID "$apr1$"
/*
* The following MD5 password encryption code was largely borrowed from
* the FreeBSD 3.0 /usr/src/lib/libcrypt/crypt.c file, which is
* licenced as stated at the top of this file.
*/
static void to64(char *s, unsigned long v, int n)
{
static const unsigned char itoa64[] = /* 0 ... 63 => ASCII - 64 */
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
while (--n >= 0) {
*s++ = itoa64[v&0x3f];
v >>= 6;
}
}
static void apr_md5_encode(const char *pw, const char *salt, char *result, size_t nbytes) {
/*
* Minimum size is 8 bytes for salt, plus 1 for the trailing NUL,
* plus 4 for the '$' separators, plus the password hash itself.
* Let's leave a goodly amount of leeway.
*/
char passwd[120], *p;
const char *sp, *ep;
unsigned char final[APR_MD5_DIGESTSIZE];
ssize_t sl, pl, i;
li_MD5_CTX ctx, ctx1;
unsigned long l;
/*
* Refine the salt first. It's possible we were given an already-hashed
* string as the salt argument, so extract the actual salt value from it
* if so. Otherwise just use the string up to the first '$' as the salt.
*/
sp = salt;
/*
* If it starts with the magic string, then skip that.
*/
if (!strncmp(sp, APR1_ID, strlen(APR1_ID))) {
sp += strlen(APR1_ID);
}
/*
* It stops at the first '$' or 8 chars, whichever comes first
*/
for (ep = sp; (*ep != '\0') && (*ep != '$') && (ep < (sp + 8)); ep++) {
continue;
}
/*
* Get the length of the true salt
*/
sl = ep - sp;
/*
* 'Time to make the doughnuts..'
*/
li_MD5_Init(&ctx);
/*
* The password first, since that is what is most unknown
*/
li_MD5_Update(&ctx, pw, strlen(pw));
/*
* Then our magic string
*/
li_MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
/*
* Then the raw salt
*/
li_MD5_Update(&ctx, sp, sl);
/*
* Then just as many characters of the MD5(pw, salt, pw)
*/
li_MD5_Init(&ctx1);
li_MD5_Update(&ctx1, pw, strlen(pw));
li_MD5_Update(&ctx1, sp, sl);
li_MD5_Update(&ctx1, pw, strlen(pw));
li_MD5_Final(final, &ctx1);
for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) {
li_MD5_Update(&ctx, final,
(pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl);
}
/*
* Don't leave anything around in vm they could use.
*/
memset(final, 0, sizeof(final));
/*
* Then something really weird...
*/
for (i = strlen(pw); i != 0; i >>= 1) {
if (i & 1) {
li_MD5_Update(&ctx, final, 1);
}
else {
li_MD5_Update(&ctx, pw, 1);
}
}
/*
* Now make the output string. We know our limitations, so we
* can use the string routines without bounds checking.
*/
strcpy(passwd, APR1_ID);
strncat(passwd, sp, sl);
strcat(passwd, "$");
li_MD5_Final(final, &ctx);
/*
* And now, just to make sure things don't run too fast..
* On a 60 Mhz Pentium this takes 34 msec, so you would
* need 30 seconds to build a 1000 entry dictionary...
*/
for (i = 0; i < 1000; i++) {
li_MD5_Init(&ctx1);
if (i & 1) {
li_MD5_Update(&ctx1, pw, strlen(pw));
}
else {
li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
}
if (i % 3) {
li_MD5_Update(&ctx1, sp, sl);
}
if (i % 7) {
li_MD5_Update(&ctx1, pw, strlen(pw));
}
if (i & 1) {
li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
}
else {
li_MD5_Update(&ctx1, pw, strlen(pw));
}
li_MD5_Final(final,&ctx1);
}
p = passwd + strlen(passwd);
l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p, l, 4); p += 4;
l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p, l, 4); p += 4;
l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p, l, 4); p += 4;
l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p, l, 4); p += 4;
l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p, l, 4); p += 4;
l = final[11] ; to64(p, l, 2); p += 2;
*p = '\0';
/*
* Don't leave anything around in vm they could use.
*/
memset(final, 0, sizeof(final));
/* FIXME
*/
#define apr_cpystrn strncpy
apr_cpystrn(result, passwd, nbytes - 1);
}
#ifdef USE_OPENSSL
static void apr_sha_encode(const char *pw, char *result, size_t nbytes) {
static const unsigned char base64_data[65] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
unsigned char digest[21]; /* multiple of 3 for base64 encoding */
int i;
memset(result, 0, nbytes);
/* need 5 bytes for "{SHA}", 28 for base64 (3 bytes -> 4 bytes) of SHA1 (20 bytes), 1 terminating */
if (nbytes < 5 + 28 + 1) return;
SHA1((const unsigned char*) pw, strlen(pw), digest);
digest[20] = 0;
strcpy(result, "{SHA}");
result = result + 5;
for (i = 0; i < 21; i += 3) {
unsigned int v = (digest[i] << 16) | (digest[i+1] << 8) | digest[i+2];
result[3] = base64_data[v & 0x3f]; v >>= 6;
result[2] = base64_data[v & 0x3f]; v >>= 6;
result[1] = base64_data[v & 0x3f]; v >>= 6;
result[0] = base64_data[v & 0x3f];
result += 4;
}
result[-1] = '='; /* last digest character was already end of string, pad it */
*result = '\0';
}
#endif
/**
*
*
* @param password password-string from the auth-backend
* @param pw password-string from the client
*/
static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) {
UNUSED(srv);
UNUSED(req);
if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
/*
* htdigest format
*
* user:realm:md5(user:realm:password)
*/
li_MD5_CTX Md5Ctx;
HASH HA1;
char a1[256];
li_MD5_Init(&Md5Ctx);
li_MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
li_MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
li_MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
li_MD5_Final(HA1, &Md5Ctx);
CvtHex(HA1, a1);
if (0 == strcmp(password->ptr, a1)) {
return 0;
}
} else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) {
char sample[120];
if (!strncmp(password->ptr, APR1_ID, strlen(APR1_ID))) {
/*
* The hash was created using $apr1$ custom algorithm.
*/
apr_md5_encode(pw, password->ptr, sample, sizeof(sample));
return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
#ifdef USE_OPENSSL
} else if (0 == strncmp(password->ptr, "{SHA}", 5)) {
apr_sha_encode(pw, sample, sizeof(sample));
return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
#endif
} else {
#ifdef HAVE_CRYPT
char *crypted;
/* a simple DES password is 2 + 11 characters. everything else should be longer. */
if (password->used < 13 + 1) {
return -1;
}
if (0 == (crypted = crypt(pw, password->ptr))) {
/* crypt failed. */
return -1;
}
if (0 == strcmp(password->ptr, crypted)) {
return 0;
}
#endif
}
} else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
if (0 == strcmp(password->ptr, pw)) {
return 0;
}
} else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
#ifdef USE_LDAP
LDAP *ldap;
LDAPMessage *lm, *first;
char *dn;
int ret;
char *attrs[] = { LDAP_NO_ATTRS, NULL };
size_t i;
/* for now we stay synchronous */
/*
* 1. connect anonymously (done in plugin init)
* 2. get DN for