|
|
|
@ -538,7 +538,7 @@ typedef struct {
|
|
|
|
|
char **ptr;
|
|
|
|
|
} digest_kv;
|
|
|
|
|
|
|
|
|
|
static handler_t mod_auth_send_401_unauthorized_digest(server *srv, connection *con, buffer *realm, int nonce_stale);
|
|
|
|
|
static handler_t mod_auth_send_401_unauthorized_digest(server *srv, connection *con, const struct http_auth_require_t *require, int nonce_stale);
|
|
|
|
|
|
|
|
|
|
static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d, const struct http_auth_require_t *require, const struct http_auth_backend_t *backend) {
|
|
|
|
|
buffer *vb = http_header_request_get(con, HTTP_HEADER_AUTHORIZATION, CONST_STR_LEN("Authorization"));
|
|
|
|
@ -607,11 +607,11 @@ static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (NULL == vb) {
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 0);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (0 != strncasecmp(vb->ptr, "Digest ", sizeof("Digest ")-1)) {
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 0);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 0);
|
|
|
|
|
} else {
|
|
|
|
|
size_t n = buffer_string_length(vb);
|
|
|
|
|
#ifdef __COVERITY__
|
|
|
|
@ -682,7 +682,7 @@ static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d,
|
|
|
|
|
log_error_write(srv, __FILE__, __LINE__, "s",
|
|
|
|
|
"digest: realm mismatch");
|
|
|
|
|
buffer_free(b);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 0);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
@ -741,7 +741,7 @@ static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d,
|
|
|
|
|
case HANDLER_ERROR:
|
|
|
|
|
default:
|
|
|
|
|
buffer_free(b);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 0);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 0);
|
|
|
|
|
}
|
|
|
|
|
memcpy(HA1, ai.digest, ai.dlen);
|
|
|
|
|
|
|
|
|
@ -799,13 +799,13 @@ static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d,
|
|
|
|
|
"digest: auth failed for ", username, ": wrong password, IP:", con->dst_addr_buf);
|
|
|
|
|
|
|
|
|
|
buffer_free(b);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 0);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* value is our allow-rules */
|
|
|
|
|
if (!http_auth_match_rules(require, username, NULL, NULL)) {
|
|
|
|
|
buffer_free(b);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 0);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* check age of nonce. Note, random data is used in nonce generation
|
|
|
|
@ -827,7 +827,7 @@ static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d,
|
|
|
|
|
|| ts > srv->cur_ts || srv->cur_ts - ts > 600) { /*(10 mins)*/
|
|
|
|
|
/* nonce is stale; have client regenerate digest */
|
|
|
|
|
buffer_free(b);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require->realm, 1);
|
|
|
|
|
return mod_auth_send_401_unauthorized_digest(srv, con, require, 1);
|
|
|
|
|
} /*(future: might send nextnonce when expiration is imminent)*/
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -838,7 +838,7 @@ static handler_t mod_auth_check_digest(server *srv, connection *con, void *p_d,
|
|
|
|
|
return HANDLER_GO_ON;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static handler_t mod_auth_send_401_unauthorized_digest(server *srv, connection *con, buffer *realm, int nonce_stale) {
|
|
|
|
|
static handler_t mod_auth_send_401_unauthorized_digest(server *srv, connection *con, const struct http_auth_require_t *require, int nonce_stale) {
|
|
|
|
|
li_MD5_CTX Md5Ctx;
|
|
|
|
|
HASH h;
|
|
|
|
|
char hh[33];
|
|
|
|
@ -865,7 +865,7 @@ static handler_t mod_auth_send_401_unauthorized_digest(server *srv, connection *
|
|
|
|
|
con->mode = DIRECT;
|
|
|
|
|
|
|
|
|
|
buffer_copy_string_len(srv->tmp_buf, CONST_STR_LEN("Digest realm=\""));
|
|
|
|
|
buffer_append_string_buffer(srv->tmp_buf, realm);
|
|
|
|
|
buffer_append_string_buffer(srv->tmp_buf, require->realm);
|
|
|
|
|
buffer_append_string_len(srv->tmp_buf, CONST_STR_LEN("\", charset=\"UTF-8\", nonce=\""));
|
|
|
|
|
buffer_append_uint_hex(srv->tmp_buf, (uintmax_t)srv->cur_ts);
|
|
|
|
|
buffer_append_string_len(srv->tmp_buf, CONST_STR_LEN(":"));
|
|
|
|
|