Commit Graph

28 Commits

Author SHA1 Message Date
Glenn Strauss e1188e770e [mod_auth] "nonce_secret" option to validate nonce (fixes #2976)
"nonce_secret" option to validate nonce was generated by the server

Marginally hardens HTTP Digest Auth.  Necessary piece, but not
sufficient, to restrict re-use of nonce (mitigations for replay
or limiting nonce count reuse via nc=... are not implemented)

  "Digest auth nonces are not validated"
2020-07-08 19:54:29 -04:00
Glenn Strauss 7c7f8c467c [multiple] split con, request (very large change)
NB: r->tmp_buf == srv->tmp_buf (pointer is copied for quicker access)

NB: request read and write chunkqueues currently point to connection
    chunkqueues; per-request and per-connection chunkqueues are
    not distinct from one another
      con->read_queue  == r->read_queue
      con->write_queue == r->write_queue

NB: in the future, a separate connection config may be needed for
    connection-level module hooks.  Similarly, might need to have
    per-request chunkqueues separate from per-connection chunkqueues.
    Should probably also have a request_reset() which is distinct from
2020-07-08 19:54:29 -04:00
Glenn Strauss 010c28949c [multiple] prefer (connection *) to (srv *)
convert all log_error_write() to log_error() and pass (log_error_st *)

use con->errh in preference to srv->errh (even though currently same)

avoid passing (server *) when previously used only for logging (errh)
2020-07-08 19:54:28 -04:00
Glenn Strauss a03afc9043 [mod_auth] inline arrays in http_auth_require_t
also, keep ptr to const buffer *realm rather than copy
2020-07-08 18:08:52 -04:00
Glenn Strauss 0e749c1c84 [mod_auth] http_auth_const_time_memeq() (#2975, #2976)
use constant time comparison when comparing digests

(mitigation for brute-force timing attacks against digests
 generated using the same nonce)

  "Digest auth nonces are not validated"
  "safe_memcmp new function proposal"
2019-09-08 18:26:58 -04:00
Glenn Strauss 89dfbf14a5 [mod_auth] http_auth_const_time_memeq_pad()
rename http_auth_const_time_memeq() to http_auth_const_time_memeq_pad()
for constant time padded comparison of strings of potentially different
2019-09-08 18:25:39 -04:00
Glenn Strauss 60f4cf3ad8 [mod_auth] http_auth_info_t digest abstraction 2019-03-07 00:32:17 -05:00
Glenn Strauss 07fef25867 [mod_auth] http_auth_digest_hex2bin()
replace http_auth_md5_hex2bin() with more generic function to handle
digests of different lengths
2019-03-07 00:32:17 -05:00
Glenn Strauss 3dd3cde902 [core] abstraction layer for HTTP header manip
convert existing calls to manip request/response headers
convert existing calls to manip environment array (often header-related)
2018-09-23 18:01:58 -04:00
Glenn Strauss 04d76e7afd [core] some header cleanup
provide standard types in first.h instead of base.h
provide lighttpd types in base_decls.h instead of settings.h
reduce headers exposed by headers for core data structures
  do not expose <pcre.h> or <stdlib.h> in headers
move stat_cache_entry to stat_cache.h
reduce use of "server.h" and "base.h" in headers
2018-04-08 22:22:23 -04:00
Glenn Strauss 81b7e8e2fb [mod_auth] constant time compare plain passwords
(digests have same length)
2018-03-11 00:28:56 -05:00
Glenn Strauss b0c66266d9 [core] initialize globals at top of main()
initialize globals (including file-scoped static globals) at top of main
2017-01-31 14:40:05 -05:00
Glenn Strauss a401c9469a [mod_auth] HTTP Basic auth backends also do authz (#1817)
HTTP Basic auth backends now do both authn and authz
in order to allow provide a means to extend backends to optionally
support group authz

  "LDAP-Group support for HTTP-Authentication"
2016-09-28 06:36:38 -04:00
Glenn Strauss 7ba06c71a6 [mod_auth] structured data, register auth schemes
- parse auth.* directives into structured data during config processing
- register auth schemes (basic, digest, extern, ...) for extensibility
- remove auth.debug directive
2016-09-22 19:54:57 -04:00
Glenn Strauss cde68b7b23 [mod_auth] http_auth_md5_hex2bin()
Note: http_auth_backend_t digest interface returns result as a
binary MD5 (16-bytes) so that caller consistently converts to
lowercase before using it in further digest calculation.

(Alternatively, the http_auth_backend_t digest interface could have
 taken a 33-char buffer and returned an explicitly lowercased hex str)
2016-09-09 22:28:01 -04:00
Glenn Strauss 4b3a91e64b [mod_auth] extensible interface for auth backends
create new, extensible interface for (additional) auth backends

attempt to handle HANDLER_WAIT_FOR_EVENT returned by auth backends
to allow for async auth backends (e.g. to mysql database)

separate auth backends from mod_auth and http_auth
  mod_authn_file.c htdigest, htpasswd, plain auth backends
  mod_authn_ldap.c ldap auth backend
add http_auth.c to common_sources for auth backend registration

(mod_authn_file could be three separate modules, but no need for now)
2016-08-20 13:42:08 -04:00
Glenn Strauss 3dcca966f4 [mod_auth] refactor out auth backend code
separate routines for each auth backend in http_auth.c,
move ldap backend init from mod_auth.c to http_auth.c
2016-08-18 10:18:14 -04:00
Glenn Strauss 81b2d1f020 [mod_auth] refactor out auth backend code
move basic and digest code into mod_auth.c,
and leave auth backend code in http_auth.c
2016-08-18 10:16:01 -04:00
Glenn Strauss e5006d88eb pass buf size to li_tohex()
also change passing of fixed-sized arrays: need to pass pointer to array
as otherwise size does not get enforced

From: Glenn Strauss <>

git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-04-01 16:54:46 +00:00
Glenn Strauss 8abd06a7ff consistent inclusion of config.h at top of files (fixes #2073)
From: Glenn Strauss <>

git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-03-19 15:14:35 +00:00
Stefan Bühler 2bcf65c285 [mod_auth] some cleanup, only search for matching auth.require path once
From: Stefan Bühler <>

git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2013-08-30 13:14:54 +00:00
Stefan Bühler cfba07cb82 Now really fix mod auth ldap (#1066)
git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2008-09-30 15:30:06 +00:00
Marcus Rückert d471bcc9ca r1553@h2o: darix | 2007-01-14 10:37:14 +0100
- allow empty passwords with ldap.
   patch by Jöerg Sonnenberger

git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2007-01-14 09:40:02 +00:00
Marcus Rückert 8cd1471cb3 - white space cleanup part 2 this time 1.4 ;)
i hope it helps with merging stuff back to 1.5

git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2006-10-04 13:26:23 +00:00
Marcus Rückert 27e3de6ca4 Remove unmaintained and not working pam code.
Most people would use pam auth with /etc/{passwd,shadow}.
This is a stupid idea anyway.

* src/server.c: Remove pam from the feature list (-V)
* src/http_auth.h, src/http_auth.c: Remove the pam code.

(merge of r1115:1116 from branches/lighttpd-merge-1.4.x/)

git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2006-09-07 14:21:17 +00:00
Jan Kneschke 9238cad69e added support for LDAP-bind()
git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-08-15 09:42:17 +00:00
Jan Kneschke 5c26d86fd2 missing parts of the starttls patch
git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-08-08 10:26:26 +00:00
Jan Kneschke bcdc6a3bbc moved everything below trunk/ and added branches/ and tags/
git-svn-id: svn:// 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-02-20 14:27:00 +00:00