mod_auth_digest.c revision b4a287513d176e4355dd56ea47b27228e0e5d75f
/* ====================================================================
* The Apache Software License, Version 1.1
*
* Copyright (c) 2000-2002 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Apache" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
*
* Portions of this software are based upon public domain software
* originally written at the National Center for Supercomputing Applications,
* University of Illinois, Urbana-Champaign.
*/
/*
* mod_auth_digest: MD5 digest authentication
*
* Originally by Alexei Kosut <akosut@nueva.pvt.k12.ca.us>
* Updated to RFC-2617 by Ronald Tschal�r <ronald@innovation.ch>
* based on mod_auth, by Rob McCool and Robert S. Thau
*
* This module an updated version of modules/standard/mod_digest.c
* It is still fairly new and problems may turn up - submit problem
* reports to the Apache bug-database, or send them directly to me
* at ronald@innovation.ch.
*
* available for instance from
*
* Open Issues:
* - qop=auth-int (when streams and trailer support available)
* - nonce-format configurability
* - Proxy-Authorization-Info header is set by this module, but is
* currently ignored by mod_proxy (needs patch to mod_proxy)
* - generating the secret takes a while (~ 8 seconds) if using the
* truerand library
* - The source of the secret should be run-time directive (with server
* scope: RSRC_CONF). However, that could be tricky when trying to
* choose truerand vs. file...
* - shared-mem not completely tested yet. Seems to work ok for me,
* but... (definitely won't work on Windoze)
* - Sharing a realm among multiple servers has following problems:
* o Server name and port can't be included in nonce-hash
* (we need two nonce formats, which must be configured explicitly)
* o Nonce-count check can't be for equal, or then nonce-count checking
* must be disabled. What we could do is the following:
* (expected < received) ? set expected = received : issue error
* The only problem is that it allows replay attacks when somebody
* captures a packet sent to one server and sends it to another
* one. Should we add "AuthDigestNcCheck Strict"?
* - expired nonces give amaya fits.
*/
#include "apr_sha1.h"
#include "apr_base64.h"
#include "apr_lib.h"
#include "apr_time.h"
#include "apr_errno.h"
#include "apr_global_mutex.h"
#include "apr_strings.h"
#define APR_WANT_STRFUNC
#include "apr_want.h"
#include "ap_config.h"
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_request.h"
#include "http_log.h"
#include "http_protocol.h"
#include "apr_uri.h"
#include "util_md5.h"
#include "apr_shm.h"
#include "apr_rmm.h"
* remove following two lines when fixed
*/
#define APR_HAS_SHARED_MEMORY 0
/* struct to hold the configuration info */
typedef struct digest_config_struct {
const char *dir_name;
const char *pwfile;
const char *realm;
char **qop_list;
const char *nonce_format;
int check_nc;
const char *algorithm;
char *uri_list;
const char *ha1;
#define DFLT_ALGORITHM "MD5"
#define SECRET_LEN 20
/* client list definitions */
typedef struct hash_entry {
unsigned long key; /* the key for this entry */
unsigned long nonce_count; /* for nonce-count checking */
} client_entry;
static struct hash_table {
unsigned long tbl_len;
unsigned long num_entries;
unsigned long num_created;
unsigned long num_removed;
unsigned long num_renewed;
} *client_list;
/* struct to hold a parsed Authorization header */
typedef struct digest_header_struct {
const char *scheme;
const char *realm;
const char *username;
char *nonce;
const char *uri;
const char *digest;
const char *algorithm;
const char *cnonce;
const char *opaque;
unsigned long opaque_num;
const char *message_qop;
const char *nonce_count;
/* the following fields are not (directly) from the header */
enum hdr_sts auth_hdr_sts;
const char *raw_request_uri;
int needed_auth;
/* (mostly) nonce stuff */
typedef union time_union {
unsigned char arr[sizeof(apr_time_t)];
} time_rec;
static unsigned char secret[SECRET_LEN];
/* client-list, opaque, and one-time-nonce stuff */
static unsigned long *opaque_cntr;
static char client_lock_name[L_tmpnam];
static char opaque_lock_name[L_tmpnam];
#define DEF_NUM_BUCKETS 15L
#define HASH_DEPTH 5
static long shmem_size = DEF_SHMEM_SIZE;
static long num_buckets = DEF_NUM_BUCKETS;
/*
* initialization code
*/
{
"Digest: cleaning up shared memory");
if (client_shm) {
client_shm = NULL;
}
if (client_lock) {
client_lock = NULL;
}
if (opaque_lock) {
opaque_lock = NULL;
}
return APR_SUCCESS;
}
{
"Digest: generating secret for digest authentication ...");
#if APR_HAS_RANDOM
#else
#endif
if (status != APR_SUCCESS) {
char buf[120];
"Digest: error generating secret: %s",
return status;
}
return APR_SUCCESS;
}
{
"Digest: %s - all nonce-count checking, one-time nonces, and "
"MD5-sess algorithm disabled", msg);
}
{
unsigned long idx;
/* set up client list */
if (sts != APR_SUCCESS) {
return;
}
sizeof(client_entry*)*num_buckets);
if (!client_list) {
return;
}
}
client_list->num_entries = 0;
/* FIXME: get the client_lock_name from a directive so we're portable
* to non-process-inheriting operating systems, like Win32. */
if (sts != APR_SUCCESS) {
return;
}
/* setup opaque */
if (opaque_cntr == NULL) {
return;
}
*opaque_cntr = 1UL;
/* FIXME: get the opaque_lock_name from a directive so we're portable
* to non-process-inheriting operating systems, like Win32. */
if (sts != APR_SUCCESS) {
return;
}
/* setup one-time-nonce counter */
if (otn_counter == NULL) {
return;
}
*otn_counter = 0;
/* no lock here */
/* success */
return;
}
#endif /* APR_HAS_SHARED_MEMORY */
{
void *data;
const char *userdata_key = "auth_digest_init";
/* initialize_module() will be called twice, and if it's a DSO
* then all static data from the first call will be lost. Only
* set up our static data on the second call. */
if (!data) {
return OK;
}
if (initialize_secret(s) != APR_SUCCESS) {
return !OK;
}
/* Note: this stuff is currently fixed for the lifetime of the server,
* i.e. even across restarts. This means that A) any shmem-size
* configuration changes are ignored, and B) certain optimizations,
* such as only allocating the smallest necessary entry for each
* client, can't be done. However, the alternative is a nightmare:
* we can't call apr_shm_destroy on a graceful restart because there
* will be children using the tables, and we also don't know when the
* last child dies. Therefore we can never clean up the old stuff,
* creating a creeping memory leak.
*/
initialize_tables(s, p);
#endif /* APR_HAS_SHARED_MEMORY */
return OK;
}
{
if (!client_shm) {
return;
}
/* FIXME: get the client_lock_name from a directive so we're portable
* to non-process-inheriting operating systems, like Win32. */
if (sts != APR_SUCCESS) {
return;
}
/* FIXME: get the opaque_lock_name from a directive so we're portable
* to non-process-inheriting operating systems, like Win32. */
if (sts != APR_SUCCESS) {
return;
}
}
/*
* configuration code
*/
{
return NULL;
}
if (conf) {
}
return conf;
}
{
/* The core already handles the realm, but it's just too convenient to
* grab it ourselves too and cache some setups. However, we need to
* let the core get at it too, which is why we decline at the end -
* this relies on the fact that http_core is last in the list.
*/
/* we precompute the part of the nonce hash that is constant (well,
* the host:port would be too, but that varies for .htaccess files
* and directives outside a virtual host section)
*/
return DECLINE_CMD;
}
const char *file)
{
return NULL;
}
{
char **tmp;
int cnt;
}
return NULL;
}
"Digest: WARNING: qop `auth-int' currently only works "
"correctly for responses with no entity");
}
}
;
return NULL;
}
const char *t)
{
char *endptr;
long lifetime;
"Invalid time in AuthDigestNonceLifetime: ",
t, NULL);
}
return NULL;
}
const char *fmt)
{
return "AuthDigestNonceFormat is not implemented (yet)";
}
{
if (flag && !client_shm)
"is not supported on platforms without shared-memory "
"support - disabling check");
return NULL;
}
{
if (!client_shm) {
"is not supported on platforms without shared-memory "
"support - reverting to MD5");
alg = "MD5";
}
}
}
return NULL;
}
{
if (c->uri_list) {
}
else {
}
return NULL;
}
const char *size_str)
{
char *endptr;
;
}
size *= 1024;
}
size *= 1048576;
}
else {
}
}
shmem_size = size;
if (num_buckets == 0) {
num_buckets = 1;
}
"Digest: Set shmem-size: %ld, num-buckets: %ld", shmem_size,
return NULL;
}
static const command_rec digest_cmds[] =
{
"The authentication realm (e.g. \"Members Only\")"),
"The name of the file containing the usernames and password hashes"),
"A list of quality-of-protection options"),
"Maximum lifetime of the server nonce (seconds)"),
"The format to use when generating the server nonce"),
"Whether or not to check the nonce-count sent by the client"),
"The algorithm used for the hash calculation"),
"A list of URI's which belong to the same protection space as the current URI"),
"The amount of shared memory to allocate for keeping track of clients"),
{NULL}
};
/*
* client list code
*
* Each client is assigned a number, which is transfered in the opaque
* field of the WWW-Authenticate and Authorization headers. The number
* is just a simple counter which is incremented for each new client.
* Clients can't forge this number because it is hashed up into the
* server nonce, and that is checked.
*
* The clients are kept in a simple hash table, which consists of an
* array of client_entry's, each with a linked list of entries hanging
* off it. The client's number modulo the size of the array gives the
* bucket number.
*
* The clients are garbage collected whenever a new client is allocated
* but there is not enough space left in the shared memory segment. A
* simple semi-LRU is used for this: whenever a client entry is accessed
* it is moved to the beginning of the linked list in its bucket (this
* also makes for faster lookups for current clients). The garbage
* collecter then just removes the oldest entry (i.e. the one at the
* end of the list) in each bucket.
*
* The main advantages of the above scheme are that it's easy to implement
* and it keeps the hash table evenly balanced (i.e. same number of entries
* in each bucket). The major disadvantage is that you may be throwing
* entries out which are in active use. This is not tragic, as these
* clients will just be sent a new client id (opaque field) and nonce
* with a stale=true (i.e. it will just look like the nonce expired,
* thereby forcing an extra round trip). If the shared memory segment
* has enough headroom over the current client set size then this should
* not occur too often.
*
* To help tune the size of the shared memory segment (and see if the
* above algorithm is really sufficient) a set of counters is kept
* indicating the number of clients held, the number of garbage collected
* clients, and the number of erroneously purged clients. These are printed
* out at each garbage collection run. Note that access to the counters is
* not synchronized because they are just indicaters, and whether they are
* off by a few doesn't matter; and for the same reason no attempt is made
* to guarantee the num_renewed is correct in the face of clients spoofing
* the opaque field.
*/
/*
* Get the client given its client number (the key). Returns the entry,
* or NULL if it's not found.
*
* Access to the list itself is synchronized via locks. However, access
* to the entry returned by get_client() is NOT synchronized. This means
* that there are potentially problems if a client uses multiple,
* simultaneous connections to access url's within the same protection
* space. However, these problems are not new: when using multiple
* connections you have no guarantee of the order the requests are
* processed anyway, so you have problems with the nonce-count and
* one-time nonces anyway.
*/
{
int bucket;
}
}
if (entry) {
"get_client(): client %lu found", key);
}
else {
"get_client(): client %lu not found", key);
}
return entry;
}
/* A simple garbage-collecter to remove unused clients. It removes the
* last entry in each bucket and updates the counters. Returns the
* number of removed entries.
*/
static long gc(void)
{
unsigned long num_removed = 0, idx;
/* garbage collect all last entries */
}
if (prev) {
}
else {
}
if (entry) { /* remove entry */
num_removed++;
}
}
/* update counters and log */
return num_removed;
}
/*
* Add a new client to the list. Returns the entry if successful, NULL
* otherwise. This triggers the garbage collection if memory is low.
*/
server_rec *s)
{
int bucket;
if (!key || !client_shm) {
return NULL;
}
/* try to allocate a new entry */
if (!entry) {
long num_removed = gc();
"Digest: gc'd %ld client entries. Total new clients: "
"%ld; Total removed clients: %ld; Total renewed clients: "
"%ld", num_removed,
if (!entry) {
return NULL; /* give up */
}
}
/* now add the entry */
"allocated new client %lu", key);
return entry;
}
/*
* Authorization header parser code
*/
/* Parse the Authorization header, if it exists */
{
const char *auth_line;
apr_size_t l;
(PROXYREQ_PROXY == r->proxyreq)
? "Proxy-Authorization"
: "Authorization");
if (!auth_line) {
return !OK;
}
return !OK;
}
while (auth_line[0] != '\0') {
/* find key */
while (apr_isspace(auth_line[0])) {
auth_line++;
}
vk = 0;
}
while (apr_isspace(auth_line[0])) {
auth_line++;
}
/* find value */
if (auth_line[0] == '=') {
auth_line++;
while (apr_isspace(auth_line[0])) {
auth_line++;
}
vv = 0;
auth_line++;
auth_line++; /* escaped char */
}
}
if (auth_line[0] != '\0') {
auth_line++;
}
}
else { /* token */
&& !apr_isspace(auth_line[0])) {
}
}
}
auth_line++;
}
if (auth_line[0] != '\0') {
auth_line++;
}
}
return !OK;
}
}
return OK;
}
/* Because the browser may preemptively send auth info, incrementing the
* nonce-count when it does, and because the client does not get notified
* if the URI didn't need authentication after all, we need to be sure to
* update the nonce-count each time we receive an Authorization header no
* matter what the final outcome of the request. Furthermore this is a
* convenient place to get the request-uri (before any subrequests etc
* are initiated) and to initialize the request_config.
*
* Note that this must be called after mod_proxy had its go so that
* r->proxyreq is set correctly.
*/
static int parse_hdr_and_update_nc(request_rec *r)
{
int res;
if (!ap_is_initial_req(r)) {
return DECLINED;
}
resp->needed_auth = 0;
}
return DECLINED;
}
/*
* Nonce generation code
*/
/* The hash part of the nonce is a SHA-1 hash of the time, realm, server host
* and port, opaque, and our secret.
*/
const server_rec *server,
const digest_config_rec *conf)
{
const char *hex = "0123456789abcdef";
unsigned char sha1[APR_SHA1_DIGESTSIZE];
int idx;
/*
apr_sha1_update_binary(&ctx, (const unsigned char *) server->server_hostname,
strlen(server->server_hostname));
apr_sha1_update_binary(&ctx, (const unsigned char *) &server->port,
sizeof(server->port));
*/
if (opaque) {
}
}
*hash++ = '\0';
}
/* The nonce has the format b64(time)+hash .
*/
const server_rec *server,
const digest_config_rec *conf)
{
int len;
time_rec t;
if (conf->nonce_lifetime != 0) {
}
else if (otn_counter) {
/* this counter is not synch'd, because it doesn't really matter
* if it counts exactly.
*/
t.time = (*otn_counter)++;
}
else {
/* XXX: WHAT IS THIS CONSTANT? */
t.time = 42;
}
return nonce;
}
/*
* Opaque and hash-table management
*/
/*
* Generate a new client entry, add it to the list, and return the
* entry. Returns NULL if failed.
*/
{
unsigned long op;
if (!opaque_cntr) {
return NULL;
}
op = (*opaque_cntr)++;
"Digest: failed to allocate client entry - ignoring "
"client");
return NULL;
}
return entry;
}
/*
* MD5-sess code.
*
* If you want to use algorithm=MD5-sess you must write get_userpw_hash()
* yourself (see below). The dummy provided here just uses the hash from
* the auth-file, i.e. it is only useful for testing client implementations
* of MD5-sess .
*/
/*
* get_userpw_hash() will be called each time a new session needs to be
* generated and is expected to return the equivalent of
*
* h_urp = ap_md5(r->pool,
* apr_pstrcat(r->pool, username, ":", ap_auth_name(r), ":", passwd))
* ap_md5(r->pool,
* (unsigned char *) apr_pstrcat(r->pool, h_urp, ":", resp->nonce, ":",
* resp->cnonce, NULL));
*
* or put differently, it must return
*
* MD5(MD5(username ":" realm ":" password) ":" nonce ":" cnonce)
*
* If something goes wrong, the failure must be logged and NULL returned.
*
* You must implement this yourself, which will probably consist of code
* contacting the password server with the necessary information (typically
* the username, realm, nonce, and cnonce) and receiving the hash from it.
*
* TBD: This function should probably be in a seperate source file so that
* people need not modify mod_auth_digest.c each time they install a new
* version of apache.
*/
static const char *get_userpw_hash(const request_rec *r,
const digest_header_rec *resp,
const digest_config_rec *conf)
{
}
/* Retrieve current session H(A1). If there is none and "generate" is
* true then a new session for MD5-sess is generated and stored in the
* client struct; if generate is false, or a new session could not be
* generated then NULL is returned (in case of failure to generate the
* failure reason will have been logged already).
*/
static const char *get_session_HA1(const request_rec *r,
const digest_config_rec *conf,
int generate)
{
/* return the current sessions if there is one */
}
else if (!generate) {
return NULL;
}
/* generate a new session */
}
if (ha1) {
}
}
return ha1;
}
{
}
}
/*
* Authorization challenge generation code (for WWW-Authenticate)
*/
{
const char *u, *f;
/* Because of things like mod_alias and mod_rewrite and the fact that
* protection is often on a directory basis (not a location basis) it
* is hard to determine the uri to put in the domain attribute.
*
* What we do is the following: first we see if the directory is
* a prefix for the uri - if this is the case we assume that therefore
* a <Location> directive was protecting this uri and we can use it
* for the domain.
*/
return dir;
}
/* Now we check for <Files ...>, and if we find one we send back a
* dummy uri - this is the only way to specify that the protection
* space only covers a single uri.
*/
if (dir[0] != '/') {
/* This doesn't work for Amaya (ok, it's of arguable validity in
* the first place), so just return the file name instead
return "http://0.0.0.0/";
*/
return dir;
}
/* Next we find the largest common common suffix of the request-uri
* and the final file name, ignoring any extensions; this gives us a
* hint as to where any rewriting could've occured (assuming that some
* prefix of the uri is rewritten, not a suffix).
*/
while (u > uri && *u != '/') {
u--;
}
while (*u && *u != '.') {
u++;
}
if (*u == '.') {
u--;
}
if (*u == '/') {
u--;
}
while (f > filename && *f != '/') {
f--;
}
while (*f && *f != '.') {
f++;
}
if (*f == '.') {
f--;
}
if (*f == '/') {
f--;
}
u--;
f--;
}
f++;
u++;
while (*f && *f != '/') {
f++;
u++; /* suffix must start with / */
}
/* Now, if the directory reaches into this common suffix then we can
* take the uri with the same reach.
*/
return tmp;
}
return ""; /* give up */
}
{
if (num != 0) {
}
else {
return "";
}
}
static void note_digest_auth_failure(request_rec *r,
const digest_config_rec *conf,
{
int cnt;
/* Setup qop */
qop = ", qop=\"auth\"";
}
qop = "";
}
else {
}
}
/* Setup opaque */
/* new client */
}
else {
}
}
/* client info was gc'd */
stale = 1;
}
else {
}
}
else {
/* we're generating a new nonce, so reset the nonce-count */
}
if (opaque[0]) {
}
else {
opaque_param = NULL;
}
/* Setup nonce */
}
/* Setup MD5-sess stuff. Note that we just clear out the session
* info here, since we can't generate a new session until the request
* from the client comes in with the cnonce.
*/
}
/* setup domain attribute. We want to send this attribute wherever
* possible so that the client won't send the Authorization header
* unneccessarily (it's usually > 200 bytes!).
*/
if (r->proxyreq) {
}
}
else {
/* They didn't specify any domain, so let's guess at it */
}
else {
}
}
(PROXYREQ_PROXY == r->proxyreq)
? "Proxy-Authenticate" : "WWW-Authenticate",
"nonce=\"%s\", algorithm=%s%s%s%s%s",
}
/*
* Authorization header verification code
*/
const char *realm, const char *auth_pwfile)
{
ap_configfile_t *f;
char l[MAX_STRING_LEN];
const char *rpw;
char *w, *x;
"Digest: Could not open password file: %s", auth_pwfile);
return NULL;
}
while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
if ((l[0] == '#') || (!l[0])) {
continue;
}
rpw = l;
ap_cfg_closefile(f);
}
}
ap_cfg_closefile(f);
return NULL;
}
const digest_config_rec *conf)
{
unsigned long nc;
char *endptr;
return OK;
}
"Digest: invalid nc %s received - not a number", snc);
return !OK;
}
return !OK;
}
"Digest: Warning, possible replay attack: nonce-count "
"check failed: %lu != %lu", nc,
return !OK;
}
return OK;
}
const digest_config_rec *conf)
{
int len;
"Digest: invalid nonce %s received - length is not %d",
return HTTP_UNAUTHORIZED;
}
"Digest: invalid nonce %s received - hash is not %s",
return HTTP_UNAUTHORIZED;
}
"Digest: invalid nonce %s received - user attempted "
return HTTP_UNAUTHORIZED;
}
if (conf->nonce_lifetime > 0) {
"Digest: user %s: nonce expired (%.2f seconds old "
"- max lifetime %.2f) - sending new nonce",
return HTTP_UNAUTHORIZED;
}
}
"Digest: user %s: one-time-nonce mismatch - sending "
"new nonce", r->user);
return HTTP_UNAUTHORIZED;
}
}
/* else (lifetime < 0) => never expires */
return OK;
}
/* The actual MD5 code... whee */
/* RFC-2069 */
static const char *old_digest(const request_rec *r,
{
const char *ha2;
}
/* RFC-2617 */
static const char *new_digest(const request_rec *r,
const digest_config_rec *conf)
{
if (!ha1) {
return NULL;
}
}
else {
}
/* TBD */
}
else {
}
NULL));
}
}
else {
}
}
else {
}
}
else {
}
}
else {
}
}
else {
}
}
/* These functions return 0 if client is OK, and proper error status
* if not... either HTTP_UNAUTHORIZED, if we made a check, and it failed, or
* HTTP_INTERNAL_SERVER_ERROR, if things are so totally confused that we
* couldn't figure out how to tell if the client is authorized or not.
*
* If they return DECLINED, and all other modules also decline, that's
* treated by the server core as a configuration error, logged and
* reported as such.
*/
/* Determine user ID, and check if the attributes are correct, if it
* really is that user, if the nonce is correct, etc.
*/
static int authenticate_digest_user(request_rec *r)
{
const char *t;
int res;
/* do we require Digest auth for this URI? */
return DECLINED;
}
if (!ap_auth_name(r)) {
"Digest: need AuthName: %s", r->uri);
return HTTP_INTERNAL_SERVER_ERROR;
}
/* get the client response and mark */
mainreq = r;
}
}
/* get our conf */
/* check for existence and syntax of Auth header */
"Digest: client used wrong authentication scheme "
}
"Digest: missing user, realm, nonce, uri, digest, "
"cnonce, or nonce_count in authorization header: %s",
r->uri);
}
/* else (resp->auth_hdr_sts == NO_HEADER) */
return HTTP_UNAUTHORIZED;
}
r->ap_auth_type = (char *) "Digest";
/* check the auth attributes */
/* Hmm, the simple match didn't work (probably a proxy modified the
* request-uri), so lets do a more sophisticated match
*/
"Digest: invalid uri <%s> in Authorization header",
return HTTP_BAD_REQUEST;
}
}
}
}
if (r->method_number == M_CONNECT) {
"Digest: uri mismatch - <%s> does not match "
return HTTP_BAD_REQUEST;
}
}
else if (
/* check hostname matches, if present */
/* check port matches, if present */
/* check that server-port is default port if no port present */
/* check that path matches */
/* either exact match */
/* or '*' matches empty path in scheme://host */
/* check that query matches */
) {
"Digest: uri mismatch - <%s> does not match "
return HTTP_BAD_REQUEST;
}
}
"Digest: received invalid opaque - got `%s'",
return HTTP_UNAUTHORIZED;
}
"Digest: realm mismatch - got `%s' but expected `%s'",
return HTTP_UNAUTHORIZED;
}
"Digest: unknown algorithm `%s' received: %s",
return HTTP_UNAUTHORIZED;
}
return DECLINED;
}
"Digest: user `%s' in realm `%s' not found: %s",
return HTTP_UNAUTHORIZED;
}
/* old (rfc-2069) style digest */
"Digest: user %s: password mismatch: %s", r->user,
r->uri);
return HTTP_UNAUTHORIZED;
}
}
else {
const char *exp_digest;
match = 1;
break;
}
}
if (!match
"Digest: invalid qop `%s' received: %s",
return HTTP_UNAUTHORIZED;
}
if (!exp_digest) {
/* we failed to allocate a client struct */
return HTTP_INTERNAL_SERVER_ERROR;
}
"Digest: user %s: password mismatch: %s", r->user,
r->uri);
return HTTP_UNAUTHORIZED;
}
}
return HTTP_UNAUTHORIZED;
}
/* Note: this check is done last so that a "stale=true" can be
generated if the nonce is old */
return res;
}
return OK;
}
/*
* Authorization-Info header code
*/
#ifdef SEND_DIGEST
{
if (val) {
return val;
}
else {
return "";
}
}
#endif
static int add_auth_info(request_rec *r)
{
const digest_config_rec *conf =
return OK;
}
/* rfc-2069 digest
*/
/* old client, so calc rfc-2069 digest */
#ifdef SEND_DIGEST
/* most of this totally bogus because the handlers don't set the
* headers until the final handler phase (I wonder why this phase
* is called fixup when there's almost nothing you can fix up...)
*
* Because it's basically impossible to get this right (e.g. the
* Content-length is never set yet when we get here, and we can't
* calc the entity hash) it's best to just leave this #def'd out.
*/
char date[APR_RFC822_DATE_LEN];
char *entity_info =
":",
date :
NULL));
digest =
r->method, ":",
date, ":",
entity_info, ":",
NULL));
#endif
}
/* setup nextnonce
*/
if (conf->nonce_lifetime > 0) {
/* send nextnonce if current nonce will expire in less than 30 secs */
"\"", NULL);
}
}
conf);
}
/* else nonce never expires, hence no nextnonce */
/* do rfc-2069 digest
*/
/* use only RFC-2069 format */
if (digest) {
}
else {
}
}
else {
/* calculate rspauth attribute
*/
if (!ha1) {
"Digest: internal error: couldn't find session "
return !OK;
}
}
else {
}
/* TBD */
}
else {
}
resp->message_qop ?
/* assemble Authentication-Info header
*/
: "",
NULL);
}
(PROXYREQ_PROXY == r->proxyreq)
? "Proxy-Authentication-Info"
: "Authentication-Info",
ai);
}
return OK;
}
static void register_hooks(apr_pool_t *p)
{
}
{
create_digest_dir_config, /* dir config creater */
NULL, /* dir merger --- default is to override */
NULL, /* server config */
NULL, /* merge server config */
digest_cmds, /* command table */
register_hooks /* register hooks */
};