mod_auth_digest.c revision e5db2522dbe503cbf5399094b6239c88c246a8c5
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/*
* mod_auth_digest: MD5 digest authentication
*
* Originally by Alexei Kosut <akosut@nueva.pvt.k12.ca.us>
* Updated to RFC-2617 by Ronald Tschal�r <ronald@innovation.ch>
* based on mod_auth, by Rob McCool and Robert S. Thau
*
* This module an updated version of modules/standard/mod_digest.c
* It is still fairly new and problems may turn up - submit problem
* reports to the Apache bug-database, or send them directly to me
* at ronald@innovation.ch.
*
* available for instance from
*
* Open Issues:
* - qop=auth-int (when streams and trailer support available)
* - nonce-format configurability
* - Proxy-Authorization-Info header is set by this module, but is
* currently ignored by mod_proxy (needs patch to mod_proxy)
* - generating the secret takes a while (~ 8 seconds) if using the
* truerand library
* - The source of the secret should be run-time directive (with server
* scope: RSRC_CONF). However, that could be tricky when trying to
* choose truerand vs. file...
* - shared-mem not completely tested yet. Seems to work ok for me,
* but... (definitely won't work on Windoze)
* - Sharing a realm among multiple servers has following problems:
* o Server name and port can't be included in nonce-hash
* (we need two nonce formats, which must be configured explicitly)
* o Nonce-count check can't be for equal, or then nonce-count checking
* must be disabled. What we could do is the following:
* (expected < received) ? set expected = received : issue error
* The only problem is that it allows replay attacks when somebody
* captures a packet sent to one server and sends it to another
* one. Should we add "AuthDigestNcCheck Strict"?
* - expired nonces give amaya fits.
*/
#include "apr_sha1.h"
#include "apr_base64.h"
#include "apr_lib.h"
#include "apr_time.h"
#include "apr_errno.h"
#include "apr_global_mutex.h"
#include "apr_strings.h"
#define APR_WANT_STRFUNC
#include "apr_want.h"
#include "ap_config.h"
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_request.h"
#include "http_log.h"
#include "http_protocol.h"
#include "apr_uri.h"
#include "util_md5.h"
#include "apr_shm.h"
#include "apr_rmm.h"
#include "ap_provider.h"
#include "mod_auth.h"
#include <unistd.h>
#endif
/* struct to hold the configuration info */
typedef struct digest_config_struct {
const char *dir_name;
const char *realm;
char **qop_list;
const char *nonce_format;
int check_nc;
const char *algorithm;
char *uri_list;
const char *ha1;
#define DFLT_ALGORITHM "MD5"
#define SECRET_LEN 20
/* client list definitions */
typedef struct hash_entry {
unsigned long key; /* the key for this entry */
unsigned long nonce_count; /* for nonce-count checking */
} client_entry;
static struct hash_table {
unsigned long tbl_len;
unsigned long num_entries;
unsigned long num_created;
unsigned long num_removed;
unsigned long num_renewed;
} *client_list;
/* struct to hold a parsed Authorization header */
typedef struct digest_header_struct {
const char *scheme;
const char *realm;
const char *username;
char *nonce;
const char *uri;
const char *method;
const char *digest;
const char *algorithm;
const char *cnonce;
const char *opaque;
unsigned long opaque_num;
const char *message_qop;
const char *nonce_count;
/* the following fields are not (directly) from the header */
enum hdr_sts auth_hdr_sts;
const char *raw_request_uri;
int needed_auth;
/* (mostly) nonce stuff */
typedef union time_union {
unsigned char arr[sizeof(apr_time_t)];
} time_rec;
static unsigned char secret[SECRET_LEN];
/* client-list, opaque, and one-time-nonce stuff */
static unsigned long *opaque_cntr;
static const char *client_lock_name;
static const char *opaque_lock_name;
static const char *client_shm_filename;
#define DEF_NUM_BUCKETS 15L
#define HASH_DEPTH 5
static long shmem_size = DEF_SHMEM_SIZE;
static long num_buckets = DEF_NUM_BUCKETS;
/*
* initialization code
*/
{
"Digest: cleaning up shared memory");
if (client_rmm) {
client_rmm = NULL;
}
if (client_shm) {
client_shm = NULL;
}
if (client_lock) {
client_lock = NULL;
}
if (opaque_lock) {
opaque_lock = NULL;
}
return APR_SUCCESS;
}
{
"Digest: generating secret for digest authentication ...");
#if APR_HAS_RANDOM
#else
#endif
if (status != APR_SUCCESS) {
char buf[120];
"Digest: error generating secret: %s",
return status;
}
return APR_SUCCESS;
}
{
"Digest: %s - all nonce-count checking, one-time nonces, and "
"MD5-sess algorithm disabled", msg);
}
{
unsigned long idx;
const char *tempdir;
/* set up client list */
if (APR_SUCCESS != sts) {
"Failed to find temporary directory");
return HTTP_INTERNAL_SERVER_ERROR;
}
/* Create the shared memory segment */
/*
* Create a unique filename using our pid. This information is
* stashed in the global variable so the children inherit it.
*/
getpid());
/* Now create that segment */
if (APR_SUCCESS != sts) {
"Failed to create shared memory segment on file %s",
return HTTP_INTERNAL_SERVER_ERROR;
}
NULL, /* no lock, we'll do the locking ourselves */
shmem_size, ctx);
if (sts != APR_SUCCESS) {
return !OK;
}
sizeof(client_entry*)*num_buckets));
if (!client_list) {
return !OK;
}
}
client_list->num_entries = 0;
getpid());
/* FIXME: get the client_lock_name from a directive so we're portable
* to non-process-inheriting operating systems, like Win32. */
if (sts != APR_SUCCESS) {
return !OK;
}
/* setup opaque */
if (opaque_cntr == NULL) {
return !OK;
}
*opaque_cntr = 1UL;
getpid());
if (sts != APR_SUCCESS) {
return !OK;
}
/* setup one-time-nonce counter */
if (otn_counter == NULL) {
return !OK;
}
*otn_counter = 0;
/* no lock here */
/* success */
return OK;
}
#endif /* APR_HAS_SHARED_MEMORY */
{
void *data;
const char *userdata_key = "auth_digest_init";
/* initialize_module() will be called twice, and if it's a DSO
* then all static data from the first call will be lost. Only
* set up our static data on the second call. */
if (!data) {
return OK;
}
if (initialize_secret(s) != APR_SUCCESS) {
return !OK;
}
/* Note: this stuff is currently fixed for the lifetime of the server,
* i.e. even across restarts. This means that A) any shmem-size
* configuration changes are ignored, and B) certain optimizations,
* such as only allocating the smallest necessary entry for each
* client, can't be done. However, the alternative is a nightmare:
* we can't call apr_shm_destroy on a graceful restart because there
* will be children using the tables, and we also don't know when the
* last child dies. Therefore we can never clean up the old stuff,
* creating a creeping memory leak.
*/
if (initialize_tables(s, p) != OK) {
return !OK;
}
/* Call cleanup_tables on exit or restart */
#endif /* APR_HAS_SHARED_MEMORY */
return OK;
}
{
if (!client_shm) {
return;
}
/* Get access to rmm in child */
NULL,
p);
if (sts != APR_SUCCESS) {
return;
}
if (sts != APR_SUCCESS) {
return;
}
if (sts != APR_SUCCESS) {
return;
}
}
/*
* configuration code
*/
{
return NULL;
}
if (conf) {
}
return conf;
}
{
/* The core already handles the realm, but it's just too convenient to
* grab it ourselves too and cache some setups. However, we need to
* let the core get at it too, which is why we decline at the end -
* this relies on the fact that http_core is last in the list.
*/
/* we precompute the part of the nonce hash that is constant (well,
* the host:port would be too, but that varies for .htaccess files
* and directives outside a virtual host section)
*/
return DECLINE_CMD;
}
const char *arg)
{
/* lookup and cache the actual provider now */
/* by the time they use it, the provider should be loaded and
registered with us. */
"Unknown Authn provider: %s",
}
/* if it doesn't provide the appropriate function, reject it */
"The '%s' Authn provider doesn't support "
}
/* Add it to the list now. */
}
else {
}
}
return NULL;
}
{
char **tmp;
int cnt;
}
return NULL;
}
return "AuthDigestQop auth-int is not implemented";
}
}
;
return NULL;
}
const char *t)
{
char *endptr;
long lifetime;
"Invalid time in AuthDigestNonceLifetime: ",
t, NULL);
}
return NULL;
}
const char *fmt)
{
return "AuthDigestNonceFormat is not implemented (yet)";
}
{
if (flag) {
return "AuthDigestNcCheck: ERROR: nonce-count checking "
"is not supported on platforms without shared-memory "
"support";
}
#endif
return NULL;
}
{
return "AuthDigestAlgorithm: ERROR: algorithm `MD5-sess' "
"is not fully implemented";
}
}
return NULL;
}
{
if (c->uri_list) {
}
else {
}
return NULL;
}
const char *size_str)
{
char *endptr;
;
}
size *= 1024;
}
size *= 1048576;
}
else {
}
}
shmem_size = size;
if (num_buckets == 0) {
num_buckets = 1;
}
"Digest: Set shmem-size: %ld, num-buckets: %ld", shmem_size,
return NULL;
}
static const command_rec digest_cmds[] =
{
"The authentication realm (e.g. \"Members Only\")"),
"specify the auth providers for a directory or location"),
"A list of quality-of-protection options"),
"Maximum lifetime of the server nonce (seconds)"),
"The format to use when generating the server nonce"),
"Whether or not to check the nonce-count sent by the client"),
"The algorithm used for the hash calculation"),
"A list of URI's which belong to the same protection space as the current URI"),
"The amount of shared memory to allocate for keeping track of clients"),
{NULL}
};
/*
* client list code
*
* Each client is assigned a number, which is transferred in the opaque
* field of the WWW-Authenticate and Authorization headers. The number
* is just a simple counter which is incremented for each new client.
* Clients can't forge this number because it is hashed up into the
* server nonce, and that is checked.
*
* The clients are kept in a simple hash table, which consists of an
* array of client_entry's, each with a linked list of entries hanging
* off it. The client's number modulo the size of the array gives the
* bucket number.
*
* The clients are garbage collected whenever a new client is allocated
* but there is not enough space left in the shared memory segment. A
* simple semi-LRU is used for this: whenever a client entry is accessed
* it is moved to the beginning of the linked list in its bucket (this
* also makes for faster lookups for current clients). The garbage
* collecter then just removes the oldest entry (i.e. the one at the
* end of the list) in each bucket.
*
* The main advantages of the above scheme are that it's easy to implement
* and it keeps the hash table evenly balanced (i.e. same number of entries
* in each bucket). The major disadvantage is that you may be throwing
* entries out which are in active use. This is not tragic, as these
* clients will just be sent a new client id (opaque field) and nonce
* with a stale=true (i.e. it will just look like the nonce expired,
* thereby forcing an extra round trip). If the shared memory segment
* has enough headroom over the current client set size then this should
* not occur too often.
*
* To help tune the size of the shared memory segment (and see if the
* above algorithm is really sufficient) a set of counters is kept
* indicating the number of clients held, the number of garbage collected
* clients, and the number of erroneously purged clients. These are printed
* out at each garbage collection run. Note that access to the counters is
* not synchronized because they are just indicaters, and whether they are
* off by a few doesn't matter; and for the same reason no attempt is made
* to guarantee the num_renewed is correct in the face of clients spoofing
* the opaque field.
*/
/*
* Get the client given its client number (the key). Returns the entry,
* or NULL if it's not found.
*
* Access to the list itself is synchronized via locks. However, access
* to the entry returned by get_client() is NOT synchronized. This means
* that there are potentially problems if a client uses multiple,
* simultaneous connections to access url's within the same protection
* space. However, these problems are not new: when using multiple
* connections you have no guarantee of the order the requests are
* processed anyway, so you have problems with the nonce-count and
* one-time nonces anyway.
*/
{
int bucket;
}
}
if (entry) {
"get_client(): client %lu found", key);
}
else {
"get_client(): client %lu not found", key);
}
return entry;
}
/* A simple garbage-collecter to remove unused clients. It removes the
* last entry in each bucket and updates the counters. Returns the
* number of removed entries.
*/
static long gc(void)
{
unsigned long num_removed = 0, idx;
/* garbage collect all last entries */
}
if (prev) {
}
else {
}
if (entry) { /* remove entry */
num_removed++;
}
}
/* update counters and log */
return num_removed;
}
/*
* Add a new client to the list. Returns the entry if successful, NULL
* otherwise. This triggers the garbage collection if memory is low.
*/
server_rec *s)
{
int bucket;
if (!key || !client_shm) {
return NULL;
}
/* try to allocate a new entry */
if (!entry) {
long num_removed = gc();
"Digest: gc'd %ld client entries. Total new clients: "
"%ld; Total removed clients: %ld; Total renewed clients: "
"%ld", num_removed,
if (!entry) {
"unable to allocate new auth_digest client");
return NULL; /* give up */
}
}
/* now add the entry */
"allocated new client %lu", key);
return entry;
}
/*
* Authorization header parser code
*/
/* Parse the Authorization header, if it exists */
{
const char *auth_line;
apr_size_t l;
(PROXYREQ_PROXY == r->proxyreq)
? "Proxy-Authorization"
: "Authorization");
if (!auth_line) {
return !OK;
}
return !OK;
}
while (auth_line[0] != '\0') {
/* find key */
while (apr_isspace(auth_line[0])) {
auth_line++;
}
vk = 0;
}
while (apr_isspace(auth_line[0])) {
auth_line++;
}
/* find value */
if (auth_line[0] == '=') {
auth_line++;
while (apr_isspace(auth_line[0])) {
auth_line++;
}
vv = 0;
auth_line++;
auth_line++; /* escaped char */
}
}
if (auth_line[0] != '\0') {
auth_line++;
}
}
else { /* token */
&& !apr_isspace(auth_line[0])) {
}
}
}
auth_line++;
}
if (auth_line[0] != '\0') {
auth_line++;
}
}
return !OK;
}
}
return OK;
}
/* Because the browser may preemptively send auth info, incrementing the
* nonce-count when it does, and because the client does not get notified
* if the URI didn't need authentication after all, we need to be sure to
* update the nonce-count each time we receive an Authorization header no
* matter what the final outcome of the request. Furthermore this is a
* convenient place to get the request-uri (before any subrequests etc
* are initiated) and to initialize the request_config.
*
* Note that this must be called after mod_proxy had its go so that
* r->proxyreq is set correctly.
*/
static int parse_hdr_and_update_nc(request_rec *r)
{
int res;
if (!ap_is_initial_req(r)) {
return DECLINED;
}
resp->needed_auth = 0;
}
return DECLINED;
}
/*
* Nonce generation code
*/
/* The hash part of the nonce is a SHA-1 hash of the time, realm, server host
* and port, opaque, and our secret.
*/
const server_rec *server,
const digest_config_rec *conf)
{
const char *hex = "0123456789abcdef";
unsigned char sha1[APR_SHA1_DIGESTSIZE];
int idx;
/*
apr_sha1_update_binary(&ctx, (const unsigned char *) server->server_hostname,
strlen(server->server_hostname));
apr_sha1_update_binary(&ctx, (const unsigned char *) &server->port,
sizeof(server->port));
*/
if (opaque) {
}
}
*hash++ = '\0';
}
/* The nonce has the format b64(time)+hash .
*/
const server_rec *server,
const digest_config_rec *conf)
{
int len;
time_rec t;
if (conf->nonce_lifetime != 0) {
}
else if (otn_counter) {
/* this counter is not synch'd, because it doesn't really matter
* if it counts exactly.
*/
t.time = (*otn_counter)++;
}
else {
/* XXX: WHAT IS THIS CONSTANT? */
t.time = 42;
}
return nonce;
}
/*
* Opaque and hash-table management
*/
/*
* Generate a new client entry, add it to the list, and return the
* entry. Returns NULL if failed.
*/
{
unsigned long op;
if (!opaque_cntr) {
return NULL;
}
op = (*opaque_cntr)++;
"Digest: failed to allocate client entry - ignoring "
"client");
return NULL;
}
return entry;
}
/*
* MD5-sess code.
*
* If you want to use algorithm=MD5-sess you must write get_userpw_hash()
* yourself (see below). The dummy provided here just uses the hash from
* the auth-file, i.e. it is only useful for testing client implementations
* of MD5-sess .
*/
/*
* get_userpw_hash() will be called each time a new session needs to be
* generated and is expected to return the equivalent of
*
* h_urp = ap_md5(r->pool,
* apr_pstrcat(r->pool, username, ":", ap_auth_name(r), ":", passwd))
* ap_md5(r->pool,
* (unsigned char *) apr_pstrcat(r->pool, h_urp, ":", resp->nonce, ":",
* resp->cnonce, NULL));
*
* or put differently, it must return
*
* MD5(MD5(username ":" realm ":" password) ":" nonce ":" cnonce)
*
* If something goes wrong, the failure must be logged and NULL returned.
*
* You must implement this yourself, which will probably consist of code
* contacting the password server with the necessary information (typically
* the username, realm, nonce, and cnonce) and receiving the hash from it.
*
* TBD: This function should probably be in a seperate source file so that
* people need not modify mod_auth_digest.c each time they install a new
* version of apache.
*/
static const char *get_userpw_hash(const request_rec *r,
const digest_header_rec *resp,
const digest_config_rec *conf)
{
}
/* Retrieve current session H(A1). If there is none and "generate" is
* true then a new session for MD5-sess is generated and stored in the
* client struct; if generate is false, or a new session could not be
* generated then NULL is returned (in case of failure to generate the
* failure reason will have been logged already).
*/
static const char *get_session_HA1(const request_rec *r,
const digest_config_rec *conf,
int generate)
{
/* return the current sessions if there is one */
}
else if (!generate) {
return NULL;
}
/* generate a new session */
}
if (ha1) {
}
}
return ha1;
}
{
}
}
/*
* Authorization challenge generation code (for WWW-Authenticate)
*/
{
if (num != 0) {
}
else {
return "";
}
}
static void note_digest_auth_failure(request_rec *r,
const digest_config_rec *conf,
{
int cnt;
/* Setup qop */
qop = ", qop=\"auth\"";
}
qop = "";
}
else {
}
}
/* Setup opaque */
/* new client */
}
else {
}
}
/* client info was gc'd */
stale = 1;
}
else {
}
}
else {
/* we're generating a new nonce, so reset the nonce-count */
}
if (opaque[0]) {
}
else {
opaque_param = NULL;
}
/* Setup nonce */
}
/* Setup MD5-sess stuff. Note that we just clear out the session
* info here, since we can't generate a new session until the request
* from the client comes in with the cnonce.
*/
}
/* setup domain attribute. We want to send this attribute wherever
* possible so that the client won't send the Authorization header
* unneccessarily (it's usually > 200 bytes!).
*/
/* don't send domain
* - for proxy requests
* - if it's no specified
*/
}
else {
}
(PROXYREQ_PROXY == r->proxyreq)
? "Proxy-Authenticate" : "WWW-Authenticate",
"nonce=\"%s\", algorithm=%s%s%s%s%s",
}
/*
* Authorization header verification code
*/
{
char *password;
do {
const authn_provider *provider;
/* For now, if a provider isn't set, we'll be nice and use the file
* provider.
*/
if (!current_provider) {
"No Authn provider configured");
break;
}
}
else {
}
/* We expect the password to be md5 hash of user:realm:password */
&password);
/* Something occured. Stop checking. */
if (auth_result != AUTH_USER_NOT_FOUND) {
break;
}
/* If we're not really configured for providers, stop now. */
break;
}
} while (current_provider);
if (auth_result == AUTH_USER_FOUND) {
}
return auth_result;
}
const digest_config_rec *conf)
{
unsigned long nc;
char *endptr;
/* Shouldn't happen, but just in case... */
"Digest: cannot check nonce count without shared memory");
return OK;
}
return OK;
}
/* qop is none, client must not send a nonce count */
"Digest: invalid nc %s received - no nonce count allowed when qop=none",
snc);
return !OK;
}
/* qop is none, cannot check nonce count */
return OK;
}
"Digest: invalid nc %s received - not a number", snc);
return !OK;
}
return !OK;
}
"Digest: Warning, possible replay attack: nonce-count "
"check failed: %lu != %lu", nc,
return !OK;
}
return OK;
}
const digest_config_rec *conf)
{
int len;
"Digest: invalid nonce %s received - length is not %d",
return HTTP_UNAUTHORIZED;
}
"Digest: invalid nonce %s received - hash is not %s",
return HTTP_UNAUTHORIZED;
}
"Digest: invalid nonce %s received - user attempted "
return HTTP_UNAUTHORIZED;
}
if (conf->nonce_lifetime > 0) {
"Digest: user %s: nonce expired (%.2f seconds old "
"- max lifetime %.2f) - sending new nonce",
return HTTP_UNAUTHORIZED;
}
}
"Digest: user %s: one-time-nonce mismatch - sending "
"new nonce", r->user);
return HTTP_UNAUTHORIZED;
}
}
/* else (lifetime < 0) => never expires */
return OK;
}
/* The actual MD5 code... whee */
/* RFC-2069 */
static const char *old_digest(const request_rec *r,
{
const char *ha2;
}
/* RFC-2617 */
static const char *new_digest(const request_rec *r,
const digest_config_rec *conf)
{
if (!ha1) {
return NULL;
}
}
else {
}
/* TBD */
}
else {
}
NULL));
}
}
else {
}
}
else {
}
}
else {
}
}
else {
}
}
else {
}
}
/* These functions return 0 if client is OK, and proper error status
* if not... either HTTP_UNAUTHORIZED, if we made a check, and it failed, or
* HTTP_INTERNAL_SERVER_ERROR, if things are so totally confused that we
* couldn't figure out how to tell if the client is authorized or not.
*
* If they return DECLINED, and all other modules also decline, that's
* treated by the server core as a configuration error, logged and
* reported as such.
*/
/* Determine user ID, and check if the attributes are correct, if it
* really is that user, if the nonce is correct, etc.
*/
static int authenticate_digest_user(request_rec *r)
{
const char *t;
int res;
/* do we require Digest auth for this URI? */
return DECLINED;
}
if (!ap_auth_name(r)) {
"Digest: need AuthName: %s", r->uri);
return HTTP_INTERNAL_SERVER_ERROR;
}
/* get the client response and mark */
mainreq = r;
}
}
/* get our conf */
/* check for existence and syntax of Auth header */
"Digest: client used wrong authentication scheme "
}
"Digest: missing user, realm, nonce, uri, digest, "
"cnonce, or nonce_count in authorization header: %s",
r->uri);
}
/* else (resp->auth_hdr_sts == NO_HEADER) */
return HTTP_UNAUTHORIZED;
}
r->ap_auth_type = (char *) "Digest";
/* check the auth attributes */
/* Hmm, the simple match didn't work (probably a proxy modified the
* request-uri), so lets do a more sophisticated match
*/
"Digest: invalid uri <%s> in Authorization header",
return HTTP_BAD_REQUEST;
}
}
}
}
/* MSIE compatibility hack. MSIE has some RFC issues - doesn't
* include the query string in the uri Authorization component
* or when computing the response component. the second part
* works out ok, since we can hash the header and get the same
* result. however, the uri from the request line won't match
* the uri Authorization component since the header lacks the
* query string, leaving us incompatable with a (broken) MSIE.
*
* the workaround is to fake a query string match if in the proper
* environment - BrowserMatch MSIE, for example. the cool thing
* is that if MSIE ever fixes itself the simple match ought to
* work and this code won't be reached anyway, even if the
* environment is set.
*/
if (apr_table_get(r->subprocess_env,
"AuthDigestEnableQueryStringHack")) {
"applying AuthDigestEnableQueryStringHack "
}
}
if (r->method_number == M_CONNECT) {
"Digest: uri mismatch - <%s> does not match "
return HTTP_BAD_REQUEST;
}
}
else if (
/* check hostname matches, if present */
/* check port matches, if present */
/* check that server-port is default port if no port present */
/* check that path matches */
/* either exact match */
/* or '*' matches empty path in scheme://host */
/* check that query matches */
) {
"Digest: uri mismatch - <%s> does not match "
return HTTP_BAD_REQUEST;
}
}
"Digest: received invalid opaque - got `%s'",
return HTTP_UNAUTHORIZED;
}
"Digest: realm mismatch - got `%s' but expected `%s'",
return HTTP_UNAUTHORIZED;
}
"Digest: unknown algorithm `%s' received: %s",
return HTTP_UNAUTHORIZED;
}
if (return_code == AUTH_USER_NOT_FOUND) {
"Digest: user `%s' in realm `%s' not found: %s",
return HTTP_UNAUTHORIZED;
}
else if (return_code == AUTH_USER_FOUND) {
/* we have a password, so continue */
}
else if (return_code == AUTH_DENIED) {
/* authentication denied in the provider before attempting a match */
"Digest: user `%s' in realm `%s' denied by provider: %s",
return HTTP_UNAUTHORIZED;
}
else {
/* AUTH_GENERAL_ERROR (or worse)
* We'll assume that the module has already said what its error
* was in the logs.
*/
return HTTP_INTERNAL_SERVER_ERROR;
}
/* old (rfc-2069) style digest */
"Digest: user %s: password mismatch: %s", r->user,
r->uri);
return HTTP_UNAUTHORIZED;
}
}
else {
const char *exp_digest;
match = 1;
break;
}
}
if (!match
"Digest: invalid qop `%s' received: %s",
return HTTP_UNAUTHORIZED;
}
if (!exp_digest) {
/* we failed to allocate a client struct */
return HTTP_INTERNAL_SERVER_ERROR;
}
"Digest: user %s: password mismatch: %s", r->user,
r->uri);
return HTTP_UNAUTHORIZED;
}
}
return HTTP_UNAUTHORIZED;
}
/* Note: this check is done last so that a "stale=true" can be
generated if the nonce is old */
return res;
}
return OK;
}
/*
* Authorization-Info header code
*/
static int add_auth_info(request_rec *r)
{
const digest_config_rec *conf =
return OK;
}
/* 2069-style entity-digest is not supported (it's too hard, and
* there are no clients which support 2069 but not 2617). */
/* setup nextnonce
*/
if (conf->nonce_lifetime > 0) {
/* send nextnonce if current nonce will expire in less than 30 secs */
"\"", NULL);
}
}
conf);
}
/* else nonce never expires, hence no nextnonce */
/* do rfc-2069 digest
*/
/* use only RFC-2069 format */
}
else {
/* calculate rspauth attribute
*/
if (!ha1) {
"Digest: internal error: couldn't find session "
return !OK;
}
}
else {
}
/* TBD */
}
else {
}
resp->message_qop ?
/* assemble Authentication-Info header
*/
: "",
NULL);
}
(PROXYREQ_PROXY == r->proxyreq)
? "Proxy-Authentication-Info"
: "Authentication-Info",
ai);
}
return OK;
}
static void register_hooks(apr_pool_t *p)
{
}
{
create_digest_dir_config, /* dir config creater */
NULL, /* dir merger --- default is to override */
NULL, /* server config */
NULL, /* merge server config */
digest_cmds, /* command table */
register_hooks /* register hooks */
};