diff options
Diffstat (limited to 'src/http_auth.c')
| -rw-r--r-- | src/http_auth.c | 1252 |
1 files changed, 0 insertions, 1252 deletions
diff --git a/src/http_auth.c b/src/http_auth.c deleted file mode 100644 index 357f4a1b..00000000 --- a/src/http_auth.c +++ /dev/null @@ -1,1252 +0,0 @@ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#ifdef HAVE_CRYPT_H -# include <crypt.h> -#elif defined(__linux__) -/* linux needs _XOPEN_SOURCE */ -#endif - -#ifdef HAVE_LIBCRYPT -# define HAVE_CRYPT -#endif - -#include <sys/types.h> -#include <sys/stat.h> - -#include <fcntl.h> -#include <stdlib.h> -#include <stdio.h> -#include <string.h> -#include <time.h> -#include <errno.h> -#include <ctype.h> - -#include "server.h" -#include "log.h" -#include "http_auth.h" -#include "http_auth_digest.h" -#include "stream.h" - -#include "inet_ntop_cache.h" - -#include "sys-strings.h" -#include "sys-files.h" - -#ifdef USE_OPENSSL -# include <openssl/md5.h> -#else -# include "md5.h" - -typedef li_MD5_CTX MD5_CTX; -#define MD5_Init li_MD5_Init -#define MD5_Update li_MD5_Update -#define MD5_Final li_MD5_Final - -#endif - -/** - * the $apr1$ handling is taken from apache 1.3.x - */ - -/* - * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0 - * MD5 crypt() function, which is licenced as follows: - * ---------------------------------------------------------------------------- - * "THE BEER-WARE LICENSE" (Revision 42): - * <phk@login.dknet.dk> wrote this file. As long as you retain this notice you - * can do whatever you want with this stuff. If we meet some day, and you think - * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp - * ---------------------------------------------------------------------------- - */ - -handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s); -#ifdef USE_LDAP -void auth_ldap_cleanup(ldap_plugin_config *p); -#endif - -static const char base64_pad = '='; - -/* "A-Z a-z 0-9 + /" maps to 0-63 */ -static const short base64_reverse_table[256] = { -/* 0 1 2 3 4 5 6 7 8 9 A B C D E F */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x00 - 0x0F */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x10 - 0x1F */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, /* 0x20 - 0x2F */ - 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, /* 0x30 - 0x3F */ - -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, /* 0x40 - 0x4F */ - 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, /* 0x50 - 0x5F */ - -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, /* 0x60 - 0x6F */ - 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1, /* 0x70 - 0x7F */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x80 - 0x8F */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0x90 - 0x9F */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xA0 - 0xAF */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xB0 - 0xBF */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xC0 - 0xCF */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xD0 - 0xDF */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xE0 - 0xEF */ - -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 0xF0 - 0xFF */ -}; - - -static unsigned char * base64_decode(buffer *out, const char *in) { - unsigned char *result; - int ch, j = 0, k; - size_t i; - - size_t in_len = strlen(in); - - buffer_prepare_copy(out, in_len); - - result = (unsigned char *)out->ptr; - - ch = in[0]; - /* run through the whole string, converting as we go */ - for (i = 0; i < in_len; i++) { - ch = (unsigned char) in[i]; - - if (ch == '\0') break; - - if (ch == base64_pad) break; - - ch = base64_reverse_table[ch]; - if (ch < 0) continue; - - switch(i % 4) { - case 0: - result[j] = ch << 2; - break; - case 1: - result[j++] |= ch >> 4; - result[j] = (ch & 0x0f) << 4; - break; - case 2: - result[j++] |= ch >>2; - result[j] = (ch & 0x03) << 6; - break; - case 3: - result[j++] |= ch; - break; - } - } - k = j; - /* mop things up if we ended on a boundary */ - if (ch == base64_pad) { - switch(i % 4) { - case 0: - case 1: - return NULL; - case 2: - k++; - case 3: - result[k++] = 0; - } - } - result[k] = '\0'; - - out->used = k; - - return result; -} - -static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) { - int ret = -1; - - if (!username->used|| !realm->used) return -1; - - if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) { - stream f; - char * f_line; - - if (buffer_is_empty(p->conf.auth_htdigest_userfile)) return -1; - - if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) { - log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno)); - - return -1; - } - - f_line = f.start; - - while (f_line - f.start != f.size) { - char *f_user, *f_pwd, *e, *f_realm; - size_t u_len, pwd_len, r_len; - - f_user = f_line; - - /* - * htdigest format - * - * user:realm:md5(user:realm:password) - */ - - if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) { - log_error_write(srv, __FILE__, __LINE__, "sbs", - "parsed error in", p->conf.auth_htdigest_userfile, - "expected 'username:realm:hashed password'"); - - stream_close(&f); - - return -1; - } - - if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) { - log_error_write(srv, __FILE__, __LINE__, "sbs", - "parsed error in", p->conf.auth_plain_userfile, - "expected 'username:realm:hashed password'"); - - stream_close(&f); - - return -1; - } - - /* get pointers to the fields */ - u_len = f_realm - f_user; - f_realm++; - r_len = f_pwd - f_realm; - f_pwd++; - - if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) { - pwd_len = e - f_pwd; - } else { - pwd_len = f.size - (f_pwd - f.start); - } - - if (username->used - 1 == u_len && - (realm->used - 1 == r_len) && - (0 == strncmp(username->ptr, f_user, u_len)) && - (0 == strncmp(realm->ptr, f_realm, r_len))) { - /* found */ - - buffer_copy_string_len(password, f_pwd, pwd_len); - - ret = 0; - break; - } - - /* EOL */ - if (!e) break; - - f_line = e + 1; - } - - stream_close(&f); - } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD || - p->conf.auth_backend == AUTH_BACKEND_PLAIN) { - stream f; - char * f_line; - buffer *auth_fn; - - auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile; - - if (buffer_is_empty(auth_fn)) return -1; - - if (0 != stream_open(&f, auth_fn)) { - log_error_write(srv, __FILE__, __LINE__, "sbss", - "opening plain-userfile", auth_fn, "failed:", strerror(errno)); - - return -1; - } - - f_line = f.start; - - while (f_line - f.start != f.size) { - char *f_user, *f_pwd, *e; - size_t u_len, pwd_len; - - f_user = f_line; - - /* - * htpasswd format - * - * user:crypted passwd - */ - - if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) { - log_error_write(srv, __FILE__, __LINE__, "sbs", - "parsed error in", auth_fn, - "expected 'username:hashed password'"); - - stream_close(&f); - - return -1; - } - - /* get pointers to the fields */ - u_len = f_pwd - f_user; - f_pwd++; - - if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) { - pwd_len = e - f_pwd; - } else { - pwd_len = f.size - (f_pwd - f.start); - } - - if (username->used - 1 == u_len && - (0 == strncmp(username->ptr, f_user, u_len))) { - /* found */ - - buffer_copy_string_len(password, f_pwd, pwd_len); - - ret = 0; - break; - } - - /* EOL */ - if (!e) break; - - f_line = e + 1; - } - - stream_close(&f); - } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) { - ret = 0; - } else { - return -1; - } - - return ret; -} - -static int http_auth_match_rules(server *srv, mod_auth_plugin_data *p, const char *url, const char *username, const char *group, const char *host) { - const char *r = NULL, *rules = NULL; - size_t i; - int username_len; - data_string *require; - array *req; - - UNUSED(group); - UNUSED(host); - - /* check what has to be match to fullfil the request */ - /* search auth-directives for path */ - for (i = 0; i < p->conf.auth_require->used; i++) { - if (p->conf.auth_require->data[i]->key->used == 0) continue; - - if (0 == strncmp(url, p->conf.auth_require->data[i]->key->ptr, p->conf.auth_require->data[i]->key->used - 1)) { - break; - } - } - - if (i == p->conf.auth_require->used) { - return -1; - } - - req = ((data_array *)(p->conf.auth_require->data[i]))->value; - - require = (data_string *)array_get_element(req, CONST_STR_LEN("require")); - - /* if we get here, the user we got a authed user */ - if (buffer_is_equal_string(require->value, CONST_STR_LEN("valid-user"))) { - return 0; - } - - /* user=name1|group=name3|host=name4 */ - - /* seperate the string by | */ -#if 0 - log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value); -#endif - - username_len = username ? strlen(username) : 0; - - r = rules = require->value->ptr; - - while (1) { - const char *eq; - const char *k, *v, *e; - int k_len, v_len, r_len; - - e = strchr(r, '|'); - - if (e) { - r_len = e - r; - } else { - r_len = strlen(rules) - (r - rules); - } - - /* from r to r + r_len is a rule */ - - if (0 == strncmp(r, "valid-user", r_len)) { - log_error_write(srv, __FILE__, __LINE__, "sb", - "parsing the 'require' section in 'auth.require' failed: valid-user cannot be combined with other require rules", - require->value); - return -1; - } - - /* search for = in the rules */ - if (NULL == (eq = strchr(r, '='))) { - log_error_write(srv, __FILE__, __LINE__, "sb", - "parsing the 'require' section in 'auth.require' failed: a = is missing", - require->value); - return -1; - } - - /* = out of range */ - if (eq > r + r_len) { - log_error_write(srv, __FILE__, __LINE__, "sb", - "parsing the 'require' section in 'auth.require' failed: = out of range", - require->value); - - return -1; - } - - /* the part before the = is user|group|host */ - - k = r; - k_len = eq - r; - v = eq + 1; - v_len = r_len - k_len - 1; - - if (k_len == 4) { - if (0 == strncmp(k, "user", k_len)) { - if (username && - username_len == v_len && - 0 == strncmp(username, v, v_len)) { - return 0; - } - } else if (0 == strncmp(k, "host", k_len)) { - log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)"); - } else { - log_error_write(srv, __FILE__, __LINE__, "s", "unknown key"); - return -1; - } - } else if (k_len == 5) { - if (0 == strncmp(k, "group", k_len)) { - log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)"); - } else { - log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k); - return -1; - } - } else { - log_error_write(srv, __FILE__, __LINE__, "s", "unknown key"); - return -1; - } - - if (!e) break; - r = e + 1; - } - - log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched"); - - return -1; -} - -#define APR_MD5_DIGESTSIZE 16 -#define APR1_ID "$apr1$" - -/* - * The following MD5 password encryption code was largely borrowed from - * the FreeBSD 3.0 /usr/src/lib/libcrypt/crypt.c file, which is - * licenced as stated at the top of this file. - */ - -static void to64(char *s, unsigned long v, int n) -{ - static unsigned char itoa64[] = /* 0 ... 63 => ASCII - 64 */ - "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; - - while (--n >= 0) { - *s++ = itoa64[v&0x3f]; - v >>= 6; - } -} - -static void apr_md5_encode(const char *pw, const char *salt, char *result, size_t nbytes) { - /* - * Minimum size is 8 bytes for salt, plus 1 for the trailing NUL, - * plus 4 for the '$' separators, plus the password hash itself. - * Let's leave a goodly amount of leeway. - */ - - char passwd[120], *p; - const char *sp, *ep; - unsigned char final[APR_MD5_DIGESTSIZE]; - ssize_t sl, pl, i; - MD5_CTX ctx, ctx1; - unsigned long l; - - /* - * Refine the salt first. It's possible we were given an already-hashed - * string as the salt argument, so extract the actual salt value from it - * if so. Otherwise just use the string up to the first '$' as the salt. - */ - sp = salt; - - /* - * If it starts with the magic string, then skip that. - */ - if (!strncmp(sp, APR1_ID, strlen(APR1_ID))) { - sp += strlen(APR1_ID); - } - - /* - * It stops at the first '$' or 8 chars, whichever comes first - */ - for (ep = sp; (*ep != '\0') && (*ep != '$') && (ep < (sp + 8)); ep++) { - continue; - } - - /* - * Get the length of the true salt - */ - sl = ep - sp; - - /* - * 'Time to make the doughnuts..' - */ - MD5_Init(&ctx); - - /* - * The password first, since that is what is most unknown - */ - MD5_Update(&ctx, (const unsigned char*) pw, strlen(pw)); - - /* - * Then our magic string - */ - MD5_Update(&ctx, (const unsigned char*) APR1_ID, strlen(APR1_ID)); - - /* - * Then the raw salt - */ - MD5_Update(&ctx, (const unsigned char*) sp, sl); - - /* - * Then just as many characters of the MD5(pw, salt, pw) - */ - MD5_Init(&ctx1); - MD5_Update(&ctx1, (const unsigned char*) pw, strlen(pw)); - MD5_Update(&ctx1, (const unsigned char*) sp, sl); - MD5_Update(&ctx1, (const unsigned char*) pw, strlen(pw)); - MD5_Final(final, &ctx1); - for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) { - MD5_Update(&ctx, final, - (pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl); - } - - /* - * Don't leave anything around in vm they could use. - */ - memset(final, 0, sizeof(final)); - - /* - * Then something really weird... - */ - for (i = strlen(pw); i != 0; i >>= 1) { - if (i & 1) { - MD5_Update(&ctx, final, 1); - } - else { - MD5_Update(&ctx, (const unsigned char*) pw, 1); - } - } - - /* - * Now make the output string. We know our limitations, so we - * can use the string routines without bounds checking. - */ - strcpy(passwd, APR1_ID); - strncat(passwd, sp, sl); - strcat(passwd, "$"); - - MD5_Final(final, &ctx); - - /* - * And now, just to make sure things don't run too fast.. - * On a 60 Mhz Pentium this takes 34 msec, so you would - * need 30 seconds to build a 1000 entry dictionary... - */ - for (i = 0; i < 1000; i++) { - MD5_Init(&ctx1); - if (i & 1) { - MD5_Update(&ctx1, (const unsigned char*) pw, strlen(pw)); - } - else { - MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE); - } - if (i % 3) { - MD5_Update(&ctx1, (const unsigned char*) sp, sl); - } - - if (i % 7) { - MD5_Update(&ctx1, (const unsigned char*) pw, strlen(pw)); - } - - if (i & 1) { - MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE); - } - else { - MD5_Update(&ctx1, (const unsigned char*) pw, strlen(pw)); - } - MD5_Final(final,&ctx1); - } - - p = passwd + strlen(passwd); - - l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p, l, 4); p += 4; - l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p, l, 4); p += 4; - l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p, l, 4); p += 4; - l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p, l, 4); p += 4; - l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p, l, 4); p += 4; - l = final[11] ; to64(p, l, 2); p += 2; - *p = '\0'; - - /* - * Don't leave anything around in vm they could use. - */ - memset(final, 0, sizeof(final)); - - /* FIXME - */ -#define apr_cpystrn strncpy - apr_cpystrn(result, passwd, nbytes - 1); -} - - -/** - * - * - * @param password password-string from the auth-backend - * @param pw password-string from the client - */ - -static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) { - UNUSED(srv); - UNUSED(req); - - if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) { - /* - * htdigest format - * - * user:realm:md5(user:realm:password) - */ - - MD5_CTX Md5Ctx; - HASH HA1; - char a1[256]; - - MD5_Init(&Md5Ctx); - MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw)); - MD5_Final(HA1, &Md5Ctx); - - CvtHex(HA1, a1); - - if (buffer_is_equal_string(password, a1, strlen(a1))) { - return 0; - } - } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) { - char sample[120]; - if (!strncmp(password->ptr, APR1_ID, strlen(APR1_ID))) { - /* - * The hash was created using $apr1$ custom algorithm. - */ - apr_md5_encode(pw, password->ptr, sample, sizeof(sample)); - return (strcmp(sample, password->ptr) == 0) ? 0 : 1; - } else { -#ifdef HAVE_CRYPT - char salt[32]; - char *crypted; - size_t salt_len = 0; - /* - * htpasswd format - * - * user:crypted password - */ - - /* - * Algorithm Salt - * CRYPT_STD_DES 2-character (Default) - * CRYPT_EXT_DES 9-character - * CRYPT_MD5 12-character beginning with $1$ - * CRYPT_BLOWFISH 16-character beginning with $2$ - */ - - if (password->used < 13 + 1) { - fprintf(stderr, "%s.%d\n", __FILE__, __LINE__); - return -1; - } - - if (password->used == 13 + 1) { - /* a simple DES password is 2 + 11 characters */ - salt_len = 2; - } else if (password->ptr[0] == '$' && password->ptr[2] == '$') { - char *dollar = NULL; - - if (NULL == (dollar = strchr(password->ptr + 3, '$'))) { - fprintf(stderr, "%s.%d\n", __FILE__, __LINE__); - return -1; - } - - salt_len = dollar - password->ptr; - } - - if (salt_len > sizeof(salt) - 1) { - fprintf(stderr, "%s.%d\n", __FILE__, __LINE__); - return -1; - } - - strncpy(salt, password->ptr, salt_len); - - salt[salt_len] = '\0'; - - crypted = crypt(pw, salt); - - if (buffer_is_equal_string(password, crypted, strlen(crypted))) { - return 0; - } else { - fprintf(stderr, "%s.%d\n", __FILE__, __LINE__); - } - -#endif - } - } else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) { - if (buffer_is_equal_string(password, pw, strlen(pw))) { - return 0; - } - } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) { -#ifdef USE_LDAP - LDAP *ldap = NULL; - LDAPMessage *lm = NULL, *first = NULL; - struct berval credentials; - char *dn = NULL; - int ret = 0; - char *attrs[] = { LDAP_NO_ATTRS, NULL }; - size_t i = 0; - - /* for now we stay synchronous */ - - /* - * 1. connect anonymously (done in plugin init) - * 2. get DN for uid = username - * 3. auth against ldap server - * 4. (optional) check a field - * 5. disconnect - * - */ - - /* check username - * - * we have to protect us againt username which modifies out filter in - * a unpleasant way - */ - - for (i = 0; i < username->used - 1; i++) { - char c = username->ptr[i]; - - if (!isalpha(c) && - !isdigit(c) && - (c != ' ') && - (c != '@') && - (c != '-') && - (c != '_') && - (c != '.') ) { - - log_error_write(srv, __FILE__, __LINE__, "sbd", - "ldap: invalid character (- _.@a-zA-Z0-9 allowed) in username:", username, i); - - return -1; - } - } - - if (p->conf.auth_ldap_allow_empty_pw != 1 && pw[0] == '\0') - return -1; - - /* 2. */ - - if (p->conf.ldap->ldap == NULL) { - if(auth_ldap_init(srv, &p->conf) != HANDLER_GO_ON) - return -1; - } - - /* build filter */ - buffer_copy_string_buffer(p->ldap_filter, p->conf.ldap->ldap_filter_pre); - buffer_append_string_buffer(p->ldap_filter, username); - buffer_append_string_buffer(p->ldap_filter, p->conf.ldap->ldap_filter_post); - - ret = ldap_search_ext_s(p->conf.ldap->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, NULL, NULL, NULL, 0, &lm); - - if (ret == LDAP_SERVER_DOWN) { - log_error_write(srv, __FILE__, __LINE__, "s", - "ldap: server down, try to reconnect"); - - auth_ldap_cleanup(p->conf.ldap); - - if(auth_ldap_init(srv, &p->conf) != HANDLER_GO_ON) - return -1; - - log_error_write(srv, __FILE__, __LINE__, "s", - "ldap: successfully reconnected"); - } - - if (ret != LDAP_SUCCESS) { - log_error_write(srv, __FILE__, __LINE__, "sssb", - "ldap:", ldap_err2string(ret), ", filter:", p->ldap_filter); - - return -1; - } - - if (ldap_count_entries(p->conf.ldap->ldap, lm) > 1) { - log_error_write(srv, __FILE__, __LINE__, "ssb", - "ldap:", "more than one record returned, you might have to refine the filter:", p->ldap_filter); - } - - first = ldap_first_entry(p->conf.ldap->ldap, lm); - if (first == NULL) { - ldap_get_option(p->conf.ldap->ldap, LDAP_OPT_ERROR_NUMBER, &ret); - log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret)); - - ldap_msgfree(lm); - - return -1; - } - - dn = ldap_get_dn(p->conf.ldap->ldap, first); - if (dn == NULL) { - ldap_get_option(p->conf.ldap->ldap, LDAP_OPT_ERROR_NUMBER, &ret); - log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret)); - - ldap_msgfree(lm); - - return -1; - } - - ldap_msgfree(lm); - - /* 3. */ - ret = ldap_initialize(&ldap, p->conf.auth_ldap_url->ptr); - if (ret) { - log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret)); - - ldap_memfree(dn); - - return -1; - } - - { - const int ldap_version = LDAP_VERSION3; - ret = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &ldap_version); - } - if (ret != LDAP_OPT_SUCCESS) { - log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret)); - - ldap_memfree(ldap); - ldap_memfree(dn); - - return -1; - } - - if (p->conf.auth_ldap_starttls == 1) { - ret = ldap_start_tls_s(ldap, NULL, NULL); - if (ret != LDAP_OPT_SUCCESS) { - log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret)); - - ldap_memfree(ldap); - ldap_memfree(dn); - - return -1; - } - } - - /* Don't initialize it using " = {...}" since upstream doesn't - * guarantee an order and the compiler only issues a warning when - * passing an int as the pointer and vice-versa. - * We have to cast away the const since berval is a general struct, - * but ldap_sasl_bind_s doesn't write to the *pw location - */ - credentials.bv_val = (char*)pw; - credentials.bv_len = strlen(pw); - - /* TODO: add funtionality to specify LDAP_SASL_EXTERNAL (or GSS-SPNEGO, etc.) */ - ret = ldap_sasl_bind_s(ldap, dn, LDAP_SASL_SIMPLE, &credentials, NULL, NULL, NULL); - if (ret != LDAP_SUCCESS) { - log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret)); - - ldap_memfree(ldap); - ldap_memfree(dn); - - return -1; - } - - /* 5. */ - ldap_unbind_ext_s(ldap, NULL, NULL); - ldap_memfree(dn); - - /* everything worked, good, access granted */ - - return 0; -#endif - } - return -1; -} - -int http_auth_basic_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, buffer *url, const char *realm_str) { - buffer *username, *password; - char *pw; - - data_string *realm; - - realm = (data_string *)array_get_element(req, CONST_STR_LEN("realm")); - - username = buffer_init(); - - if (!base64_decode(username, realm_str)) { - log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username); - - buffer_free(username); - return 0; - } - - /* r2 == user:password */ - if (NULL == (pw = strchr(username->ptr, ':'))) { - log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username); - - buffer_free(username); - return 0; - } - - *pw++ = '\0'; - - username->used = pw - username->ptr; - - password = buffer_init(); - - /* copy password to r1 */ - if (http_auth_get_password(srv, p, username, realm->value, password)) { - buffer_free(username); - buffer_free(password); - - log_error_write(srv, __FILE__, __LINE__, "ss", "get_password failed, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr))); - - return 0; - } - - /* password doesn't match */ - if (http_auth_basic_password_compare(srv, p, req, username, realm->value, password, pw)) { - log_error_write(srv, __FILE__, __LINE__, "sbsBss", "password doesn't match for", con->uri.path, "username:", username, ", IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr))); - - buffer_free(username); - buffer_free(password); - - return 0; - } - - /* value is our allow-rules */ - if (http_auth_match_rules(srv, p, url->ptr, username->ptr, NULL, NULL)) { - buffer_free(username); - buffer_free(password); - - log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match"); - - return 0; - } - - /* remember the username */ - buffer_copy_string_buffer(p->auth_user, username); - - buffer_free(username); - buffer_free(password); - - return 1; -} - -typedef struct { - const char *key; - int key_len; - char **ptr; -} digest_kv; - -int http_auth_digest_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, buffer *url, const char *realm_str) { - char a1[256]; - char a2[256]; - - char *username; - char *realm; - char *nonce; - char *uri; - char *algorithm; - char *qop; - char *cnonce; - char *nc; - char *respons; - - char *e, *c; - const char *m = NULL; - int i; - buffer *password, *b, *username_buf, *realm_buf; - - MD5_CTX Md5Ctx; - HASH HA1; - HASH HA2; - HASH RespHash; - HASHHEX HA2Hex; - - - /* init pointers */ -#define S(x) \ - x, sizeof(x)-1, NULL - digest_kv dkv[10] = { - { S("username=") }, - { S("realm=") }, - { S("nonce=") }, - { S("uri=") }, - { S("algorithm=") }, - { S("qop=") }, - { S("cnonce=") }, - { S("nc=") }, - { S("response=") }, - - { NULL, 0, NULL } - }; -#undef S - - dkv[0].ptr = &username; - dkv[1].ptr = &realm; - dkv[2].ptr = &nonce; - dkv[3].ptr = &uri; - dkv[4].ptr = &algorithm; - dkv[5].ptr = &qop; - dkv[6].ptr = &cnonce; - dkv[7].ptr = &nc; - dkv[8].ptr = &respons; - dkv[9].ptr = NULL; - - UNUSED(req); - - for (i = 0; dkv[i].key; i++) { - *(dkv[i].ptr) = NULL; - } - - - if (p->conf.auth_backend != AUTH_BACKEND_HTDIGEST && - p->conf.auth_backend != AUTH_BACKEND_PLAIN) { - log_error_write(srv, __FILE__, __LINE__, "s", - "digest: unsupported backend (only htdigest or plain)"); - - return -1; - } - - b = buffer_init_string(realm_str); - - /* parse credentials from client */ - for (c = b->ptr; *c; c++) { - /* skip whitespaces */ - while (*c == ' ' || *c == '\t') c++; - if (!*c) break; - - for (i = 0; dkv[i].key; i++) { - if ((0 == strncmp(c, dkv[i].key, dkv[i].key_len))) { - if ((c[dkv[i].key_len] == '"') && - (NULL != (e = strchr(c + dkv[i].key_len + 1, '"')))) { - /* value with "..." */ - *(dkv[i].ptr) = c + dkv[i].key_len + 1; - c = e; - - *e = '\0'; - } else if (NULL != (e = strchr(c + dkv[i].key_len, ','))) { - /* value without "...", terminated by ',' */ - *(dkv[i].ptr) = c + dkv[i].key_len; - c = e; - - *e = '\0'; - } else { - /* value without "...", terminated by EOL */ - *(dkv[i].ptr) = c + dkv[i].key_len; - c += strlen(c) - 1; - } - } - } - } - - if (p->conf.auth_debug > 1) { - log_error_write(srv, __FILE__, __LINE__, "ss", "username", username); - log_error_write(srv, __FILE__, __LINE__, "ss", "realm", realm); - log_error_write(srv, __FILE__, __LINE__, "ss", "nonce", nonce); - log_error_write(srv, __FILE__, __LINE__, "ss", "uri", uri); - log_error_write(srv, __FILE__, __LINE__, "ss", "algorigthm", algorithm); - log_error_write(srv, __FILE__, __LINE__, "ss", "qop", qop); - log_error_write(srv, __FILE__, __LINE__, "ss", "cnonce", cnonce); - log_error_write(srv, __FILE__, __LINE__, "ss", "nc", nc); - log_error_write(srv, __FILE__, __LINE__, "ss", "response", respons); - } - - /* check if everything is transmitted */ - if (!username || - !realm || - !nonce || - !uri || - (qop && (!nc || !cnonce)) || - !respons ) { - /* missing field */ - - log_error_write(srv, __FILE__, __LINE__, "s", - "digest: missing field"); - - buffer_free(b); - return -1; - } - - /** - * protect the md5-sess against missing cnonce and nonce - */ - if (algorithm && - 0 == strcasecmp(algorithm, "md5-sess") && - (!nonce || !cnonce)) { - log_error_write(srv, __FILE__, __LINE__, "s", - "digest: (md5-sess: missing field"); - - buffer_free(b); - return -1; - } - - m = get_http_method_name(con->request.http_method); - - /* password-string == HA1 */ - password = buffer_init(); - username_buf = buffer_init_string(username); - realm_buf = buffer_init_string(realm); - if (http_auth_get_password(srv, p, username_buf, realm_buf, password)) { - buffer_free(password); - buffer_free(b); - buffer_free(username_buf); - buffer_free(realm_buf); - return 0; - } - - buffer_free(username_buf); - buffer_free(realm_buf); - - if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) { - /* generate password from plain-text */ - MD5_Init(&Md5Ctx); - MD5_Update(&Md5Ctx, (unsigned char *)username, strlen(username)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)password->ptr, password->used - 1); - MD5_Final(HA1, &Md5Ctx); - } else if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) { - /* HA1 */ - /* transform the 32-byte-hex-md5 to a 16-byte-md5 */ - for (i = 0; i < HASHLEN; i++) { - HA1[i] = hex2int(password->ptr[i*2]) << 4; - HA1[i] |= hex2int(password->ptr[i*2+1]); - } - } else { - /* we already check that above */ - SEGFAULT("p->conf.auth_backend is %d", p->conf.auth_backend); - } - - buffer_free(password); - - if (algorithm && - strcasecmp(algorithm, "md5-sess") == 0) { - MD5_Init(&Md5Ctx); - MD5_Update(&Md5Ctx, (unsigned char *)HA1, 16); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce)); - MD5_Final(HA1, &Md5Ctx); - } - - CvtHex(HA1, a1); - - /* calculate H(A2) */ - MD5_Init(&Md5Ctx); - MD5_Update(&Md5Ctx, (unsigned char *)m, strlen(m)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)uri, strlen(uri)); - if (qop && strcasecmp(qop, "auth-int") == 0) { - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)"", HASHHEXLEN); - } - MD5_Final(HA2, &Md5Ctx); - CvtHex(HA2, HA2Hex); - - /* calculate response */ - MD5_Init(&Md5Ctx); - MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - if (qop && *qop) { - MD5_Update(&Md5Ctx, (unsigned char *)nc, strlen(nc)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - MD5_Update(&Md5Ctx, (unsigned char *)qop, strlen(qop)); - MD5_Update(&Md5Ctx, (unsigned char *)":", 1); - }; - MD5_Update(&Md5Ctx, (unsigned char *)HA2Hex, HASHHEXLEN); - MD5_Final(RespHash, &Md5Ctx); - CvtHex(RespHash, a2); - - if (0 != strcmp(a2, respons)) { - /* digest not ok */ - - if (p->conf.auth_debug) { - log_error_write(srv, __FILE__, __LINE__, "sss", - "digest: digest mismatch", a2, respons); - } - - log_error_write(srv, __FILE__, __LINE__, "ssss", - "digest: auth failed for ", username, ": wrong password, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr))); - - buffer_free(b); - return 0; - } - - /* value is our allow-rules */ - if (http_auth_match_rules(srv, p, url->ptr, username, NULL, NULL)) { - buffer_free(b); - - log_error_write(srv, __FILE__, __LINE__, "s", - "digest: rules did match"); - - return 0; - } - - /* remember the username */ - buffer_copy_string(p->auth_user, username); - - buffer_free(b); - - if (p->conf.auth_debug) { - log_error_write(srv, __FILE__, __LINE__, "s", - "digest: auth ok"); - } - return 1; -} - - -int http_auth_digest_generate_nonce(server *srv, mod_auth_plugin_data *p, buffer *fn, char out[33]) { - HASH h; - MD5_CTX Md5Ctx; - char hh[32]; - - UNUSED(p); - - /* generate shared-secret */ - MD5_Init(&Md5Ctx); - MD5_Update(&Md5Ctx, (unsigned char *)fn->ptr, fn->used - 1); - MD5_Update(&Md5Ctx, (unsigned char *)"+", 1); - - /* we assume sizeof(time_t) == 4 here, but if not it ain't a problem at all */ - LI_ltostr(hh, srv->cur_ts); - MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh)); - MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy)); - LI_ltostr(hh, rand()); - MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh)); - - MD5_Final(h, &Md5Ctx); - - CvtHex(h, out); - - return 0; -} |