src/mod_authn_file.c

   1 #include "first.h"
   2
   3
   4 /*(htpasswd)*/
   5 #ifdef HAVE_CRYPT_H
   6 # include <crypt.h>
   7 #elif defined(__linux__)
   8 /* linux needs _XOPEN_SOURCE */
   9 # define _XOPEN_SOURCE
  10 #endif
  11
  12 #if defined(HAVE_LIBCRYPT) && !defined(HAVE_CRYPT)
  13 /* always assume crypt() is present if we have -lcrypt */
  14 # define HAVE_CRYPT
  15 #endif
  16
  17 #include "base.h"
  18
  19 #ifdef USE_OPENSSL
  20 #include "base64.h"
  21 #include <openssl/md4.h>
  22 #include <openssl/sha.h>
  23 #endif
  24
  25 #include "safe_memclear.h"
  26 /*(htpasswd)*/
  27
  28
  29 #include "plugin.h"
  30 #include "http_auth.h"
  31 #include "log.h"
  32 #include "response.h"
  33
  34 #include "inet_ntop_cache.h"
  35 #include "base64.h"
  36 #include "md5.h"
  37
  38 #include <sys/types.h>
  39 #include <sys/stat.h>
  40
  41 #include <stdlib.h>
  42 #include <string.h>
  43 #include <errno.h>
  44 #include <fcntl.h>
  45 #include <unistd.h>
  46
  47 /*
  48  * htdigest, htpasswd, plain auth backends
  49  */
  50
  51 typedef struct {
  52     buffer *auth_plain_groupfile;
  53     buffer *auth_plain_userfile;
  54     buffer *auth_htdigest_userfile;
  55     buffer *auth_htpasswd_userfile;
  56 } plugin_config;
  57
  58 typedef struct {
  59     PLUGIN_DATA;
  60     plugin_config **config_storage;
  61     plugin_config conf;
  62 } plugin_data;
  63
  64 static handler_t mod_authn_file_htdigest_digest(server *srv, connection *con, void *p_d, const char *username, const char *realm, unsigned char HA1[16]);
  65 static handler_t mod_authn_file_htdigest_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw);
  66 static handler_t mod_authn_file_plain_digest(server *srv, connection *con, void *p_d, const char *username, const char *realm, unsigned char HA1[16]);
  67 static handler_t mod_authn_file_plain_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw);
  68 static handler_t mod_authn_file_htpasswd_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw);
  69
  70 INIT_FUNC(mod_authn_file_init) {
  71     static http_auth_backend_t http_auth_backend_htdigest =
  72       { "htdigest", mod_authn_file_htdigest_basic, mod_authn_file_htdigest_digest, NULL };
  73     static http_auth_backend_t http_auth_backend_htpasswd =
  74       { "htpasswd", mod_authn_file_htpasswd_basic, NULL, NULL };
  75     static http_auth_backend_t http_auth_backend_plain =
  76       { "plain", mod_authn_file_plain_basic, mod_authn_file_plain_digest, NULL };
  77     plugin_data *p = calloc(1, sizeof(*p));
  78
  79     /* register http_auth_backend_htdigest */
  80     http_auth_backend_htdigest.p_d = p;
  81     http_auth_backend_set(&http_auth_backend_htdigest);
  82
  83     /* register http_auth_backend_htpasswd */
  84     http_auth_backend_htpasswd.p_d = p;
  85     http_auth_backend_set(&http_auth_backend_htpasswd);
  86
  87     /* register http_auth_backend_plain */
  88     http_auth_backend_plain.p_d = p;
  89     http_auth_backend_set(&http_auth_backend_plain);
  90
  91     return p;
  92 }
  93
  94 FREE_FUNC(mod_authn_file_free) {
  95     plugin_data *p = p_d;
  96
  97     UNUSED(srv);
  98
  99     if (!p) return HANDLER_GO_ON;
 100
 101     if (p->config_storage) {
 102         size_t i;
 103         for (i = 0; i < srv->config_context->used; i++) {
 104             plugin_config *s = p->config_storage[i];
 105
 106             if (NULL == s) continue;
 107
 108             buffer_free(s->auth_plain_groupfile);
 109             buffer_free(s->auth_plain_userfile);
 110             buffer_free(s->auth_htdigest_userfile);
 111             buffer_free(s->auth_htpasswd_userfile);
 112
 113             free(s);
 114         }
 115         free(p->config_storage);
 116     }
 117
 118     free(p);
 119
 120     return HANDLER_GO_ON;
 121 }
 122
 123 SETDEFAULTS_FUNC(mod_authn_file_set_defaults) {
 124     plugin_data *p = p_d;
 125     size_t i;
 126
 127     config_values_t cv[] = {
 128         { "auth.backend.plain.groupfile",   NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
 129         { "auth.backend.plain.userfile",    NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
 130         { "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
 131         { "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 3 */
 132         { NULL,                             NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
 133     };
 134
 135     p->config_storage = calloc(1, srv->config_context->used * sizeof(plugin_config *));
 136
 137     for (i = 0; i < srv->config_context->used; i++) {
 138         data_config const* config = (data_config const*)srv->config_context->data[i];
 139         plugin_config *s;
 140
 141         s = calloc(1, sizeof(plugin_config));
 142         s->auth_plain_groupfile = buffer_init();
 143         s->auth_plain_userfile = buffer_init();
 144         s->auth_htdigest_userfile = buffer_init();
 145         s->auth_htpasswd_userfile = buffer_init();
 146
 147         cv[0].destination = s->auth_plain_groupfile;
 148         cv[1].destination = s->auth_plain_userfile;
 149         cv[2].destination = s->auth_htdigest_userfile;
 150         cv[3].destination = s->auth_htpasswd_userfile;
 151
 152         p->config_storage[i] = s;
 153
 154         if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
 155             return HANDLER_ERROR;
 156         }
 157     }
 158
 159     return HANDLER_GO_ON;
 160 }
 161
 162 #define PATCH(x) \
 163     p->conf.x = s->x;
 164 static int mod_authn_file_patch_connection(server *srv, connection *con, plugin_data *p) {
 165     size_t i, j;
 166     plugin_config *s = p->config_storage[0];
 167
 168     PATCH(auth_plain_groupfile);
 169     PATCH(auth_plain_userfile);
 170     PATCH(auth_htdigest_userfile);
 171     PATCH(auth_htpasswd_userfile);
 172
 173     /* skip the first, the global context */
 174     for (i = 1; i < srv->config_context->used; i++) {
 175         data_config *dc = (data_config *)srv->config_context->data[i];
 176         s = p->config_storage[i];
 177
 178         /* condition didn't match */
 179         if (!config_check_cond(srv, con, dc)) continue;
 180
 181         /* merge config */
 182         for (j = 0; j < dc->value->used; j++) {
 183             data_unset *du = dc->value->data[j];
 184
 185             if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.groupfile"))) {
 186                 PATCH(auth_plain_groupfile);
 187             } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.userfile"))) {
 188                 PATCH(auth_plain_userfile);
 189             } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htdigest.userfile"))) {
 190                 PATCH(auth_htdigest_userfile);
 191             } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htpasswd.userfile"))) {
 192                 PATCH(auth_htpasswd_userfile);
 193             }
 194         }
 195     }
 196
 197     return 0;
 198 }
 199 #undef PATCH
 200
 201
 202 static int mod_authn_file_htdigest_get(server *srv, const buffer *auth_fn, const buffer *username, const buffer *realm, unsigned char HA1[16]) {
 203     FILE *fp;
 204     char f_user[1024];
 205
 206     if (buffer_string_is_empty(auth_fn)) return -1;
 207     if (buffer_is_empty(username) || buffer_is_empty(realm)) return -1;
 208
 209     fp = fopen(auth_fn->ptr, "r");
 210     if (NULL == fp) {
 211         log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", auth_fn, "failed:", strerror(errno));
 212
 213         return -1;
 214     }
 215
 216     while (NULL != fgets(f_user, sizeof(f_user), fp)) {
 217         char *f_pwd, *f_realm;
 218         size_t u_len, r_len;
 219
 220         /* skip blank lines and comment lines (beginning '#') */
 221         if (f_user[0] == '#' || f_user[0] == '\n' || f_user[0] == '\0') continue;
 222
 223         /*
 224          * htdigest format
 225          *
 226          * user:realm:md5(user:realm:password)
 227          */
 228
 229         if (NULL == (f_realm = strchr(f_user, ':'))) {
 230             log_error_write(srv, __FILE__, __LINE__, "sbs",
 231                     "parsed error in", auth_fn,
 232                     "expected 'username:realm:hashed password'");
 233
 234             continue; /* skip bad lines */
 235         }
 236
 237         if (NULL == (f_pwd = strchr(f_realm + 1, ':'))) {
 238             log_error_write(srv, __FILE__, __LINE__, "sbs",
 239                     "parsed error in", auth_fn,
 240                     "expected 'username:realm:hashed password'");
 241
 242             continue; /* skip bad lines */
 243         }
 244
 245         /* get pointers to the fields */
 246         u_len = f_realm - f_user;
 247         f_realm++;
 248         r_len = f_pwd - f_realm;
 249         f_pwd++;
 250
 251         if (buffer_string_length(username) == u_len &&
 252             (buffer_string_length(realm) == r_len) &&
 253             (0 == strncmp(username->ptr, f_user, u_len)) &&
 254             (0 == strncmp(realm->ptr, f_realm, r_len))) {
 255             /* found */
 256
 257             size_t pwd_len = strlen(f_pwd);
 258             if (f_pwd[pwd_len-1] == '\n') --pwd_len;
 259
 260             fclose(fp);
 261
 262             return http_auth_md5_hex2bin(f_pwd, pwd_len, HA1);
 263         }
 264     }
 265
 266     fclose(fp);
 267     return -1;
 268 }
 269
 270 static handler_t mod_authn_file_htdigest_digest(server *srv, connection *con, void *p_d, const char *username, const char *realm, unsigned char HA1[16]) {
 271     plugin_data *p = (plugin_data *)p_d;
 272     buffer *username_buf = buffer_init_string(username);
 273     buffer *realm_buf = buffer_init_string(realm);
 274     int rc;
 275     mod_authn_file_patch_connection(srv, con, p);
 276     rc = mod_authn_file_htdigest_get(srv, p->conf.auth_htdigest_userfile, username_buf, realm_buf, HA1);
 277     buffer_free(realm_buf);
 278     buffer_free(username_buf);
 279     UNUSED(con);
 280     return (0 == rc) ? HANDLER_GO_ON : HANDLER_ERROR;
 281 }
 282
 283 static handler_t mod_authn_file_htdigest_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw) {
 284     plugin_data *p = (plugin_data *)p_d;
 285     li_MD5_CTX Md5Ctx;
 286     unsigned char HA1[16];
 287     unsigned char htdigest[16];
 288
 289     mod_authn_file_patch_connection(srv, con, p);
 290     if (mod_authn_file_htdigest_get(srv, p->conf.auth_htdigest_userfile, username, require->realm, htdigest)) return HANDLER_ERROR;
 291
 292     li_MD5_Init(&Md5Ctx);
 293     li_MD5_Update(&Md5Ctx, CONST_BUF_LEN(username));
 294     li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 295     li_MD5_Update(&Md5Ctx, CONST_BUF_LEN(require->realm));
 296     li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 297     li_MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
 298     li_MD5_Final(HA1, &Md5Ctx);
 299
 300     UNUSED(con);
 301     return (0 == memcmp(HA1, htdigest, sizeof(HA1))
 302             && http_auth_match_rules(require, username->ptr, NULL, NULL))
 303       ? HANDLER_GO_ON
 304       : HANDLER_ERROR;
 305 }
 306
 307
 308
 309
 310 static int mod_authn_file_htpasswd_get(server *srv, const buffer *auth_fn, const buffer *username, buffer *password) {
 311     FILE *fp;
 312     char f_user[1024];
 313
 314     if (buffer_is_empty(username)) return -1;
 315
 316     if (buffer_string_is_empty(auth_fn)) return -1;
 317     fp = fopen(auth_fn->ptr, "r");
 318     if (NULL == fp) {
 319         log_error_write(srv, __FILE__, __LINE__, "sbss",
 320                 "opening plain-userfile", auth_fn, "failed:", strerror(errno));
 321
 322         return -1;
 323     }
 324
 325     while (NULL != fgets(f_user, sizeof(f_user), fp)) {
 326         char *f_pwd;
 327         size_t u_len;
 328
 329         /* skip blank lines and comment lines (beginning '#') */
 330         if (f_user[0] == '#' || f_user[0] == '\n' || f_user[0] == '\0') continue;
 331
 332         /*
 333          * htpasswd format
 334          *
 335          * user:crypted passwd
 336          */
 337
 338         if (NULL == (f_pwd = strchr(f_user, ':'))) {
 339             log_error_write(srv, __FILE__, __LINE__, "sbs",
 340                     "parsed error in", auth_fn,
 341                     "expected 'username:hashed password'");
 342
 343             continue; /* skip bad lines */
 344         }
 345
 346         /* get pointers to the fields */
 347         u_len = f_pwd - f_user;
 348         f_pwd++;
 349
 350         if (buffer_string_length(username) == u_len &&
 351             (0 == strncmp(username->ptr, f_user, u_len))) {
 352             /* found */
 353
 354             size_t pwd_len = strlen(f_pwd);
 355             if (f_pwd[pwd_len-1] == '\n') --pwd_len;
 356
 357             buffer_copy_string_len(password, f_pwd, pwd_len);
 358
 359             fclose(fp);
 360             return 0;
 361         }
 362     }
 363
 364     fclose(fp);
 365     return -1;
 366 }
 367
 368 static handler_t mod_authn_file_plain_digest(server *srv, connection *con, void *p_d, const char *username, const char *realm, unsigned char HA1[16]) {
 369     plugin_data *p = (plugin_data *)p_d;
 370     buffer *username_buf = buffer_init_string(username);
 371     buffer *password_buf = buffer_init();/* password-string from auth-backend */
 372     int rc;
 373     mod_authn_file_patch_connection(srv, con, p);
 374     rc = mod_authn_file_htpasswd_get(srv, p->conf.auth_plain_userfile, username_buf, password_buf);
 375     if (0 == rc) {
 376         /* generate password from plain-text */
 377         li_MD5_CTX Md5Ctx;
 378         li_MD5_Init(&Md5Ctx);
 379         li_MD5_Update(&Md5Ctx, (unsigned char *)username_buf->ptr, buffer_string_length(username_buf));
 380         li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 381         li_MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm));
 382         li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 383         li_MD5_Update(&Md5Ctx, (unsigned char *)password_buf->ptr, buffer_string_length(password_buf));
 384         li_MD5_Final(HA1, &Md5Ctx);
 385     }
 386     buffer_free(password_buf);
 387     buffer_free(username_buf);
 388     UNUSED(con);
 389     return (0 == rc) ? HANDLER_GO_ON : HANDLER_ERROR;
 390 }
 391
 392 static handler_t mod_authn_file_plain_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw) {
 393     plugin_data *p = (plugin_data *)p_d;
 394     buffer *password_buf = buffer_init();/* password-string from auth-backend */
 395     int rc;
 396     mod_authn_file_patch_connection(srv, con, p);
 397     rc = mod_authn_file_htpasswd_get(srv, p->conf.auth_plain_userfile, username, password_buf);
 398     if (0 == rc) {
 399         rc = buffer_is_equal_string(password_buf, pw, strlen(pw)) ? 0 : -1;
 400     }
 401     buffer_free(password_buf);
 402     UNUSED(con);
 403     return 0 == rc && http_auth_match_rules(require, username->ptr, NULL, NULL)
 404       ? HANDLER_GO_ON
 405       : HANDLER_ERROR;
 406 }
 407
 408
 409
 410
 411 /**
 412  * the $apr1$ handling is taken from apache 1.3.x
 413  */
 414
 415 /*
 416  * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
 417  * MD5 crypt() function, which is licenced as follows:
 418  * ----------------------------------------------------------------------------
 419  * "THE BEER-WARE LICENSE" (Revision 42):
 420  * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
 421  * can do whatever you want with this stuff. If we meet some day, and you think
 422  * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
 423  * ----------------------------------------------------------------------------
 424  */
 425
 426 #define APR_MD5_DIGESTSIZE 16
 427 #define APR1_ID "$apr1$"
 428
 429 /*
 430  * The following MD5 password encryption code was largely borrowed from
 431  * the FreeBSD 3.0 /usr/src/lib/libcrypt/crypt.c file, which is
 432  * licenced as stated above.
 433  */
 434
 435 static void to64(char *s, unsigned long v, int n)
 436 {
 437     static const unsigned char itoa64[] =         /* 0 ... 63 => ASCII - 64 */
 438         "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 439
 440     while (--n >= 0) {
 441         *s++ = itoa64[v&0x3f];
 442         v >>= 6;
 443     }
 444 }
 445
 446 static void apr_md5_encode(const char *pw, const char *salt, char *result, size_t nbytes) {
 447     /*
 448      * Minimum size is 8 bytes for salt, plus 1 for the trailing NUL,
 449      * plus 4 for the '$' separators, plus the password hash itself.
 450      * Let's leave a goodly amount of leeway.
 451      */
 452
 453     char passwd[120], *p;
 454     const char *sp, *ep;
 455     unsigned char final[APR_MD5_DIGESTSIZE];
 456     ssize_t sl, pl, i;
 457     li_MD5_CTX ctx, ctx1;
 458     unsigned long l;
 459
 460     /*
 461      * Refine the salt first.  It's possible we were given an already-hashed
 462      * string as the salt argument, so extract the actual salt value from it
 463      * if so.  Otherwise just use the string up to the first '$' as the salt.
 464      */
 465     sp = salt;
 466
 467     /*
 468      * If it starts with the magic string, then skip that.
 469      */
 470     if (!strncmp(sp, APR1_ID, strlen(APR1_ID))) {
 471         sp += strlen(APR1_ID);
 472     }
 473
 474     /*
 475      * It stops at the first '$' or 8 chars, whichever comes first
 476      */
 477     for (ep = sp; (*ep != '\0') && (*ep != '$') && (ep < (sp + 8)); ep++) {
 478         continue;
 479     }
 480
 481     /*
 482      * Get the length of the true salt
 483      */
 484     sl = ep - sp;
 485
 486     /*
 487      * 'Time to make the doughnuts..'
 488      */
 489     li_MD5_Init(&ctx);
 490
 491     /*
 492      * The password first, since that is what is most unknown
 493      */
 494     li_MD5_Update(&ctx, pw, strlen(pw));
 495
 496     /*
 497      * Then our magic string
 498      */
 499     li_MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
 500
 501     /*
 502      * Then the raw salt
 503      */
 504     li_MD5_Update(&ctx, sp, sl);
 505
 506     /*
 507      * Then just as many characters of the MD5(pw, salt, pw)
 508      */
 509     li_MD5_Init(&ctx1);
 510     li_MD5_Update(&ctx1, pw, strlen(pw));
 511     li_MD5_Update(&ctx1, sp, sl);
 512     li_MD5_Update(&ctx1, pw, strlen(pw));
 513     li_MD5_Final(final, &ctx1);
 514     for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) {
 515         li_MD5_Update(&ctx, final,
 516                       (pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl);
 517     }
 518
 519     /*
 520      * Don't leave anything around in vm they could use.
 521      */
 522     memset(final, 0, sizeof(final));
 523
 524     /*
 525      * Then something really weird...
 526      */
 527     for (i = strlen(pw); i != 0; i >>= 1) {
 528         if (i & 1) {
 529             li_MD5_Update(&ctx, final, 1);
 530         }
 531         else {
 532             li_MD5_Update(&ctx, pw, 1);
 533         }
 534     }
 535
 536     /*
 537      * Now make the output string.  We know our limitations, so we
 538      * can use the string routines without bounds checking.
 539      */
 540     strcpy(passwd, APR1_ID);
 541     strncat(passwd, sp, sl);
 542     strcat(passwd, "$");
 543
 544     li_MD5_Final(final, &ctx);
 545
 546     /*
 547      * And now, just to make sure things don't run too fast..
 548      * On a 60 Mhz Pentium this takes 34 msec, so you would
 549      * need 30 seconds to build a 1000 entry dictionary...
 550      */
 551     for (i = 0; i < 1000; i++) {
 552         li_MD5_Init(&ctx1);
 553         if (i & 1) {
 554             li_MD5_Update(&ctx1, pw, strlen(pw));
 555         }
 556         else {
 557             li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
 558         }
 559         if (i % 3) {
 560             li_MD5_Update(&ctx1, sp, sl);
 561         }
 562
 563         if (i % 7) {
 564             li_MD5_Update(&ctx1, pw, strlen(pw));
 565         }
 566
 567         if (i & 1) {
 568             li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
 569         }
 570         else {
 571             li_MD5_Update(&ctx1, pw, strlen(pw));
 572         }
 573         li_MD5_Final(final,&ctx1);
 574     }
 575
 576     p = passwd + strlen(passwd);
 577
 578     l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p, l, 4); p += 4;
 579     l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p, l, 4); p += 4;
 580     l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p, l, 4); p += 4;
 581     l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p, l, 4); p += 4;
 582     l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p, l, 4); p += 4;
 583     l =                    final[11]                ; to64(p, l, 2); p += 2;
 584     *p = '\0';
 585
 586     /*
 587      * Don't leave anything around in vm they could use.
 588      */
 589     safe_memclear(final, sizeof(final));
 590
 591     /* FIXME
 592      */
 593 #define apr_cpystrn strncpy
 594     apr_cpystrn(result, passwd, nbytes - 1);
 595 }
 596
 597 #ifdef USE_OPENSSL
 598 static void apr_sha_encode(const char *pw, char *result, size_t nbytes) {
 599     unsigned char digest[20];
 600     size_t base64_written;
 601
 602     SHA1((const unsigned char*) pw, strlen(pw), digest);
 603
 604     memset(result, 0, nbytes);
 605
 606     /* need 5 bytes for "{SHA}", 28 for base64 (3 bytes -> 4 bytes) of SHA1 (20 bytes), 1 terminating */
 607     if (nbytes < 5 + 28 + 1) return;
 608
 609     memcpy(result, "{SHA}", 5);
 610     base64_written = li_to_base64(result + 5, nbytes - 5, digest, 20, BASE64_STANDARD);
 611     force_assert(base64_written == 28);
 612     result[5 + base64_written] = '\0'; /* terminate string */
 613 }
 614 #endif
 615
 616 static handler_t mod_authn_file_htpasswd_basic(server *srv, connection *con, void *p_d, const http_auth_require_t *require, const buffer *username, const char *pw) {
 617     plugin_data *p = (plugin_data *)p_d;
 618     buffer *password = buffer_init();/* password-string from auth-backend */
 619     int rc;
 620     mod_authn_file_patch_connection(srv, con, p);
 621     rc = mod_authn_file_htpasswd_get(srv, p->conf.auth_htpasswd_userfile, username, password);
 622     if (0 == rc) {
 623         char sample[256];
 624         rc = -1;
 625         if (!strncmp(password->ptr, APR1_ID, strlen(APR1_ID))) {
 626             /*
 627              * The hash was created using $apr1$ custom algorithm.
 628              */
 629             apr_md5_encode(pw, password->ptr, sample, sizeof(sample));
 630             rc = strcmp(sample, password->ptr);
 631         }
 632       #ifdef USE_OPENSSL
 633         else if (0 == strncmp(password->ptr, "{SHA}", 5)) {
 634             apr_sha_encode(pw, sample, sizeof(sample));
 635             rc = strcmp(sample, password->ptr);
 636         }
 637       #endif
 638       #if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT)
 639         /* a simple DES password is 2 + 11 characters. everything else should be longer. */
 640         else if (buffer_string_length(password) >= 13) {
 641             char *crypted;
 642            #if defined(HAVE_CRYPT_R)
 643             struct crypt_data crypt_tmp_data;
 644             crypt_tmp_data.initialized = 0;
 645            #endif
 646            #ifdef USE_OPENSSL /* (for MD4_*() (e.g. MD4_Update())) */
 647             if (0 == memcmp(password->ptr, CONST_STR_LEN("$1+ntlm$"))) {
 648                 /* CRYPT-MD5-NTLM algorithm
 649                  * This algorithm allows for the construction of (slight more)
 650                  * secure, salted password hashes from an environment where only
 651                  * legacy NTLM hashes are available and where it is not feasible
 652                  * to re-hash all the passwords with the MD5-based crypt(). */
 653                 /* Note: originally, LM password were limited to 14 chars.
 654                  * NTLM passwords limited to 127 chars, and encoding to UCS-2LE
 655                  * requires double that, so sample[256] buf is large enough.
 656                  * Prior sample[120] size likely taken from apr_md5_encode(). */
 657                 char *b = password->ptr+sizeof("$1+ntlm$")-1;
 658                 char *e = strchr(b, '$');
 659                 size_t slen = (NULL != e) ? (size_t)(e - b) : sizeof(sample);
 660                 size_t pwlen = strlen(pw) * 2;
 661                 if (slen < sizeof(sample) - (sizeof("$1$")-1)
 662                     && pwlen < sizeof(sample)) {
 663                     /* compute NTLM hash and convert to lowercase hex chars
 664                      * (require lc hex chars from li_tohex()) */
 665                     char ntlmhash[16];
 666                     char ntlmhex[33]; /*(sizeof(ntlmhash)*2 + 1)*/
 667                     MD4_CTX c;
 668                     MD4_Init(&c);
 669                     if (pwlen) {
 670                         /*(reuse sample buffer to encode pw into UCS-2LE)
 671                          *(Note: assumes pw input in ISO-8859-1) */
 672                         /*(buffer sizes checked above)*/
 673                         for (int i=0; i < (int)pwlen; i+=2) {
 674                             sample[i] = pw[(i >> 1)];
 675                             sample[i+1] = 0;
 676                         }
 677                         MD4_Update(&c, (unsigned char *)sample, pwlen);
 678                     }
 679                     MD4_Final((unsigned char *)ntlmhash, &c);
 680                     li_tohex(ntlmhex,sizeof(ntlmhex),ntlmhash,sizeof(ntlmhash));
 681
 682                     /*(reuse sample buffer for salt  (FYI: expect slen == 8))*/
 683                     memcpy(sample, CONST_STR_LEN("$1$"));
 684                     memcpy(sample+sizeof("$1$")-1, b, slen);
 685                     sample[sizeof("$1$")-1+slen] = '\0';
 686                    #if defined(HAVE_CRYPT_R)
 687                     crypted = crypt_r(ntlmhex, sample, &crypt_tmp_data);
 688                    #else
 689                     crypted = crypt(ntlmhex, sample);
 690                    #endif
 691                     if (NULL != crypted
 692                         && 0 == strncmp(crypted, "$1$", sizeof("$1$")-1)) {
 693                         rc = strcmp(b, crypted+3); /*skip crypted "$1$" prefix*/
 694                     }
 695                 }
 696             }
 697             else
 698            #endif
 699             {
 700                #if defined(HAVE_CRYPT_R)
 701                 crypted = crypt_r(pw, password->ptr, &crypt_tmp_data);
 702                #else
 703                 crypted = crypt(pw, password->ptr);
 704                #endif
 705                 if (NULL != crypted) {
 706                     rc = strcmp(password->ptr, crypted);
 707                 }
 708             }
 709         }
 710       #endif
 711     }
 712     buffer_free(password);
 713     UNUSED(con);
 714     return 0 == rc && http_auth_match_rules(require, username->ptr, NULL, NULL)
 715       ? HANDLER_GO_ON
 716       : HANDLER_ERROR;
 717 }
 718
 719
 720 int mod_authn_file_plugin_init(plugin *p);
 721 int mod_authn_file_plugin_init(plugin *p) {
 722     p->version     = LIGHTTPD_VERSION_ID;
 723     p->name        = buffer_init_string("authn_file");
 724     p->init        = mod_authn_file_init;
 725     p->set_defaults= mod_authn_file_set_defaults;
 726     p->cleanup     = mod_authn_file_free;
 727
 728     p->data        = NULL;
 729
 730     return 0;
 731 }