src/http_auth.c

   1 #include "first.h"
   2
   3 #include "server.h"
   4 #include "log.h"
   5 #include "http_auth.h"
   6 #include "inet_ntop_cache.h"
   7 #include "stream.h"
   8 #include "base64.h"
   9
  10 #ifdef HAVE_CRYPT_H
  11 # include <crypt.h>
  12 #elif defined(__linux__)
  13 /* linux needs _XOPEN_SOURCE */
  14 # define _XOPEN_SOURCE
  15 #endif
  16
  17 #if defined(HAVE_LIBCRYPT) && !defined(HAVE_CRYPT)
  18 /* always assume crypt() is present if we have -lcrypt */
  19 # define HAVE_CRYPT
  20 #endif
  21
  22 #include <sys/types.h>
  23 #include <sys/stat.h>
  24
  25 #include <fcntl.h>
  26 #include <stdlib.h>
  27 #include <stdio.h>
  28 #include <string.h>
  29 #include <time.h>
  30 #include <errno.h>
  31 #include <unistd.h>
  32 #include <ctype.h>
  33
  34 #include "md5.h"
  35
  36 #ifdef USE_OPENSSL
  37 #include <openssl/sha.h>
  38 #endif
  39
  40 #include "safe_memclear.h"
  41
  42 #define HASHLEN 16
  43 #define HASHHEXLEN 32
  44 typedef unsigned char HASH[HASHLEN];
  45 typedef char HASHHEX[HASHHEXLEN+1];
  46
  47 static void CvtHex(const HASH Bin, char (*Hex)[33]) {
  48         li_tohex(*Hex, sizeof(*Hex), (const char*) Bin, 16);
  49 }
  50
  51
  52 /**
  53  * the $apr1$ handling is taken from apache 1.3.x
  54  */
  55
  56 /*
  57  * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
  58  * MD5 crypt() function, which is licenced as follows:
  59  * ----------------------------------------------------------------------------
  60  * "THE BEER-WARE LICENSE" (Revision 42):
  61  * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
  62  * can do whatever you want with this stuff. If we meet some day, and you think
  63  * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
  64  * ----------------------------------------------------------------------------
  65  */
  66
  67 handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
  68
  69 static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) {
  70         int ret = -1;
  71
  72         if (buffer_is_empty(username) || buffer_is_empty(realm)) return -1;
  73
  74         if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
  75                 stream f;
  76                 char * f_line;
  77
  78                 if (buffer_string_is_empty(p->conf.auth_htdigest_userfile)) return -1;
  79
  80                 if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) {
  81                         log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno));
  82
  83                         return -1;
  84                 }
  85
  86                 f_line = f.start;
  87
  88                 while (f_line - f.start != f.size) {
  89                         char *f_user, *f_pwd, *e, *f_realm;
  90                         size_t u_len, pwd_len, r_len;
  91
  92                         f_user = f_line;
  93
  94                         /*
  95                          * htdigest format
  96                          *
  97                          * user:realm:md5(user:realm:password)
  98                          */
  99
 100                         if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
 101                                 log_error_write(srv, __FILE__, __LINE__, "sbs",
 102                                                 "parsed error in", p->conf.auth_htdigest_userfile,
 103                                                 "expected 'username:realm:hashed password'");
 104
 105                                 stream_close(&f);
 106
 107                                 return -1;
 108                         }
 109
 110                         if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) {
 111                                 log_error_write(srv, __FILE__, __LINE__, "sbs",
 112                                                 "parsed error in", p->conf.auth_plain_userfile,
 113                                                 "expected 'username:realm:hashed password'");
 114
 115                                 stream_close(&f);
 116
 117                                 return -1;
 118                         }
 119
 120                         /* get pointers to the fields */
 121                         u_len = f_realm - f_user;
 122                         f_realm++;
 123                         r_len = f_pwd - f_realm;
 124                         f_pwd++;
 125
 126                         if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
 127                                 pwd_len = e - f_pwd;
 128                         } else {
 129                                 pwd_len = f.size - (f_pwd - f.start);
 130                         }
 131
 132                         if (buffer_string_length(username) == u_len &&
 133                             (buffer_string_length(realm) == r_len) &&
 134                             (0 == strncmp(username->ptr, f_user, u_len)) &&
 135                             (0 == strncmp(realm->ptr, f_realm, r_len))) {
 136                                 /* found */
 137
 138                                 buffer_copy_string_len(password, f_pwd, pwd_len);
 139
 140                                 ret = 0;
 141                                 break;
 142                         }
 143
 144                         /* EOL */
 145                         if (!e) break;
 146
 147                         f_line = e + 1;
 148                 }
 149
 150                 stream_close(&f);
 151         } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD ||
 152                    p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
 153                 stream f;
 154                 char * f_line;
 155                 buffer *auth_fn;
 156
 157                 auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile;
 158
 159                 if (buffer_string_is_empty(auth_fn)) return -1;
 160
 161                 if (0 != stream_open(&f, auth_fn)) {
 162                         log_error_write(srv, __FILE__, __LINE__, "sbss",
 163                                         "opening plain-userfile", auth_fn, "failed:", strerror(errno));
 164
 165                         return -1;
 166                 }
 167
 168                 f_line = f.start;
 169
 170                 while (f_line - f.start != f.size) {
 171                         char *f_user, *f_pwd, *e;
 172                         size_t u_len, pwd_len;
 173
 174                         f_user = f_line;
 175
 176                         /*
 177                          * htpasswd format
 178                          *
 179                          * user:crypted passwd
 180                          */
 181
 182                         if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
 183                                 log_error_write(srv, __FILE__, __LINE__, "sbs",
 184                                                 "parsed error in", auth_fn,
 185                                                 "expected 'username:hashed password'");
 186
 187                                 stream_close(&f);
 188
 189                                 return -1;
 190                         }
 191
 192                         /* get pointers to the fields */
 193                         u_len = f_pwd - f_user;
 194                         f_pwd++;
 195
 196                         if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
 197                                 pwd_len = e - f_pwd;
 198                         } else {
 199                                 pwd_len = f.size - (f_pwd - f.start);
 200                         }
 201
 202                         if (buffer_string_length(username) == u_len &&
 203                             (0 == strncmp(username->ptr, f_user, u_len))) {
 204                                 /* found */
 205
 206                                 buffer_copy_string_len(password, f_pwd, pwd_len);
 207
 208                                 ret = 0;
 209                                 break;
 210                         }
 211
 212                         /* EOL */
 213                         if (!e) break;
 214
 215                         f_line = e + 1;
 216                 }
 217
 218                 stream_close(&f);
 219         } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
 220                 ret = 0;
 221         } else {
 222                 return -1;
 223         }
 224
 225         return ret;
 226 }
 227
 228 int http_auth_match_rules(server *srv, array *req, const char *username, const char *group, const char *host) {
 229         const char *r = NULL, *rules = NULL;
 230         int username_len;
 231         data_string *require;
 232
 233         UNUSED(group);
 234         UNUSED(host);
 235
 236         require = (data_string *)array_get_element(req, "require");
 237
 238         /* if we get here, the user we got a authed user */
 239         if (0 == strcmp(require->value->ptr, "valid-user")) {
 240                 return 0;
 241         }
 242
 243         /* user=name1|group=name3|host=name4 */
 244
 245         /* seperate the string by | */
 246 #if 0
 247         log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value);
 248 #endif
 249
 250         username_len = username ? strlen(username) : 0;
 251
 252         r = rules = require->value->ptr;
 253
 254         while (1) {
 255                 const char *eq;
 256                 const char *k, *v, *e;
 257                 int k_len, v_len, r_len;
 258
 259                 e = strchr(r, '|');
 260
 261                 if (e) {
 262                         r_len = e - r;
 263                 } else {
 264                         r_len = strlen(rules) - (r - rules);
 265                 }
 266
 267                 /* from r to r + r_len is a rule */
 268
 269                 if (0 == strncmp(r, "valid-user", r_len)) {
 270                         log_error_write(srv, __FILE__, __LINE__, "sb",
 271                                         "parsing the 'require' section in 'auth.require' failed: valid-user cannot be combined with other require rules",
 272                                         require->value);
 273                         return -1;
 274                 }
 275
 276                 /* search for = in the rules */
 277                 if (NULL == (eq = strchr(r, '='))) {
 278                         log_error_write(srv, __FILE__, __LINE__, "sb",
 279                                         "parsing the 'require' section in 'auth.require' failed: a = is missing",
 280                                         require->value);
 281                         return -1;
 282                 }
 283
 284                 /* = out of range */
 285                 if (eq > r + r_len) {
 286                         log_error_write(srv, __FILE__, __LINE__, "sb",
 287                                         "parsing the 'require' section in 'auth.require' failed: = out of range",
 288                                         require->value);
 289
 290                         return -1;
 291                 }
 292
 293                 /* the part before the = is user|group|host */
 294
 295                 k = r;
 296                 k_len = eq - r;
 297                 v = eq + 1;
 298                 v_len = r_len - k_len - 1;
 299
 300                 if (k_len == 4) {
 301                         if (0 == strncmp(k, "user", k_len)) {
 302                                 if (username &&
 303                                     username_len == v_len &&
 304                                     0 == strncmp(username, v, v_len)) {
 305                                         return 0;
 306                                 }
 307                         } else if (0 == strncmp(k, "host", k_len)) {
 308                                 log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)");
 309                         } else {
 310                                 log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
 311                                 return -1;
 312                         }
 313                 } else if (k_len == 5) {
 314                         if (0 == strncmp(k, "group", k_len)) {
 315                                 log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)");
 316                         } else {
 317                                 log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k);
 318                                 return -1;
 319                         }
 320                 } else {
 321                         log_error_write(srv, __FILE__, __LINE__, "s", "unknown  key");
 322                         return -1;
 323                 }
 324
 325                 if (!e) break;
 326                 r = e + 1;
 327         }
 328
 329         log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched");
 330
 331         return -1;
 332 }
 333
 334 #define APR_MD5_DIGESTSIZE 16
 335 #define APR1_ID "$apr1$"
 336
 337 /*
 338  * The following MD5 password encryption code was largely borrowed from
 339  * the FreeBSD 3.0 /usr/src/lib/libcrypt/crypt.c file, which is
 340  * licenced as stated at the top of this file.
 341  */
 342
 343 static void to64(char *s, unsigned long v, int n)
 344 {
 345         static const unsigned char itoa64[] =         /* 0 ... 63 => ASCII - 64 */
 346                 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 347
 348         while (--n >= 0) {
 349                 *s++ = itoa64[v&0x3f];
 350                 v >>= 6;
 351         }
 352 }
 353
 354 static void apr_md5_encode(const char *pw, const char *salt, char *result, size_t nbytes) {
 355         /*
 356          * Minimum size is 8 bytes for salt, plus 1 for the trailing NUL,
 357          * plus 4 for the '$' separators, plus the password hash itself.
 358          * Let's leave a goodly amount of leeway.
 359          */
 360
 361         char passwd[120], *p;
 362         const char *sp, *ep;
 363         unsigned char final[APR_MD5_DIGESTSIZE];
 364         ssize_t sl, pl, i;
 365         li_MD5_CTX ctx, ctx1;
 366         unsigned long l;
 367
 368         /*
 369          * Refine the salt first.  It's possible we were given an already-hashed
 370          * string as the salt argument, so extract the actual salt value from it
 371          * if so.  Otherwise just use the string up to the first '$' as the salt.
 372          */
 373         sp = salt;
 374
 375         /*
 376          * If it starts with the magic string, then skip that.
 377          */
 378         if (!strncmp(sp, APR1_ID, strlen(APR1_ID))) {
 379                 sp += strlen(APR1_ID);
 380         }
 381
 382         /*
 383          * It stops at the first '$' or 8 chars, whichever comes first
 384          */
 385         for (ep = sp; (*ep != '\0') && (*ep != '$') && (ep < (sp + 8)); ep++) {
 386                 continue;
 387         }
 388
 389         /*
 390          * Get the length of the true salt
 391          */
 392         sl = ep - sp;
 393
 394         /*
 395          * 'Time to make the doughnuts..'
 396          */
 397         li_MD5_Init(&ctx);
 398
 399         /*
 400          * The password first, since that is what is most unknown
 401          */
 402         li_MD5_Update(&ctx, pw, strlen(pw));
 403
 404         /*
 405          * Then our magic string
 406          */
 407         li_MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
 408
 409         /*
 410          * Then the raw salt
 411          */
 412         li_MD5_Update(&ctx, sp, sl);
 413
 414         /*
 415          * Then just as many characters of the MD5(pw, salt, pw)
 416          */
 417         li_MD5_Init(&ctx1);
 418         li_MD5_Update(&ctx1, pw, strlen(pw));
 419         li_MD5_Update(&ctx1, sp, sl);
 420         li_MD5_Update(&ctx1, pw, strlen(pw));
 421         li_MD5_Final(final, &ctx1);
 422         for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) {
 423                 li_MD5_Update(
 424                         &ctx, final,
 425                         (pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl);
 426         }
 427
 428         /*
 429          * Don't leave anything around in vm they could use.
 430          */
 431         memset(final, 0, sizeof(final));
 432
 433         /*
 434          * Then something really weird...
 435          */
 436         for (i = strlen(pw); i != 0; i >>= 1) {
 437                 if (i & 1) {
 438                         li_MD5_Update(&ctx, final, 1);
 439                 }
 440                 else {
 441                         li_MD5_Update(&ctx, pw, 1);
 442                 }
 443         }
 444
 445         /*
 446          * Now make the output string.  We know our limitations, so we
 447          * can use the string routines without bounds checking.
 448          */
 449         strcpy(passwd, APR1_ID);
 450         strncat(passwd, sp, sl);
 451         strcat(passwd, "$");
 452
 453         li_MD5_Final(final, &ctx);
 454
 455         /*
 456          * And now, just to make sure things don't run too fast..
 457          * On a 60 Mhz Pentium this takes 34 msec, so you would
 458          * need 30 seconds to build a 1000 entry dictionary...
 459          */
 460         for (i = 0; i < 1000; i++) {
 461                 li_MD5_Init(&ctx1);
 462                 if (i & 1) {
 463                         li_MD5_Update(&ctx1, pw, strlen(pw));
 464                 }
 465                 else {
 466                         li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
 467                 }
 468                 if (i % 3) {
 469                         li_MD5_Update(&ctx1, sp, sl);
 470                 }
 471
 472                 if (i % 7) {
 473                         li_MD5_Update(&ctx1, pw, strlen(pw));
 474                 }
 475
 476                 if (i & 1) {
 477                         li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
 478                 }
 479                 else {
 480                         li_MD5_Update(&ctx1, pw, strlen(pw));
 481                 }
 482                 li_MD5_Final(final,&ctx1);
 483         }
 484
 485         p = passwd + strlen(passwd);
 486
 487         l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p, l, 4); p += 4;
 488         l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p, l, 4); p += 4;
 489         l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p, l, 4); p += 4;
 490         l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p, l, 4); p += 4;
 491         l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p, l, 4); p += 4;
 492         l =                    final[11]                ; to64(p, l, 2); p += 2;
 493         *p = '\0';
 494
 495         /*
 496          * Don't leave anything around in vm they could use.
 497          */
 498         safe_memclear(final, sizeof(final));
 499
 500         /* FIXME
 501          */
 502 #define apr_cpystrn strncpy
 503         apr_cpystrn(result, passwd, nbytes - 1);
 504 }
 505
 506 #ifdef USE_OPENSSL
 507 static void apr_sha_encode(const char *pw, char *result, size_t nbytes) {
 508         unsigned char digest[20];
 509         size_t base64_written;
 510
 511         SHA1((const unsigned char*) pw, strlen(pw), digest);
 512
 513         memset(result, 0, nbytes);
 514
 515         /* need 5 bytes for "{SHA}", 28 for base64 (3 bytes -> 4 bytes) of SHA1 (20 bytes), 1 terminating */
 516         if (nbytes < 5 + 28 + 1) return;
 517
 518         memcpy(result, "{SHA}", 5);
 519         base64_written = li_to_base64(result + 5, nbytes - 5, digest, 20, BASE64_STANDARD);
 520         force_assert(base64_written == 28);
 521         result[5 + base64_written] = '\0'; /* terminate string */
 522 }
 523 #endif
 524
 525 /**
 526  *
 527  *
 528  * @param password password-string from the auth-backend
 529  * @param pw       password-string from the client
 530  */
 531
 532 static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) {
 533         UNUSED(srv);
 534         UNUSED(req);
 535
 536         if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
 537                 /*
 538                  * htdigest format
 539                  *
 540                  * user:realm:md5(user:realm:password)
 541                  */
 542
 543                 li_MD5_CTX Md5Ctx;
 544                 HASH HA1;
 545                 char a1[33];
 546
 547                 li_MD5_Init(&Md5Ctx);
 548                 li_MD5_Update(&Md5Ctx, CONST_BUF_LEN(username));
 549                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 550                 li_MD5_Update(&Md5Ctx, CONST_BUF_LEN(realm));
 551                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 552                 li_MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
 553                 li_MD5_Final(HA1, &Md5Ctx);
 554
 555                 CvtHex(HA1, &a1);
 556
 557                 if (0 == strcmp(password->ptr, a1)) {
 558                         return 0;
 559                 }
 560         } else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) {
 561                 char sample[120];
 562                 if (!strncmp(password->ptr, APR1_ID, strlen(APR1_ID))) {
 563                         /*
 564                          * The hash was created using $apr1$ custom algorithm.
 565                          */
 566                         apr_md5_encode(pw, password->ptr, sample, sizeof(sample));
 567                         return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
 568 #ifdef USE_OPENSSL
 569                 } else if (0 == strncmp(password->ptr, "{SHA}", 5)) {
 570                         apr_sha_encode(pw, sample, sizeof(sample));
 571                         return (strcmp(sample, password->ptr) == 0) ? 0 : 1;
 572 #endif
 573                 } else {
 574 #if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT)
 575                         char *crypted;
 576 #if defined(HAVE_CRYPT_R)
 577                         struct crypt_data crypt_tmp_data;
 578                         crypt_tmp_data.initialized = 0;
 579 #endif
 580
 581                         /* a simple DES password is 2 + 11 characters. everything else should be longer. */
 582                         if (buffer_string_length(password) < 13) {
 583                                 return -1;
 584                         }
 585
 586 #if defined(HAVE_CRYPT_R)
 587                         if (0 == (crypted = crypt_r(pw, password->ptr, &crypt_tmp_data))) {
 588 #else
 589                         if (0 == (crypted = crypt(pw, password->ptr))) {
 590 #endif
 591                                 /* crypt failed. */
 592                                 return -1;
 593                         }
 594
 595                         if (0 == strcmp(password->ptr, crypted)) {
 596                                 return 0;
 597                         }
 598 #endif
 599                 }
 600         } else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
 601                 if (0 == strcmp(password->ptr, pw)) {
 602                         return 0;
 603                 }
 604         } else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
 605 #ifdef USE_LDAP
 606                 LDAP *ldap;
 607                 LDAPMessage *lm, *first;
 608                 char *dn;
 609                 int ret;
 610                 char *attrs[] = { LDAP_NO_ATTRS, NULL };
 611                 size_t i, len;
 612
 613                 /* for now we stay synchronous */
 614
 615                 /*
 616                  * 1. connect anonymously (done in plugin init)
 617                  * 2. get DN for uid = username
 618                  * 3. auth against ldap server
 619                  * 4. (optional) check a field
 620                  * 5. disconnect
 621                  *
 622                  */
 623
 624                 /* check username
 625                  *
 626                  * we have to protect us againt username which modifies out filter in
 627                  * a unpleasant way
 628                  */
 629
 630                 len = buffer_string_length(username);
 631                 for (i = 0; i < len; i++) {
 632                         char c = username->ptr[i];
 633
 634                         if (!isalpha(c) &&
 635                             !isdigit(c) &&
 636                             (c != ' ') &&
 637                             (c != '@') &&
 638                             (c != '-') &&
 639                             (c != '_') &&
 640                             (c != '.') ) {
 641
 642                                 log_error_write(srv, __FILE__, __LINE__, "sbd",
 643                                         "ldap: invalid character (- _.@a-zA-Z0-9 allowed) in username:", username, i);
 644
 645                                 return -1;
 646                         }
 647                 }
 648
 649                 if (p->conf.auth_ldap_allow_empty_pw != 1 && pw[0] == '\0')
 650                         return -1;
 651
 652                 /* build filter */
 653                 buffer_copy_buffer(p->ldap_filter, p->conf.ldap_filter_pre);
 654                 buffer_append_string_buffer(p->ldap_filter, username);
 655                 buffer_append_string_buffer(p->ldap_filter, p->conf.ldap_filter_post);
 656
 657
 658                 /* 2. */
 659                 if (p->anon_conf->ldap == NULL ||
 660                     LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
 661
 662                         /* try again; the ldap library sometimes fails for the first call but reconnects */
 663                         if (p->anon_conf->ldap == NULL || ret != LDAP_SERVER_DOWN ||
 664                             LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
 665
 666                                 if (auth_ldap_init(srv, p->anon_conf) != HANDLER_GO_ON)
 667                                         return -1;
 668
 669                                 if (NULL == p->anon_conf->ldap) return -1;
 670
 671                                 if (LDAP_SUCCESS != (ret = ldap_search_s(p->anon_conf->ldap, p->conf.auth_ldap_basedn->ptr, LDAP_SCOPE_SUBTREE, p->ldap_filter->ptr, attrs, 0, &lm))) {
 672                                         log_error_write(srv, __FILE__, __LINE__, "sssb",
 673                                                         "ldap:", ldap_err2string(ret), "filter:", p->ldap_filter);
 674                                         return -1;
 675                                 }
 676                         }
 677                 }
 678
 679                 if (NULL == (first = ldap_first_entry(p->anon_conf->ldap, lm))) {
 680                         log_error_write(srv, __FILE__, __LINE__, "s", "ldap ...");
 681
 682                         ldap_msgfree(lm);
 683
 684                         return -1;
 685                 }
 686
 687                 if (NULL == (dn = ldap_get_dn(p->anon_conf->ldap, first))) {
 688                         log_error_write(srv, __FILE__, __LINE__, "s", "ldap ...");
 689
 690                         ldap_msgfree(lm);
 691
 692                         return -1;
 693                 }
 694
 695                 ldap_msgfree(lm);
 696
 697
 698                 /* 3. */
 699                 if (NULL == (ldap = ldap_init(p->conf.auth_ldap_hostname->ptr, LDAP_PORT))) {
 700                         log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
 701                         return -1;
 702                 }
 703
 704                 ret = LDAP_VERSION3;
 705                 if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
 706                         log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
 707
 708                         ldap_unbind_s(ldap);
 709
 710                         return -1;
 711                 }
 712
 713                 if (p->conf.auth_ldap_starttls == 1) {
 714                         if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(ldap, NULL,  NULL))) {
 715                                 log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
 716
 717                                 ldap_unbind_s(ldap);
 718
 719                                 return -1;
 720                         }
 721                 }
 722
 723
 724                 if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(ldap, dn, pw))) {
 725                         log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
 726
 727                         ldap_unbind_s(ldap);
 728
 729                         return -1;
 730                 }
 731
 732                 /* 5. */
 733                 ldap_unbind_s(ldap);
 734
 735                 /* everything worked, good, access granted */
 736
 737                 return 0;
 738 #endif
 739         }
 740         return -1;
 741 }
 742
 743 int http_auth_basic_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, const char *realm_str) {
 744         buffer *username, *password;
 745         char *pw;
 746
 747         data_string *realm;
 748
 749         realm = (data_string *)array_get_element(req, "realm");
 750
 751         username = buffer_init();
 752
 753         if (!buffer_append_base64_decode(username, realm_str, strlen(realm_str), BASE64_STANDARD)) {
 754                 log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username);
 755
 756                 buffer_free(username);
 757                 return 0;
 758         }
 759
 760         /* r2 == user:password */
 761         if (NULL == (pw = strchr(username->ptr, ':'))) {
 762                 log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username);
 763
 764                 buffer_free(username);
 765                 return 0;
 766         }
 767
 768         buffer_string_set_length(username, pw - username->ptr);
 769         pw++;
 770
 771         password = buffer_init();
 772         /* copy password to r1 */
 773         if (http_auth_get_password(srv, p, username, realm->value, password)) {
 774                 buffer_free(username);
 775                 buffer_free(password);
 776
 777                 if (AUTH_BACKEND_UNSET == p->conf.auth_backend) {
 778                         log_error_write(srv, __FILE__, __LINE__, "s", "auth.backend is not set");
 779                 } else {
 780                         log_error_write(srv, __FILE__, __LINE__, "ss", "get_password failed, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
 781                 }
 782
 783                 return 0;
 784         }
 785
 786         /* password doesn't match */
 787         if (http_auth_basic_password_compare(srv, p, req, username, realm->value, password, pw)) {
 788                 log_error_write(srv, __FILE__, __LINE__, "sbsBss", "password doesn't match for", con->uri.path, "username:", username, ", IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
 789
 790                 buffer_free(username);
 791                 buffer_free(password);
 792
 793                 return 0;
 794         }
 795
 796         /* value is our allow-rules */
 797         if (http_auth_match_rules(srv, req, username->ptr, NULL, NULL)) {
 798                 buffer_free(username);
 799                 buffer_free(password);
 800
 801                 log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match");
 802
 803                 return 0;
 804         }
 805
 806         /* remember the username */
 807         buffer_copy_buffer(p->auth_user, username);
 808
 809         buffer_free(username);
 810         buffer_free(password);
 811
 812         return 1;
 813 }
 814
 815 typedef struct {
 816         const char *key;
 817         int key_len;
 818         char **ptr;
 819 } digest_kv;
 820
 821 /* return values: -1: error/bad request, 0: failed, 1: success */
 822 int http_auth_digest_check(server *srv, connection *con, mod_auth_plugin_data *p, array *req, const char *realm_str) {
 823         char a1[33];
 824         char a2[33];
 825
 826         char *username = NULL;
 827         char *realm = NULL;
 828         char *nonce = NULL;
 829         char *uri = NULL;
 830         char *algorithm = NULL;
 831         char *qop = NULL;
 832         char *cnonce = NULL;
 833         char *nc = NULL;
 834         char *respons = NULL;
 835
 836         char *e, *c;
 837         const char *m = NULL;
 838         int i;
 839         buffer *password, *b, *username_buf, *realm_buf;
 840
 841         li_MD5_CTX Md5Ctx;
 842         HASH HA1;
 843         HASH HA2;
 844         HASH RespHash;
 845         HASHHEX HA2Hex;
 846
 847
 848         /* init pointers */
 849 #define S(x) \
 850         x, sizeof(x)-1, NULL
 851         digest_kv dkv[10] = {
 852                 { S("username=") },
 853                 { S("realm=") },
 854                 { S("nonce=") },
 855                 { S("uri=") },
 856                 { S("algorithm=") },
 857                 { S("qop=") },
 858                 { S("cnonce=") },
 859                 { S("nc=") },
 860                 { S("response=") },
 861
 862                 { NULL, 0, NULL }
 863         };
 864 #undef S
 865
 866         dkv[0].ptr = &username;
 867         dkv[1].ptr = &realm;
 868         dkv[2].ptr = &nonce;
 869         dkv[3].ptr = &uri;
 870         dkv[4].ptr = &algorithm;
 871         dkv[5].ptr = &qop;
 872         dkv[6].ptr = &cnonce;
 873         dkv[7].ptr = &nc;
 874         dkv[8].ptr = &respons;
 875
 876         UNUSED(req);
 877
 878         if (p->conf.auth_backend != AUTH_BACKEND_HTDIGEST &&
 879             p->conf.auth_backend != AUTH_BACKEND_PLAIN) {
 880                 log_error_write(srv, __FILE__, __LINE__, "s",
 881                                 "digest: unsupported backend (only htdigest or plain)");
 882
 883                 return -1;
 884         }
 885
 886         b = buffer_init_string(realm_str);
 887
 888         /* parse credentials from client */
 889         for (c = b->ptr; *c; c++) {
 890                 /* skip whitespaces */
 891                 while (*c == ' ' || *c == '\t') c++;
 892                 if (!*c) break;
 893
 894                 for (i = 0; dkv[i].key; i++) {
 895                         if ((0 == strncmp(c, dkv[i].key, dkv[i].key_len))) {
 896                                 if ((c[dkv[i].key_len] == '"') &&
 897                                     (NULL != (e = strchr(c + dkv[i].key_len + 1, '"')))) {
 898                                         /* value with "..." */
 899                                         *(dkv[i].ptr) = c + dkv[i].key_len + 1;
 900                                         c = e;
 901
 902                                         *e = '\0';
 903                                 } else if (NULL != (e = strchr(c + dkv[i].key_len, ','))) {
 904                                         /* value without "...", terminated by ',' */
 905                                         *(dkv[i].ptr) = c + dkv[i].key_len;
 906                                         c = e;
 907
 908                                         *e = '\0';
 909                                 } else {
 910                                         /* value without "...", terminated by EOL */
 911                                         *(dkv[i].ptr) = c + dkv[i].key_len;
 912                                         c += strlen(c) - 1;
 913                                 }
 914                         }
 915                 }
 916         }
 917
 918         if (p->conf.auth_debug > 1) {
 919                 log_error_write(srv, __FILE__, __LINE__, "ss", "username", username);
 920                 log_error_write(srv, __FILE__, __LINE__, "ss", "realm", realm);
 921                 log_error_write(srv, __FILE__, __LINE__, "ss", "nonce", nonce);
 922                 log_error_write(srv, __FILE__, __LINE__, "ss", "uri", uri);
 923                 log_error_write(srv, __FILE__, __LINE__, "ss", "algorithm", algorithm);
 924                 log_error_write(srv, __FILE__, __LINE__, "ss", "qop", qop);
 925                 log_error_write(srv, __FILE__, __LINE__, "ss", "cnonce", cnonce);
 926                 log_error_write(srv, __FILE__, __LINE__, "ss", "nc", nc);
 927                 log_error_write(srv, __FILE__, __LINE__, "ss", "response", respons);
 928         }
 929
 930         /* check if everything is transmitted */
 931         if (!username ||
 932             !realm ||
 933             !nonce ||
 934             !uri ||
 935             (qop && (!nc || !cnonce)) ||
 936             !respons ) {
 937                 /* missing field */
 938
 939                 log_error_write(srv, __FILE__, __LINE__, "s",
 940                                 "digest: missing field");
 941
 942                 buffer_free(b);
 943                 return -1;
 944         }
 945
 946         /**
 947          * protect the md5-sess against missing cnonce and nonce
 948          */
 949         if (algorithm &&
 950             0 == strcasecmp(algorithm, "md5-sess") &&
 951             (!nonce || !cnonce)) {
 952                 log_error_write(srv, __FILE__, __LINE__, "s",
 953                                 "digest: (md5-sess: missing field");
 954
 955                 buffer_free(b);
 956                 return -1;
 957         }
 958
 959         if (qop && strcasecmp(qop, "auth-int") == 0) {
 960                 log_error_write(srv, __FILE__, __LINE__, "s",
 961                                 "digest: qop=auth-int not supported");
 962
 963                 buffer_free(b);
 964                 return -1;
 965         }
 966
 967         m = get_http_method_name(con->request.http_method);
 968         force_assert(m);
 969
 970         /* password-string == HA1 */
 971         password = buffer_init();
 972         username_buf = buffer_init_string(username);
 973         realm_buf = buffer_init_string(realm);
 974         if (http_auth_get_password(srv, p, username_buf, realm_buf, password)) {
 975                 buffer_free(password);
 976                 buffer_free(b);
 977                 buffer_free(username_buf);
 978                 buffer_free(realm_buf);
 979                 return 0;
 980         }
 981
 982         buffer_free(username_buf);
 983         buffer_free(realm_buf);
 984
 985         if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
 986                 /* generate password from plain-text */
 987                 li_MD5_Init(&Md5Ctx);
 988                 li_MD5_Update(&Md5Ctx, (unsigned char *)username, strlen(username));
 989                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 990                 li_MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm));
 991                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
 992                 li_MD5_Update(&Md5Ctx, CONST_BUF_LEN(password));
 993                 li_MD5_Final(HA1, &Md5Ctx);
 994         } else if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
 995                 /* HA1 */
 996                 /* transform the 32-byte-hex-md5 to a 16-byte-md5 */
 997                 for (i = 0; i < HASHLEN; i++) {
 998                         HA1[i] = hex2int(password->ptr[i*2]) << 4;
 999                         HA1[i] |= hex2int(password->ptr[i*2+1]);
1000                 }
1001         } else {
1002                 /* we already check that above */
1003                 SEGFAULT();
1004         }
1005
1006         buffer_free(password);
1007
1008         if (algorithm &&
1009             strcasecmp(algorithm, "md5-sess") == 0) {
1010                 li_MD5_Init(&Md5Ctx);
1011                 /* Errata ID 1649: http://www.rfc-editor.org/errata_search.php?rfc=2617 */
1012                 CvtHex(HA1, &a1);
1013                 li_MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN);
1014                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1015                 li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
1016                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1017                 li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
1018                 li_MD5_Final(HA1, &Md5Ctx);
1019         }
1020
1021         CvtHex(HA1, &a1);
1022
1023         /* calculate H(A2) */
1024         li_MD5_Init(&Md5Ctx);
1025         li_MD5_Update(&Md5Ctx, (unsigned char *)m, strlen(m));
1026         li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1027         li_MD5_Update(&Md5Ctx, (unsigned char *)uri, strlen(uri));
1028         /* qop=auth-int not supported, already checked above */
1029 /*
1030         if (qop && strcasecmp(qop, "auth-int") == 0) {
1031                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1032                 li_MD5_Update(&Md5Ctx, (unsigned char *) [body checksum], HASHHEXLEN);
1033         }
1034 */
1035         li_MD5_Final(HA2, &Md5Ctx);
1036         CvtHex(HA2, &HA2Hex);
1037
1038         /* calculate response */
1039         li_MD5_Init(&Md5Ctx);
1040         li_MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN);
1041         li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1042         li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
1043         li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1044         if (qop && *qop) {
1045                 li_MD5_Update(&Md5Ctx, (unsigned char *)nc, strlen(nc));
1046                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1047                 li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
1048                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1049                 li_MD5_Update(&Md5Ctx, (unsigned char *)qop, strlen(qop));
1050                 li_MD5_Update(&Md5Ctx, CONST_STR_LEN(":"));
1051         };
1052         li_MD5_Update(&Md5Ctx, (unsigned char *)HA2Hex, HASHHEXLEN);
1053         li_MD5_Final(RespHash, &Md5Ctx);
1054         CvtHex(RespHash, &a2);
1055
1056         if (0 != strcmp(a2, respons)) {
1057                 /* digest not ok */
1058
1059                 if (p->conf.auth_debug) {
1060                         log_error_write(srv, __FILE__, __LINE__, "sss",
1061                                 "digest: digest mismatch", a2, respons);
1062                 }
1063
1064                 log_error_write(srv, __FILE__, __LINE__, "ssss",
1065                                 "digest: auth failed for ", username, ": wrong password, IP:", inet_ntop_cache_get_ip(srv, &(con->dst_addr)));
1066
1067                 buffer_free(b);
1068                 return 0;
1069         }
1070
1071         /* value is our allow-rules */
1072         if (http_auth_match_rules(srv, req, username, NULL, NULL)) {
1073                 buffer_free(b);
1074
1075                 log_error_write(srv, __FILE__, __LINE__, "s",
1076                                 "digest: rules did match");
1077
1078                 return 0;
1079         }
1080
1081         /* remember the username */
1082         buffer_copy_string(p->auth_user, username);
1083
1084         buffer_free(b);
1085
1086         if (p->conf.auth_debug) {
1087                 log_error_write(srv, __FILE__, __LINE__, "s",
1088                                 "digest: auth ok");
1089         }
1090         return 1;
1091 }
1092
1093
1094 int http_auth_digest_generate_nonce(server *srv, mod_auth_plugin_data *p, buffer *fn, char (*out)[33]) {
1095         HASH h;
1096         li_MD5_CTX Md5Ctx;
1097         char hh[LI_ITOSTRING_LENGTH];
1098
1099         UNUSED(p);
1100
1101         /* generate shared-secret */
1102         li_MD5_Init(&Md5Ctx);
1103         li_MD5_Update(&Md5Ctx, CONST_BUF_LEN(fn));
1104         li_MD5_Update(&Md5Ctx, CONST_STR_LEN("+"));
1105
1106         /* we assume sizeof(time_t) == 4 here, but if not it ain't a problem at all */
1107         li_itostrn(hh, sizeof(hh), srv->cur_ts);
1108         li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
1109         li_MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
1110         li_itostrn(hh, sizeof(hh), rand());
1111         li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
1112
1113         li_MD5_Final(h, &Md5Ctx);
1114
1115         CvtHex(h, out);
1116
1117         return 0;
1118 }