svn commit: r203071 - stable/7/lib/libfetch
Dag-Erling Smorgrav
des at FreeBSD.org
Wed Jan 27 14:54:49 UTC 2010
Author: des
Date: Wed Jan 27 14:54:48 2010
New Revision: 203071
URL: http://svn.freebsd.org/changeset/base/203071
Log:
Synch with head: avoid namespace collisions (r177447), plug resource leak
in FTP code (r199801), add support for HTTP (r202613, r202623, r203028).
Also record mergeinfo for previously merged patches (r174752, r174588).
Approved by: re (kib)
Modified:
stable/7/lib/libfetch/Makefile
stable/7/lib/libfetch/common.c
stable/7/lib/libfetch/fetch.3
stable/7/lib/libfetch/ftp.c
stable/7/lib/libfetch/http.c
Directory Properties:
stable/7/lib/libfetch/ (props changed)
Modified: stable/7/lib/libfetch/Makefile
==============================================================================
--- stable/7/lib/libfetch/Makefile Wed Jan 27 14:43:28 2010 (r203070)
+++ stable/7/lib/libfetch/Makefile Wed Jan 27 14:54:48 2010 (r203071)
@@ -16,8 +16,11 @@ CFLAGS+= -DINET6
.if ${MK_OPENSSL} != "no"
CFLAGS+= -DWITH_SSL
-DPADD= ${LIBSSL} ${LIBCRYPTO}
-LDADD= -lssl -lcrypto
+DPADD= ${LIBSSL} ${LIBCRYPTO} ${LIBMD}
+LDADD= -lssl -lcrypto -lmd
+.else
+DPADD= ${LIBMD}
+LDADD= -lmd
.endif
CFLAGS+= -DFTP_COMBINE_CWDS
Modified: stable/7/lib/libfetch/common.c
==============================================================================
--- stable/7/lib/libfetch/common.c Wed Jan 27 14:43:28 2010 (r203070)
+++ stable/7/lib/libfetch/common.c Wed Jan 27 14:54:48 2010 (r203071)
@@ -377,7 +377,7 @@ fetch_ssl(conn_t *conn, int verbose)
ssize_t
fetch_read(conn_t *conn, char *buf, size_t len)
{
- struct timeval now, timeout, wait;
+ struct timeval now, timeout, delta;
fd_set readfds;
ssize_t rlen, total;
int r;
@@ -393,19 +393,19 @@ fetch_read(conn_t *conn, char *buf, size
while (fetchTimeout && !FD_ISSET(conn->sd, &readfds)) {
FD_SET(conn->sd, &readfds);
gettimeofday(&now, NULL);
- wait.tv_sec = timeout.tv_sec - now.tv_sec;
- wait.tv_usec = timeout.tv_usec - now.tv_usec;
- if (wait.tv_usec < 0) {
- wait.tv_usec += 1000000;
- wait.tv_sec--;
+ delta.tv_sec = timeout.tv_sec - now.tv_sec;
+ delta.tv_usec = timeout.tv_usec - now.tv_usec;
+ if (delta.tv_usec < 0) {
+ delta.tv_usec += 1000000;
+ delta.tv_sec--;
}
- if (wait.tv_sec < 0) {
+ if (delta.tv_sec < 0) {
errno = ETIMEDOUT;
fetch_syserr();
return (-1);
}
errno = 0;
- r = select(conn->sd + 1, &readfds, NULL, NULL, &wait);
+ r = select(conn->sd + 1, &readfds, NULL, NULL, &delta);
if (r == -1) {
if (errno == EINTR && fetchRestartCalls)
continue;
@@ -503,7 +503,7 @@ fetch_write(conn_t *conn, const char *bu
ssize_t
fetch_writev(conn_t *conn, struct iovec *iov, int iovcnt)
{
- struct timeval now, timeout, wait;
+ struct timeval now, timeout, delta;
fd_set writefds;
ssize_t wlen, total;
int r;
@@ -519,19 +519,19 @@ fetch_writev(conn_t *conn, struct iovec
while (fetchTimeout && !FD_ISSET(conn->sd, &writefds)) {
FD_SET(conn->sd, &writefds);
gettimeofday(&now, NULL);
- wait.tv_sec = timeout.tv_sec - now.tv_sec;
- wait.tv_usec = timeout.tv_usec - now.tv_usec;
- if (wait.tv_usec < 0) {
- wait.tv_usec += 1000000;
- wait.tv_sec--;
+ delta.tv_sec = timeout.tv_sec - now.tv_sec;
+ delta.tv_usec = timeout.tv_usec - now.tv_usec;
+ if (delta.tv_usec < 0) {
+ delta.tv_usec += 1000000;
+ delta.tv_sec--;
}
- if (wait.tv_sec < 0) {
+ if (delta.tv_sec < 0) {
errno = ETIMEDOUT;
fetch_syserr();
return (-1);
}
errno = 0;
- r = select(conn->sd + 1, NULL, &writefds, NULL, &wait);
+ r = select(conn->sd + 1, NULL, &writefds, NULL, &delta);
if (r == -1) {
if (errno == EINTR && fetchRestartCalls)
continue;
Modified: stable/7/lib/libfetch/fetch.3
==============================================================================
--- stable/7/lib/libfetch/fetch.3 Wed Jan 27 14:43:28 2010 (r203070)
+++ stable/7/lib/libfetch/fetch.3 Wed Jan 27 14:54:48 2010 (r203071)
@@ -25,7 +25,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd December 14, 2008
+.Dd January 26, 2010
.Dt FETCH 3
.Os
.Sh NAME
@@ -509,9 +509,13 @@ Specifies HTTP authorization parameters
items.
The first and second item are the authorization scheme and realm
respectively; further items are scheme-dependent.
-Currently, only basic authorization is supported.
+Currently, the
+.Dq basic
+and
+.Dq digest
+authorization methods are supported.
.Pp
-Basic authorization requires two parameters: the user name and
+Both methods require two parameters: the user name and
password, in that order.
.Pp
This variable is only used if the server requires authorization and
@@ -656,12 +660,14 @@ The
.Nm fetch
library was mostly written by
.An Dag-Erling Sm\(/orgrav Aq des at FreeBSD.org
-with numerous suggestions from
+with numerous suggestions and contributions from
.An Jordan K. Hubbard Aq jkh at FreeBSD.org ,
-.An Eugene Skepner Aq eu at qub.com
-and other
-.Fx
-developers.
+.An Eugene Skepner Aq eu at qub.com ,
+.An Hajimu Umemoto Aq ume at FreeBSD.org ,
+.An Henry Whincup Aq henry at techiebod.com ,
+.An Jukka A. Ukkonen Aq jau at iki.fi ,
+.An Jean-Fran\(,cois Dockes Aq jf at dockes.org
+and others.
It replaces the older
.Nm ftpio
library written by
Modified: stable/7/lib/libfetch/ftp.c
==============================================================================
--- stable/7/lib/libfetch/ftp.c Wed Jan 27 14:43:28 2010 (r203070)
+++ stable/7/lib/libfetch/ftp.c Wed Jan 27 14:54:48 2010 (r203071)
@@ -1122,17 +1122,19 @@ ftp_request(struct url *url, const char
/* change directory */
if (ftp_cwd(conn, url->doc) == -1)
- return (NULL);
+ goto errsock;
/* stat file */
if (us && ftp_stat(conn, url->doc, us) == -1
&& fetchLastErrCode != FETCH_PROTO
&& fetchLastErrCode != FETCH_UNAVAIL)
- return (NULL);
+ goto errsock;
/* just a stat */
- if (strcmp(op, "STAT") == 0)
+ if (strcmp(op, "STAT") == 0) {
+ ftp_disconnect(conn);
return (FILE *)1; /* bogus return value */
+ }
if (strcmp(op, "STOR") == 0 || strcmp(op, "APPE") == 0)
oflag = O_WRONLY;
else
@@ -1140,6 +1142,10 @@ ftp_request(struct url *url, const char
/* initiate the transfer */
return (ftp_transfer(conn, op, url->doc, oflag, url->offset, flags));
+
+errsock:
+ ftp_disconnect(conn);
+ return (NULL);
}
/*
Modified: stable/7/lib/libfetch/http.c
==============================================================================
--- stable/7/lib/libfetch/http.c Wed Jan 27 14:43:28 2010 (r203070)
+++ stable/7/lib/libfetch/http.c Wed Jan 27 14:54:48 2010 (r203071)
@@ -76,6 +76,7 @@ __FBSDID("$FreeBSD$");
#include <string.h>
#include <time.h>
#include <unistd.h>
+#include <md5.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
@@ -343,7 +344,8 @@ typedef enum {
hdr_last_modified,
hdr_location,
hdr_transfer_encoding,
- hdr_www_authenticate
+ hdr_www_authenticate,
+ hdr_proxy_authenticate,
} hdr_t;
/* Names of interesting headers */
@@ -357,6 +359,7 @@ static struct {
{ hdr_location, "Location" },
{ hdr_transfer_encoding, "Transfer-Encoding" },
{ hdr_www_authenticate, "WWW-Authenticate" },
+ { hdr_proxy_authenticate, "Proxy-Authenticate" },
{ hdr_unknown, NULL },
};
@@ -446,21 +449,114 @@ http_match(const char *str, const char *
return (hdr);
}
+
/*
- * Get the next header and return the appropriate symbolic code.
- */
-static hdr_t
-http_next_header(conn_t *conn, const char **p)
+ * Get the next header and return the appropriate symbolic code. We
+ * need to read one line ahead for checking for a continuation line
+ * belonging to the current header (continuation lines start with
+ * white space).
+ *
+ * We get called with a fresh line already in the conn buffer, either
+ * from the previous http_next_header() invocation, or, the first
+ * time, from a fetch_getln() performed by our caller.
+ *
+ * This stops when we encounter an empty line (we dont read beyond the header
+ * area).
+ *
+ * Note that the "headerbuf" is just a place to return the result. Its
+ * contents are not used for the next call. This means that no cleanup
+ * is needed when ie doing another connection, just call the cleanup when
+ * fully done to deallocate memory.
+ */
+
+/* Limit the max number of continuation lines to some reasonable value */
+#define HTTP_MAX_CONT_LINES 10
+
+/* Place into which to build a header from one or several lines */
+typedef struct {
+ char *buf; /* buffer */
+ size_t bufsize; /* buffer size */
+ size_t buflen; /* length of buffer contents */
+} http_headerbuf_t;
+
+static void
+init_http_headerbuf(http_headerbuf_t *buf)
{
- int i;
+ buf->buf = NULL;
+ buf->bufsize = 0;
+ buf->buflen = 0;
+}
- if (fetch_getln(conn) == -1)
- return (hdr_syserror);
- while (conn->buflen && isspace((unsigned char)conn->buf[conn->buflen - 1]))
+static void
+clean_http_headerbuf(http_headerbuf_t *buf)
+{
+ if (buf->buf)
+ free(buf->buf);
+ init_http_headerbuf(buf);
+}
+
+/* Remove whitespace at the end of the buffer */
+static void
+http_conn_trimright(conn_t *conn)
+{
+ while (conn->buflen &&
+ isspace((unsigned char)conn->buf[conn->buflen - 1]))
conn->buflen--;
conn->buf[conn->buflen] = '\0';
+}
+
+static hdr_t
+http_next_header(conn_t *conn, http_headerbuf_t *hbuf, const char **p)
+{
+ int i, len;
+
+ /*
+ * Have to do the stripping here because of the first line. So
+ * it's done twice for the subsequent lines. No big deal
+ */
+ http_conn_trimright(conn);
if (conn->buflen == 0)
return (hdr_end);
+
+ /* Copy the line to the headerbuf */
+ if (hbuf->bufsize < conn->buflen + 1) {
+ if ((hbuf->buf = realloc(hbuf->buf, conn->buflen + 1)) == NULL)
+ return (hdr_syserror);
+ hbuf->bufsize = conn->buflen + 1;
+ }
+ strcpy(hbuf->buf, conn->buf);
+ hbuf->buflen = conn->buflen;
+
+ /*
+ * Fetch possible continuation lines. Stop at 1st non-continuation
+ * and leave it in the conn buffer
+ */
+ for (i = 0; i < HTTP_MAX_CONT_LINES; i++) {
+ if (fetch_getln(conn) == -1)
+ return (hdr_syserror);
+
+ /*
+ * Note: we carry on the idea from the previous version
+ * that a pure whitespace line is equivalent to an empty
+ * one (so it's not continuation and will be handled when
+ * we are called next)
+ */
+ http_conn_trimright(conn);
+ if (conn->buf[0] != ' ' && conn->buf[0] != "\t"[0])
+ break;
+
+ /* Got a continuation line. Concatenate to previous */
+ len = hbuf->buflen + conn->buflen;
+ if (hbuf->bufsize < len + 1) {
+ len *= 2;
+ if ((hbuf->buf = realloc(hbuf->buf, len + 1)) == NULL)
+ return (hdr_syserror);
+ hbuf->bufsize = len + 1;
+ }
+ strcpy(hbuf->buf + hbuf->buflen, conn->buf);
+ hbuf->buflen += conn->buflen;
+ }
+
/*
* We could check for malformed headers but we don't really care.
* A valid header starts with a token immediately followed by a
@@ -468,11 +564,290 @@ http_next_header(conn_t *conn, const cha
* characters except "()<>@,;:\\\"{}".
*/
for (i = 0; hdr_names[i].num != hdr_unknown; i++)
- if ((*p = http_match(hdr_names[i].name, conn->buf)) != NULL)
+ if ((*p = http_match(hdr_names[i].name, hbuf->buf)) != NULL)
return (hdr_names[i].num);
+
return (hdr_unknown);
}
+/**************************
+ * [Proxy-]Authenticate header parsing
+ */
+
+/*
+ * Read doublequote-delimited string into output buffer obuf (allocated
+ * by caller, whose responsibility it is to ensure that it's big enough)
+ * cp points to the first char after the initial '"'
+ * Handles \ quoting
+ * Returns pointer to the first char after the terminating double quote, or
+ * NULL for error.
+ */
+static const char *
+http_parse_headerstring(const char *cp, char *obuf)
+{
+ for (;;) {
+ switch (*cp) {
+ case 0: /* Unterminated string */
+ *obuf = 0;
+ return (NULL);
+ case '"': /* Ending quote */
+ *obuf = 0;
+ return (++cp);
+ case '\\':
+ if (*++cp == 0) {
+ *obuf = 0;
+ return (NULL);
+ }
+ /* FALLTHROUGH */
+ default:
+ *obuf++ = *cp++;
+ }
+ }
+}
+
+/* Http auth challenge schemes */
+typedef enum {HTTPAS_UNKNOWN, HTTPAS_BASIC,HTTPAS_DIGEST} http_auth_schemes_t;
+
+/* Data holder for a Basic or Digest challenge. */
+typedef struct {
+ http_auth_schemes_t scheme;
+ char *realm;
+ char *qop;
+ char *nonce;
+ char *opaque;
+ char *algo;
+ int stale;
+ int nc; /* Nonce count */
+} http_auth_challenge_t;
+
+static void
+init_http_auth_challenge(http_auth_challenge_t *b)
+{
+ b->scheme = HTTPAS_UNKNOWN;
+ b->realm = b->qop = b->nonce = b->opaque = b->algo = NULL;
+ b->stale = b->nc = 0;
+}
+
+static void
+clean_http_auth_challenge(http_auth_challenge_t *b)
+{
+ if (b->realm)
+ free(b->realm);
+ if (b->qop)
+ free(b->qop);
+ if (b->nonce)
+ free(b->nonce);
+ if (b->opaque)
+ free(b->opaque);
+ if (b->algo)
+ free(b->algo);
+ init_http_auth_challenge(b);
+}
+
+/* Data holder for an array of challenges offered in an http response. */
+#define MAX_CHALLENGES 10
+typedef struct {
+ http_auth_challenge_t *challenges[MAX_CHALLENGES];
+ int count; /* Number of parsed challenges in the array */
+ int valid; /* We did parse an authenticate header */
+} http_auth_challenges_t;
+
+static void
+init_http_auth_challenges(http_auth_challenges_t *cs)
+{
+ int i;
+ for (i = 0; i < MAX_CHALLENGES; i++)
+ cs->challenges[i] = NULL;
+ cs->count = cs->valid = 0;
+}
+
+static void
+clean_http_auth_challenges(http_auth_challenges_t *cs)
+{
+ int i;
+ /* We rely on non-zero pointers being allocated, not on the count */
+ for (i = 0; i < MAX_CHALLENGES; i++) {
+ if (cs->challenges[i] != NULL) {
+ clean_http_auth_challenge(cs->challenges[i]);
+ free(cs->challenges[i]);
+ }
+ }
+ init_http_auth_challenges(cs);
+}
+
+/*
+ * Enumeration for lexical elements. Separators will be returned as their own
+ * ascii value
+ */
+typedef enum {HTTPHL_WORD=256, HTTPHL_STRING=257, HTTPHL_END=258,
+ HTTPHL_ERROR = 259} http_header_lex_t;
+
+/*
+ * Determine what kind of token comes next and return possible value
+ * in buf, which is supposed to have been allocated big enough by
+ * caller. Advance input pointer and return element type.
+ */
+static int
+http_header_lex(const char **cpp, char *buf)
+{
+ size_t l;
+ /* Eat initial whitespace */
+ *cpp += strspn(*cpp, " \t");
+ if (**cpp == 0)
+ return (HTTPHL_END);
+
+ /* Separator ? */
+ if (**cpp == ',' || **cpp == '=')
+ return (*((*cpp)++));
+
+ /* String ? */
+ if (**cpp == '"') {
+ *cpp = http_parse_headerstring(++*cpp, buf);
+ if (*cpp == NULL)
+ return (HTTPHL_ERROR);
+ return (HTTPHL_STRING);
+ }
+
+ /* Read other token, until separator or whitespace */
+ l = strcspn(*cpp, " \t,=");
+ memcpy(buf, *cpp, l);
+ buf[l] = 0;
+ *cpp += l;
+ return (HTTPHL_WORD);
+}
+
+/*
+ * Read challenges from http xxx-authenticate header and accumulate them
+ * in the challenges list structure.
+ *
+ * Headers with multiple challenges are specified by rfc2617, but
+ * servers (ie: squid) often send them in separate headers instead,
+ * which in turn is forbidden by the http spec (multiple headers with
+ * the same name are only allowed for pure comma-separated lists, see
+ * rfc2616 sec 4.2).
+ *
+ * We support both approaches anyway
+ */
+static int
+http_parse_authenticate(const char *cp, http_auth_challenges_t *cs)
+{
+ int ret = -1;
+ http_header_lex_t lex;
+ char *key = malloc(strlen(cp) + 1);
+ char *value = malloc(strlen(cp) + 1);
+ char *buf = malloc(strlen(cp) + 1);
+
+ if (key == NULL || value == NULL || buf == NULL) {
+ fetch_syserr();
+ goto out;
+ }
+
+ /* In any case we've seen the header and we set the valid bit */
+ cs->valid = 1;
+
+ /* Need word first */
+ lex = http_header_lex(&cp, key);
+ if (lex != HTTPHL_WORD)
+ goto out;
+
+ /* Loop on challenges */
+ for (; cs->count < MAX_CHALLENGES; cs->count++) {
+ cs->challenges[cs->count] =
+ malloc(sizeof(http_auth_challenge_t));
+ if (cs->challenges[cs->count] == NULL) {
+ fetch_syserr();
+ goto out;
+ }
+ init_http_auth_challenge(cs->challenges[cs->count]);
+ if (!strcasecmp(key, "basic")) {
+ cs->challenges[cs->count]->scheme = HTTPAS_BASIC;
+ } else if (!strcasecmp(key, "digest")) {
+ cs->challenges[cs->count]->scheme = HTTPAS_DIGEST;
+ } else {
+ cs->challenges[cs->count]->scheme = HTTPAS_UNKNOWN;
+ /*
+ * Continue parsing as basic or digest may
+ * follow, and the syntax is the same for
+ * all. We'll just ignore this one when
+ * looking at the list
+ */
+ }
+
+ /* Loop on attributes */
+ for (;;) {
+ /* Key */
+ lex = http_header_lex(&cp, key);
+ if (lex != HTTPHL_WORD)
+ goto out;
+
+ /* Equal sign */
+ lex = http_header_lex(&cp, buf);
+ if (lex != '=')
+ goto out;
+
+ /* Value */
+ lex = http_header_lex(&cp, value);
+ if (lex != HTTPHL_WORD && lex != HTTPHL_STRING)
+ goto out;
+
+ if (!strcasecmp(key, "realm"))
+ cs->challenges[cs->count]->realm =
+ strdup(value);
+ else if (!strcasecmp(key, "qop"))
+ cs->challenges[cs->count]->qop =
+ strdup(value);
+ else if (!strcasecmp(key, "nonce"))
+ cs->challenges[cs->count]->nonce =
+ strdup(value);
+ else if (!strcasecmp(key, "opaque"))
+ cs->challenges[cs->count]->opaque =
+ strdup(value);
+ else if (!strcasecmp(key, "algorithm"))
+ cs->challenges[cs->count]->algo =
+ strdup(value);
+ else if (!strcasecmp(key, "stale"))
+ cs->challenges[cs->count]->stale =
+ strcasecmp(value, "no");
+ /* Else ignore unknown attributes */
+
+ /* Comma or Next challenge or End */
+ lex = http_header_lex(&cp, key);
+ /*
+ * If we get a word here, this is the beginning of the
+ * next challenge. Break the attributes loop
+ */
+ if (lex == HTTPHL_WORD)
+ break;
+
+ if (lex == HTTPHL_END) {
+ /* End while looking for ',' is normal exit */
+ cs->count++;
+ ret = 0;
+ goto out;
+ }
+ /* Anything else is an error */
+ if (lex != ',')
+ goto out;
+
+ } /* End attributes loop */
+ } /* End challenge loop */
+
+ /*
+ * Challenges max count exceeded. This really can't happen
+ * with normal data, something's fishy -> error
+ */
+
+out:
+ if (key)
+ free(key);
+ if (value)
+ free(value);
+ if (buf)
+ free(buf);
+ return (ret);
+}
+
+
/*
* Parse a last-modified header
*/
@@ -618,6 +993,291 @@ http_base64(const char *src)
return (str);
}
+
+/*
+ * Extract authorization parameters from environment value.
+ * The value is like scheme:realm:user:pass
+ */
+typedef struct {
+ char *scheme;
+ char *realm;
+ char *user;
+ char *password;
+} http_auth_params_t;
+
+static void
+init_http_auth_params(http_auth_params_t *s)
+{
+ s->scheme = s->realm = s->user = s->password = 0;
+}
+
+static void
+clean_http_auth_params(http_auth_params_t *s)
+{
+ if (s->scheme)
+ free(s->scheme);
+ if (s->realm)
+ free(s->realm);
+ if (s->user)
+ free(s->user);
+ if (s->password)
+ free(s->password);
+ init_http_auth_params(s);
+}
+
+static int
+http_authfromenv(const char *p, http_auth_params_t *parms)
+{
+ int ret = -1;
+ char *v, *ve;
+ char *str = strdup(p);
+
+ if (str == NULL) {
+ fetch_syserr();
+ return (-1);
+ }
+ v = str;
+
+ if ((ve = strchr(v, ':')) == NULL)
+ goto out;
+
+ *ve = 0;
+ if ((parms->scheme = strdup(v)) == NULL) {
+ fetch_syserr();
+ goto out;
+ }
+ v = ve + 1;
+
+ if ((ve = strchr(v, ':')) == NULL)
+ goto out;
+
+ *ve = 0;
+ if ((parms->realm = strdup(v)) == NULL) {
+ fetch_syserr();
+ goto out;
+ }
+ v = ve + 1;
+
+ if ((ve = strchr(v, ':')) == NULL)
+ goto out;
+
+ *ve = 0;
+ if ((parms->user = strdup(v)) == NULL) {
+ fetch_syserr();
+ goto out;
+ }
+ v = ve + 1;
+
+
+ if ((parms->password = strdup(v)) == NULL) {
+ fetch_syserr();
+ goto out;
+ }
+ ret = 0;
+out:
+ if (ret == -1)
+ clean_http_auth_params(parms);
+ if (str)
+ free(str);
+ return (ret);
+}
+
+
+/*
+ * Digest response: the code to compute the digest is taken from the
+ * sample implementation in RFC2616
+ */
+#define IN
+#define OUT
+
+#define HASHLEN 16
+typedef char HASH[HASHLEN];
+#define HASHHEXLEN 32
+typedef char HASHHEX[HASHHEXLEN+1];
+
+static const char *hexchars = "0123456789abcdef";
+static void
+CvtHex(IN HASH Bin, OUT HASHHEX Hex)
+{
+ unsigned short i;
+ unsigned char j;
+
+ for (i = 0; i < HASHLEN; i++) {
+ j = (Bin[i] >> 4) & 0xf;
+ Hex[i*2] = hexchars[j];
+ j = Bin[i] & 0xf;
+ Hex[i*2+1] = hexchars[j];
+ };
+ Hex[HASHHEXLEN] = '\0';
+};
+
+/* calculate H(A1) as per spec */
+static void
+DigestCalcHA1(
+ IN char * pszAlg,
+ IN char * pszUserName,
+ IN char * pszRealm,
+ IN char * pszPassword,
+ IN char * pszNonce,
+ IN char * pszCNonce,
+ OUT HASHHEX SessionKey
+ )
+{
+ MD5_CTX Md5Ctx;
+ HASH HA1;
+
+ MD5Init(&Md5Ctx);
+ MD5Update(&Md5Ctx, pszUserName, strlen(pszUserName));
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszRealm, strlen(pszRealm));
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszPassword, strlen(pszPassword));
+ MD5Final(HA1, &Md5Ctx);
+ if (strcasecmp(pszAlg, "md5-sess") == 0) {
+
+ MD5Init(&Md5Ctx);
+ MD5Update(&Md5Ctx, HA1, HASHLEN);
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
+ MD5Final(HA1, &Md5Ctx);
+ };
+ CvtHex(HA1, SessionKey);
+}
+
+/* calculate request-digest/response-digest as per HTTP Digest spec */
+static void
+DigestCalcResponse(
+ IN HASHHEX HA1, /* H(A1) */
+ IN char * pszNonce, /* nonce from server */
+ IN char * pszNonceCount, /* 8 hex digits */
+ IN char * pszCNonce, /* client nonce */
+ IN char * pszQop, /* qop-value: "", "auth", "auth-int" */
+ IN char * pszMethod, /* method from the request */
+ IN char * pszDigestUri, /* requested URL */
+ IN HASHHEX HEntity, /* H(entity body) if qop="auth-int" */
+ OUT HASHHEX Response /* request-digest or response-digest */
+ )
+{
+/* DEBUG(fprintf(stderr,
+ "Calc: HA1[%s] Nonce[%s] qop[%s] method[%s] URI[%s]\n",
+ HA1, pszNonce, pszQop, pszMethod, pszDigestUri));*/
+ MD5_CTX Md5Ctx;
+ HASH HA2;
+ HASH RespHash;
+ HASHHEX HA2Hex;
+
+ // calculate H(A2)
+ MD5Init(&Md5Ctx);
+ MD5Update(&Md5Ctx, pszMethod, strlen(pszMethod));
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszDigestUri, strlen(pszDigestUri));
+ if (strcasecmp(pszQop, "auth-int") == 0) {
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, HEntity, HASHHEXLEN);
+ };
+ MD5Final(HA2, &Md5Ctx);
+ CvtHex(HA2, HA2Hex);
+
+ // calculate response
+ MD5Init(&Md5Ctx);
+ MD5Update(&Md5Ctx, HA1, HASHHEXLEN);
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
+ MD5Update(&Md5Ctx, ":", 1);
+ if (*pszQop) {
+ MD5Update(&Md5Ctx, pszNonceCount, strlen(pszNonceCount));
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
+ MD5Update(&Md5Ctx, ":", 1);
+ MD5Update(&Md5Ctx, pszQop, strlen(pszQop));
+ MD5Update(&Md5Ctx, ":", 1);
+ };
+ MD5Update(&Md5Ctx, HA2Hex, HASHHEXLEN);
+ MD5Final(RespHash, &Md5Ctx);
+ CvtHex(RespHash, Response);
+}
+
+/*
+ * Generate/Send a Digest authorization header
+ * This looks like: [Proxy-]Authorization: credentials
+ *
+ * credentials = "Digest" digest-response
+ * digest-response = 1#( username | realm | nonce | digest-uri
+ * | response | [ algorithm ] | [cnonce] |
+ * [opaque] | [message-qop] |
+ * [nonce-count] | [auth-param] )
+ * username = "username" "=" username-value
+ * username-value = quoted-string
+ * digest-uri = "uri" "=" digest-uri-value
+ * digest-uri-value = request-uri ; As specified by HTTP/1.1
+ * message-qop = "qop" "=" qop-value
+ * cnonce = "cnonce" "=" cnonce-value
+ * cnonce-value = nonce-value
+ * nonce-count = "nc" "=" nc-value
+ * nc-value = 8LHEX
+ * response = "response" "=" request-digest
+ * request-digest = <"> 32LHEX <">
+ */
+static int
+http_digest_auth(conn_t *conn, const char *hdr, http_auth_challenge_t *c,
+ http_auth_params_t *parms, struct url *url)
+{
+ int r;
+ char noncecount[10];
+ char cnonce[40];
+ char *options = 0;
+
+ if (!c->realm || !c->nonce) {
+ DEBUG(fprintf(stderr, "realm/nonce not set in challenge\n"));
+ return(-1);
+ }
+ if (!c->algo)
+ c->algo = strdup("");
+
+ if (asprintf(&options, "%s%s%s%s",
+ *c->algo? ",algorithm=" : "", c->algo,
+ c->opaque? ",opaque=" : "", c->opaque?c->opaque:"")== -1)
+ return (-1);
+
+ if (!c->qop) {
+ c->qop = strdup("");
+ *noncecount = 0;
+ *cnonce = 0;
+ } else {
+ c->nc++;
+ sprintf(noncecount, "%08x", c->nc);
+ /* We don't try very hard with the cnonce ... */
+ sprintf(cnonce, "%x%lx", getpid(), (unsigned long)time(0));
+ }
+
+ HASHHEX HA1;
+ DigestCalcHA1(c->algo, parms->user, c->realm,
+ parms->password, c->nonce, cnonce, HA1);
+ DEBUG(fprintf(stderr, "HA1: [%s]\n", HA1));
+ HASHHEX digest;
+ DigestCalcResponse(HA1, c->nonce, noncecount, cnonce, c->qop,
+ "GET", url->doc, "", digest);
+
+ if (c->qop[0]) {
+ r = http_cmd(conn, "%s: Digest username=\"%s\",realm=\"%s\","
+ "nonce=\"%s\",uri=\"%s\",response=\"%s\","
+ "qop=\"auth\", cnonce=\"%s\", nc=%s%s",
+ hdr, parms->user, c->realm,
+ c->nonce, url->doc, digest,
+ cnonce, noncecount, options);
+ } else {
+ r = http_cmd(conn, "%s: Digest username=\"%s\",realm=\"%s\","
+ "nonce=\"%s\",uri=\"%s\",response=\"%s\"%s",
+ hdr, parms->user, c->realm,
+ c->nonce, url->doc, digest, options);
+ }
+ if (options)
+ free(options);
+ return (r);
+}
+
/*
* Encode username and password
*/
@@ -627,8 +1287,8 @@ http_basic_auth(conn_t *conn, const char
char *upw, *auth;
int r;
- DEBUG(fprintf(stderr, "usr: [%s]\n", usr));
- DEBUG(fprintf(stderr, "pwd: [%s]\n", pwd));
+ DEBUG(fprintf(stderr, "basic: usr: [%s]\n", usr));
+ DEBUG(fprintf(stderr, "basic: pwd: [%s]\n", pwd));
if (asprintf(&upw, "%s:%s", usr, pwd) == -1)
return (-1);
auth = http_base64(upw);
@@ -641,33 +1301,49 @@ http_basic_auth(conn_t *conn, const char
}
/*
- * Send an authorization header
+ * Chose the challenge to answer and call the appropriate routine to
+ * produce the header.
*/
static int
-http_authorize(conn_t *conn, const char *hdr, const char *p)
+http_authorize(conn_t *conn, const char *hdr, http_auth_challenges_t *cs,
+ http_auth_params_t *parms, struct url *url)
{
- /* basic authorization */
- if (strncasecmp(p, "basic:", 6) == 0) {
- char *user, *pwd, *str;
- int r;
-
- /* skip realm */
- for (p += 6; *p && *p != ':'; ++p)
- /* nothing */ ;
- if (!*p || strchr(++p, ':') == NULL)
- return (-1);
- if ((str = strdup(p)) == NULL)
- return (-1); /* XXX */
- user = str;
- pwd = strchr(str, ':');
- *pwd++ = '\0';
- r = http_basic_auth(conn, hdr, user, pwd);
- free(str);
- return (r);
+ http_auth_challenge_t *basic = NULL;
+ http_auth_challenge_t *digest = NULL;
+ int i;
+
+ /* If user or pass are null we're not happy */
+ if (!parms->user || !parms->password) {
+ DEBUG(fprintf(stderr, "NULL usr or pass\n"));
+ return (-1);
}
- return (-1);
-}
+ /* Look for a Digest and a Basic challenge */
+ for (i = 0; i < cs->count; i++) {
+ if (cs->challenges[i]->scheme == HTTPAS_BASIC)
+ basic = cs->challenges[i];
+ if (cs->challenges[i]->scheme == HTTPAS_DIGEST)
+ digest = cs->challenges[i];
+ }
+
+ /* Error if "Digest" was specified and there is no Digest challenge */
+ if (!digest && (parms->scheme &&
+ !strcasecmp(parms->scheme, "digest"))) {
+ DEBUG(fprintf(stderr,
+ "Digest auth in env, not supported by peer\n"));
+ return (-1);
+ }
+ /*
+ * If "basic" was specified in the environment, or there is no Digest
+ * challenge, do the basic thing. Don't need a challenge for this,
+ * so no need to check basic!=NULL
+ */
+ if (!digest || (parms->scheme && !strcasecmp(parms->scheme,"basic")))
+ return (http_basic_auth(conn,hdr,parms->user,parms->password));
+
+ /* Else, prefer digest. We just checked that it's not NULL */
+ return (http_digest_auth(conn, hdr, digest, parms, url));
+}
/*****************************************************************************
* Helper functions for connecting to a server or proxy
@@ -797,13 +1473,13 @@ http_print_html(FILE *out, FILE *in)
*/
FILE *
http_request(struct url *URL, const char *op, struct url_stat *us,
- struct url *purl, const char *flags)
+ struct url *purl, const char *flags)
{
char timebuf[80];
char hbuf[MAXHOSTNAMELEN + 7], *host;
*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
More information about the svn-src-all
mailing list