GNU libmicrohttpd 1.0.1
|
Macros | |
#define | MHD_MD5_DIGEST_SIZE 16 |
#define | MHD_SHA256_DIGEST_SIZE 32 |
#define | MHD_SHA512_256_DIGEST_SIZE 32 |
#define | MHD_INVALID_NONCE -1 |
Functions | |
_MHD_EXTERN size_t | MHD_digest_get_hash_size (enum MHD_DigestAuthAlgo3 algo3) |
_MHD_EXTERN enum MHD_Result | MHD_digest_auth_calc_userhash (enum MHD_DigestAuthAlgo3 algo3, const char *username, const char *realm, void *userhash_bin, size_t bin_buf_size) |
_MHD_EXTERN enum MHD_Result | MHD_digest_auth_calc_userhash_hex (enum MHD_DigestAuthAlgo3 algo3, const char *username, const char *realm, char *userhash_hex, size_t hex_buf_size) |
_MHD_EXTERN struct MHD_DigestAuthInfo * | MHD_digest_auth_get_request_info3 (struct MHD_Connection *connection) |
_MHD_EXTERN struct MHD_DigestAuthUsernameInfo * | MHD_digest_auth_get_username3 (struct MHD_Connection *connection) |
_MHD_EXTERN enum MHD_DigestAuthResult | MHD_digest_auth_check3 (struct MHD_Connection *connection, const char *realm, const char *username, const char *password, unsigned int nonce_timeout, uint32_t max_nc, enum MHD_DigestAuthMultiQOP mqop, enum MHD_DigestAuthMultiAlgo3 malgo3) |
_MHD_EXTERN enum MHD_Result | MHD_digest_auth_calc_userdigest (enum MHD_DigestAuthAlgo3 algo3, const char *username, const char *realm, const char *password, void *userdigest_bin, size_t bin_buf_size) |
_MHD_EXTERN enum MHD_DigestAuthResult | MHD_digest_auth_check_digest3 (struct MHD_Connection *connection, const char *realm, const char *username, const void *userdigest, size_t userdigest_size, unsigned int nonce_timeout, uint32_t max_nc, enum MHD_DigestAuthMultiQOP mqop, enum MHD_DigestAuthMultiAlgo3 malgo3) |
_MHD_EXTERN enum MHD_Result | MHD_queue_auth_required_response3 (struct MHD_Connection *connection, const char *realm, const char *opaque, const char *domain, struct MHD_Response *response, int signal_stale, enum MHD_DigestAuthMultiQOP mqop, enum MHD_DigestAuthMultiAlgo3 algo, int userhash_support, int prefer_utf8) |
_MHD_EXTERN char * | MHD_digest_auth_get_username (struct MHD_Connection *connection) |
_MHD_EXTERN int | MHD_digest_auth_check2 (struct MHD_Connection *connection, const char *realm, const char *username, const char *password, unsigned int nonce_timeout, enum MHD_DigestAuthAlgorithm algo) |
_MHD_EXTERN int | MHD_digest_auth_check (struct MHD_Connection *connection, const char *realm, const char *username, const char *password, unsigned int nonce_timeout) |
_MHD_EXTERN int | MHD_digest_auth_check_digest2 (struct MHD_Connection *connection, const char *realm, const char *username, const uint8_t *digest, size_t digest_size, unsigned int nonce_timeout, enum MHD_DigestAuthAlgorithm algo) |
_MHD_EXTERN int | MHD_digest_auth_check_digest (struct MHD_Connection *connection, const char *realm, const char *username, const uint8_t digest[MHD_MD5_DIGEST_SIZE], unsigned int nonce_timeout) |
_MHD_EXTERN enum MHD_Result | MHD_queue_auth_fail_response2 (struct MHD_Connection *connection, const char *realm, const char *opaque, struct MHD_Response *response, int signal_stale, enum MHD_DigestAuthAlgorithm algo) |
_MHD_EXTERN enum MHD_Result | MHD_queue_auth_fail_response (struct MHD_Connection *connection, const char *realm, const char *opaque, struct MHD_Response *response, int signal_stale) |
_MHD_EXTERN struct MHD_BasicAuthInfo * | MHD_basic_auth_get_username_password3 (struct MHD_Connection *connection) |
_MHD_EXTERN enum MHD_Result | MHD_queue_basic_auth_required_response3 (struct MHD_Connection *connection, const char *realm, int prefer_utf8, struct MHD_Response *response) |
_MHD_EXTERN char * | MHD_basic_auth_get_username_password (struct MHD_Connection *connection, char **password) |
_MHD_EXTERN enum MHD_Result | MHD_queue_basic_auth_fail_response (struct MHD_Connection *connection, const char *realm, struct MHD_Response *response) |
static enum MHD_DigestAuthResult | digest_auth_check_all_inner (struct MHD_Connection *connection, const char *realm, const char *username, const char *password, const uint8_t *userdigest, unsigned int nonce_timeout, uint32_t max_nc, enum MHD_DigestAuthMultiQOP mqop, enum MHD_DigestAuthMultiAlgo3 malgo3, char **pbuf, struct DigestAlgorithm *da) |
static enum MHD_DigestAuthResult | digest_auth_check_all (struct MHD_Connection *connection, const char *realm, const char *username, const char *password, const uint8_t *userdigest, unsigned int nonce_timeout, uint32_t max_nc, enum MHD_DigestAuthMultiQOP mqop, enum MHD_DigestAuthMultiAlgo3 malgo3) |
static enum MHD_Result | queue_auth_required_response3_inner (struct MHD_Connection *connection, const char *realm, const char *opaque, const char *domain, struct MHD_Response *response, int signal_stale, enum MHD_DigestAuthMultiQOP mqop, enum MHD_DigestAuthMultiAlgo3 malgo3, int userhash_support, int prefer_utf8, char **buf_ptr, struct DigestAlgorithm *da) |
MHD API related to basic and digest HTTP authentication.
#define MHD_INVALID_NONCE -1 |
Constant to indicate that the nonce of the provided authentication code was wrong. Used as return code by MHD_digest_auth_check(), MHD_digest_auth_check2(), MHD_digest_auth_check_digest(), MHD_digest_auth_check_digest2().
Definition at line 5751 of file microhttpd.h.
#define MHD_MD5_DIGEST_SIZE 16 |
Length of the binary output of the MD5 hash function.
Definition at line 4683 of file microhttpd.h.
#define MHD_SHA256_DIGEST_SIZE 32 |
Length of the binary output of the SHA-256 hash function.
Definition at line 4690 of file microhttpd.h.
#define MHD_SHA512_256_DIGEST_SIZE 32 |
Length of the binary output of the SHA-512/256 hash function.
Definition at line 4700 of file microhttpd.h.
|
static |
Authenticates the authorization header sent by the client
If RFC2069 mode is allowed by setting bit MHD_DIGEST_AUTH_QOP_NONE in mqop and the client uses this mode, then server generated nonces are used as one-time nonces because nonce-count is not supported in this old RFC. Communication in this mode is very inefficient, especially if the client requests several resources one-by-one as for every request new nonce must be generated and client repeat all requests twice (the first time to get a new nonce and the second time to perform an authorised request).
connection | the MHD connection structure |
realm | the realm for authorization of the client |
username | the username to be authenticated, must be in clear text even if userhash is used by the client |
password | the password used in the authentication, must be NULL if userdigest is not NULL |
userdigest | the precalculated binary hash of the string "username:realm:password", must be NULL if password is not NULL |
nonce_timeout | the period of seconds since nonce generation, when the nonce is recognised as valid and not stale; if set to zero then daemon's default value is used |
max_nc | the maximum allowed nc (Nonce Count) value, if client's nc exceeds the specified value then MHD_DAUTH_NONCE_STALE is returned; if set to zero then daemon's default value is used |
mqop | the QOP to use |
malgo3 | digest algorithms allowed to use, fail if algorithm specified by the client is not allowed by this parameter |
Definition at line 3081 of file digestauth.c.
References MHD_Connection::daemon, digest_auth_check_all_inner(), digest_deinit, digest_setup_zero, and NULL.
Referenced by MHD_digest_auth_check3(), and MHD_digest_auth_check_digest3().
|
static |
Authenticates the authorization header sent by the client
If RFC2069 mode is allowed by setting bit MHD_DIGEST_AUTH_QOP_NONE in mqop and the client uses this mode, then server generated nonces are used as one-time nonces because nonce-count is not supported in this old RFC. Communication in this mode is very inefficient, especially if the client requests several resources one-by-one as for every request new nonce must be generated and client repeat all requests twice (the first time to get a new nonce and the second time to perform an authorised request).
connection | the MHD connection structure | |
realm | the realm for authorization of the client | |
username | the username to be authenticated, must be in clear text even if userhash is used by the client | |
password | the password used in the authentication, must be NULL if userdigest is not NULL | |
userdigest | the precalculated binary hash of the string "username:realm:password", must be NULL if password is not NULL | |
nonce_timeout | the period of seconds since nonce generation, when the nonce is recognised as valid and not stale; unlike digest_auth_check_all() zero is used literally | |
max_nc | the maximum allowed nc (Nonce Count) value, if client's nc exceeds the specified value then MHD_DAUTH_NONCE_STALE is returned; unlike digest_auth_check_all() zero is treated as "no limit" | |
mqop | the QOP to use | |
malgo3 | digest algorithms allowed to use, fail if algorithm specified by the client is not allowed by this parameter | |
[out] | pbuf | the pointer to pointer to internally malloc'ed buffer, to be freed if not NULL upon return |
< Client's algorithm
< Client's QOP
Temporal buffer in stack for unquoting and other needs
< Temporal malloc'ed buffer for unquoting
< The size of tmp2 buffer
Definition at line 2534 of file digestauth.c.
References _, _MHD_AUTH_DIGEST_MAX_PARAM_SIZE, _MHD_STATIC_UNQ_BUFFER_SIZE, _MHD_UNQ_OK, MHD_Connection::addr, MHD_Connection::addr_len, calc_userdigest(), calc_userhash(), calculate_nonce(), check_nonce_nc(), check_uri_match(), MHD_Connection::daemon, digest_calc_hash(), digest_ext_error, digest_get_size(), digest_init_one_time(), digest_reset(), digest_update(), digest_update_str(), digest_update_with_colon(), get_base_digest_algo(), get_buffer_for_size(), get_nonce_timestamp(), get_rq_extended_uname_copy_z(), get_unquoted_param(), get_unquoted_param_copy(), MHD_Request::headers_received, MHD_Request::http_mthd, is_param_equal(), is_param_equal_caseless(), _MHD_str_w_len::len, _MHD_mstr_w_len::len, MHD_Request::method, mhd_assert, MHD_bin_to_hex(), MHD_CHECK_NONCENC_OK, MHD_CHECK_NONCENC_STALE, MHD_CHECK_NONCENC_WRONG, MHD_DAUTH_BIND_NONCE_NONE, MHD_DAUTH_ERROR, MHD_DAUTH_EXT_PARAM_MIN_LEN, MHD_DAUTH_NONCE_OTHER_COND, MHD_DAUTH_NONCE_STALE, MHD_DAUTH_NONCE_WRONG, MHD_DAUTH_OK, MHD_DAUTH_RESPONSE_WRONG, MHD_DAUTH_TOO_LARGE, MHD_DAUTH_WRONG_ALGO, MHD_DAUTH_WRONG_HEADER, MHD_DAUTH_WRONG_QOP, MHD_DAUTH_WRONG_REALM, MHD_DAUTH_WRONG_URI, MHD_DAUTH_WRONG_USERNAME, MHD_DIGEST_AUTH_ALGO3_SESSION, MHD_DIGEST_AUTH_QOP_AUTH_INT, MHD_DIGEST_AUTH_QOP_NONE, MHD_DIGEST_BASE_ALGO_MD5, MHD_DIGEST_BASE_ALGO_SHA256, MHD_DIGEST_BASE_ALGO_SHA512_256, MHD_get_master(), MHD_hex_to_bin(), MHD_monotonic_msec_counter(), MHD_PANIC, MHD_strx_to_uint64_n_(), NONCE_STD_LEN, NULL, MHD_Connection::rq, _MHD_str_w_len::str, _MHD_mstr_w_len::str, TRIM_TO_TIMESTAMP, MHD_Request::url, and MHD_Request::url_len.
Referenced by digest_auth_check_all().
_MHD_EXTERN char * MHD_basic_auth_get_username_password | ( | struct MHD_Connection * | connection, |
char ** | password | ||
) |
Get the username and password from the basic authorization header sent by the client
connection | The MHD connection structure | |
[out] | password | a pointer for the password, free using MHD_free(). |
Get the username and password from the basic authorization header sent by the client
connection | The MHD connection structure | |
[out] | password | a pointer for the password, free using MHD_free(). |
Definition at line 137 of file basicauth.c.
References _, MHD_Connection::daemon, mhd_assert, MHD_basic_auth_get_username_password3(), NULL, MHD_BasicAuthInfo::password, MHD_BasicAuthInfo::password_len, MHD_BasicAuthInfo::username, and MHD_BasicAuthInfo::username_len.
_MHD_EXTERN struct MHD_BasicAuthInfo * MHD_basic_auth_get_username_password3 | ( | struct MHD_Connection * | connection | ) |
Get the username and password from the Basic Authorisation header sent by the client
connection | the MHD connection structure |
Definition at line 49 of file basicauth.c.
References _, MHD_Connection::daemon, _MHD_str_w_len::len, mhd_assert, NULL, MHD_BasicAuthInfo::password, MHD_BasicAuthInfo::password_len, _MHD_str_w_len::str, MHD_RqBAuth::token68, MHD_BasicAuthInfo::username, and MHD_BasicAuthInfo::username_len.
Referenced by MHD_basic_auth_get_username_password().
_MHD_EXTERN enum MHD_Result MHD_digest_auth_calc_userdigest | ( | enum MHD_DigestAuthAlgo3 | algo3, |
const char * | username, | ||
const char * | realm, | ||
const char * | password, | ||
void * | userdigest_bin, | ||
size_t | bin_buf_size | ||
) |
Calculate userdigest, return it as a binary data.
The "userdigest" is the hash of the "username:realm:password" string.
The "userdigest" can be used to avoid storing the password in clear text in database/files
This function is designed to improve security of stored credentials, the "userdigest" does not improve security of the authentication process.
The results can be used to store username & userdigest pairs instead of username & password pairs. To further improve security, application may store username & userhash & userdigest triplets.
algo3 | the digest algorithm | |
username | the username | |
realm | the realm | |
password | the password | |
[out] | userdigest_bin | the output buffer for userdigest; if this function succeeds, then this buffer has #MHD_digest_get_hash_size(algo3) bytes of userdigest upon return |
bin_buf_size | the size of the userdigest_bin buffer, must be at least #MHD_digest_get_hash_size(algo3) bytes long |
Definition at line 1937 of file digestauth.c.
References calc_userdigest(), digest_deinit, digest_ext_error, digest_get_size(), digest_init_one_time(), get_base_digest_algo(), MHD_NO, and MHD_YES.
_MHD_EXTERN enum MHD_Result MHD_digest_auth_calc_userhash | ( | enum MHD_DigestAuthAlgo3 | algo3, |
const char * | username, | ||
const char * | realm, | ||
void * | userhash_bin, | ||
size_t | bin_buf_size | ||
) |
Calculate "userhash", return it as binary data.
The "userhash" is the hash of the string "username:realm".
The "userhash" could be used to avoid sending username in cleartext in Digest Authorization client's header.
Userhash is not designed to hide the username in local database or files, as username in cleartext is required for MHD_digest_auth_check3() function to check the response, but it can be used to hide username in HTTP headers.
This function could be used when the new username is added to the username database to save the "userhash" alongside with the username (preferably) or when loading list of the usernames to generate the userhash for every loaded username (this will cause delays at the start with the long lists).
Once "userhash" is generated it could be used to identify users by clients with "userhash" support. Avoid repetitive usage of this function for the same username/realm combination as it will cause excessive CPU load; save and re-use the result instead.
algo3 | the algorithm for userhash calculations | |
username | the username | |
realm | the realm | |
[out] | userhash_bin | the output buffer for userhash as binary data; if this function succeeds, then this buffer has #MHD_digest_get_hash_size(algo3) bytes of userhash upon return |
bin_buf_size | the size of the userhash_bin buffer, must be at least #MHD_digest_get_hash_size(algo3) bytes long |
Definition at line 2042 of file digestauth.c.
References calc_userhash(), digest_deinit, digest_ext_error, digest_get_size(), digest_init_one_time(), get_base_digest_algo(), MHD_NO, and MHD_YES.
Referenced by MHD_digest_auth_calc_userhash_hex().
_MHD_EXTERN enum MHD_Result MHD_digest_auth_calc_userhash_hex | ( | enum MHD_DigestAuthAlgo3 | algo3, |
const char * | username, | ||
const char * | realm, | ||
char * | userhash_hex, | ||
size_t | hex_buf_size | ||
) |
Calculate "userhash", return it as hexadecimal string.
The "userhash" is the hash of the string "username:realm".
The "userhash" could be used to avoid sending username in cleartext in Digest Authorization client's header.
Userhash is not designed to hide the username in local database or files, as username in cleartext is required for MHD_digest_auth_check3() function to check the response, but it can be used to hide username in HTTP headers.
This function could be used when the new username is added to the username database to save the "userhash" alongside with the username (preferably) or when loading list of the usernames to generate the userhash for every loaded username (this will cause delays at the start with the long lists).
Once "userhash" is generated it could be used to identify users by clients with "userhash" support. Avoid repetitive usage of this function for the same username/realm combination as it will cause excessive CPU load; save and re-use the result instead.
algo3 | the algorithm for userhash calculations | |
username | the username | |
realm | the realm | |
[out] | userhash_hex | the output buffer for userhash as hex string; if this function succeeds, then this buffer has #MHD_digest_get_hash_size(algo3)*2 chars long userhash zero-terminated string |
bin_buf_size | the size of the userhash_bin buffer, must be at least #MHD_digest_get_hash_size(algo3)*2+1 chars long |
Definition at line 2117 of file digestauth.c.
References digest_get_hash_size(), MHD_bin_to_hex_z(), MHD_digest_auth_calc_userhash(), MHD_NO, and MHD_YES.
_MHD_EXTERN int MHD_digest_auth_check | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | username, | ||
const char * | password, | ||
unsigned int | nonce_timeout | ||
) |
Authenticates the authorization header sent by the client. Uses MHD_DIGEST_ALG_MD5 (for now, for backwards-compatibility). Note that this MAY change to MHD_DIGEST_ALG_AUTO in the future. If you want to be sure you get MD5, use MHD_digest_auth_check2() and specify MD5 explicitly.
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
password | The password used in the authentication |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
Authenticates the authorization header sent by the client. Uses MHD_DIGEST_ALG_MD5 (for now, for backwards-compatibility). Note that this MAY change to MHD_DIGEST_ALG_AUTO in the future. If you want to be sure you get MD5, use MHD_digest_auth_check2() and specify MD5 explicitly.
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
password | The password used in the authentication |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
Definition at line 3133 of file digestauth.c.
References MHD_DIGEST_ALG_MD5, and MHD_digest_auth_check2().
_MHD_EXTERN int MHD_digest_auth_check2 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | username, | ||
const char * | password, | ||
unsigned int | nonce_timeout, | ||
enum MHD_DigestAuthAlgorithm | algo | ||
) |
Authenticates the authorization header sent by the client.
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
password | The password used in the authentication |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
algo | digest algorithms allowed for verification |
Authenticates the authorization header sent by the client.
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
password | The password used in the authentication |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
algo | digest algorithms allowed for verification |
Definition at line 3330 of file digestauth.c.
References _, MHD_DAUTH_NONCE_OTHER_COND, MHD_DAUTH_NONCE_STALE, MHD_DAUTH_NONCE_WRONG, MHD_DAUTH_OK, MHD_DIGEST_ALG_AUTO, MHD_DIGEST_ALG_MD5, MHD_DIGEST_ALG_SHA256, MHD_digest_auth_check3(), MHD_DIGEST_AUTH_MULT_ALGO3_ANY_NON_SESSION, MHD_DIGEST_AUTH_MULT_ALGO3_MD5, MHD_DIGEST_AUTH_MULT_ALGO3_SHA256, MHD_DIGEST_AUTH_MULT_QOP_AUTH, MHD_INVALID_NONCE, MHD_NO, MHD_PANIC, and MHD_YES.
Referenced by MHD_digest_auth_check().
_MHD_EXTERN enum MHD_DigestAuthResult MHD_digest_auth_check3 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | username, | ||
const char * | password, | ||
unsigned int | nonce_timeout, | ||
uint32_t | max_nc, | ||
enum MHD_DigestAuthMultiQOP | mqop, | ||
enum MHD_DigestAuthMultiAlgo3 | malgo3 | ||
) |
Authenticates the authorization header sent by the client.
If RFC2069 mode is allowed by setting bit MHD_DIGEST_AUTH_QOP_NONE in mqop and the client uses this mode, then server generated nonces are used as one-time nonces because nonce-count is not supported in this old RFC. Communication in this mode is very inefficient, especially if the client requests several resources one-by-one as for every request a new nonce must be generated and client repeats all requests twice (first time to get a new nonce and second time to perform an authorised request).
connection | the MHD connection structure |
realm | the realm for authorization of the client |
username | the username to be authenticated, must be in clear text even if userhash is used by the client |
password | the password matching the username (and the realm) |
nonce_timeout | the period of seconds since nonce generation, when the nonce is recognised as valid and not stale; if zero is specified then daemon default value is used. |
max_nc | the maximum allowed nc (Nonce Count) value, if client's nc exceeds the specified value then MHD_DAUTH_NONCE_STALE is returned; if zero is specified then daemon default value is used. |
mqop | the QOP to use |
malgo3 | digest algorithms allowed to use, fail if algorithm used by the client is not allowed by this parameter |
Definition at line 3180 of file digestauth.c.
References digest_auth_check_all(), mhd_assert, and NULL.
Referenced by MHD_digest_auth_check2().
_MHD_EXTERN int MHD_digest_auth_check_digest | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | username, | ||
const uint8_t | digest[MHD_MD5_DIGEST_SIZE], | ||
unsigned int | nonce_timeout | ||
) |
Authenticates the authorization header sent by the client Uses MHD_DIGEST_ALG_MD5 (required, as digest is of fixed size).
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
digest | An ‘unsigned char *’ pointer to the binary hash for the precalculated hash value "username:realm:password"; length must be MHD_MD5_DIGEST_SIZE bytes |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
Authenticates the authorization header sent by the client Uses MHD_DIGEST_ALG_MD5 (required, as digest is of fixed size).
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
digest | An ‘unsigned char *’ pointer to the binary hash for the precalculated hash value "username:realm:password"; length must be MHD_MD5_DIGEST_SIZE bytes |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
Definition at line 3443 of file digestauth.c.
References MHD_DIGEST_ALG_MD5, MHD_digest_auth_check_digest2(), and MHD_MD5_DIGEST_SIZE.
_MHD_EXTERN int MHD_digest_auth_check_digest2 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | username, | ||
const uint8_t * | digest, | ||
size_t | digest_size, | ||
unsigned int | nonce_timeout, | ||
enum MHD_DigestAuthAlgorithm | algo | ||
) |
Authenticates the authorization header sent by the client.
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
digest | An ‘unsigned char *’ pointer to the binary MD5 sum for the precalculated hash value "username:realm:password" of digest_size bytes |
digest_size | number of bytes in digest (size must match algo!) |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
algo | digest algorithms allowed for verification |
Authenticates the authorization header sent by the client.
connection | The MHD connection structure |
realm | The realm presented to the client |
username | The username needs to be authenticated |
digest | An ‘unsigned char *’ pointer to the binary MD5 sum for the precalculated hash value "username:realm:password" of digest_size bytes |
digest_size | number of bytes in digest (size must match algo!) |
nonce_timeout | The amount of time for a nonce to be invalid in seconds |
algo | digest algorithms allowed for verification |
Definition at line 3386 of file digestauth.c.
References _, MHD_DAUTH_NONCE_OTHER_COND, MHD_DAUTH_NONCE_STALE, MHD_DAUTH_NONCE_WRONG, MHD_DAUTH_OK, MHD_DIGEST_ALG_AUTO, MHD_DIGEST_ALG_MD5, MHD_DIGEST_ALG_SHA256, MHD_digest_auth_check_digest3(), MHD_DIGEST_AUTH_MULT_ALGO3_ANY_NON_SESSION, MHD_DIGEST_AUTH_MULT_ALGO3_MD5, MHD_DIGEST_AUTH_MULT_ALGO3_SHA256, MHD_DIGEST_AUTH_MULT_QOP_AUTH, MHD_INVALID_NONCE, MHD_NO, MHD_PANIC, and MHD_YES.
Referenced by MHD_digest_auth_check_digest().
_MHD_EXTERN enum MHD_DigestAuthResult MHD_digest_auth_check_digest3 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | username, | ||
const void * | userdigest, | ||
size_t | userdigest_size, | ||
unsigned int | nonce_timeout, | ||
uint32_t | max_nc, | ||
enum MHD_DigestAuthMultiQOP | mqop, | ||
enum MHD_DigestAuthMultiAlgo3 | malgo3 | ||
) |
Authenticates the authorization header sent by the client by using hash of "username:realm:password".
If RFC2069 mode is allowed by setting bit MHD_DIGEST_AUTH_QOP_NONE in mqop and the client uses this mode, then server generated nonces are used as one-time nonces because nonce-count is not supported in this old RFC. Communication in this mode is very inefficient, especially if the client requests several resources one-by-one as for every request a new nonce must be generated and client repeats all requests twice (first time to get a new nonce and second time to perform an authorised request).
connection | the MHD connection structure |
realm | the realm for authorization of the client |
username | the username to be authenticated, must be in clear text even if userhash is used by the client |
userdigest | the precalculated binary hash of the string "username:realm:password", see MHD_digest_auth_calc_userdigest() |
userdigest_size | the size of the userdigest in bytes, must match the hashing algorithm (see MHD_MD5_DIGEST_SIZE, MHD_SHA256_DIGEST_SIZE, MHD_SHA512_256_DIGEST_SIZE, MHD_digest_get_hash_size()) |
nonce_timeout | the period of seconds since nonce generation, when the nonce is recognised as valid and not stale; if zero is specified then daemon default value is used. |
max_nc | the maximum allowed nc (Nonce Count) value, if client's nc exceeds the specified value then MHD_DAUTH_NONCE_STALE is returned; if zero is specified then daemon default value is used. |
mqop | the QOP to use |
malgo3 | digest algorithms allowed to use, fail if algorithm used by the client is not allowed by this parameter; more than one base algorithms (MD5, SHA-256, SHA-512/256) cannot be used at the same time for this function as userdigest must match specified algorithm |
Authenticates the authorization header sent by the client by using hash of "username:realm:password".
If RFC2069 mode is allowed by setting bit MHD_DIGEST_AUTH_QOP_NONE in mqop and the client uses this mode, then server generated nonces are used as one-time nonces because nonce-count is not supported in this old RFC. Communication in this mode is very inefficient, especially if the client requests several resources one-by-one as for every request a new nonce must be generated and client repeats all requests twice (first time to get a new nonce and second time to perform an authorised request).
connection | the MHD connection structure |
realm | the realm for authorization of the client |
username | the username to be authenticated, must be in clear text even if userhash is used by the client |
userdigest | the precalculated binary hash of the string "username:realm:password", see MHD_digest_auth_calc_userdigest() |
userdigest_size | the size of the userdigest in bytes, must match the hashing algorithm (see MHD_MD5_DIGEST_SIZE, MHD_SHA256_DIGEST_SIZE, MHD_SHA512_256_DIGEST_SIZE, MHD_digest_get_hash_size()) |
nonce_timeout | the period of seconds since nonce generation, when the nonce is recognised as valid and not stale; if zero is specified then daemon default value is used. |
max_nc | the maximum allowed nc (Nonce Count) value, if client's nc exceeds the specified value then MHD_DAUTH_NONCE_STALE is returned; if zero is specified then daemon default value is used. |
mqop | the QOP to use |
malgo3 | digest algorithms allowed to use, fail if algorithm used by the client is not allowed by this parameter; more than one base algorithms (MD5, SHA-256, SHA-512/256) cannot be used at the same time for this function as userdigest must match specified algorithm |
Definition at line 3246 of file digestauth.c.
References _, MHD_Connection::daemon, digest_auth_check_all(), digest_get_hash_size(), MHD_DAUTH_WRONG_ALGO, MHD_DIGEST_BASE_ALGO_MD5, MHD_DIGEST_BASE_ALGO_SHA256, MHD_DIGEST_BASE_ALGO_SHA512_256, MHD_PANIC, and NULL.
Referenced by MHD_digest_auth_check_digest2().
_MHD_EXTERN struct MHD_DigestAuthInfo * MHD_digest_auth_get_request_info3 | ( | struct MHD_Connection * | connection | ) |
Get information about Digest Authorization client's header.
connection | The MHD connection structure |
Get information about Digest Authorization client's header.
connection | The MHD connection structure |
Definition at line 1268 of file digestauth.c.
References MHD_DigestAuthInfo::algo3, MHD_DigestAuthInfo::cnonce_len, get_rq_nc(), get_rq_param_unquoted_copy_z(), get_rq_uname(), get_rq_uname_type(), get_rq_unames_size(), mhd_assert, MHD_calloc_(), MHD_DIGEST_AUTH_INVALID_NC_VALUE, MHD_DIGEST_AUTH_UNAME_TYPE_INVALID, MHD_DIGEST_AUTH_UNAME_TYPE_MISSING, MHD_GET_RQ_NC_VALID, MHD_DigestAuthInfo::nc, NULL, MHD_DigestAuthInfo::opaque, MHD_DigestAuthInfo::opaque_len, MHD_DigestAuthInfo::qop, MHD_DigestAuthInfo::realm, MHD_DigestAuthInfo::realm_len, and MHD_DigestAuthInfo::uname_type.
_MHD_EXTERN char * MHD_digest_auth_get_username | ( | struct MHD_Connection * | connection | ) |
Get the username from the authorization header sent by the client
This function supports username in standard and extended notations. "userhash" is not supported by this function.
connection | The MHD connection structure |
Definition at line 1414 of file digestauth.c.
References get_rq_uname(), get_rq_uname_type(), get_rq_unames_size(), mhd_assert, MHD_calloc_(), MHD_DIGEST_AUTH_UNAME_TYPE_EXTENDED, MHD_DIGEST_AUTH_UNAME_TYPE_STANDARD, NULL, MHD_DigestAuthUsernameInfo::uname_type, and MHD_DigestAuthUsernameInfo::username.
_MHD_EXTERN struct MHD_DigestAuthUsernameInfo * MHD_digest_auth_get_username3 | ( | struct MHD_Connection * | connection | ) |
Get the username from Digest Authorization client's header.
connection | The MHD connection structure |
Get the username from Digest Authorization client's header.
connection | The MHD connection structure |
Definition at line 1356 of file digestauth.c.
References MHD_DigestAuthUsernameInfo::algo3, get_rq_uname(), get_rq_uname_type(), get_rq_unames_size(), mhd_assert, MHD_calloc_(), MHD_DIGEST_AUTH_UNAME_TYPE_INVALID, MHD_DIGEST_AUTH_UNAME_TYPE_MISSING, NULL, and MHD_DigestAuthUsernameInfo::uname_type.
_MHD_EXTERN size_t MHD_digest_get_hash_size | ( | enum MHD_DigestAuthAlgo3 | algo3 | ) |
Get digest size for specified algorithm.
The size of the digest specifies the size of the userhash, userdigest and other parameters which size depends on used hash algorithm.
algo3 | the algorithm to check |
Definition at line 295 of file digestauth.c.
References digest_get_hash_size().
_MHD_EXTERN enum MHD_Result MHD_queue_auth_fail_response | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | opaque, | ||
struct MHD_Response * | response, | ||
int | signal_stale | ||
) |
Queues a response to request authentication from the client. For now uses MD5 (for backwards-compatibility). Still, if you need to be sure, use MHD_queue_auth_fail_response2().
This function modifies provided response. The response must not be reused and should be destroyed after call of this function.
connection | The MHD connection structure |
realm | the realm presented to the client |
opaque | string to user for opaque value |
response | reply to send; should contain the "access denied" body; note that this function will set the "WWW Authenticate" header and that the caller should not do this; the NULL is tolerated |
signal_stale | MHD_YES if the nonce is stale to add 'stale=true' to the authentication header |
Queues a response to request authentication from the client. For now uses MD5 (for backwards-compatibility). Still, if you need to be sure, use MHD_queue_auth_fail_response2().
connection | The MHD connection structure |
realm | the realm presented to the client |
opaque | string to user for opaque value |
response | reply to send; should contain the "access denied" body; note that this function will set the "WWW Authenticate" header and that the caller should not do this; the NULL is tolerated |
signal_stale | MHD_YES if the nonce is stale to add 'stale=true' to the authentication header |
Definition at line 4066 of file digestauth.c.
References MHD_DIGEST_ALG_MD5, and MHD_queue_auth_fail_response2().
_MHD_EXTERN enum MHD_Result MHD_queue_auth_fail_response2 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | opaque, | ||
struct MHD_Response * | response, | ||
int | signal_stale, | ||
enum MHD_DigestAuthAlgorithm | algo | ||
) |
Queues a response to request authentication from the client
This function modifies provided response. The response must not be reused and should be destroyed after call of this function.
connection | The MHD connection structure |
realm | the realm presented to the client |
opaque | string to user for opaque value |
response | reply to send; should contain the "access denied" body; note that this function will set the "WWW Authenticate" header and that the caller should not do this; the NULL is tolerated |
signal_stale | MHD_YES if the nonce is stale to add 'stale=true' to the authentication header |
algo | digest algorithm to use |
Queues a response to request authentication from the client
connection | The MHD connection structure |
realm | the realm presented to the client |
opaque | string to user for opaque value |
response | reply to send; should contain the "access denied" body; note that this function will set the "WWW Authenticate" header and that the caller should not do this; the NULL is tolerated |
signal_stale | MHD_YES if the nonce is stale to add 'stale=true' to the authentication header |
algo | digest algorithm to use |
Definition at line 4022 of file digestauth.c.
References _, MHD_DIGEST_ALG_AUTO, MHD_DIGEST_ALG_MD5, MHD_DIGEST_ALG_SHA256, MHD_DIGEST_AUTH_MULT_ALGO3_ANY_NON_SESSION, MHD_DIGEST_AUTH_MULT_ALGO3_MD5, MHD_DIGEST_AUTH_MULT_ALGO3_SHA256, MHD_DIGEST_AUTH_MULT_QOP_AUTH, MHD_PANIC, MHD_queue_auth_required_response3(), and NULL.
Referenced by MHD_queue_auth_fail_response().
_MHD_EXTERN enum MHD_Result MHD_queue_auth_required_response3 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
const char * | opaque, | ||
const char * | domain, | ||
struct MHD_Response * | response, | ||
int | signal_stale, | ||
enum MHD_DigestAuthMultiQOP | mqop, | ||
enum MHD_DigestAuthMultiAlgo3 | malgo3, | ||
int | userhash_support, | ||
int | prefer_utf8 | ||
) |
Queues a response to request authentication from the client
This function modifies provided response. The response must not be reused and should be destroyed (by MHD_destroy_response()) after call of this function.
If mqop allows both RFC 2069 (MHD_DIGEST_AUTH_QOP_NONE) and QOP with value, then response is formed like if MHD_DIGEST_AUTH_QOP_NONE bit was not set, because such response should be backward-compatible with RFC 2069.
If mqop allows only MHD_DIGEST_AUTH_MULT_QOP_NONE, then the response is formed in strict accordance with RFC 2069 (no 'qop', no 'userhash', no 'charset'). For better compatibility with clients, it is recommended (but not required) to set domain to NULL in this mode.
connection | the MHD connection structure |
realm | the realm presented to the client |
opaque | the string for opaque value, can be NULL, but NULL is not recommended for better compatibility with clients; the recommended format is hex or Base64 encoded string |
domain | the optional space-separated list of URIs for which the same authorisation could be used, URIs can be in form "path-absolute" (the path for the same host with initial slash) or in form "absolute-URI" (the full path with protocol), in any case client may assume that URI is in the same "protection space" if it starts with any of values specified here; could be NULL (clients typically assume that the same credentials could be used for any URI on the same host); this list provides information for the client only and does not actually restrict anything on the server side |
response | the reply to send; should contain the "access denied" body; note: this function sets the "WWW Authenticate" header and the caller should not set this header; the NULL is tolerated |
signal_stale | if set to MHD_YES then indication of stale nonce used in the client's request is signalled by adding 'stale=true' to the authentication header, this instructs the client to retry immediately with the new nonce and the same credentials, without asking user for the new password |
mqop | the QOP to use |
malgo3 | digest algorithm to use; if several algorithms are allowed then MD5 is preferred (currently, may be changed in next versions) |
userhash_support | if set to non-zero value (MHD_YES) then support of userhash is indicated, allowing client to provide hash("username:realm") instead of the username in clear text; note that clients are allowed to provide the username in cleartext even if this parameter set to non-zero; when userhash is used, application must be ready to identify users by provided userhash value instead of username; see MHD_digest_auth_calc_userhash() and MHD_digest_auth_calc_userhash_hex() |
prefer_utf8 | if not set to MHD_NO, parameter 'charset=UTF-8' is added, indicating for the client that UTF-8 encoding for the username is preferred |
Definition at line 3969 of file digestauth.c.
References digest_deinit, digest_setup_zero, NULL, and queue_auth_required_response3_inner().
Referenced by MHD_queue_auth_fail_response2().
_MHD_EXTERN enum MHD_Result MHD_queue_basic_auth_fail_response | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
struct MHD_Response * | response | ||
) |
Queues a response to request basic authentication from the client The given response object is expected to include the payload for the response; the "WWW-Authenticate" header will be added and the response queued with the 'UNAUTHORIZED' status code.
connection | The MHD connection structure |
realm | the realm presented to the client |
response | response object to modify and queue; the NULL is tolerated |
Queues a response to request basic authentication from the client The given response object is expected to include the payload for the response; the "WWW-Authenticate" header will be added and the response queued with the 'UNAUTHORIZED' status code.
connection | The MHD connection structure |
realm | the realm presented to the client |
response | response object to modify and queue; the NULL is tolerated |
Definition at line 313 of file basicauth.c.
References MHD_NO, and MHD_queue_basic_auth_required_response3().
_MHD_EXTERN enum MHD_Result MHD_queue_basic_auth_required_response3 | ( | struct MHD_Connection * | connection, |
const char * | realm, | ||
int | prefer_utf8, | ||
struct MHD_Response * | response | ||
) |
Queues a response to request basic authentication from the client.
The given response object is expected to include the payload for the response; the "WWW-Authenticate" header will be added and the response queued with the 'UNAUTHORIZED' status code.
See RFC 7617#section-2 for details.
The response is modified by this function. The modified response object can be used to respond subsequent requests by MHD_queue_response() function with status code MHD_HTTP_UNAUTHORIZED and must not be used again with MHD_queue_basic_auth_required_response3() function. The response could be destroyed right after call of this function.
connection | the MHD connection structure |
realm | the realm presented to the client |
prefer_utf8 | if not set to MHD_NO, parameter'charset="UTF-8"' will be added, indicating for client that UTF-8 encoding is preferred |
response | the response object to modify and queue; the NULL is tolerated |
Definition at line 223 of file basicauth.c.
References _, MHD_Connection::daemon, MHD_add_response_header(), mhd_assert, MHD_HTTP_HEADER_WWW_AUTHENTICATE, MHD_HTTP_UNAUTHORIZED, MHD_NO, MHD_queue_response(), MHD_STATICSTR_LEN_, and NULL.
Referenced by MHD_queue_basic_auth_fail_response().
|
static |
Internal version of MHD_queue_auth_required_response3() to simplify cleanups.
connection | the MHD connection structure |
realm | the realm presented to the client |
opaque | the string for opaque value, can be NULL, but NULL is not recommended for better compatibility with clients; the recommended format is hex or Base64 encoded string |
domain | the optional space-separated list of URIs for which the same authorisation could be used, URIs can be in form "path-absolute" (the path for the same host with initial slash) or in form "absolute-URI" (the full path with protocol), in any case client may assume that URI is in the same "protection space" if it starts with any of values specified here; could be NULL (clients typically assume that the same credentials could be used for any URI on the same host) |
response | the reply to send; should contain the "access denied" body; note that this function sets the "WWW Authenticate" header and that the caller should not do this; the NULL is tolerated |
signal_stale | set to MHD_YES if the nonce is stale to add 'stale=true' to the authentication header, this instructs the client to retry immediately with the new nonce and the same credentials, without asking user for the new password |
mqop | the QOP to use |
malgo3 | digest algorithm to use, MHD selects; if several algorithms are allowed then MD5 is preferred (currently, may be changed in next versions) |
userhash_support | if set to non-zero value (MHD_YES) then support of userhash is indicated, the client may provide hash("username:realm") instead of username in clear text; note that clients are allowed to provide the username in cleartext even if this parameter set to non-zero; when userhash is used, application must be ready to identify users by provided userhash value instead of username; see MHD_digest_auth_calc_userhash() and MHD_digest_auth_calc_userhash_hex() |
prefer_utf8 | if not set to MHD_NO, parameter 'charset=UTF-8' is added, indicating for the client that UTF-8 encoding is preferred |
prefer_utf8 | if not set to MHD_NO, parameter 'charset=UTF-8' is added, indicating for the client that UTF-8 encoding is preferred |
< Selected algorithm
Definition at line 3509 of file digestauth.c.
References _, _MHD_AUTH_DIGEST_BASE, _MHD_AUTH_DIGEST_MAX_PARAM_SIZE, _MHD_MD5_TOKEN, _MHD_SHA256_TOKEN, _MHD_SHA512_256_TOKEN, calculate_add_nonce_with_retry(), MHD_Connection::daemon, digest_ext_error, digest_get_size(), digest_init_one_time(), get_base_digest_algo(), MHD_add_response_entry_no_alloc_(), mhd_assert, MHD_DIGEST_AUTH_ALGO3_MD5, MHD_DIGEST_AUTH_ALGO3_NON_SESSION, MHD_DIGEST_AUTH_ALGO3_SHA256, MHD_DIGEST_AUTH_ALGO3_SHA512_256, MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT, MHD_DIGEST_AUTH_MULT_QOP_NONE, MHD_DIGEST_AUTH_QOP_AUTH_INT, MHD_DIGEST_BASE_ALGO_MD5, MHD_DIGEST_BASE_ALGO_SHA256, MHD_DIGEST_BASE_ALGO_SHA512_256, MHD_get_master(), MHD_HEADER_KIND, MHD_HTTP_HEADER_WWW_AUTHENTICATE, MHD_HTTP_UNAUTHORIZED, MHD_NO, MHD_PANIC, MHD_queue_response(), MHD_STATICSTR_LEN_, MHD_TOKEN_AUTH_, NONCE_STD_LEN, and NULL.
Referenced by MHD_queue_auth_required_response3().