Mercurial > ecos

comparison packages/net/athttpd/current/src/auth.c @ 2250:0830ae6acddc

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add ATHTTPD server from Anthony Tonizzo.
author jlarmour
date Tue, 18 Jul 2006 16:37:23 +0000
parents
children b5670f3c40f2
comparison
equal deleted inserted replaced
2249:6778c16dcfcd 2250:0830ae6acddc
1 /* =================================================================
2 *
3 * auth.c
4 *
5 * Handles basic authentication.
6 *
7 * =================================================================
8 * ####ECOSGPLCOPYRIGHTBEGIN####
9 * -------------------------------------------
10 * This file is part of eCos, the Embedded Configurable Operating
11 * System.
12 * Copyright (C) 2005 eCosCentric Ltd.
13 *
14 * eCos is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 or (at your option)
17 * any later version.
18 *
19 * eCos is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
22 * General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with eCos; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
27 *
28 * As a special exception, if other files instantiate templates or
29 * use macros or inline functions from this file, or you compile this
30 * file and link it with other works to produce a work based on this
31 * file, this file does not by itself cause the resulting work to be
32 * covered by the GNU General Public License. However the source code
33 * for this file must still be made available in accordance with
34 * section (3) of the GNU General Public License.
35 *
36 * This exception does not invalidate any other reasons why a work
37 * based on this file might be covered by the GNU General Public
38 * License.
39 *
40 * -------------------------------------------
41 * ####ECOSGPLCOPYRIGHTEND####
42 * =================================================================
43 * #####DESCRIPTIONBEGIN####
44 *
45 * Author(s): Anthony Tonizzo (atonizzo@gmail.com)
46 * Contributors:
47 * Date: 2006-06-12
48 * Purpose:
49 * Description:
50 *
51 * ####DESCRIPTIONEND####
52 *
53 * =================================================================
54 */
55 #include <pkgconf/hal.h>
56 #include <pkgconf/kernel.h>
57 #include <cyg/kernel/kapi.h> // Kernel API.
58 #include <cyg/hal/hal_tables.h>
59
60 #include <stdio.h>
61
62 #include <network.h>
63 #include <string.h>
64
65 #include <cyg/athttpd/http.h>
66 #include <cyg/athttpd/md5.h>
67
68 // This is the domain that is currently authorized.
69 cyg_uint8 *cyg_httpd_current_authName;
70
71 CYG_HAL_TABLE_BEGIN(cyg_httpd_auth_table, httpd_auth_table );
72 CYG_HAL_TABLE_END(cyg_httpd_auth_table_end, httpd_auth_table );
73
74 __externC cyg_httpd_auth_table_entry cyg_httpd_auth_table[];
75 __externC cyg_httpd_auth_table_entry cyg_httpd_auth_table_end[];
76
77 // Variables used for authorization.
78 char cyg_httpd_md5_nonce[33];
79 char cyg_httpd_md5_digest[33];
80 char cyg_httpd_md5_response[33];
81 char cyg_httpd_md5_cnonce[33];
82 char cyg_httpd_md5_noncecount[9];
83 char cyg_httpd_md5_ha2[HASHHEXLEN+1] = {'\0'};
84 char cyg_httpd_md5_ha1[HASHHEXLEN+1];
85
86 char b64string[] =
87 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
88
89 cyg_httpd_auth_table_entry*
90 cyg_httpd_auth_entry_from_path(char *authPath)
91 {
92 cyg_httpd_auth_table_entry *entry = cyg_httpd_auth_table;
93 if (strcmp(authPath, "/") != 0)
94 while (entry != cyg_httpd_auth_table_end)
95 {
96 if (strncmp(entry->auth_dirname,
97 authPath,
98 strlen(entry->auth_dirname)) == 0)
99 return entry;
100 entry++;
101 }
102 else
103 while (entry != cyg_httpd_auth_table_end)
104 {
105 if (strcmp(entry->auth_dirname, authPath) == 0)
106 return entry;
107 entry++;
108 }
109
110 return (cyg_httpd_auth_table_entry *)0;
111 }
112
113 cyg_httpd_auth_table_entry*
114 cyg_httpd_auth_entry_from_domain(char *authDomain)
115 {
116 cyg_httpd_auth_table_entry *entry = cyg_httpd_auth_table;
117 while (entry != cyg_httpd_auth_table_end)
118 {
119 if (!strncmp((const char*)authDomain,
120 entry->auth_domainname,
121 strlen(entry->auth_domainname)))
122 return entry;
123 entry++;
124 }
125
126 return (cyg_httpd_auth_table_entry *)0;
127 }
128
129 cyg_int32
130 cyg_httpd_base64_encode(char* to, char* from, cyg_uint32 len )
131 {
132 char *fromp = from;
133 char *top = to;
134 char cbyte;
135 char obyte;
136 cyg_int8 end[3];
137
138 for (; len >= 3; len -= 3)
139 {
140 cbyte = *fromp++;
141 *top++ = b64string[(int)(cbyte >> 2)];
142 obyte = (cbyte << 4) & 0x30;
143
144 cbyte = *fromp++;
145 obyte |= (cbyte >> 4);
146 *top++ = b64string[(cyg_int32)obyte];
147 obyte = (cbyte << 2) & 0x3C;
148
149 cbyte = *fromp++;
150 obyte |= (cbyte >> 6);
151 *top++ = b64string[(cyg_int32)obyte];
152 *top++ = b64string[(cyg_int32)(cbyte & 0x3F)];
153 }
154
155 if (len)
156 {
157 end[0] = *fromp++;
158 if (--len )
159 end[1] = *fromp++;
160 else
161 end[1] = 0;
162 end[2] = 0;
163
164 cbyte = end[0];
165 *top++ = b64string[(cyg_int32)(cbyte >> 2)];
166 obyte = (cbyte << 4) & 0x30;
167
168 cbyte = end[1];
169 obyte |= (cbyte >> 4);
170 *top++ = b64string[(cyg_int32)obyte];
171 obyte = (cbyte << 2) & 0x3C;
172
173 if (len )
174 *top++ = b64string[(cyg_int32)obyte];
175 else
176 *top++ = '=';
177 *top++ = '=';
178 }
179 *top = 0;
180 return top - to;
181 }
182
183 cyg_int32
184 cyg_httpd_base64_decode(char* to, char* from, cyg_uint32 len )
185 {
186 char *fromp = from;
187 char *top = to;
188 char *p;
189 char cbyte;
190 char obyte;
191 cyg_int32 padding = 0;
192
193 for (; len >= 4; len -= 4)
194 {
195 if ((cbyte = *fromp++) == '=')
196 cbyte = 0;
197 else
198 {
199 if (badchar(cbyte, p ) )
200 return -1;
201 cbyte = (p - b64string);
202 }
203 obyte = cbyte << 2;
204
205 if ((cbyte = *fromp++) == '=')
206 cbyte = 0;
207 else
208 {
209 if (badchar(cbyte, p))
210 return -1;
211 cbyte = p - b64string;
212 }
213 obyte |= cbyte >> 4;
214 *top++ = obyte;
215
216 obyte = cbyte << 4;
217 if ((cbyte = *fromp++) == '=')
218 {
219 cbyte = 0;
220 padding++;
221 }
222 else
223 {
224 padding = 0;
225 if (badchar(cbyte, p))
226 return -1;
227 cbyte = p - b64string;
228 }
229 obyte |= cbyte >> 2;
230 *top++ = obyte;
231
232 obyte = cbyte << 6;
233 if ((cbyte = *fromp++) == '=')
234 {
235 cbyte = 0;
236 padding++;
237 }
238 else
239 {
240 padding = 0;
241 if (badchar(cbyte, p))
242 return -1;
243 cbyte = p - b64string;
244 }
245 obyte |= cbyte;
246 *top++ = obyte;
247 }
248
249 *top = 0;
250 if (len)
251 return -1;
252 return (top - to) - padding;
253 }
254
255 cyg_httpd_auth_table_entry*
256 cyg_httpd_verify_auth(char* username, char* password)
257 {
258 if ((strcmp(httpstate.needs_auth->auth_username, username) == 0) &&
259 (strcmp(httpstate.needs_auth->auth_password, password) == 0))
260 return httpstate.needs_auth;
261 else
262 return (cyg_httpd_auth_table_entry*)0;
263 }
264
265 // The following code is a slightly modified version of those available at the
266 // end of RFC1270.
267 void cyg_httpd_cvthex(HASH Bin, HASHHEX Hex)
268 {
269 unsigned short i;
270 unsigned char j;
271
272 for (i = 0; i < HASHLEN; i++)
273 {
274 j = (Bin[i] >> 4) & 0xf;
275 if (j <= 9)
276 Hex[i*2] = (j + '0');
277 else
278 Hex[i*2] = (j + 'a' - 10);
279 j = Bin[i] & 0xf;
280 if (j <= 9)
281 Hex[i*2+1] = (j + '0');
282 else
283 Hex[i*2+1] = (j + 'a' - 10);
284 };
285 Hex[HASHHEXLEN] = '\0';
286 };
287
288 // Calculate H(A1) as per spec.
289 void
290 cyg_httpd_digest_calc_HA1( char *pszAlg,
291 char *pszUserName,
292 char *pszRealm,
293 char *pszPassword,
294 char *pszNonce,
295 char *pszCNonce,
296 HASHHEX SessionKey )
297 {
298 MD5_CTX Md5Ctx;
299 HASH HA1;
300
301 MD5Init(&Md5Ctx);
302 MD5Update(&Md5Ctx, (unsigned char*)pszUserName, strlen(pszUserName));
303 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
304 MD5Update(&Md5Ctx, (unsigned char*)pszRealm, strlen(pszRealm));
305 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
306 MD5Update(&Md5Ctx, (unsigned char*)pszPassword, strlen(pszPassword));
307 MD5Final((unsigned char*)HA1, &Md5Ctx);
308 if (strcmp(pszAlg, "md5-sess") == 0)
309 {
310 MD5Init(&Md5Ctx);
311 MD5Update(&Md5Ctx, (unsigned char*)HA1, HASHLEN);
312 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
313 MD5Update(&Md5Ctx, (unsigned char*)pszNonce, strlen(pszNonce));
314 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
315 MD5Update(&Md5Ctx, (unsigned char*)pszCNonce, strlen(pszCNonce));
316 MD5Final((unsigned char*)HA1, &Md5Ctx);
317 };
318 cyg_httpd_cvthex(HA1, SessionKey);
319 };
320
321 // Calculate request-digest/response-digest as per HTTP Digest spec.
322 void
323 cyg_httpd_digest_calc_response(HASHHEX HA1,
324 char *pszNonce,
325 char *pszNonceCount,
326 char *pszCNonce,
327 char *pszQop,
328 char *pszMethod,
329 char *pszDigestUri,
330 HASHHEX HEntity,
331 HASHHEX Response)
332 {
333 MD5_CTX Md5Ctx;
334 HASH HA2;
335 HASH RespHash;
336 HASHHEX HA2Hex;
337
338 // Calculate H(A2).
339 MD5Init(&Md5Ctx);
340 MD5Update(&Md5Ctx, (unsigned char*)pszMethod, strlen(pszMethod));
341 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
342 MD5Update(&Md5Ctx, (unsigned char*)pszDigestUri, strlen(pszDigestUri));
343 if (strcmp(pszQop, "auth-int") == 0) {
344 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
345 MD5Update(&Md5Ctx, (unsigned char*)HEntity, HASHHEXLEN);
346 };
347 MD5Final((unsigned char*)HA2, &Md5Ctx);
348 cyg_httpd_cvthex(HA2, HA2Hex);
349
350 // calculate response
351 MD5Init(&Md5Ctx);
352 MD5Update(&Md5Ctx, (unsigned char*)HA1, HASHHEXLEN);
353 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
354 MD5Update(&Md5Ctx, (unsigned char*)pszNonce, strlen(pszNonce));
355 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
356 if (*pszQop)
357 {
358 MD5Update(&Md5Ctx, (unsigned char*)pszNonceCount, strlen(pszNonceCount));
359 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
360 MD5Update(&Md5Ctx, (unsigned char*)pszCNonce, strlen(pszCNonce));
361 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
362 MD5Update(&Md5Ctx, (unsigned char*)pszQop, strlen(pszQop));
363 MD5Update(&Md5Ctx, (unsigned char*)":", 1);
364 };
365 MD5Update(&Md5Ctx, (unsigned char*)HA2Hex, HASHHEXLEN);
366 MD5Final((unsigned char*)RespHash, &Md5Ctx);
367 cyg_httpd_cvthex(RespHash, Response);
368 };
369
370 cyg_httpd_auth_table_entry*
371 cyg_httpd_is_authenticated(char* fname)
372 {
373 // Let's check if the directory access needs authorization. The
374 // authentication is done on the directory name.
375 cyg_httpd_auth_table_entry* entry =
376 cyg_httpd_auth_entry_from_path(fname);
377 if (entry != 0)
378 {
379 if (entry->auth_mode == CYG_HTTPD_AUTH_BASIC)
380 {
381 cyg_httpd_base64_decode(cyg_httpd_md5_response,
382 cyg_httpd_md5_digest,
383 strlen(cyg_httpd_md5_digest));
384 char *extension = rindex(cyg_httpd_md5_response, ':');
385 if (extension == NULL)
386 {
387 return (httpstate.needs_auth = entry);
388 }
389 else
390 {
391 *extension = '\0'; // Crypto now has the username.
392
393 // In the case of a 'Basic" authentication, the HTTP header
394 // did not return to us the domain name that we sent when we
395 // challenged the request: The only things that are returned
396 // are the username:password duo. In this case I will just
397 // compare the entry's username/password to those read from
398 // the header.
399 if ((strcmp(entry->auth_username,
400 cyg_httpd_md5_response) != 0) ||
401 (strcmp(entry->auth_password,
402 ++extension) != 0))
403 return (httpstate.needs_auth = entry);
404 }
405 }
406 else
407 {
408 char *cyg_httpd_md5_method;
409
410 switch (httpstate.method)
411 {
412 case CYG_HTTPD_METHOD_GET:
413 cyg_httpd_md5_method = "GET";
414 break;
415 case CYG_HTTPD_METHOD_POST:
416 cyg_httpd_md5_method = "POST";
417 break;
418 default:
419 cyg_httpd_md5_method = "HEAD";
420 break;
421 }
422 cyg_httpd_digest_calc_HA1(CYG_HTTPD_MD5_AUTH_NAME,
423 entry->auth_username,
424 entry->auth_domainname,
425 entry->auth_password,
426 cyg_httpd_md5_nonce,
427 cyg_httpd_md5_cnonce,
428 cyg_httpd_md5_ha1);
429 cyg_httpd_digest_calc_response(cyg_httpd_md5_ha1,
430 cyg_httpd_md5_nonce,
431 cyg_httpd_md5_noncecount,
432 cyg_httpd_md5_cnonce,
433 CYG_HTTPD_MD5_AUTH_QOP,
434 cyg_httpd_md5_method,
435 httpstate.url,
436 cyg_httpd_md5_ha2,
437 cyg_httpd_md5_digest);
438 if (strcmp(cyg_httpd_md5_response, cyg_httpd_md5_digest) != 0)
439 return (httpstate.needs_auth = entry);
440 }
441 }
442 // No need for authentication...
443 return (cyg_httpd_auth_table_entry*)0;
444 }
445
446 char*
447 cyg_httpd_digest_data(char *dest, char *src)
448 {
449 int exit = 0;
450 while (exit == 0)
451 {
452 switch (*src )
453 {
454 case '\r':
455 case '\n':
456 *dest = '\0';
457 exit = 1;
458 break;
459 case ' ':
460 src++;
461 *dest = '\0';
462 exit = 1;
463 break;
464 case '"':
465 case ',':
466 src++;
467 break;
468 default:
469 *dest++ = *src++;
470 }
471 }
472 return src;
473 }
474
475 // Skips through fields we do not need.
476 char*
477 cyg_httpd_digest_skip(char *p)
478 {
479 if (*p == '"')
480 {
481 p++;
482 while ((*p != '"') && (*p != '\n'))
483 p++;
484 p++;
485 if (*p == ',')
486 p++;
487 if (*p == ' ')
488 p++;
489 if (*p == '\n')
490 p++;
491 }
492 else
493 {
494 while ((*p != ' ') && (*p != '\n'))
495 p++;
496 if (*p == ',')
497 p++;
498 if (*p == ' ')
499 p++;
500 if (*p == '\n')
501 p++;
502 }
503 return p;
504 }