mirror/jak-project
1
0
Fork 0
mirror of https://github.com/open-goal/jak-project synced 2026-08-20 14:24:45 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
8565ddfbdd355c178e00fda93ba0672525793012
jak-project/third-party/curl/lib/vauth/digest.c
T
Alexander J. Semenuk 5d5e35fb9b fix: Windows toolchain compatibility (curl 8.21 re-vendor, endless reconfigure loop) (#4355) 
## Problem

Windows builds break with a current local toolchain (Scoop LLVM 22.1.8,
CMake 4.4.0, VS 2026), in two independent ways:

1. The build stops at curl's deliberate guard: `#error "no non-blocking
method was found/used/set"` in `third-party/curl/lib/nonblock.c`.
2. From the second configure onward, `cmake --build` re-runs CMake in an
endless loop (observed 42 consecutive reconfigure cycles in a single
build). Likely the same mechanism behind the "endlessly building" VS
2026 note in `docs/setup/dev/vs.md`.

## Root cause

1. `third-party/curl/CMake/CurlTests.c` passes `int *` to
`ioctlsocket()`, whose third parameter is `u_long *`. Clang 22 promotes
`-Wincompatible-pointer-types` to a hard error in C, so the
`HAVE_IOCTLSOCKET_FIONBIO` try_compile silently fails and
`curl_config.h` never defines it. Upstream CI does not see this because
the windows-2022 runner image ships an older LLVM. GCC 14 promotes the
same warning to a hard error, which is very likely the `CurlTests.c.obj`
failure reported from MSYS2 in open-goal/jak-project#3551. Upstream curl
hit the identical problem with GCC 14 and fixed the probe in curl 8.8.0
(curl/curl#13578).
2. The root CMakeLists copies the build tree's `compile_commands.json`
into `<src>/build/` for clangd using `configure_file()`, which registers
its input as a configure dependency. CMake rewrites
`compile_commands.json` late in every generation, after
`CTestTestfile.cmake` and `cmake_install.cmake` (outputs of the same
Ninja regen rule), so once the dependency is registered the rule is
deterministically dirty and every `ninja` invocation re-runs CMake. A
pristine first configure is safe (the file does not exist yet, so the
`if(EXISTS ...)` guard skips the copy), which is why the loop looks
machine- or IDE-specific.

## Fix

1. Per review, re-vendor `third-party/curl` at the `curl-8_21_0` tag
(previously `curl-8_3_0`), which carries the upstream probe fix plus two
years of upstream development; `vendor.yaml` updated to match.
Adjustments the version jump forced:
- curl 8.15 removed the native macOS Secure Transport backend
(`CURL_USE_SECTRANSP`), so macOS now builds curl against OpenSSL like
Linux. The two macOS workflows install Homebrew `openssl@3` and export
`OPENSSL_ROOT_DIR` (keg-only), and the macOS setup docs gained the same
two lines.
- `CURL_BROTLI` / `CURL_ZSTD` switched to AUTO-detection in curl 8.10;
pinned OFF to keep the previous no-compression behavior and avoid
silently linking whatever the CI images happen to have.
- curl's new top-level `BUILD_EXAMPLES` cache option (default ON) leaked
into discord-rpc's identically named option and broke configure at a
nonexistent `examples/send-presence` directory; pinned OFF ahead of the
third-party subdirectories.

The diff is dominated by the mechanical tag-tree swap under
`third-party/curl` (linguist-vendored, collapsed in review). The
hand-written changes are `CMakeLists.txt`, the two macOS workflows,
`docs/setup/system/macos.md`, and `vendor.yaml`.
2. Swap `configure_file()` for `file(COPY ...)`: the same clangd copy
with no configure dependency registered. (`file(COPY_FILE ...
ONLY_IF_DIFFERENT)` would be cleaner still but requires CMake 3.21,
above the declared `cmake_minimum_required(VERSION 3.10)`.)

## Test plan

- [x] Fresh `cmake --preset Release-windows-clang` (LLVM 22, no cache
seeding) completes and logs `Enabled SSL backends: Schannel`; the
FIONBIO probe passes without the previous `#error`
- [x] Full Windows Release build from scratch in the branch worktree
(all 1422 targets)
- [x] goalc-test suite: 1509 passed, 0 failed
- [x] Second consecutive configure with `compile_commands.json` present:
the regen rule in `build.ninja` has no `compile_commands.json` input;
`<src>/build/compile_commands.json` is still refreshed for clangd
- [x] Repeated `ninja` invocations after a full build no longer re-run
CMake
- [x] macOS Intel and ARM CI green (first exercise of the OpenSSL
backend switch)

---

I work off a self-hosted forge, so this GitHub account is quiet; the
configure logs and ninja dirty-node traces from the investigation are
available if anyone wants the raw data.

(AI-assisted)
2026-07-27 19:19:18 -04:00

1060 lines
32 KiB
C
Vendored
Generated
Raw Blame History

/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
* RFC2831 DIGEST-MD5 authentication
* RFC7616 DIGEST-SHA256, DIGEST-SHA512-256 authentication
*
***************************************************************************/
#include "curl_setup.h"
#ifndef CURL_DISABLE_DIGEST_AUTH
#include "vauth/vauth.h"
#include "vauth/digest.h"
#include "curlx/base64.h"
#include "curl_md5.h"
#include "curl_sha256.h"
#include "curl_sha512_256.h"
#include "curlx/strparse.h"
#include "rand.h"
#include "escape.h"
#ifndef USE_WINDOWS_SSPI
#define SESSION_ALGO 1 /* for algos with this bit set */
#define ALGO_MD5 0
#define ALGO_MD5SESS (ALGO_MD5 | SESSION_ALGO)
#define ALGO_SHA256 2
#define ALGO_SHA256SESS (ALGO_SHA256 | SESSION_ALGO)
#define ALGO_SHA512_256 4
#define ALGO_SHA512_256SESS (ALGO_SHA512_256 | SESSION_ALGO)
#define DIGEST_QOP_VALUE_AUTH (1 << 0)
#define DIGEST_QOP_VALUE_AUTH_INT (1 << 1)
#define DIGEST_QOP_VALUE_AUTH_CONF (1 << 2)
#define DIGEST_QOP_VALUE_STRING_AUTH "auth"
#define DIGEST_QOP_VALUE_STRING_AUTH_INT "auth-int"
#define DIGEST_QOP_VALUE_STRING_AUTH_CONF "auth-conf"
#endif
bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
const char **endptr)
{
int c;
bool starts_with_quote = FALSE;
bool escape = FALSE;
for(c = DIGEST_MAX_VALUE_LENGTH - 1; (*str && (*str != '=') && c--);)
*value++ = *str++;
*value = 0;
if('=' != *str++)
/* eek, no match */
return FALSE;
if('\"' == *str) {
/* This starts with a quote so it must end with one as well! */
str++;
starts_with_quote = TRUE;
}
for(c = DIGEST_MAX_CONTENT_LENGTH - 1; *str && c--; str++) {
if(!escape) {
switch(*str) {
case '\\':
if(starts_with_quote) {
/* the start of an escaped quote */
escape = TRUE;
continue;
}
break;
case ',':
if(!starts_with_quote) {
/* This signals the end of the content if we did not get a starting
quote and then we do "sloppy" parsing */
c = 0; /* the end */
continue;
}
break;
case '\r':
case '\n':
/* end of string */
if(starts_with_quote)
return FALSE; /* No closing quote */
c = 0;
continue;
case '\"':
if(starts_with_quote) {
/* end of string */
c = 0;
continue;
}
else
return FALSE;
}
}
escape = FALSE;
*content++ = *str;
}
if(escape)
return FALSE; /* No character after backslash */
*content = 0;
*endptr = str;
return TRUE;
}
#ifndef USE_WINDOWS_SSPI
/* Convert MD5 chunk to RFC2617 (section 3.1.3) -suitable ASCII string */
static void auth_digest_md5_to_ascii(
const unsigned char *source, /* 16 bytes */
unsigned char *dest) /* 33 bytes */
{
int i;
for(i = 0; i < 16; i++)
curl_msnprintf((char *)&dest[i * 2], 3, "%02x", source[i]);
}
/* Convert sha256 or SHA-512/256 chunk to RFC7616 -suitable ASCII string */
static void auth_digest_sha256_to_ascii(
const unsigned char *source, /* 32 bytes */
unsigned char *dest) /* 65 bytes */
{
int i;
for(i = 0; i < 32; i++)
curl_msnprintf((char *)&dest[i * 2], 3, "%02x", source[i]);
}
/* Perform quoted-string escaping as described in RFC2616 and its errata */
static char *auth_digest_string_quoted(const char *s)
{
struct dynbuf out;
curlx_dyn_init(&out, 2048);
if(!*s) /* for zero length input, make sure we return an empty string */
return curlx_strdup("");
while(*s) {
CURLcode result;
if(*s == '"' || *s == '\\') {
result = curlx_dyn_addn(&out, "\\", 1);
if(!result)
result = curlx_dyn_addn(&out, s, 1);
}
else if((*s < ' ') || (*s > 0x7e)) {
unsigned char buf[3] = { '%' };
Curl_hexbyte(&buf[1], (unsigned char)*s);
result = curlx_dyn_addn(&out, buf, 3);
}
else
result = curlx_dyn_addn(&out, s, 1);
if(result)
return NULL;
s++;
}
return curlx_dyn_ptr(&out);
}
/* Retrieves the value for a corresponding key from the challenge string
* returns TRUE if the key could be found, FALSE if it does not exists
*/
static bool auth_digest_get_key_value(const char *chlg, const char *key,
char *buf, size_t buflen)
{
/* keyword=[value],keyword2=[value]
The values may or may not be quoted.
*/
do {
struct Curl_str data;
struct Curl_str name;
curlx_str_passblanks(&chlg);
if(!curlx_str_until(&chlg, &name, 64, '=') &&
!curlx_str_single(&chlg, '=')) {
/* this is the key, get the value, possibly quoted */
int rc = curlx_str_quotedword(&chlg, &data, 256);
if(rc == STRE_BEGQUOTE)
/* try unquoted until comma */
rc = curlx_str_until(&chlg, &data, 256, ',');
if(rc)
return FALSE; /* weird */
if(curlx_str_cmp(&name, key)) {
/* if this is our key, return the value */
size_t len = curlx_strlen(&data);
const char *src = curlx_str(&data);
size_t i;
size_t outlen = 0;
if(len >= buflen)
/* does not fit */
return FALSE;
for(i = 0; i < len; i++) {
if(src[i] == '\\' && i + 1 < len) {
i++; /* skip backslash */
}
buf[outlen++] = src[i];
}
buf[outlen] = 0;
return TRUE;
}
if(curlx_str_single(&chlg, ','))
return FALSE;
}
else /* odd syntax */
break;
} while(1);
return FALSE;
}
static void auth_digest_get_qop_values(const char *options, int *value)
{
struct Curl_str out;
/* Initialize the output */
*value = 0;
while(!curlx_str_until(&options, &out, 32, ',')) {
if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH))
*value |= DIGEST_QOP_VALUE_AUTH;
else if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH_INT))
*value |= DIGEST_QOP_VALUE_AUTH_INT;
else if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH_CONF))
*value |= DIGEST_QOP_VALUE_AUTH_CONF;
if(curlx_str_single(&options, ','))
break;
}
}
/*
* auth_decode_digest_md5_message()
*
* This is used internally to decode an already encoded DIGEST-MD5 challenge
* message into the separate attributes.
*
* Parameters:
*
* chlgref [in] - The challenge message.
* nonce [in/out] - The buffer where the nonce is stored.
* nlen [in] - The length of the nonce buffer.
* realm [in/out] - The buffer where the realm is stored.
* rlen [in] - The length of the realm buffer.
* alg [in/out] - The buffer where the algorithm is stored.
* alen [in] - The length of the algorithm buffer.
* qop [in/out] - The buffer where the qop-options is stored.
* qlen [in] - The length of the qop buffer.
*
* Returns CURLE_OK on success.
*/
static CURLcode auth_decode_digest_md5_message(const struct bufref *chlgref,
char *nonce, size_t nlen,
char *realm, size_t rlen,
char *alg, size_t alen,
char *qop, size_t qlen)
{
const char *chlg = Curl_bufref_ptr(chlgref);
/* Ensure we have a valid challenge message */
if(!Curl_bufref_len(chlgref))
return CURLE_BAD_CONTENT_ENCODING;
/* Retrieve nonce string from the challenge */
if(!auth_digest_get_key_value(chlg, "nonce", nonce, nlen))
return CURLE_BAD_CONTENT_ENCODING;
/* Retrieve realm string from the challenge */
if(!auth_digest_get_key_value(chlg, "realm", realm, rlen)) {
/* Challenge does not have a realm, set empty string [RFC2831] page 6 */
*realm = '\0';
}
/* Retrieve algorithm string from the challenge */
if(!auth_digest_get_key_value(chlg, "algorithm", alg, alen))
return CURLE_BAD_CONTENT_ENCODING;
/* Retrieve qop-options string from the challenge */
if(!auth_digest_get_key_value(chlg, "qop", qop, qlen))
return CURLE_BAD_CONTENT_ENCODING;
return CURLE_OK;
}
/*
* Curl_auth_is_digest_supported()
*
* This is used to evaluate if DIGEST is supported.
*
* Parameters: None
*
* Returns TRUE as DIGEST as handled by libcurl.
*/
bool Curl_auth_is_digest_supported(void)
{
return TRUE;
}
/*
* Curl_auth_create_digest_md5_message()
*
* This is used to generate an already encoded DIGEST-MD5 response message
* ready for sending to the recipient.
*
* Parameters:
*
* data [in] - The session handle.
* chlg [in] - The challenge message.
* userp [in] - The username.
* passwdp [in] - The user's password.
* service [in] - The service type such as http, smtp, pop or imap.
* out [out] - The result storage.
*
* Returns CURLE_OK on success.
*/
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg,
struct Curl_creds *creds,
const char *default_service,
struct bufref *out)
{
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
size_t i;
struct MD5_context *ctxt;
const char *userp = Curl_creds_user(creds);
const char *passwdp = Curl_creds_passwd(creds);
char *response = NULL;
unsigned char digest[MD5_DIGEST_LEN];
char HA1_hex[(2 * MD5_DIGEST_LEN) + 1];
char HA2_hex[(2 * MD5_DIGEST_LEN) + 1];
char resp_hash_hex[(2 * MD5_DIGEST_LEN) + 1];
char nonce[64];
char realm[128];
char algorithm[64];
char qop_options[64];
int qop_values;
char cnonce[33];
char nonceCount[] = "00000001";
char method[] = "AUTHENTICATE";
char qop[] = DIGEST_QOP_VALUE_STRING_AUTH;
char *spn = NULL;
char *qrealm;
char *qnonce;
char *quserp;
/* Decode the challenge message */
CURLcode result = auth_decode_digest_md5_message(chlg,
nonce, sizeof(nonce),
realm, sizeof(realm),
algorithm,
sizeof(algorithm),
qop_options,
sizeof(qop_options));
if(result)
return result;
/* We only support md5 sessions */
if(strcmp(algorithm, "md5-sess"))
return CURLE_BAD_CONTENT_ENCODING;
/* Get the qop-values from the qop-options */
auth_digest_get_qop_values(qop_options, &qop_values);
/* We only support auth quality-of-protection */
if(!(qop_values & DIGEST_QOP_VALUE_AUTH))
return CURLE_BAD_CONTENT_ENCODING;
/* Generate 32 random hex chars, 32 bytes + 1 null-termination */
result = Curl_rand_hex(data, (unsigned char *)cnonce, sizeof(cnonce));
if(result)
return result;
/* Good so far, now calculate A1 and H(A1) according to RFC 2831 */
ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
if(!ctxt)
return CURLE_OUT_OF_MEMORY;
Curl_MD5_update(ctxt, (const unsigned char *)userp,
curlx_uztoui(strlen(userp)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)realm,
curlx_uztoui(strlen(realm)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)passwdp,
curlx_uztoui(strlen(passwdp)));
Curl_MD5_final(ctxt, digest);
ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
if(!ctxt)
return CURLE_OUT_OF_MEMORY;
Curl_MD5_update(ctxt, (const unsigned char *)digest, MD5_DIGEST_LEN);
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)nonce,
curlx_uztoui(strlen(nonce)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)cnonce,
curlx_uztoui(strlen(cnonce)));
Curl_MD5_final(ctxt, digest);
/* Convert calculated 16 octet hex into 32 bytes string */
for(i = 0; i < MD5_DIGEST_LEN; i++)
curl_msnprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]);
/* Generate our SPN */
spn = Curl_auth_build_spn(service, data->state.origin->hostname, NULL);
if(!spn)
return CURLE_OUT_OF_MEMORY;
/* Calculate H(A2) */
ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
if(!ctxt) {
curlx_free(spn);
return CURLE_OUT_OF_MEMORY;
}
Curl_MD5_update(ctxt, (const unsigned char *)method,
curlx_uztoui(strlen(method)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)spn,
curlx_uztoui(strlen(spn)));
Curl_MD5_final(ctxt, digest);
for(i = 0; i < MD5_DIGEST_LEN; i++)
curl_msnprintf(&HA2_hex[2 * i], 3, "%02x", digest[i]);
/* Now calculate the response hash */
ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
if(!ctxt) {
curlx_free(spn);
return CURLE_OUT_OF_MEMORY;
}
Curl_MD5_update(ctxt, (const unsigned char *)HA1_hex, 2 * MD5_DIGEST_LEN);
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)nonce,
curlx_uztoui(strlen(nonce)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)nonceCount,
curlx_uztoui(strlen(nonceCount)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)cnonce,
curlx_uztoui(strlen(cnonce)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)qop,
curlx_uztoui(strlen(qop)));
Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
Curl_MD5_update(ctxt, (const unsigned char *)HA2_hex, 2 * MD5_DIGEST_LEN);
Curl_MD5_final(ctxt, digest);
for(i = 0; i < MD5_DIGEST_LEN; i++)
curl_msnprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
/* escape double quotes and backslashes in the username, realm and nonce as
necessary */
qrealm = auth_digest_string_quoted(realm);
qnonce = auth_digest_string_quoted(nonce);
quserp = auth_digest_string_quoted(userp);
if(qrealm && qnonce && quserp)
/* Generate the response */
response = curl_maprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
"cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\","
"response=%s,qop=%s",
quserp, qrealm, qnonce,
cnonce, nonceCount, spn, resp_hash_hex, qop);
curlx_free(qrealm);
curlx_free(qnonce);
curlx_free(quserp);
curlx_free(spn);
if(!response)
return CURLE_OUT_OF_MEMORY;
/* Return the response. */
Curl_bufref_set(out, response, strlen(response), curl_free);
return result;
}
/*
* Curl_auth_decode_digest_http_message()
*
* This is used to decode an HTTP DIGEST challenge message into the separate
* attributes.
*
* Parameters:
*
* chlg [in] - The challenge message.
* digest [in/out] - The digest data struct being used and modified.
*
* Returns CURLE_OK on success.
*/
CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
struct digestdata *digest)
{
bool before = FALSE; /* got a nonce before */
/* If we already have received a nonce, keep that in mind */
if(digest->nonce)
before = TRUE;
/* Clean up any former leftovers and initialize to defaults */
Curl_auth_digest_cleanup(digest);
for(;;) {
char value[DIGEST_MAX_VALUE_LENGTH];
char content[DIGEST_MAX_CONTENT_LENGTH];
/* Pass all additional spaces here */
while(*chlg && ISBLANK(*chlg))
chlg++;
/* Extract a value=content pair */
if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
if(curl_strequal(value, "nonce")) {
curlx_free(digest->nonce);
digest->nonce = curlx_strdup(content);
if(!digest->nonce)
return CURLE_OUT_OF_MEMORY;
}
else if(curl_strequal(value, "stale")) {
if(curl_strequal(content, "true")) {
digest->stale = TRUE;
digest->nc = 1; /* we make a new nonce now */
}
}
else if(curl_strequal(value, "realm")) {
curlx_free(digest->realm);
digest->realm = curlx_strdup(content);
if(!digest->realm)
return CURLE_OUT_OF_MEMORY;
}
else if(curl_strequal(value, "opaque")) {
curlx_free(digest->opaque);
digest->opaque = curlx_strdup(content);
if(!digest->opaque)
return CURLE_OUT_OF_MEMORY;
}
else if(curl_strequal(value, "qop")) {
const char *token = content;
struct Curl_str out;
bool foundAuth = FALSE;
bool foundAuthInt = FALSE;
/* Pass leading spaces */
while(*token && ISBLANK(*token))
token++;
while(!curlx_str_until(&token, &out, 32, ',')) {
if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH))
foundAuth = TRUE;
else if(curlx_str_casecompare(&out,
DIGEST_QOP_VALUE_STRING_AUTH_INT))
foundAuthInt = TRUE;
if(curlx_str_single(&token, ','))
break;
while(*token && ISBLANK(*token))
token++;
}
/* Select only auth or auth-int. Otherwise, ignore */
if(foundAuth) {
curlx_free(digest->qop);
digest->qop = curlx_strdup(DIGEST_QOP_VALUE_STRING_AUTH);
if(!digest->qop)
return CURLE_OUT_OF_MEMORY;
}
else if(foundAuthInt) {
curlx_free(digest->qop);
digest->qop = curlx_strdup(DIGEST_QOP_VALUE_STRING_AUTH_INT);
if(!digest->qop)
return CURLE_OUT_OF_MEMORY;
}
}
else if(curl_strequal(value, "algorithm")) {
curlx_free(digest->algorithm);
digest->algorithm = curlx_strdup(content);
if(!digest->algorithm)
return CURLE_OUT_OF_MEMORY;
if(curl_strequal(content, "MD5-sess"))
digest->algo = ALGO_MD5SESS;
else if(curl_strequal(content, "MD5"))
digest->algo = ALGO_MD5;
else if(curl_strequal(content, "SHA-256"))
digest->algo = ALGO_SHA256;
else if(curl_strequal(content, "SHA-256-SESS"))
digest->algo = ALGO_SHA256SESS;
else if(curl_strequal(content, "SHA-512-256")) {
#ifdef CURL_HAVE_SHA512_256
digest->algo = ALGO_SHA512_256;
#else /* !CURL_HAVE_SHA512_256 */
return CURLE_NOT_BUILT_IN;
#endif /* CURL_HAVE_SHA512_256 */
}
else if(curl_strequal(content, "SHA-512-256-SESS")) {
#ifdef CURL_HAVE_SHA512_256
digest->algo = ALGO_SHA512_256SESS;
#else /* !CURL_HAVE_SHA512_256 */
return CURLE_NOT_BUILT_IN;
#endif /* CURL_HAVE_SHA512_256 */
}
else
return CURLE_BAD_CONTENT_ENCODING;
}
else if(curl_strequal(value, "userhash")) {
if(curl_strequal(content, "true")) {
digest->userhash = TRUE;
}
}
else {
/* Unknown specifier, ignore it! */
}
}
else
break; /* We are done here */
/* Pass all additional spaces here */
while(*chlg && ISBLANK(*chlg))
chlg++;
/* Allow the list to be comma-separated */
if(',' == *chlg)
chlg++;
}
/* We had a nonce since before, and we got another one now without
'stale=true'. This means we provided bad credentials in the previous
request */
if(before && !digest->stale)
return CURLE_BAD_CONTENT_ENCODING;
/* We got this header without a nonce, that is a bad Digest line! */
if(!digest->nonce)
return CURLE_BAD_CONTENT_ENCODING;
/* "<algo>-sess" protocol versions require "auth" or "auth-int" qop */
if(!digest->qop && (digest->algo & SESSION_ALGO))
return CURLE_BAD_CONTENT_ENCODING;
return CURLE_OK;
}
/*
* auth_create_digest_http_message()
*
* This is used to generate an HTTP DIGEST response message ready for sending
* to the recipient.
*
* Parameters:
*
* data [in] - The session handle.
* creds [in] - The credentials
* request [in] - The HTTP request.
* uripath [in] - The path of the HTTP uri.
* digest [in/out] - The digest data struct being used and modified.
* outptr [in/out] - The address where a pointer to newly allocated memory
* holding the result is stored upon completion.
* outlen [out] - The length of the output message.
*
* Returns CURLE_OK on success.
*/
static CURLcode auth_create_digest_http_message(
struct Curl_easy *data,
struct Curl_creds *creds,
const unsigned char *request,
const unsigned char *uripath,
struct digestdata *digest,
char **outptr, size_t *outlen,
void (*convert_to_ascii)(const unsigned char *, unsigned char *),
CURLcode (*hash)(unsigned char *, const unsigned char *, const size_t))
{
CURLcode result;
const char *userp = Curl_creds_user(creds);
const char *passwdp = Curl_creds_passwd(creds);
unsigned char hashbuf[32]; /* 32 bytes/256 bits */
unsigned char request_digest[65];
unsigned char ha1[65]; /* 64 digits and 1 zero byte */
unsigned char ha2[65]; /* 64 digits and 1 zero byte */
char userh[65];
char *cnonce = NULL;
size_t cnonce_sz = 0;
char *userp_quoted = NULL;
char *realm_quoted = NULL;
char *nonce_quoted = NULL;
char *hashthis = NULL;
char *uri_quoted = NULL;
struct dynbuf response;
*outptr = NULL;
curlx_dyn_init(&response, 4096); /* arbitrary max */
memset(hashbuf, 0, sizeof(hashbuf));
if(!digest->nc)
digest->nc = 1;
if(!digest->cnonce) {
char cnoncebuf[12];
result = Curl_rand_bytes(data,
#ifdef DEBUGBUILD
TRUE,
#endif
(unsigned char *)cnoncebuf,
sizeof(cnoncebuf));
if(!result)
result = curlx_base64_encode((uint8_t *)cnoncebuf, sizeof(cnoncebuf),
&cnonce, &cnonce_sz);
if(result)
goto oom;
digest->cnonce = cnonce;
}
if(digest->userhash) {
char *hasht = curl_maprintf("%s:%s", userp,
digest->realm ? digest->realm : "");
if(!hasht) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
result = hash(hashbuf, (unsigned char *)hasht, strlen(hasht));
curlx_free(hasht);
if(result)
goto oom;
convert_to_ascii(hashbuf, (unsigned char *)userh);
}
/*
If the algorithm is "MD5" or unspecified (which then defaults to MD5):
A1 = unq(username-value) ":" unq(realm-value) ":" passwd
If the algorithm is "MD5-sess" then:
A1 = H(unq(username-value) ":" unq(realm-value) ":" passwd) ":"
unq(nonce-value) ":" unq(cnonce-value)
*/
hashthis = curl_maprintf("%s:%s:%s", userp, digest->realm ?
digest->realm : "", passwdp);
if(!hashthis) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
result = hash(hashbuf, (unsigned char *)hashthis, strlen(hashthis));
curlx_free(hashthis);
if(result)
goto oom;
convert_to_ascii(hashbuf, ha1);
if(digest->algo & SESSION_ALGO) {
/* nonce and cnonce are OUTSIDE the hash */
char *tmp = curl_maprintf("%s:%s:%s", ha1, digest->nonce, digest->cnonce);
if(!tmp) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
result = hash(hashbuf, (unsigned char *)tmp, strlen(tmp));
curlx_free(tmp);
if(result)
goto oom;
convert_to_ascii(hashbuf, ha1);
}
/*
If the "qop" directive's value is "auth" or is unspecified, then A2 is:
A2 = Method ":" digest-uri-value
If the "qop" value is "auth-int", then A2 is:
A2 = Method ":" digest-uri-value ":" H(entity-body)
(The "Method" value is the HTTP request method as specified in section
5.1.1 of RFC 2616)
*/
uri_quoted = auth_digest_string_quoted((const char *)uripath);
if(!uri_quoted) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
hashthis = curl_maprintf("%s:%s", request, uripath);
if(!hashthis) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
if(digest->qop && curl_strequal(digest->qop, "auth-int")) {
/* We do not support auth-int for PUT or POST */
char hashed[65];
char *hashthis2;
result = hash(hashbuf, (const unsigned char *)"", 0);
if(result) {
curlx_free(hashthis);
goto oom;
}
convert_to_ascii(hashbuf, (unsigned char *)hashed);
hashthis2 = curl_maprintf("%s:%s", hashthis, hashed);
curlx_free(hashthis);
hashthis = hashthis2;
if(!hashthis) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
}
result = hash(hashbuf, (unsigned char *)hashthis, strlen(hashthis));
curlx_free(hashthis);
if(result)
goto oom;
convert_to_ascii(hashbuf, ha2);
if(digest->qop)
hashthis = curl_maprintf("%s:%s:%08x:%s:%s:%s", ha1, digest->nonce,
(unsigned int)digest->nc, digest->cnonce,
digest->qop, ha2);
else
hashthis = curl_maprintf("%s:%s:%s", ha1, digest->nonce, ha2);
if(!hashthis) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
result = hash(hashbuf, (unsigned char *)hashthis, strlen(hashthis));
curlx_free(hashthis);
if(result)
goto oom;
convert_to_ascii(hashbuf, request_digest);
/* For test case 64 (snooped from a Mozilla 1.3a request)
Authorization: Digest username="testuser", realm="testrealm", \
nonce="1053604145", uri="/64", response="c55f7f30d83d774a3d2dcacf725abaca"
Digest parameters are all quoted strings. Username which is provided by
the user needs double quotes and backslashes within it escaped.
realm, nonce, and opaque needs backslashes as well as they were
de-escaped when copied from request header. cnonce is generated with
web-safe characters. uri is already percent encoded. nc is 8 hex
characters. algorithm and qop with standard values only contain web-safe
characters.
*/
userp_quoted = auth_digest_string_quoted(digest->userhash ? userh : userp);
if(!userp_quoted) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
if(digest->realm)
realm_quoted = auth_digest_string_quoted(digest->realm);
else {
realm_quoted = curlx_malloc(1);
if(realm_quoted)
realm_quoted[0] = 0;
}
if(!realm_quoted) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
nonce_quoted = auth_digest_string_quoted(digest->nonce);
if(!nonce_quoted) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
if(digest->qop) {
result = curlx_dyn_addf(&response, "username=\"%s\", "
"realm=\"%s\", "
"nonce=\"%s\", "
"uri=\"%s\", "
"cnonce=\"%s\", "
"nc=%08x, "
"qop=%s, "
"response=\"%s\"",
userp_quoted,
realm_quoted,
nonce_quoted,
uri_quoted,
digest->cnonce,
(unsigned int)digest->nc,
digest->qop,
request_digest);
/* Increment nonce-count to use another nc value for the next request */
digest->nc++;
}
else {
result = curlx_dyn_addf(&response, "username=\"%s\", "
"realm=\"%s\", "
"nonce=\"%s\", "
"uri=\"%s\", "
"response=\"%s\"",
userp_quoted,
realm_quoted,
nonce_quoted,
uri_quoted,
request_digest);
}
if(result)
goto oom;
/* Add the optional fields */
if(digest->opaque) {
/* Append the opaque */
char *opaque_quoted = auth_digest_string_quoted(digest->opaque);
if(!opaque_quoted) {
result = CURLE_OUT_OF_MEMORY;
goto oom;
}
result = curlx_dyn_addf(&response, ", opaque=\"%s\"", opaque_quoted);
curlx_free(opaque_quoted);
if(result)
goto oom;
}
if(digest->algorithm) {
/* Append the algorithm */
result = curlx_dyn_addf(&response, ", algorithm=%s", digest->algorithm);
if(result)
goto oom;
}
if(digest->userhash) {
/* Append the userhash */
result = curlx_dyn_add(&response, ", userhash=true");
if(result)
goto oom;
}
/* Return the output */
*outptr = curlx_dyn_ptr(&response);
*outlen = curlx_dyn_len(&response);
result = CURLE_OK;
oom:
curlx_free(nonce_quoted);
curlx_free(realm_quoted);
curlx_free(uri_quoted);
curlx_free(userp_quoted);
if(result)
curlx_dyn_free(&response);
return result;
}
/*
* Curl_auth_create_digest_http_message()
*
* This is used to generate an HTTP DIGEST response message ready for sending
* to the recipient.
*
* Parameters:
*
* data [in] - The session handle.
* userp [in] - The username.
* passwdp [in] - The user's password.
* request [in] - The HTTP request.
* uripath [in] - The path of the HTTP uri.
* digest [in/out] - The digest data struct being used and modified.
* outptr [in/out] - The address where a pointer to newly allocated memory
* holding the result is stored upon completion.
* outlen [out] - The length of the output message.
*
* Returns CURLE_OK on success.
*/
CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
struct Curl_creds *creds,
const unsigned char *request,
const unsigned char *uripath,
struct digestdata *digest,
char **outptr, size_t *outlen)
{
if(digest->algo <= ALGO_MD5SESS)
return auth_create_digest_http_message(data, creds,
request, uripath, digest,
outptr, outlen,
auth_digest_md5_to_ascii,
Curl_md5it);
if(digest->algo <= ALGO_SHA256SESS)
return auth_create_digest_http_message(data, creds,
request, uripath, digest,
outptr, outlen,
auth_digest_sha256_to_ascii,
Curl_sha256it);
#ifdef CURL_HAVE_SHA512_256
if(digest->algo <= ALGO_SHA512_256SESS)
return auth_create_digest_http_message(data, creds,
request, uripath, digest,
outptr, outlen,
auth_digest_sha256_to_ascii,
Curl_sha512_256it);
#endif /* CURL_HAVE_SHA512_256 */
/* Should be unreachable */
return CURLE_BAD_CONTENT_ENCODING;
}
/*
* Curl_auth_digest_cleanup()
*
* This is used to clean up the digest specific data.
*
* Parameters:
*
* digest [in/out] - The digest data struct being cleaned up.
*
*/
void Curl_auth_digest_cleanup(struct digestdata *digest)
{
Curl_peer_unlink(&digest->origin);
Curl_creds_unlink(&digest->creds);
curlx_safefree(digest->nonce);
curlx_safefree(digest->cnonce);
curlx_safefree(digest->realm);
curlx_safefree(digest->opaque);
curlx_safefree(digest->qop);
curlx_safefree(digest->algorithm);
digest->nc = 0;
digest->algo = ALGO_MD5; /* default algorithm */
digest->stale = FALSE; /* default means normal, not stale */
digest->userhash = FALSE;
}
#endif /* !USE_WINDOWS_SSPI */
#endif /* !CURL_DISABLE_DIGEST_AUTH */
Reference in New Issue View Git Blame Copy Permalink