lighttpd 1.4.x https://www.lighttpd.net/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
lighttpd1.4/src/mod_auth.c

1215 lines
40 KiB

#include "first.h"
#include "base.h"
#include "plugin.h"
#include "http_auth.h"
#include "http_header.h"
#include "log.h"
#include "sys-crypto.h" /* USE_OPENSSL_CRYPTO */
#ifdef USE_OPENSSL_CRYPTO
#include <openssl/sha.h>
#endif
#include <stdlib.h>
#include <string.h>
/**
* auth framework
*/
typedef struct {
const http_auth_backend_t *auth_backend;
const array *auth_require;
unsigned int auth_extern_authn;
} plugin_config;
typedef struct {
PLUGIN_DATA;
plugin_config defaults;
plugin_config conf;
} plugin_data;
static handler_t mod_auth_check_basic(request_st *r, void *p_d, const struct http_auth_require_t *require, const struct http_auth_backend_t *backend);
static handler_t mod_auth_check_digest(request_st *r, void *p_d, const struct http_auth_require_t *require, const struct http_auth_backend_t *backend);
static handler_t mod_auth_check_extern(request_st *r, void *p_d, const struct http_auth_require_t *require, const struct http_auth_backend_t *backend);
INIT_FUNC(mod_auth_init) {
static const http_auth_scheme_t http_auth_scheme_basic = { "basic", mod_auth_check_basic, NULL };
static const http_auth_scheme_t http_auth_scheme_digest = { "digest", mod_auth_check_digest, NULL };
static const http_auth_scheme_t http_auth_scheme_extern = { "extern", mod_auth_check_extern, NULL };
plugin_data *p;
/* register http_auth_scheme_* */
http_auth_scheme_set(&http_auth_scheme_basic);
http_auth_scheme_set(&http_auth_scheme_digest);
http_auth_scheme_set(&http_auth_scheme_extern);
p = calloc(1, sizeof(*p));
return p;
}
FREE_FUNC(mod_auth_free) {
plugin_data * const p = p_d;
if (NULL == p->cvlist) return;
/* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1], used = p->nconfig; i < used; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
for (; -1 != cpv->k_id; ++cpv) {
if (cpv->vtype != T_CONFIG_LOCAL || NULL == cpv->v.v) continue;
switch (cpv->k_id) {
case 1: /* auth.require */
array_free(cpv->v.v);
break;
default:
break;
}
}
}
}
/* data type for mod_auth structured data
* (parsed from auth.require array of strings) */
typedef struct {
DATA_UNSET;
http_auth_require_t *require;
} data_auth;
static void data_auth_free(data_unset *d)
{
data_auth * const dauth = (data_auth *)d;
free(dauth->key.ptr);
http_auth_require_free(dauth->require);
free(dauth);
}
static data_auth *data_auth_init(void)
{
static const struct data_methods fn = {
NULL, /* copy must not be called on this data */
data_auth_free,
NULL, /* insert_dup must not be called on this data */
NULL /* print must not be called on this data */
};
data_auth * const dauth = calloc(1, sizeof(*dauth));
force_assert(NULL != dauth);
dauth->type = TYPE_OTHER;
dauth->fn = &fn;
dauth->require = http_auth_require_init();
return dauth;
}
static int mod_auth_algorithm_parse(http_auth_info_t *ai, const char *s) {
size_t len;
if (NULL == s) {
ai->dalgo = HTTP_AUTH_DIGEST_MD5;
ai->dlen = HTTP_AUTH_DIGEST_MD5_BINLEN;
return 1;
}
len = strlen(s);
if (len > 5
&& (s[len-5] ) == '-'
&& (s[len-4] | 0x20) == 's'
&& (s[len-3] | 0x20) == 'e'
&& (s[len-2] | 0x20) == 's'
&& (s[len-1] | 0x20) == 's') {
ai->dalgo = HTTP_AUTH_DIGEST_SESS;
len -= 5;
}
else {
ai->dalgo = HTTP_AUTH_DIGEST_NONE;
}
if (3 == len
&& 'm' == (s[0] | 0x20)
&& 'd' == (s[1] | 0x20)
&& '5' == (s[2] )) {
ai->dalgo |= HTTP_AUTH_DIGEST_MD5;
ai->dlen = HTTP_AUTH_DIGEST_MD5_BINLEN;
return 1;
}
#ifdef USE_OPENSSL_CRYPTO
else if (len >= 7
&& 's' == (s[0] | 0x20)
&& 'h' == (s[1] | 0x20)
&& 'a' == (s[2] | 0x20)
&& '-' == (s[3] )) {
if (len == 7 && s[4] == '2' && s[5] == '5' && s[6] == '6') {
ai->dalgo |= HTTP_AUTH_DIGEST_SHA256;
ai->dlen = HTTP_AUTH_DIGEST_SHA256_BINLEN;
return 1;
}
#ifdef SHA512_256_DIGEST_LENGTH
if (len == 11 && 0 == memcmp(s+4, "512-256", 7)) {
ai->dalgo |= HTTP_AUTH_DIGEST_SHA512_256;
ai->dlen = HTTP_AUTH_DIGEST_SHA512_256_BINLEN;
return 1;
}
#endif
}
#endif
return 0; /*(error)*/
}
static int mod_auth_algorithms_parse(int *algorithm, buffer *algos) {
for (char *s = algos->ptr, *p; s; s = p ? p+1 : NULL) {
http_auth_info_t ai;
int rc;
p = strchr(s, '|');
if (p) *p = '\0';
rc = mod_auth_algorithm_parse(&ai, s);
if (p) *p = '|';
if (!rc) return 0;
*algorithm |= ai.dalgo;
}
return 1;
}
static int mod_auth_require_parse (http_auth_require_t * const require, const buffer *b, log_error_st *errh)
{
/* user=name1|user=name2|group=name3|host=name4 */
const char *str = b->ptr;
const char *p;
if (buffer_is_equal_string(b, CONST_STR_LEN("valid-user"))) {
require->valid_user = 1;
return 1; /* success */
}
do {
const char *eq;
size_t len;
p = strchr(str, '|');
len = NULL != p ? (size_t)(p - str) : strlen(str);
eq = memchr(str, '=', len);
if (NULL == eq) {
log_error(errh, __FILE__, __LINE__,
"error parsing auth.require 'require' field: missing '=' "
"(expecting \"valid-user\" or \"user=a|user=b|group=g|host=h\"). "
"error value: %s error near: %s", b->ptr, str);
return 0;
}
if (eq[1] == '|' || eq[1] == '\0') {
log_error(errh, __FILE__, __LINE__,
"error parsing auth.require 'require' field: "
"missing token after '=' "
"(expecting \"valid-user\" or \"user=a|user=b|group=g|host=h\"). "
"error value: %s error near: %s", b->ptr, str);
return 0;
}
switch ((int)(eq - str)) {
case 4:
if (0 == memcmp(str, CONST_STR_LEN("user"))) {
/*("user=" is 5)*/
array_set_key_value(&require->user, str+5, len-5, CONST_STR_LEN(""));
continue;
}
else if (0 == memcmp(str, CONST_STR_LEN("host"))) {
/*("host=" is 5)*/
array_set_key_value(&require->host, str+5, len-5, CONST_STR_LEN(""));
log_error(errh, __FILE__, __LINE__,
"warning parsing auth.require 'require' field: "
"'host' not implemented; field value: %s", b->ptr);
continue;
}
break; /* to error */
case 5:
if (0 == memcmp(str, CONST_STR_LEN("group"))) {
/*("group=" is 6)*/
array_set_key_value(&require->group, str+6, len-6, CONST_STR_LEN(""));
#if 0/*(supported by mod_authn_ldap, but not all other backends)*/
log_error(errh, __FILE__, __LINE__,
"warning parsing auth.require 'require' field: "
"'group' not implemented; field value: %s", b->ptr);
#endif
continue;
}
break; /* to error */
case 10:
if (0 == memcmp(str, CONST_STR_LEN("valid-user"))) {
log_error(errh, __FILE__, __LINE__,
"error parsing auth.require 'require' field: "
"valid user can not be combined with other require rules "
"(expecting \"valid-user\" or "
"\"user=a|user=b|group=g|host=h\"). error value: %s", b->ptr);
return 0;
}
break; /* to error */
default:
break; /* to error */
}
log_error(errh, __FILE__, __LINE__,
"error parsing auth.require 'require' field: "
"invalid/unsupported token "
"(expecting \"valid-user\" or \"user=a|user=b|group=g|host=h\"). "
"error value: %s error near: %s", b->ptr, str);
return 0;
} while (p && *((str = p+1)));
return 1; /* success */
}
static handler_t mod_auth_require_parse_array(const array *value, array * const auth_require, log_error_st *errh)
{
for (uint32_t n = 0; n < value->used; ++n) {
size_t m;
data_array *da_file = (data_array *)value->data[n];
const buffer *method = NULL, *realm = NULL, *require = NULL;
const http_auth_scheme_t *auth_scheme;
buffer *algos = NULL;
int algorithm = HTTP_AUTH_DIGEST_SESS;
if (!array_is_kvstring(&da_file->value)) {
log_error(errh, __FILE__, __LINE__,
"unexpected value for auth.require; expected "
"auth.require = ( \"urlpath\" => ( \"option\" => \"value\" ) )");
return HANDLER_ERROR;
}
for (m = 0; m < da_file->value.used; m++) {
if (da_file->value.data[m]->type == TYPE_STRING) {
data_string *ds = (data_string *)da_file->value.data[m];
if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("method"))) {
method = &ds->value;
} else if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("realm"))) {
realm = &ds->value;
} else if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("require"))) {
require = &ds->value;
} else if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("algorithm"))) {
algos = &ds->value;
} else {
log_error(errh, __FILE__, __LINE__,
"the field is unknown in: "
"auth.require = ( \"...\" => ( ..., -> \"%s\" <- => \"...\" ) )",
da_file->value.data[m]->key.ptr);
return HANDLER_ERROR;
}
} else {
log_error(errh, __FILE__, __LINE__,
"a string was expected for: "
"auth.require = ( \"...\" => ( ..., -> \"%s\" <- => \"...\" ) )",
da_file->value.data[m]->key.ptr);
return HANDLER_ERROR;
}
}
if (buffer_string_is_empty(method)) {
log_error(errh, __FILE__, __LINE__,
"the method field is missing or blank in: "
"auth.require = ( \"...\" => ( ..., \"method\" => \"...\" ) )");
return HANDLER_ERROR;
} else {
auth_scheme = http_auth_scheme_get(method);
if (NULL == auth_scheme) {
log_error(errh, __FILE__, __LINE__,
"unknown method %s (e.g. \"basic\", \"digest\" or \"extern\") in "
"auth.require = ( \"...\" => ( ..., \"method\" => \"...\") )", method->ptr);
return HANDLER_ERROR;
}
}
if (buffer_is_empty(realm)) {
log_error(errh, __FILE__, __LINE__,
"the realm field is missing in: "
"auth.require = ( \"...\" => ( ..., \"realm\" => \"...\" ) )");
return HANDLER_ERROR;
}
if (buffer_string_is_empty(require)) {
log_error(errh, __FILE__, __LINE__,
"the require field is missing or blank in: "
"auth.require = ( \"...\" => ( ..., \"require\" => \"...\" ) )");
return HANDLER_ERROR;
}
if (buffer_string_is_empty(algos)) {
algorithm |= HTTP_AUTH_DIGEST_MD5;
} else if (!mod_auth_algorithms_parse(&algorithm, algos)) {
log_error(errh, __FILE__, __LINE__,
"invalid algorithm in: "
"auth.require = ( \"...\" => ( ..., \"algorithm\" => \"...\" ) )");
return HANDLER_ERROR;
}
if (require) { /*(always true at this point)*/
data_auth * const dauth = data_auth_init();
buffer_copy_buffer(&dauth->key, &da_file->key);
dauth->require->scheme = auth_scheme;
dauth->require->algorithm = algorithm;
dauth->require->realm = realm;
if (!mod_auth_require_parse(dauth->require, require, errh)) {
dauth->fn->free((data_unset *)dauth);
return HANDLER_ERROR;
}
array_insert_unique(auth_require, (data_unset *)dauth);
}
}
return HANDLER_GO_ON;
}
static void mod_auth_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* auth.backend */
if (cpv->vtype == T_CONFIG_LOCAL)
pconf->auth_backend = cpv->v.v;
break;
case 1: /* auth.require */
if (cpv->vtype == T_CONFIG_LOCAL)
pconf->auth_require = cpv->v.v;
break;
case 2: /* auth.extern-authn */
pconf->auth_extern_authn = cpv->v.u;
default:/* should not happen */
return;
}
}
static void mod_auth_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_auth_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
static void mod_auth_patch_config(request_st * const r, plugin_data * const p) {
p->conf = p->defaults; /* copy small struct instead of memcpy() */
/*memcpy(&p->conf, &p->defaults, sizeof(plugin_config));*/
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(r, (uint32_t)p->cvlist[i].k_id))
mod_auth_merge_config(&p->conf, p->cvlist + p->cvlist[i].v.u2[0]);
}
}
SETDEFAULTS_FUNC(mod_auth_set_defaults) {
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("auth.backend"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.require"),
T_CONFIG_ARRAY_KVARRAY,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("auth.extern-authn"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_auth"))
return HANDLER_ERROR;
/* process and validate config directives
* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
for (; -1 != cpv->k_id; ++cpv) {
switch (cpv->k_id) {
case 0: /* auth.backend */
if (!buffer_string_is_empty(cpv->v.b)) {
const http_auth_backend_t * const auth_backend =
http_auth_backend_get(cpv->v.b);
if (NULL == auth_backend) {
log_error(srv->errh, __FILE__, __LINE__,
"auth.backend not supported: %s", cpv->v.b->ptr);
return HANDLER_ERROR;
}
*(const http_auth_backend_t **)&cpv->v.v = auth_backend;
cpv->vtype = T_CONFIG_LOCAL;
}
break;
case 1: /* auth.require */
{
array * const a = array_init(4);
if (HANDLER_GO_ON !=
mod_auth_require_parse_array(cpv->v.a, a, srv->errh)) {
array_free(a);
return HANDLER_ERROR;
}
cpv->v.a = a;
cpv->vtype = T_CONFIG_LOCAL;
}
break;
case 2: /* auth.extern-authn */
break;
default:/* should not happen */
break;
}
}
}
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_auth_merge_config(&p->defaults, cpv);
}
return HANDLER_GO_ON;
}
static handler_t mod_auth_uri_handler(request_st * const r, void *p_d) {
plugin_data *p = p_d;
data_auth *dauth;
mod_auth_patch_config(r, p);
if (p->conf.auth_require == NULL) return HANDLER_GO_ON;
/* search auth directives for first prefix match against URL path */
/* if we have a case-insensitive FS we have to lower-case the URI here too */
dauth = (!r->conf.force_lowercase_filenames)
? (data_auth *)array_match_key_prefix(p->conf.auth_require, &r->uri.path)
: (data_auth *)array_match_key_prefix_nc(p->conf.auth_require, &r->uri.path);
if (NULL == dauth) return HANDLER_GO_ON;
{
const http_auth_scheme_t * const scheme = dauth->require->scheme;
if (p->conf.auth_extern_authn) {
const buffer *vb = http_header_env_get(r, CONST_STR_LEN("REMOTE_USER"));
if (NULL != vb && http_auth_match_rules(dauth->require, vb->ptr, NULL, NULL)) {
return HANDLER_GO_ON;
}
}
return scheme->checkfn(r, scheme->p_d, dauth->require, p->conf.auth_backend);
}
}
int mod_auth_plugin_init(plugin *p);
int mod_auth_plugin_init(plugin *p) {
p->version = LIGHTTPD_VERSION_ID;
p->name = "auth";
p->init = mod_auth_init;
p->set_defaults = mod_auth_set_defaults;
p->handle_uri_clean = mod_auth_uri_handler;
p->cleanup = mod_auth_free;
return 0;
}
/*
* auth schemes (basic, digest, extern)
*
* (could be in separate file from mod_auth.c as long as registration occurs)
*/
#include "base64.h"
#include "md5.h"
#include "rand.h"
#include "http_header.h"
__attribute_cold__
static handler_t mod_auth_send_400_bad_request(request_st * const r) {
/* a field was missing or invalid */
r->http_status = 400; /* Bad Request */
r->handler_module = NULL;
return HANDLER_FINISHED;
}
static handler_t mod_auth_send_401_unauthorized_basic(request_st * const r, const buffer * const realm) {
r->http_status = 401;
r->handler_module = NULL;
buffer * const tb = r->tmp_buf;
buffer_copy_string_len(tb, CONST_STR_LEN("Basic realm=\""));
buffer_append_string_buffer(tb, realm);
buffer_append_string_len(tb, CONST_STR_LEN("\", charset=\"UTF-8\""));
http_header_response_set(r, HTTP_HEADER_OTHER, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(tb));
return HANDLER_FINISHED;
}
static handler_t mod_auth_check_basic(request_st * const r, void *p_d, const struct http_auth_require_t * const require, const struct http_auth_backend_t * const backend) {
const buffer *b = http_header_request_get(r, HTTP_HEADER_AUTHORIZATION, CONST_STR_LEN("Authorization"));
buffer *username;
char *pw;
handler_t rc = HANDLER_UNSET;
UNUSED(p_d);
if (NULL == backend) {
log_error(r->conf.errh, __FILE__, __LINE__, "auth.backend not configured for %s", r->uri.path.ptr);
r->http_status = 500;
r->handler_module = NULL;
return HANDLER_FINISHED;
}
if (NULL == b) {
return mod_auth_send_401_unauthorized_basic(r, require->realm);
}
if (!buffer_eq_icase_ssn(b->ptr, CONST_STR_LEN("Basic "))) {
return mod_auth_send_401_unauthorized_basic(r, require->realm);
}
#ifdef __COVERITY__
if (buffer_string_length(b) < sizeof("Basic ")-1) {
return mod_auth_send_400_bad_request(r);
}
#endif
username = buffer_init();
/* coverity[overflow_sink : FALSE] */
if (!buffer_append_base64_decode(username, b->ptr+sizeof("Basic ")-1, buffer_string_length(b)-(sizeof("Basic ")-1), BASE64_STANDARD)) {
log_error(r->conf.errh, __FILE__, __LINE__, "decoding base64-string failed %s", b->ptr+sizeof("Basic ")-1);
buffer_free(username);
return mod_auth_send_400_bad_request(r);
}
/* r2 == user:password */
if (NULL == (pw = strchr(username->ptr, ':'))) {
log_error(r->conf.errh, __FILE__, __LINE__, "missing ':' in %s", username->ptr);
buffer_free(username);
return mod_auth_send_400_bad_request(r);
}
buffer_string_set_length(username, pw - username->ptr);
pw++;
rc = backend->basic(r, backend->p_d, require, username, pw);
switch (rc) {
case HANDLER_GO_ON:
http_auth_setenv(r, CONST_BUF_LEN(username), CONST_STR_LEN("Basic"));
break;
case HANDLER_WAIT_FOR_EVENT:
case HANDLER_FINISHED:
break;
case HANDLER_ERROR:
default:
log_error(r->conf.errh, __FILE__, __LINE__,
"password doesn't match for %s username: %s IP: %s",
r->uri.path.ptr, username->ptr, r->con->dst_addr_buf->ptr);
r->keep_alive = 0; /*(disable keep-alive if bad password)*/
rc = HANDLER_UNSET;
break;
}
buffer_free(username);
return (HANDLER_UNSET != rc) ? rc : mod_auth_send_401_unauthorized_basic(r, require->realm);
}
#ifdef USE_OPENSSL_CRYPTO
static void mod_auth_digest_mutate_sha256(http_auth_info_t *ai, const char *m, const char *uri, const char *nonce, const char *cnonce, const char *nc, const char *qop) {
SHA256_CTX ctx;
char a1[HTTP_AUTH_DIGEST_SHA256_BINLEN*2+1];
char a2[HTTP_AUTH_DIGEST_SHA256_BINLEN*2+1];
if (ai->dalgo & HTTP_AUTH_DIGEST_SESS) {
SHA256_Init(&ctx);
li_tohex(a1, sizeof(a1), (const char *)ai->digest, ai->dlen);
SHA256_Update(&ctx, (unsigned char *)a1, sizeof(a1)-1);
SHA256_Update(&ctx, CONST_STR_LEN(":"));
SHA256_Update(&ctx, (unsigned char *)nonce, strlen(nonce));
SHA256_Update(&ctx, CONST_STR_LEN(":"));
SHA256_Update(&ctx, (unsigned char *)cnonce, strlen(cnonce));
SHA256_Final(ai->digest, &ctx);
}
li_tohex(a1, sizeof(a1), (const char *)ai->digest, ai->dlen);
/* calculate H(A2) */
SHA256_Init(&ctx);
SHA256_Update(&ctx, (unsigned char *)m, strlen(m));
SHA256_Update(&ctx, CONST_STR_LEN(":"));
SHA256_Update(&ctx, (unsigned char *)uri, strlen(uri));
#if 0
/* qop=auth-int not supported, already checked in caller */
if (qop && buffer_eq_icase_ss(qop, strlen(qop), CONST_STR_LEN("auth-int"))){