mirrors/libmicrohttpd
2
0
Fork 0
mirror of https://git.gnunet.org/libmicrohttpd.git synced 2026-09-25 04:09:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

digestauth: updated the method of nonce generation in default mode

Browse Source
This commit is contained in:
Evgeny Grin (Karlson2k)
2022-08-15 21:37:51 +03:00
parent e1d6b7635b
commit 21d8f5461b
2 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/include/microhttpd.h
+4 -3
View File
@@ -1562,6 +1562,9 @@ enum MHD_DAuthBindNonce
* for any request in the same "protection space".
* CPU is loaded less when this value is used when checking client's
* authorisation request.
* This mode gives MHD maximum flexibility for nonces generation and can
* prevent possible nonce collisions (and corresponding log warning messages)
* when clients' requests are intensive.
* This value cannot be combined with other values.
*/
MHD_DAUTH_BIND_NONCE_NONE = 0,
@@ -1596,9 +1599,6 @@ enum MHD_DAuthBindNonce
* jump from one IP to another (mobile or Wi-Fi handover, DHCP re-assignment,
* Multi-NAT, different proxy chain and other reasons), while IP address
* spoofing could be used relatively easily.
* However, if server gets intensive requests with Digest Authentication
* this value helps to generate unique nonces for several requests, received
* exactly at the same time (within one millisecond) from different clients.
*/
MHD_DAUTH_BIND_NONCE_CLIENT_IP = 1 << 3
} _MHD_FLAGS_ENUM;
@@ -2014,6 +2014,7 @@ enum MHD_OPTION
* #MHD_digest_auth_check3() and similar functions.
* This option should be followed by an 'unsigned int` argument with value
* formed as bitwise OR combination of #MHD_DAuthBindNonce values.
* When not specified, default value #MHD_DAUTH_BIND_NONCE_NONE is used.
* @note Available since #MHD_VERSION 0x00097531
*/
MHD_OPTION_DIGEST_AUTH_NONCE_BIND_TYPE = 36
src/microhttpd/digestauth.c
+17 -2
View File
@@ -1380,6 +1380,16 @@ calculate_nonce (uint64_t nonce_time,
rnd_size);
digest_update_with_colon (da);
}
if ( (MHD_DAUTH_BIND_NONCE_NONE == bind_options) &&
(0 != saddr_size) )
{
/* Use full client address including source port to make unique nonces
* for requests received exactly at the same time */
digest_update (da,
saddr,
saddr_size);
digest_update_with_colon (da);
}
if ( (0 != (bind_options & MHD_DAUTH_BIND_NONCE_CLIENT_IP)) &&
(0 != saddr_size) )
{
@@ -1395,7 +1405,8 @@ calculate_nonce (uint64_t nonce_time,
#endif /* HAVE_INET6 */
digest_update_with_colon (da);
}
if (0 != (bind_options & MHD_DAUTH_BIND_NONCE_URI))
if ( (MHD_DAUTH_BIND_NONCE_NONE == bind_options) ||
(0 != (bind_options & MHD_DAUTH_BIND_NONCE_URI)))
{
if (MHD_HTTP_MTHD_OTHER != mthd_e)
{
@@ -1410,7 +1421,10 @@ calculate_nonce (uint64_t nonce_time,
}
else
digest_update_str (da, method);
}
if (0 != (bind_options & MHD_DAUTH_BIND_NONCE_URI))
{
digest_update_with_colon (da);
digest_update (da,
@@ -1435,7 +1449,8 @@ calculate_nonce (uint64_t nonce_time,
}
digest_update_with_colon (da);
}
if (0 != (bind_options & MHD_DAUTH_BIND_NONCE_REALM))
if ( (MHD_DAUTH_BIND_NONCE_NONE == bind_options) ||
(0 != (bind_options & MHD_DAUTH_BIND_NONCE_REALM)))
{
digest_update (da,
realm,