Evgeny Grin (Karlson2k)
8714ba41f7
gen_auth: fixed detection of userhash in Digest Auth requests
2022-07-25 16:20:48 +03:00
Evgeny Grin (Karlson2k)
7ace1e11a3
digestauth: fixed copy-paste error in request algo parsing
2022-07-25 16:20:33 +03:00
Evgeny Grin (Karlson2k)
2279673589
Added test for Digest Auth with username in extended notation
...
As libcurl does not support extended notation, it is not completely
real test. Pregenerated fake nonce, cnonce and response are used so
only parsing of request header and checking request header are tested.
No real authorisation.
2022-07-21 15:07:08 +03:00
Evgeny Grin (Karlson2k)
aac0cc55ea
digestauth: added support for extended notation for old API
2022-07-21 15:07:07 +03:00
Evgeny Grin (Karlson2k)
c7ac9d80a5
digestauth: do not allocate extra space for extended notation
2022-07-21 15:07:07 +03:00
Evgeny Grin (Karlson2k)
57a5fcfac7
digestauth: fixed username extraction with the new API
2022-07-21 15:07:07 +03:00
Evgeny Grin (Karlson2k)
69aec9dc33
digest_auth_check(): updated the order of parameters check
...
If more than one parameter is wrong, then the first checked wrong
parameter will be reported, so check the most important parameters
first.
2022-07-21 15:07:07 +03:00
Evgeny Grin (Karlson2k)
b528bec9c1
digest_auth_check(): added support for username in extended notation
2022-07-21 15:07:06 +03:00
Evgeny Grin (Karlson2k)
e1e5a39568
digestauth: removed usage of variable-length arrays
...
This should improve efficiency, size and security:
* Code works just fine with fixed size arrays.
* The resulting binary size is smaller when fixed size arrays are used.
* GCC stack protector cannot be used with functions with variable-length
arrays.
2022-07-21 15:07:06 +03:00
Evgeny Grin (Karlson2k)
c63e7544d8
digest calculations: further simplified code, removed some local variables
2022-07-21 15:07:06 +03:00
Evgeny Grin (Karlson2k)
76813be7bf
digest_auth_check(): removed one more large local variable
2022-07-21 15:07:06 +03:00
Evgeny Grin (Karlson2k)
98ade6e6fe
digestauth: added sanity check for digest macros
2022-07-21 15:07:06 +03:00
Evgeny Grin (Karlson2k)
984f72a201
digestauth: simplified internal function call
2022-07-21 15:07:05 +03:00
Evgeny Grin (Karlson2k)
348da88b86
digestauth: added small helper function to simplify the code
2022-07-21 15:07:05 +03:00
Evgeny Grin (Karlson2k)
e916620931
test_digest: improved test URI
2022-07-21 15:07:05 +03:00
Evgeny Grin (Karlson2k)
755b338ba5
test_basicauth: Fixed doxy
2022-07-21 15:07:05 +03:00
Christian Grothoff
bd88a19e2d
-typo
2022-07-20 21:04:25 +02:00
Evgeny Grin (Karlson2k)
76b5b1952c
microhttpd.h: formatted some deprecation warnings
2022-07-19 17:50:07 +03:00
Evgeny Grin (Karlson2k)
d39ad79ab6
digest_auth_check(): check and report wrong algorithm
2022-07-19 17:50:07 +03:00
Evgeny Grin (Karlson2k)
1a8a2b8d19
digest: small internal refactoring to clarify used hash type
2022-07-19 17:50:07 +03:00
Evgeny Grin (Karlson2k)
f826bbca44
microhttpd.h: added special enum for hash types
2022-07-19 17:50:06 +03:00
Evgeny Grin (Karlson2k)
da89942421
digest_auth_check: mostly rewritten, simplified, optimised
...
Moved all simple checks (size comparison, then strings comparison) to
the front, before starting any heavy digest calculcations.
Used extracted parameters for calculations immediately, therefore
avoided many memcpy()s and extra temporal storages.
2022-07-19 17:50:06 +03:00
Evgeny Grin (Karlson2k)
cc40800c76
Digest: moved URI match check to separate function, avoid one memcpy()
2022-07-19 17:50:05 +03:00
Evgeny Grin (Karlson2k)
c8a549bf4c
Digest: check whether all required parameters are present before doing heavy calculations
2022-07-19 17:50:05 +03:00
Evgeny Grin (Karlson2k)
619e5f631e
Digest: use binary zero to separate get params in digest
2022-07-19 17:50:05 +03:00
Evgeny Grin (Karlson2k)
98b3c68aab
Added new functions MHD_digest_auth_get_request_info3() and MHD_digest_auth_get_username3()
2022-07-19 17:50:05 +03:00
Evgeny Grin (Karlson2k)
c80ceb0d02
mhd_str: added macros for simple comparison against static strings
2022-07-19 17:50:05 +03:00
Evgeny Grin (Karlson2k)
b78b38bae9
Added tests for hex <-> binary functions
2022-07-19 17:50:04 +03:00
Evgeny Grin (Karlson2k)
ee06f77543
mhd_str: added MHD_hex_to_bin() internal function
2022-07-19 17:50:04 +03:00
Evgeny Grin (Karlson2k)
93a449edfb
Use new functions for decode request URLs
2022-07-19 17:50:04 +03:00
Evgeny Grin (Karlson2k)
57f57e8bfe
Added tests for percent-decoding functions
2022-07-18 12:57:11 +03:00
Evgeny Grin (Karlson2k)
420ed698d6
mhd_str: added functions for percent-decoding
2022-07-18 11:35:19 +03:00
Christian Grothoff
d629ada1a2
-fix typos
2022-06-26 15:24:24 +02:00
Evgeny Grin (Karlson2k)
8e4eba0e70
digestauth: use GET parameters in digest calculation
2022-06-23 12:42:43 +03:00
Evgeny Grin (Karlson2k)
b41fedd52b
digestauth: use pre-calculated URI length to avoid stop at first binary zero
2022-06-23 12:42:43 +03:00
Evgeny Grin (Karlson2k)
2de47d2007
digestauth: use size_t for counting headers
2022-06-23 11:39:00 +03:00
Evgeny Grin (Karlson2k)
23d69214bd
digestauth: added check whether arguments specified in the right order
2022-06-23 11:38:54 +03:00
Evgeny Grin (Karlson2k)
8b01c152a2
mhd_str.h: fixed doxy
2022-06-22 20:59:00 +03:00
Evgeny Grin (Karlson2k)
da3457eab1
digestauth.h: added some doxy
2022-06-22 20:58:59 +03:00
Evgeny Grin (Karlson2k)
348945c306
digestauth: removed now unused do-while scope
2022-06-22 20:58:44 +03:00
Evgeny Grin (Karlson2k)
1efb758b79
Fixed check for URL match to handle URLs with binary zero
2022-06-22 20:58:44 +03:00
Evgeny Grin (Karlson2k)
c4246b5251
Added tracking of the request URL length.
...
URL may have binary zeros after url-decoding, the length helps to detect
such situations.
2022-06-22 20:58:43 +03:00
Evgeny Grin (Karlson2k)
a5af7f7379
digest_auth_check_all(): simplified, improved readability
...
Added check for too long nonce (the size is know in advance, no need to
try other check if nonce size is wrong);
Used caseless match more 'qop' value (as required by RFC), too long
'qop' values reject early, added special result value for wrong qop;
Reject early with too long 'nc' value;
Reject early with wrong response size (the size is know in advance, no
need to make CPU-intensive hash calculations if size if incorrect);
Added special return value is any parameter is too large to be processed
2022-06-22 20:58:43 +03:00
Evgeny Grin (Karlson2k)
6ccaa5da57
MHD_parse_arguments_(): refactored, allow cls for the callback
2022-06-22 20:58:43 +03:00
Evgeny Grin (Karlson2k)
5ba4b7709f
test_digestauth{._with_arguments}: do test really with arguments
2022-06-22 20:58:43 +03:00
Evgeny Grin (Karlson2k)
299fdcd226
configure: removed unused variable
2022-06-22 20:58:42 +03:00
Evgeny Grin (Karlson2k)
2286bbe11e
configure: added basic support for AIX XLC flags
2022-06-22 16:38:17 +03:00
Evgeny Grin (Karlson2k)
14228333e7
configure: removed unneeded special flags for Darwin
2022-06-22 16:38:17 +03:00
Evgeny Grin (Karlson2k)
1c181be2ff
Removed extra "Upgrade" token in Connection reply header in tests and examples
...
MHD automatically adds "Upgrade" header, no need to add it for the
second time.
2022-06-15 15:34:34 +03:00
Alexander Irion
3526ff8302
Remove double adding of MHD_HTTP_HEADER_CONNECTION response header
...
MHD_create_response_for_upgrade() already adds the MHD_HTTP_HEADER_CONNECTION response header, so
the additional MHD_add_response_header is wrong.
In our application it caused, that on a Apple iPad, the websocket was immediately closed by the
browser(Safari, Chrome, Opera) after the protocol upgrade. Browsers on Linux, Android did not had this issue.
Signed-off-by: Alexander Irion <alexander_irion@mentor.com >
2022-06-15 15:28:07 +03:00
