| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/http/http_auth_handler_digest.h" | |
| 6 | |
| 7 #include <string> | |
| 8 | |
| 9 #include "base/logging.h" | |
| 10 #include "base/md5.h" | |
| 11 #include "base/rand_util.h" | |
| 12 #include "base/strings/string_util.h" | |
| 13 #include "base/strings/stringprintf.h" | |
| 14 #include "base/strings/utf_string_conversions.h" | |
| 15 #include "net/base/net_errors.h" | |
| 16 #include "net/base/net_string_util.h" | |
| 17 #include "net/base/net_util.h" | |
| 18 #include "net/http/http_auth.h" | |
| 19 #include "net/http/http_auth_challenge_tokenizer.h" | |
| 20 #include "net/http/http_request_info.h" | |
| 21 #include "net/http/http_util.h" | |
| 22 #include "url/gurl.h" | |
| 23 | |
| 24 namespace net { | |
| 25 | |
| 26 // Digest authentication is specified in RFC 2617. | |
| 27 // The expanded derivations are listed in the tables below. | |
| 28 | |
| 29 //==========+==========+==========================================+ | |
| 30 // qop |algorithm | response | | |
| 31 //==========+==========+==========================================+ | |
| 32 // ? | ?, md5, | MD5(MD5(A1):nonce:MD5(A2)) | | |
| 33 // | md5-sess | | | |
| 34 //--------- +----------+------------------------------------------+ | |
| 35 // auth, | ?, md5, | MD5(MD5(A1):nonce:nc:cnonce:qop:MD5(A2)) | | |
| 36 // auth-int | md5-sess | | | |
| 37 //==========+==========+==========================================+ | |
| 38 // qop |algorithm | A1 | | |
| 39 //==========+==========+==========================================+ | |
| 40 // | ?, md5 | user:realm:password | | |
| 41 //----------+----------+------------------------------------------+ | |
| 42 // | md5-sess | MD5(user:realm:password):nonce:cnonce | | |
| 43 //==========+==========+==========================================+ | |
| 44 // qop |algorithm | A2 | | |
| 45 //==========+==========+==========================================+ | |
| 46 // ?, auth | | req-method:req-uri | | |
| 47 //----------+----------+------------------------------------------+ | |
| 48 // auth-int | | req-method:req-uri:MD5(req-entity-body) | | |
| 49 //=====================+==========================================+ | |
| 50 | |
| 51 HttpAuthHandlerDigest::NonceGenerator::NonceGenerator() { | |
| 52 } | |
| 53 | |
| 54 HttpAuthHandlerDigest::NonceGenerator::~NonceGenerator() { | |
| 55 } | |
| 56 | |
| 57 HttpAuthHandlerDigest::DynamicNonceGenerator::DynamicNonceGenerator() { | |
| 58 } | |
| 59 | |
| 60 std::string HttpAuthHandlerDigest::DynamicNonceGenerator::GenerateNonce() | |
| 61 const { | |
| 62 // This is how mozilla generates their cnonce -- a 16 digit hex string. | |
| 63 static const char domain[] = "0123456789abcdef"; | |
| 64 std::string cnonce; | |
| 65 cnonce.reserve(16); | |
| 66 for (int i = 0; i < 16; ++i) | |
| 67 cnonce.push_back(domain[base::RandInt(0, 15)]); | |
| 68 return cnonce; | |
| 69 } | |
| 70 | |
| 71 HttpAuthHandlerDigest::FixedNonceGenerator::FixedNonceGenerator( | |
| 72 const std::string& nonce) | |
| 73 : nonce_(nonce) { | |
| 74 } | |
| 75 | |
| 76 std::string HttpAuthHandlerDigest::FixedNonceGenerator::GenerateNonce() const { | |
| 77 return nonce_; | |
| 78 } | |
| 79 | |
| 80 HttpAuthHandlerDigest::Factory::Factory() | |
| 81 : nonce_generator_(new DynamicNonceGenerator()) { | |
| 82 } | |
| 83 | |
| 84 HttpAuthHandlerDigest::Factory::~Factory() { | |
| 85 } | |
| 86 | |
| 87 void HttpAuthHandlerDigest::Factory::set_nonce_generator( | |
| 88 const NonceGenerator* nonce_generator) { | |
| 89 nonce_generator_.reset(nonce_generator); | |
| 90 } | |
| 91 | |
| 92 int HttpAuthHandlerDigest::Factory::CreateAuthHandler( | |
| 93 HttpAuthChallengeTokenizer* challenge, | |
| 94 HttpAuth::Target target, | |
| 95 const GURL& origin, | |
| 96 CreateReason reason, | |
| 97 int digest_nonce_count, | |
| 98 const BoundNetLog& net_log, | |
| 99 scoped_ptr<HttpAuthHandler>* handler) { | |
| 100 // TODO(cbentzel): Move towards model of parsing in the factory | |
| 101 // method and only constructing when valid. | |
| 102 scoped_ptr<HttpAuthHandler> tmp_handler( | |
| 103 new HttpAuthHandlerDigest(digest_nonce_count, nonce_generator_.get())); | |
| 104 if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log)) | |
| 105 return ERR_INVALID_RESPONSE; | |
| 106 handler->swap(tmp_handler); | |
| 107 return OK; | |
| 108 } | |
| 109 | |
| 110 HttpAuth::AuthorizationResult HttpAuthHandlerDigest::HandleAnotherChallenge( | |
| 111 HttpAuthChallengeTokenizer* challenge) { | |
| 112 // Even though Digest is not connection based, a "second round" is parsed | |
| 113 // to differentiate between stale and rejected responses. | |
| 114 // Note that the state of the current handler is not mutated - this way if | |
| 115 // there is a rejection the realm hasn't changed. | |
| 116 if (!LowerCaseEqualsASCII(challenge->scheme(), "digest")) | |
| 117 return HttpAuth::AUTHORIZATION_RESULT_INVALID; | |
| 118 | |
| 119 HttpUtil::NameValuePairsIterator parameters = challenge->param_pairs(); | |
| 120 | |
| 121 // Try to find the "stale" value, and also keep track of the realm | |
| 122 // for the new challenge. | |
| 123 std::string original_realm; | |
| 124 while (parameters.GetNext()) { | |
| 125 if (LowerCaseEqualsASCII(parameters.name(), "stale")) { | |
| 126 if (LowerCaseEqualsASCII(parameters.value(), "true")) | |
| 127 return HttpAuth::AUTHORIZATION_RESULT_STALE; | |
| 128 } else if (LowerCaseEqualsASCII(parameters.name(), "realm")) { | |
| 129 original_realm = parameters.value(); | |
| 130 } | |
| 131 } | |
| 132 return (original_realm_ != original_realm) ? | |
| 133 HttpAuth::AUTHORIZATION_RESULT_DIFFERENT_REALM : | |
| 134 HttpAuth::AUTHORIZATION_RESULT_REJECT; | |
| 135 } | |
| 136 | |
| 137 bool HttpAuthHandlerDigest::Init(HttpAuthChallengeTokenizer* challenge) { | |
| 138 return ParseChallenge(challenge); | |
| 139 } | |
| 140 | |
| 141 int HttpAuthHandlerDigest::GenerateAuthTokenImpl( | |
| 142 const AuthCredentials* credentials, const HttpRequestInfo* request, | |
| 143 const CompletionCallback& callback, std::string* auth_token) { | |
| 144 // Generate a random client nonce. | |
| 145 std::string cnonce = nonce_generator_->GenerateNonce(); | |
| 146 | |
| 147 // Extract the request method and path -- the meaning of 'path' is overloaded | |
| 148 // in certain cases, to be a hostname. | |
| 149 std::string method; | |
| 150 std::string path; | |
| 151 GetRequestMethodAndPath(request, &method, &path); | |
| 152 | |
| 153 *auth_token = AssembleCredentials(method, path, *credentials, | |
| 154 cnonce, nonce_count_); | |
| 155 return OK; | |
| 156 } | |
| 157 | |
| 158 HttpAuthHandlerDigest::HttpAuthHandlerDigest( | |
| 159 int nonce_count, const NonceGenerator* nonce_generator) | |
| 160 : stale_(false), | |
| 161 algorithm_(ALGORITHM_UNSPECIFIED), | |
| 162 qop_(QOP_UNSPECIFIED), | |
| 163 nonce_count_(nonce_count), | |
| 164 nonce_generator_(nonce_generator) { | |
| 165 DCHECK(nonce_generator_); | |
| 166 } | |
| 167 | |
| 168 HttpAuthHandlerDigest::~HttpAuthHandlerDigest() { | |
| 169 } | |
| 170 | |
| 171 // The digest challenge header looks like: | |
| 172 // WWW-Authenticate: Digest | |
| 173 // [realm="<realm-value>"] | |
| 174 // nonce="<nonce-value>" | |
| 175 // [domain="<list-of-URIs>"] | |
| 176 // [opaque="<opaque-token-value>"] | |
| 177 // [stale="<true-or-false>"] | |
| 178 // [algorithm="<digest-algorithm>"] | |
| 179 // [qop="<list-of-qop-values>"] | |
| 180 // [<extension-directive>] | |
| 181 // | |
| 182 // Note that according to RFC 2617 (section 1.2) the realm is required. | |
| 183 // However we allow it to be omitted, in which case it will default to the | |
| 184 // empty string. | |
| 185 // | |
| 186 // This allowance is for better compatibility with webservers that fail to | |
| 187 // send the realm (See http://crbug.com/20984 for an instance where a | |
| 188 // webserver was not sending the realm with a BASIC challenge). | |
| 189 bool HttpAuthHandlerDigest::ParseChallenge( | |
| 190 HttpAuthChallengeTokenizer* challenge) { | |
| 191 auth_scheme_ = HttpAuth::AUTH_SCHEME_DIGEST; | |
| 192 score_ = 2; | |
| 193 properties_ = ENCRYPTS_IDENTITY; | |
| 194 | |
| 195 // Initialize to defaults. | |
| 196 stale_ = false; | |
| 197 algorithm_ = ALGORITHM_UNSPECIFIED; | |
| 198 qop_ = QOP_UNSPECIFIED; | |
| 199 realm_ = original_realm_ = nonce_ = domain_ = opaque_ = std::string(); | |
| 200 | |
| 201 // FAIL -- Couldn't match auth-scheme. | |
| 202 if (!LowerCaseEqualsASCII(challenge->scheme(), "digest")) | |
| 203 return false; | |
| 204 | |
| 205 HttpUtil::NameValuePairsIterator parameters = challenge->param_pairs(); | |
| 206 | |
| 207 // Loop through all the properties. | |
| 208 while (parameters.GetNext()) { | |
| 209 // FAIL -- couldn't parse a property. | |
| 210 if (!ParseChallengeProperty(parameters.name(), | |
| 211 parameters.value())) | |
| 212 return false; | |
| 213 } | |
| 214 | |
| 215 // Check if tokenizer failed. | |
| 216 if (!parameters.valid()) | |
| 217 return false; | |
| 218 | |
| 219 // Check that a minimum set of properties were provided. | |
| 220 if (nonce_.empty()) | |
| 221 return false; | |
| 222 | |
| 223 return true; | |
| 224 } | |
| 225 | |
| 226 bool HttpAuthHandlerDigest::ParseChallengeProperty(const std::string& name, | |
| 227 const std::string& value) { | |
| 228 if (LowerCaseEqualsASCII(name, "realm")) { | |
| 229 std::string realm; | |
| 230 if (!net::ConvertToUtf8AndNormalize(value, kCharsetLatin1, &realm)) | |
| 231 return false; | |
| 232 realm_ = realm; | |
| 233 original_realm_ = value; | |
| 234 } else if (LowerCaseEqualsASCII(name, "nonce")) { | |
| 235 nonce_ = value; | |
| 236 } else if (LowerCaseEqualsASCII(name, "domain")) { | |
| 237 domain_ = value; | |
| 238 } else if (LowerCaseEqualsASCII(name, "opaque")) { | |
| 239 opaque_ = value; | |
| 240 } else if (LowerCaseEqualsASCII(name, "stale")) { | |
| 241 // Parse the stale boolean. | |
| 242 stale_ = LowerCaseEqualsASCII(value, "true"); | |
| 243 } else if (LowerCaseEqualsASCII(name, "algorithm")) { | |
| 244 // Parse the algorithm. | |
| 245 if (LowerCaseEqualsASCII(value, "md5")) { | |
| 246 algorithm_ = ALGORITHM_MD5; | |
| 247 } else if (LowerCaseEqualsASCII(value, "md5-sess")) { | |
| 248 algorithm_ = ALGORITHM_MD5_SESS; | |
| 249 } else { | |
| 250 DVLOG(1) << "Unknown value of algorithm"; | |
| 251 return false; // FAIL -- unsupported value of algorithm. | |
| 252 } | |
| 253 } else if (LowerCaseEqualsASCII(name, "qop")) { | |
| 254 // Parse the comma separated list of qops. | |
| 255 // auth is the only supported qop, and all other values are ignored. | |
| 256 HttpUtil::ValuesIterator qop_values(value.begin(), value.end(), ','); | |
| 257 qop_ = QOP_UNSPECIFIED; | |
| 258 while (qop_values.GetNext()) { | |
| 259 if (LowerCaseEqualsASCII(qop_values.value(), "auth")) { | |
| 260 qop_ = QOP_AUTH; | |
| 261 break; | |
| 262 } | |
| 263 } | |
| 264 } else { | |
| 265 DVLOG(1) << "Skipping unrecognized digest property"; | |
| 266 // TODO(eroman): perhaps we should fail instead of silently skipping? | |
| 267 } | |
| 268 return true; | |
| 269 } | |
| 270 | |
| 271 // static | |
| 272 std::string HttpAuthHandlerDigest::QopToString(QualityOfProtection qop) { | |
| 273 switch (qop) { | |
| 274 case QOP_UNSPECIFIED: | |
| 275 return std::string(); | |
| 276 case QOP_AUTH: | |
| 277 return "auth"; | |
| 278 default: | |
| 279 NOTREACHED(); | |
| 280 return std::string(); | |
| 281 } | |
| 282 } | |
| 283 | |
| 284 // static | |
| 285 std::string HttpAuthHandlerDigest::AlgorithmToString( | |
| 286 DigestAlgorithm algorithm) { | |
| 287 switch (algorithm) { | |
| 288 case ALGORITHM_UNSPECIFIED: | |
| 289 return std::string(); | |
| 290 case ALGORITHM_MD5: | |
| 291 return "MD5"; | |
| 292 case ALGORITHM_MD5_SESS: | |
| 293 return "MD5-sess"; | |
| 294 default: | |
| 295 NOTREACHED(); | |
| 296 return std::string(); | |
| 297 } | |
| 298 } | |
| 299 | |
| 300 void HttpAuthHandlerDigest::GetRequestMethodAndPath( | |
| 301 const HttpRequestInfo* request, | |
| 302 std::string* method, | |
| 303 std::string* path) const { | |
| 304 DCHECK(request); | |
| 305 | |
| 306 const GURL& url = request->url; | |
| 307 | |
| 308 if (target_ == HttpAuth::AUTH_PROXY && | |
| 309 (url.SchemeIs("https") || url.SchemeIsWSOrWSS())) { | |
| 310 *method = "CONNECT"; | |
| 311 *path = GetHostAndPort(url); | |
| 312 } else { | |
| 313 *method = request->method; | |
| 314 *path = HttpUtil::PathForRequest(url); | |
| 315 } | |
| 316 } | |
| 317 | |
| 318 std::string HttpAuthHandlerDigest::AssembleResponseDigest( | |
| 319 const std::string& method, | |
| 320 const std::string& path, | |
| 321 const AuthCredentials& credentials, | |
| 322 const std::string& cnonce, | |
| 323 const std::string& nc) const { | |
| 324 // ha1 = MD5(A1) | |
| 325 // TODO(eroman): is this the right encoding? | |
| 326 std::string ha1 = base::MD5String(base::UTF16ToUTF8(credentials.username()) + | |
| 327 ":" + original_realm_ + ":" + | |
| 328 base::UTF16ToUTF8(credentials.password())); | |
| 329 if (algorithm_ == HttpAuthHandlerDigest::ALGORITHM_MD5_SESS) | |
| 330 ha1 = base::MD5String(ha1 + ":" + nonce_ + ":" + cnonce); | |
| 331 | |
| 332 // ha2 = MD5(A2) | |
| 333 // TODO(eroman): need to add MD5(req-entity-body) for qop=auth-int. | |
| 334 std::string ha2 = base::MD5String(method + ":" + path); | |
| 335 | |
| 336 std::string nc_part; | |
| 337 if (qop_ != HttpAuthHandlerDigest::QOP_UNSPECIFIED) { | |
| 338 nc_part = nc + ":" + cnonce + ":" + QopToString(qop_) + ":"; | |
| 339 } | |
| 340 | |
| 341 return base::MD5String(ha1 + ":" + nonce_ + ":" + nc_part + ha2); | |
| 342 } | |
| 343 | |
| 344 std::string HttpAuthHandlerDigest::AssembleCredentials( | |
| 345 const std::string& method, | |
| 346 const std::string& path, | |
| 347 const AuthCredentials& credentials, | |
| 348 const std::string& cnonce, | |
| 349 int nonce_count) const { | |
| 350 // the nonce-count is an 8 digit hex string. | |
| 351 std::string nc = base::StringPrintf("%08x", nonce_count); | |
| 352 | |
| 353 // TODO(eroman): is this the right encoding? | |
| 354 std::string authorization = (std::string("Digest username=") + | |
| 355 HttpUtil::Quote( | |
| 356 base::UTF16ToUTF8(credentials.username()))); | |
| 357 authorization += ", realm=" + HttpUtil::Quote(original_realm_); | |
| 358 authorization += ", nonce=" + HttpUtil::Quote(nonce_); | |
| 359 authorization += ", uri=" + HttpUtil::Quote(path); | |
| 360 | |
| 361 if (algorithm_ != ALGORITHM_UNSPECIFIED) { | |
| 362 authorization += ", algorithm=" + AlgorithmToString(algorithm_); | |
| 363 } | |
| 364 std::string response = AssembleResponseDigest(method, path, credentials, | |
| 365 cnonce, nc); | |
| 366 // No need to call HttpUtil::Quote() as the response digest cannot contain | |
| 367 // any characters needing to be escaped. | |
| 368 authorization += ", response=\"" + response + "\""; | |
| 369 | |
| 370 if (!opaque_.empty()) { | |
| 371 authorization += ", opaque=" + HttpUtil::Quote(opaque_); | |
| 372 } | |
| 373 if (qop_ != QOP_UNSPECIFIED) { | |
| 374 // TODO(eroman): Supposedly IIS server requires quotes surrounding qop. | |
| 375 authorization += ", qop=" + QopToString(qop_); | |
| 376 authorization += ", nc=" + nc; | |
| 377 authorization += ", cnonce=" + HttpUtil::Quote(cnonce); | |
| 378 } | |
| 379 | |
| 380 return authorization; | |
| 381 } | |
| 382 | |
| 383 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master