Changeset 1990

Timestamp:

09/06/2007 09:41:29 PM (12 months ago)

Author:

jan

Message:

merged [1875] from 1.4.x

• fixed mem-leak in mod_auth (reported by Stefan Esser)
• fixed crash with md5-sess and cnonce not set in mod_auth (reported
• by Stefan Esser)
• fixed missing check for base64 encoded string in mod_auth and Basic
• auth (reported by Stefan Esser)
• fixed possible crash in Auth-Digest header parser on trailing WS in mod_auth (reported by Stefan Esser)

Location:

trunk

Files:

• NEWS (modified) (1 diff)
• src/http_auth.c (modified) (3 diffs)
• tests/mod-auth.t (modified) (2 diffs)

trunk/NEWS

@@ -23 +23 @@
   * fixed prctl() usage (#1310, #1333)
   * fixed FastCGI header overrun in mod_fastcgi (reported by mattias@secweb.se)
+  * fixed mem-leak in mod_auth (reported by Stefan Esser)
+  * fixed crash with md5-sess and cnonce not set in mod_auth (reported by Stefan Esser)
+  * fixed missing check for base64 encoded string in mod_auth and Basic auth
+    (reported by Stefan Esser)
+  * fixed possible crash in Auth-Digest header parser on trailing WS in 
+    mod_auth (reported by Stefan Esser) 
 
 - 1.4.14 - ???

trunk/src/http_auth.c

@@ -833 +833 @@
         password = buffer_init();
 
-        base64_decode(username, realm_str);
+        if (!base64_decode(username, realm_str)) {
+                log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username);
+
+                buffer_free(username);
+                return 0;
+        }
 
         /* r2 == user:password */
         if (NULL == (pw = strchr(username->ptr, ':'))) {
+                log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username);
+
                 buffer_free(username);
-
-                log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username);
-
                 return 0;
         }
@@ -969 +973 @@
                 /* skip whitespaces */
                 while (*c == ' ' || *c == '\t') c++;
-                if (!c) break;
+                if (!*c) break;
 
                 for (i = 0; dkv[i].key; i++) {
@@ -1018 +1022 @@
                 log_error_write(srv, __FILE__, __LINE__, "s",
                                 "digest: missing field");
+
+                buffer_free(b);
+                return -1;
+        }
+
+        /**
+         * protect the md5-sess against missing cnonce and nonce
+         */
+        if (algorithm &&
+            0 == strcasecmp(algorithm, "md5-sess") &&
+            (!nonce || !cnonce)) {
+                log_error_write(srv, __FILE__, __LINE__, "s",
+                                "digest: (md5-sess: missing field");
+
+                buffer_free(b);
                 return -1;
         }

trunk/tests/mod-auth.t

@@ -9 +9 @@
 use strict;
 use IO::Socket;
-use Test::More tests => 10;
+use Test::More tests => 13;
 use LightyTest;
 
@@ -94 +94 @@
 ok($tf->handle_http($t) == 0, 'Digest-Auth: missing nc (noncecount instead), no crash');
 
+$t->{REQUEST}  = ( <<EOF
+GET /server-status HTTP/1.0
+Authorization: Basic =
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ok($tf->handle_http($t) == 0, 'Basic-Auth: Invalid Base64');
+
+
+$t->{REQUEST}  = ( <<EOF
+GET /server-status HTTP/1.0
+User-Agent: Wget/1.9.1
+Authorization: Digest username="jan", realm="jan",
+        nonce="b1d12348b4620437c43dd61c50ae4639", algorithm="md5-sess",
+        uri="/MJ-BONG.xm.mpc", qop=auth, noncecount=00000001",
+        cnonce="036FCA5B86F7E7C4965C7F9B8FE714B7",
+        nc="asd",
+        response="29B32C2953C763C6D033C8A49983B87E"
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ok($tf->handle_http($t) == 0, 'Digest-Auth: md5-sess + missing cnonce');
+
+$t->{REQUEST}  = ( <<EOF
+GET /server-status HTTP/1.0
+User-Agent: Wget/1.9.1
+Authorization: Digest username="jan", realm="jan",
+        nonce="b1d12348b4620437c43dd61c50ae4639", algorithm="md5-sess",
+        uri="/MJ-BONG.xm.mpc", qop=auth, noncecount=00000001",
+        cnonce="036FCA5B86F7E7C4965C7F9B8FE714B7",
+        nc="asd",
+        response="29B32C2953C763C6D033C8A49983B87E"     
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ok($tf->handle_http($t) == 0, 'Digest-Auth: trailing WS');
+