#include "auth.h"
#include "../platform/pal.h"
#include "../platform/memory.h"
#include "../user/usermgr.h"
#include <string.h>
#include <time.h>
#ifdef _WIN32
#include <wincrypt.h>
#else
#include <openssl/md5.h>
#include <openssl/rand.h>
#endif
struct auth_context {
user_manager_t *usermgr;
auth_method_t method;
char realm[128];
char current_nonce[64];
time_t nonce_time;
mutex_t mutex;
};
static const char base64_chars[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
char *auth_base64_encode(const unsigned char *data, size_t len) {
if (len > (SIZE_MAX / 4) - 1) return NULL;
size_t out_len = 4 * ((len + 2) / 3);
char *out = malloc(out_len + 1);
if (!out) return NULL;
size_t i, j;
for (i = 0, j = 0; i < len;) {
uint32_t octet_a = i < len ? data[i++] : 0;
uint32_t octet_b = i < len ? data[i++] : 0;
uint32_t octet_c = i < len ? data[i++] : 0;
uint32_t triple = (octet_a << 16) + (octet_b << 8) + octet_c;
out[j++] = base64_chars[(triple >> 18) & 0x3F];
out[j++] = base64_chars[(triple >> 12) & 0x3F];
out[j++] = base64_chars[(triple >> 6) & 0x3F];
out[j++] = base64_chars[triple & 0x3F];
}
int mod = len % 3;
if (mod > 0) {
for (int k = 0; k < 3 - mod; k++) {
out[out_len - 1 - k] = '=';
}
}
out[out_len] = '\0';
return out;
}
unsigned char *auth_base64_decode(const char *data, size_t *out_len) {
size_t len = strlen(data);
if (len % 4 != 0) return NULL;
*out_len = len / 4 * 3;
if (data[len - 1] == '=') (*out_len)--;
if (data[len - 2] == '=') (*out_len)--;
unsigned char *out = malloc(*out_len);
if (!out) return NULL;
static const unsigned char d[] = {
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 64, 64, 63,
52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
64, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 64,
64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64
};
size_t i, j;
for (i = 0, j = 0; i < len;) {
uint32_t a = data[i] == '=' ? 0 : d[(unsigned char)data[i]]; i++;
uint32_t b = data[i] == '=' ? 0 : d[(unsigned char)data[i]]; i++;
uint32_t c = data[i] == '=' ? 0 : d[(unsigned char)data[i]]; i++;
uint32_t e = data[i] == '=' ? 0 : d[(unsigned char)data[i]]; i++;
uint32_t triple = (a << 18) + (b << 12) + (c << 6) + e;
if (j < *out_len) out[j++] = (triple >> 16) & 0xFF;
if (j < *out_len) out[j++] = (triple >> 8) & 0xFF;
if (j < *out_len) out[j++] = triple & 0xFF;
}
return out;
}
auth_context_t *auth_create(const char *db_path, auth_method_t method, const char *realm) {
auth_context_t *auth = calloc(1, sizeof(auth_context_t));
if (!auth) return NULL;
auth->method = method;
strncpy(auth->realm, realm ? realm : "WebDAV", sizeof(auth->realm) - 1);
auth->realm[sizeof(auth->realm) - 1] = '\0';
if (pal_mutex_init(&auth->mutex) != NWEDAV_OK) {
free(auth);
return NULL;
}
auth->usermgr = user_manager_create(db_path);
if (!auth->usermgr) {
pal_mutex_destroy(&auth->mutex);
free(auth);
return NULL;
}
return auth;
}
void auth_destroy(auth_context_t *auth) {
if (!auth) return;
user_manager_destroy(auth->usermgr);
pal_mutex_destroy(&auth->mutex);
free(auth);
}
int auth_parse_basic(const char *header, char *username, size_t user_size,
char *password, size_t pass_size) {
if (!header || !username || !password) return NWEDAV_ERROR;
while (*header == ' ') header++;
if (str_ncasecmp(header, "Basic ", 6) != 0) return NWEDAV_ERROR;
header += 6;
while (*header == ' ') header++;
size_t decoded_len;
unsigned char *decoded = auth_base64_decode(header, &decoded_len);
if (!decoded) return NWEDAV_ERROR;
char *colon = memchr(decoded, ':', decoded_len);
if (!colon) {
free(decoded);
return NWEDAV_ERROR;
}
size_t user_len = colon - (char *)decoded;
size_t pass_len = decoded_len - user_len - 1;
if (user_len >= user_size || pass_len >= pass_size) {
free(decoded);
return NWEDAV_ERROR;
}
memcpy(username, decoded, user_len);
username[user_len] = '\0';
memcpy(password, colon + 1, pass_len);
password[pass_len] = '\0';
free(decoded);
return NWEDAV_OK;
}
static char *extract_digest_param(const char *header, const char *param) {
char search[64];
snprintf(search, sizeof(search), "%s=", param);
const char *start = strstr(header, search);
if (!start) return NULL;
start += strlen(search);
while (*start == ' ') start++;
if (*start == '"') {
start++;
const char *end = strchr(start, '"');
if (!end) return NULL;
return str_ndup(start, end - start);
} else {
const char *end = start;
while (*end && *end != ',' && *end != ' ') end++;
return str_ndup(start, end - start);
}
}
int auth_parse_digest(const char *header, char *username, char *realm,
char *nonce, char *uri, char *nc, char *cnonce,
char *qop, char *response) {
if (!header) return NWEDAV_ERROR;
while (*header == ' ') header++;
if (str_ncasecmp(header, "Digest ", 7) != 0) return NWEDAV_ERROR;
header += 7;
char *tmp;
tmp = extract_digest_param(header, "username");
if (tmp) { strncpy(username, tmp, 63); username[63] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "realm");
if (tmp) { strncpy(realm, tmp, 127); realm[127] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "nonce");
if (tmp) { strncpy(nonce, tmp, 63); nonce[63] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "uri");
if (tmp) { strncpy(uri, tmp, 255); uri[255] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "nc");
if (tmp) { strncpy(nc, tmp, 15); nc[15] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "cnonce");
if (tmp) { strncpy(cnonce, tmp, 63); cnonce[63] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "qop");
if (tmp) { strncpy(qop, tmp, 15); qop[15] = '\0'; free(tmp); }
tmp = extract_digest_param(header, "response");
if (tmp) { strncpy(response, tmp, 63); response[63] = '\0'; free(tmp); }
return NWEDAV_OK;
}
static void generate_nonce(char *nonce, size_t size) {
unsigned char rand_bytes[16];
#ifdef _WIN32
HCRYPTPROV hProv;
if (CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) {
CryptGenRandom(hProv, sizeof(rand_bytes), rand_bytes);
CryptReleaseContext(hProv, 0);
}
#else
RAND_bytes(rand_bytes, sizeof(rand_bytes));
#endif
static const char hex[] = "0123456789abcdef";
for (int i = 0; i < 16 && (size_t)(i * 2 + 1) < size - 1; i++) {
nonce[i * 2] = hex[rand_bytes[i] >> 4];
nonce[i * 2 + 1] = hex[rand_bytes[i] & 0x0f];
}
nonce[32] = '\0';
}
int auth_check(auth_context_t *auth, http_request_t *req, auth_user_t *user) {
if (!auth || !req || !user) return NWEDAV_ERROR;
if (auth->method == AUTH_METHOD_NONE) {
memset(user, 0, sizeof(auth_user_t));
strncpy(user->username, "anonymous", sizeof(user->username) - 1);
user->username[sizeof(user->username) - 1] = '\0';
return NWEDAV_OK;
}
if (!req->authorization) {
return NWEDAV_ERROR_AUTH;
}
if (auth->method == AUTH_METHOD_BASIC) {
char username[64] = {0};
char password[256] = {0};
if (auth_parse_basic(req->authorization, username, sizeof(username),
password, sizeof(password)) != NWEDAV_OK) {
return NWEDAV_ERROR_AUTH;
}
user_t db_user;
if (user_manager_authenticate(auth->usermgr, username, password, &db_user) != NWEDAV_OK) {
return NWEDAV_ERROR_AUTH;
}
user->id = db_user.id;
strncpy(user->username, db_user.username, sizeof(user->username) - 1);
user->username[sizeof(user->username) - 1] = '\0';
strncpy(user->email, db_user.email, sizeof(user->email) - 1);
user->email[sizeof(user->email) - 1] = '\0';
strncpy(user->display_name, db_user.display_name, sizeof(user->display_name) - 1);
user->display_name[sizeof(user->display_name) - 1] = '\0';
strncpy(user->home_directory, db_user.home_directory, sizeof(user->home_directory) - 1);
user->home_directory[sizeof(user->home_directory) - 1] = '\0';
user->quota_bytes = db_user.quota_bytes;
user->used_bytes = db_user.used_bytes;
user->enabled = db_user.enabled;
return NWEDAV_OK;
}
if (auth->method == AUTH_METHOD_DIGEST) {
char username[64] = {0};
char realm[128] = {0};
char nonce[64] = {0};
char uri[256] = {0};
char nc[16] = {0};
char cnonce[64] = {0};
char qop[16] = {0};
char response[64] = {0};
if (auth_parse_digest(req->authorization, username, realm, nonce, uri,
nc, cnonce, qop, response) != NWEDAV_OK) {
return NWEDAV_ERROR_AUTH;
}
user_t db_user;
if (user_manager_get_by_username(auth->usermgr, username, &db_user) != NWEDAV_OK) {
return NWEDAV_ERROR_AUTH;
}
user->id = db_user.id;
strncpy(user->username, db_user.username, sizeof(user->username) - 1);
user->username[sizeof(user->username) - 1] = '\0';
strncpy(user->email, db_user.email, sizeof(user->email) - 1);
user->email[sizeof(user->email) - 1] = '\0';
strncpy(user->display_name, db_user.display_name, sizeof(user->display_name) - 1);
user->display_name[sizeof(user->display_name) - 1] = '\0';
strncpy(user->home_directory, db_user.home_directory, sizeof(user->home_directory) - 1);
user->home_directory[sizeof(user->home_directory) - 1] = '\0';
user->quota_bytes = db_user.quota_bytes;
user->used_bytes = db_user.used_bytes;
user->enabled = db_user.enabled;
return NWEDAV_OK;
}
return NWEDAV_ERROR_AUTH;
}
int auth_build_challenge(auth_context_t *auth, http_response_t *res) {
if (!auth || !res) return NWEDAV_ERROR;
char header[512];
if (auth->method == AUTH_METHOD_BASIC) {
snprintf(header, sizeof(header), "Basic realm=\"%s\"", auth->realm);
} else if (auth->method == AUTH_METHOD_DIGEST) {
pal_mutex_lock(&auth->mutex);
time_t now = time(NULL);
if (now - auth->nonce_time > 300 || auth->current_nonce[0] == '\0') {
generate_nonce(auth->current_nonce, sizeof(auth->current_nonce));
auth->nonce_time = now;
}
snprintf(header, sizeof(header),
"Digest realm=\"%s\", nonce=\"%s\", qop=\"auth\", algorithm=MD5",
auth->realm, auth->current_nonce);
pal_mutex_unlock(&auth->mutex);
} else {
return NWEDAV_OK;
}
http_response_set_status(res, HTTP_401_UNAUTHORIZED);
http_response_add_header(res, "WWW-Authenticate", header);
http_response_error(res, HTTP_401_UNAUTHORIZED, "Authentication required");
return NWEDAV_OK;
}
Reference in New Issue View Git Blame Copy Permalink