src/auth/digest/auth_digest.cc

   1 /*
   2  * $Id: auth_digest.cc,v 1.60 2007/12/14 23:11:51 amosjeffries Exp $
   3  *
   4  * DEBUG: section 29    Authenticator
   5  * AUTHOR: Robert Collins
   6  *
   7  * SQUID Internet Object Cache  http://squid.nlanr.net/Squid/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from the
  11  *  Internet community.  Development is led by Duane Wessels of the
  12  *  National Laboratory for Applied Network Research and funded by the
  13  *  National Science Foundation.  Squid is Copyrighted (C) 1998 by
  14  *  the Regents of the University of California.  Please see the
  15  *  COPYRIGHT file for full details.  Squid incorporates software
  16  *  developed and/or copyrighted by other sources.  Please see the
  17  *  CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 /* The functions in this file handle authentication.
  36  * They DO NOT perform access control or auditing.
  37  * See acl.c for access control and client_side.c for auditing */
  38
  39
  40 #include "squid.h"
  41 #include "rfc2617.h"
  42 #include "auth_digest.h"
  43 #include "authenticate.h"
  44 #include "event.h"
  45 #include "CacheManager.h"
  46 #include "Store.h"
  47 #include "HttpRequest.h"
  48 #include "HttpReply.h"
  49 #include "wordlist.h"
  50 #include "SquidTime.h"
  51 /* TODO don't include this */
  52 #include "digestScheme.h"
  53
  54 /* Digest Scheme */
  55
  56 static HLPCB authenticateDigestHandleReply;
  57 static AUTHSSTATS authenticateDigestStats;
  58
  59 static helper *digestauthenticators = NULL;
  60
  61 static hash_table *digest_nonce_cache;
  62
  63 static AuthDigestConfig digestConfig;
  64
  65 static int authdigest_initialised = 0;
  66 static MemAllocator *digest_nonce_pool = NULL;
  67
  68 CBDATA_TYPE(DigestAuthenticateStateData);
  69
  70 /*
  71  *
  72  * Nonce Functions
  73  *
  74  */
  75
  76 static void authenticateDigestNonceCacheCleanup(void *data);
  77 static digest_nonce_h *authenticateDigestNonceFindNonce(const char *nonceb64);
  78 static digest_nonce_h *authenticateDigestNonceNew(void);
  79 static void authenticateDigestNonceDelete(digest_nonce_h * nonce);
  80 static void authenticateDigestNonceSetup(void);
  81 static void authenticateDigestNonceShutdown(void);
  82 static void authenticateDigestNonceReconfigure(void);
  83 static const char *authenticateDigestNonceNonceb64(digest_nonce_h * nonce);
  84 static int authDigestNonceIsValid(digest_nonce_h * nonce, char nc[9]);
  85 static int authDigestNonceIsStale(digest_nonce_h * nonce);
  86 static void authDigestNonceEncode(digest_nonce_h * nonce);
  87 static int authDigestNonceLastRequest(digest_nonce_h * nonce);
  88 static void authDigestNonceLink(digest_nonce_h * nonce);
  89 static void authDigestNonceUnlink(digest_nonce_h * nonce);
  90 #if NOT_USED
  91 static int authDigestNonceLinks(digest_nonce_h * nonce);
  92 #endif
  93 static void authDigestNonceUserUnlink(digest_nonce_h * nonce);
  94 static void authDigestNoncePurge(digest_nonce_h * nonce);
  95
  96 static void
  97 authDigestNonceEncode(digest_nonce_h * nonce)
  98 {
  99     if (!nonce)
 100         return;
 101
 102     if (nonce->key)
 103         xfree(nonce->key);
 104
 105     nonce->key = xstrdup(base64_encode_bin((char *) &(nonce->noncedata), sizeof(digest_nonce_data)));
 106 }
 107
 108 static digest_nonce_h *
 109 authenticateDigestNonceNew(void)
 110 {
 111     digest_nonce_h *newnonce = static_cast < digest_nonce_h * >(digest_nonce_pool->alloc());
 112     digest_nonce_h *temp;
 113
 114     /* NONCE CREATION - NOTES AND REASONING. RBC 20010108
 115      * === EXCERPT FROM RFC 2617 ===
 116      * The contents of the nonce are implementation dependent. The quality
 117      * of the implementation depends on a good choice. A nonce might, for
 118      * example, be constructed as the base 64 encoding of
 119      *
 120      * time-stamp H(time-stamp ":" ETag ":" private-key)
 121      *
 122      * where time-stamp is a server-generated time or other non-repeating
 123      * value, ETag is the value of the HTTP ETag header associated with
 124      * the requested entity, and private-key is data known only to the
 125      * server.  With a nonce of this form a server would recalculate the
 126      * hash portion after receiving the client authentication header and
 127      * reject the request if it did not match the nonce from that header
 128      * or if the time-stamp value is not recent enough. In this way the
 129      * server can limit the time of the nonce's validity. The inclusion of
 130      * the ETag prevents a replay request for an updated version of the
 131      * resource.  (Note: including the IP address of the client in the
 132      * nonce would appear to offer the server the ability to limit the
 133      * reuse of the nonce to the same client that originally got it.
 134      * However, that would break proxy farms, where requests from a single
 135      * user often go through different proxies in the farm. Also, IP
 136      * address spoofing is not that hard.)
 137      * ====
 138      *
 139      * Now for my reasoning:
 140      * We will not accept a unrecognised nonce->we have all recognisable
 141      * nonces stored. If we send out unique base64 encodings we guarantee
 142      * that a given nonce applies to only one user (barring attacks or
 143      * really bad timing with expiry and creation).  Using a random
 144      * component in the nonce allows us to loop to find a unique nonce.
 145      * We use H(nonce_data) so the nonce is meaningless to the reciever.
 146      * So our nonce looks like base64(H(timestamp,pointertohash,randomdata))
 147      * And even if our randomness is not very random (probably due to
 148      * bad coding on my part) we don't really care - the timestamp and
 149      * memory pointer also guarantee local uniqueness in the input to the hash
 150      * function.
 151      */
 152
 153     /* create a new nonce */
 154     newnonce->nc = 0;
 155     newnonce->flags.valid = 1;
 156     newnonce->noncedata.self = newnonce;
 157     newnonce->noncedata.creationtime = current_time.tv_sec;
 158     newnonce->noncedata.randomdata = squid_random();
 159
 160     authDigestNonceEncode(newnonce);
 161     /*
 162      * loop until we get a unique nonce. The nonce creation must
 163      * have a random factor
 164      */
 165
 166     while ((temp = authenticateDigestNonceFindNonce((char const *) (newnonce->key)))) {
 167         /* create a new nonce */
 168         newnonce->noncedata.randomdata = squid_random();
 169         authDigestNonceEncode(newnonce);
 170     }
 171
 172     hash_join(digest_nonce_cache, newnonce);
 173     /* the cache's link */
 174     authDigestNonceLink(newnonce);
 175     newnonce->flags.incache = 1;
 176     debugs(29, 5, "authenticateDigestNonceNew: created nonce " << newnonce << " at " << newnonce->noncedata.creationtime);
 177     return newnonce;
 178 }
 179
 180 static void
 181 authenticateDigestNonceDelete(digest_nonce_h * nonce)
 182 {
 183     if (nonce) {
 184         assert(nonce->references == 0);
 185 #if UNREACHABLECODE
 186
 187         if (nonce->flags.incache)
 188             hash_remove_link(digest_nonce_cache, nonce);
 189
 190 #endif
 191
 192         assert(nonce->flags.incache == 0);
 193
 194         safe_free(nonce->key);
 195
 196         digest_nonce_pool->free(nonce);
 197     }
 198 }
 199
 200 static void
 201 authenticateDigestNonceSetup(void)
 202 {
 203     if (!digest_nonce_pool)
 204         digest_nonce_pool = memPoolCreate("Digest Scheme nonce's", sizeof(digest_nonce_h));
 205
 206     if (!digest_nonce_cache) {
 207         digest_nonce_cache = hash_create((HASHCMP *) strcmp, 7921, hash_string);
 208         assert(digest_nonce_cache);
 209         eventAdd("Digest none cache maintenance", authenticateDigestNonceCacheCleanup, NULL, digestConfig.nonceGCInterval, 1);
 210     }
 211 }
 212
 213 static void
 214 authenticateDigestNonceShutdown(void)
 215 {
 216     /*
 217      * We empty the cache of any nonces left in there.
 218      */
 219     digest_nonce_h *nonce;
 220
 221     if (digest_nonce_cache) {
 222         debugs(29, 2, "authenticateDigestNonceShutdown: Shutting down nonce cache ");
 223         hash_first(digest_nonce_cache);
 224
 225         while ((nonce = ((digest_nonce_h *) hash_next(digest_nonce_cache)))) {
 226             assert(nonce->flags.incache);
 227             authDigestNoncePurge(nonce);
 228         }
 229     }
 230
 231 #if DEBUGSHUTDOWN
 232     if (digest_nonce_pool) {
 233         delete digest_nonce_pool;
 234         digest_nonce_pool = NULL;
 235     }
 236
 237 #endif
 238     debugs(29, 2, "authenticateDigestNonceShutdown: Nonce cache shutdown");
 239 }
 240
 241 static void
 242 authenticateDigestNonceReconfigure(void)
 243 {}
 244
 245 static void
 246 authenticateDigestNonceCacheCleanup(void *data)
 247 {
 248     /*
 249      * We walk the hash by nonceb64 as that is the unique key we
 250      * use.  For big hash tables we could consider stepping through
 251      * the cache, 100/200 entries at a time. Lets see how it flies
 252      * first.
 253      */
 254     digest_nonce_h *nonce;
 255     debugs(29, 3, "authenticateDigestNonceCacheCleanup: Cleaning the nonce cache now");
 256     debugs(29, 3, "authenticateDigestNonceCacheCleanup: Current time: " << current_time.tv_sec);
 257     hash_first(digest_nonce_cache);
 258
 259     while ((nonce = ((digest_nonce_h *) hash_next(digest_nonce_cache)))) {
 260         debugs(29, 3, "authenticateDigestNonceCacheCleanup: nonce entry  : " << nonce << " '" << (char *) nonce->key << "'");
 261         debugs(29, 4, "authenticateDigestNonceCacheCleanup: Creation time: " << nonce->noncedata.creationtime);
 262
 263         if (authDigestNonceIsStale(nonce)) {
 264             debugs(29, 4, "authenticateDigestNonceCacheCleanup: Removing nonce " << (char *) nonce->key << " from cache due to timeout.");
 265             assert(nonce->flags.incache);
 266             /* invalidate nonce so future requests fail */
 267             nonce->flags.valid = 0;
 268             /* if it is tied to a auth_user, remove the tie */
 269             authDigestNonceUserUnlink(nonce);
 270             authDigestNoncePurge(nonce);
 271         }
 272     }
 273
 274     debugs(29, 3, "authenticateDigestNonceCacheCleanup: Finished cleaning the nonce cache.");
 275
 276     if (digestConfig.active())
 277         eventAdd("Digest none cache maintenance", authenticateDigestNonceCacheCleanup, NULL, digestConfig.nonceGCInterval, 1);
 278 }
 279
 280 static void
 281 authDigestNonceLink(digest_nonce_h * nonce)
 282 {
 283     assert(nonce != NULL);
 284     nonce->references++;
 285     debugs(29, 9, "authDigestNonceLink: nonce '" << nonce << "' now at '" << nonce->references << "'.");
 286 }
 287
 288 #if NOT_USED
 289 static int
 290 authDigestNonceLinks(digest_nonce_h * nonce)
 291 {
 292     if (!nonce)
 293         return -1;
 294
 295     return nonce->references;
 296 }
 297
 298 #endif
 299
 300 static void
 301 authDigestNonceUnlink(digest_nonce_h * nonce)
 302 {
 303     assert(nonce != NULL);
 304
 305     if (nonce->references > 0) {
 306         nonce->references--;
 307     } else {
 308         debugs(29, 1, "authDigestNonceUnlink; Attempt to lower nonce " << nonce << " refcount below 0!");
 309     }
 310
 311     debugs(29, 9, "authDigestNonceUnlink: nonce '" << nonce << "' now at '" << nonce->references << "'.");
 312
 313     if (nonce->references == 0)
 314         authenticateDigestNonceDelete(nonce);
 315 }
 316
 317 static const char *
 318 authenticateDigestNonceNonceb64(digest_nonce_h * nonce)
 319 {
 320     if (!nonce)
 321         return NULL;
 322
 323     return (char const *) nonce->key;
 324 }
 325
 326 static digest_nonce_h *
 327 authenticateDigestNonceFindNonce(const char *nonceb64)
 328 {
 329     digest_nonce_h *nonce = NULL;
 330
 331     if (nonceb64 == NULL)
 332         return NULL;
 333
 334         debugs(29, 9, "authDigestNonceFindNonce:looking for nonceb64 '" << nonceb64 << "' in the nonce cache.");
 335
 336     nonce = static_cast < digest_nonce_h * >(hash_lookup(digest_nonce_cache, nonceb64));
 337
 338     if ((nonce == NULL) || (strcmp(authenticateDigestNonceNonceb64(nonce), nonceb64)))
 339         return NULL;
 340
 341     debugs(29, 9, "authDigestNonceFindNonce: Found nonce '" << nonce << "'");
 342
 343     return nonce;
 344 }
 345
 346 static int
 347 authDigestNonceIsValid(digest_nonce_h * nonce, char nc[9])
 348 {
 349     unsigned long intnc;
 350     /* do we have a nonce ? */
 351
 352     if (!nonce)
 353         return 0;
 354
 355     intnc = strtol(nc, NULL, 16);
 356
 357     /* has it already been invalidated ? */
 358     if (!nonce->flags.valid) {
 359         debugs(29, 4, "authDigestNonceIsValid: Nonce already invalidated");
 360         return 0;
 361     }
 362
 363     /* is the nonce-count ok ? */
 364     if (!digestConfig.CheckNonceCount) {
 365         nonce->nc++;
 366         return -1;              /* forced OK by configuration */
 367     }
 368
 369     if ((digestConfig.NonceStrictness && intnc != nonce->nc + 1) ||
 370             intnc < nonce->nc + 1) {
 371         debugs(29, 4, "authDigestNonceIsValid: Nonce count doesn't match");
 372         nonce->flags.valid = 0;
 373         return 0;
 374     }
 375
 376     /* seems ok */
 377     /* increment the nonce count - we've already checked that intnc is a
 378      *  valid representation for us, so we don't need the test here.
 379      */
 380     nonce->nc = intnc;
 381
 382     return -1;
 383 }
 384
 385 static int
 386 authDigestNonceIsStale(digest_nonce_h * nonce)
 387 {
 388     /* do we have a nonce ? */
 389
 390     if (!nonce)
 391         return -1;
 392
 393     /* has it's max duration expired? */
 394     if (nonce->noncedata.creationtime + digestConfig.noncemaxduration < current_time.tv_sec) {
 395         debugs(29, 4, "authDigestNonceIsStale: Nonce is too old. " <<
 396                nonce->noncedata.creationtime << " " <<
 397                digestConfig.noncemaxduration << " " <<
 398                current_time.tv_sec);
 399
 400         nonce->flags.valid = 0;
 401         return -1;
 402     }
 403
 404     if (nonce->nc > 99999998) {
 405         debugs(29, 4, "authDigestNonceIsStale: Nonce count overflow");
 406         nonce->flags.valid = 0;
 407         return -1;
 408     }
 409
 410     if (nonce->nc > digestConfig.noncemaxuses) {
 411         debugs(29, 4, "authDigestNoncelastRequest: Nonce count over user limit");
 412         nonce->flags.valid = 0;
 413         return -1;
 414     }
 415
 416     /* seems ok */
 417     return 0;
 418 }
 419
 420 /* return -1 if the digest will be stale on the next request */
 421 static int
 422 authDigestNonceLastRequest(digest_nonce_h * nonce)
 423 {
 424     if (!nonce)
 425         return -1;
 426
 427     if (nonce->nc == 99999997) {
 428         debugs(29, 4, "authDigestNoncelastRequest: Nonce count about to overflow");
 429         return -1;
 430     }
 431
 432     if (nonce->nc >= digestConfig.noncemaxuses - 1) {
 433         debugs(29, 4, "authDigestNoncelastRequest: Nonce count about to hit user limit");
 434         return -1;
 435     }
 436
 437     /* and other tests are possible. */
 438     return 0;
 439 }
 440
 441 static void
 442 authDigestNoncePurge(digest_nonce_h * nonce)
 443 {
 444     if (!nonce)
 445         return;
 446
 447     if (!nonce->flags.incache)
 448         return;
 449
 450     hash_remove_link(digest_nonce_cache, nonce);
 451
 452     nonce->flags.incache = 0;
 453
 454     /* the cache's link */
 455     authDigestNonceUnlink(nonce);
 456 }
 457
 458 /* USER related functions */
 459 static auth_user_t *
 460 authDigestUserFindUsername(const char *username)
 461 {
 462     auth_user_hash_pointer *usernamehash;
 463     auth_user_t *auth_user;
 464     debugs(29, 9, "authDigestUserFindUsername: Looking for user '" << username << "'");
 465
 466     if (username && (usernamehash = static_cast < auth_user_hash_pointer * >(hash_lookup(proxy_auth_username_cache, username)))) {
 467         while ((usernamehash->user()->auth_type != AUTH_DIGEST) &&
 468                 (usernamehash->next))
 469             usernamehash = static_cast < auth_user_hash_pointer * >(usernamehash->next);
 470
 471         auth_user = NULL;
 472
 473         if (usernamehash->user()->auth_type == AUTH_DIGEST) {
 474             auth_user = usernamehash->user();
 475         }
 476
 477         return auth_user;
 478     }
 479
 480     return NULL;
 481 }
 482
 483 static void
 484 authDigestUserShutdown(void)
 485 {
 486     /*
 487      * Future work: the auth framework could flush it's cache
 488      */
 489     auth_user_hash_pointer *usernamehash;
 490     auth_user_t *auth_user;
 491     hash_first(proxy_auth_username_cache);
 492
 493     while ((usernamehash = ((auth_user_hash_pointer *) hash_next(proxy_auth_username_cache)))) {
 494         auth_user = usernamehash->user();
 495
 496         if (strcmp(auth_user->config->type(), "digest") == 0)
 497             auth_user->unlock();
 498     }
 499 }
 500
 501 /* delete the digest request structure. Does NOT delete related structures */
 502 void
 503 digestScheme::done()
 504 {
 505     /* TODO: this should be a Config call. */
 506
 507     if (digestauthenticators)
 508         helperShutdown(digestauthenticators);
 509
 510     authdigest_initialised = 0;
 511
 512     if (!shutting_down) {
 513         authenticateDigestNonceReconfigure();
 514         return;
 515     }
 516
 517     if (digestauthenticators) {
 518         helperFree(digestauthenticators);
 519         digestauthenticators = NULL;
 520     }
 521
 522     authDigestUserShutdown();
 523     authenticateDigestNonceShutdown();
 524     debugs(29, 2, "authenticateDigestDone: Digest authentication shut down.");
 525 }
 526
 527 void
 528 AuthDigestConfig::dump(StoreEntry * entry, const char *name, AuthConfig * scheme)
 529 {
 530     wordlist *list = authenticate;
 531     debugs(29, 9, "authDigestCfgDump: Dumping configuration");
 532     storeAppendPrintf(entry, "%s %s", name, "digest");
 533
 534     while (list != NULL) {
 535         storeAppendPrintf(entry, " %s", list->key);
 536         list = list->next;
 537     }
 538
 539     storeAppendPrintf(entry, "\n%s %s realm %s\n%s %s children %d\n%s %s nonce_max_count %d\n%s %s nonce_max_duration %d seconds\n%s %s nonce_garbage_interval %d seconds\n",
 540                       name, "digest", digestAuthRealm,
 541                       name, "digest", authenticateChildren,
 542                       name, "digest", noncemaxuses,
 543                       name, "digest", (int) noncemaxduration,
 544                       name, "digest", (int) nonceGCInterval);
 545 }
 546
 547 bool
 548 AuthDigestConfig::active() const
 549 {
 550     return authdigest_initialised == 1;
 551 }
 552
 553 bool
 554 AuthDigestConfig::configured() const
 555 {
 556     if ((authenticate != NULL) &&
 557             (authenticateChildren != 0) &&
 558             (digestAuthRealm != NULL) && (noncemaxduration > -1))
 559         return true;
 560
 561     return false;
 562 }
 563
 564 int
 565 AuthDigestUserRequest::authenticated() const
 566 {
 567     if (credentials() == Ok)
 568         return 1;
 569
 570     return 0;
 571 }
 572
 573 /* log a digest user in
 574  */
 575 void
 576 AuthDigestUserRequest::authenticate(HttpRequest * request, ConnStateData::Pointer conn, http_hdr_type type)
 577 {
 578     auth_user_t *auth_user;
 579     AuthDigestUserRequest *digest_request;
 580     digest_user_h *digest_user;
 581
 582     HASHHEX SESSIONKEY;
 583     HASHHEX HA2 = "";
 584     HASHHEX Response;
 585
 586     assert(authUser() != NULL);
 587     auth_user = authUser();
 588
 589     digest_user = dynamic_cast < digest_user_h * >(auth_user);
 590
 591     assert(digest_user != NULL);
 592
 593     /* if the check has corrupted the user, just return */
 594
 595     if (credentials() == Failed) {
 596         return;
 597     }
 598
 599     digest_request = this;
 600
 601     /* do we have the HA1 */
 602
 603     if (!digest_user->HA1created) {
 604         credentials(Pending);
 605         return;
 606     }
 607
 608     if (digest_request->nonce == NULL) {
 609         /* this isn't a nonce we issued */
 610         credentials(Failed);
 611         return;
 612     }
 613
 614     DigestCalcHA1(digest_request->algorithm, NULL, NULL, NULL,
 615                   authenticateDigestNonceNonceb64(digest_request->nonce),
 616                   digest_request->cnonce,
 617                   digest_user->HA1, SESSIONKEY);
 618     DigestCalcResponse(SESSIONKEY, authenticateDigestNonceNonceb64(digest_request->nonce),
 619                        digest_request->nc, digest_request->cnonce, digest_request->qop,
 620                        RequestMethodStr[request->method], digest_request->uri, HA2, Response);
 621
 622     debugs(29, 9, "\nResponse = '" << digest_request->response << "'\nsquid is = '" << Response << "'");
 623
 624     if (strcasecmp(digest_request->response, Response) != 0) {
 625         if (!digest_request->flags.helper_queried) {
 626             /* Query the helper in case the password has changed */
 627             digest_request->flags.helper_queried = 1;
 628             digest_request->credentials_ok = Pending;
 629             return;
 630         }
 631
 632         if (digestConfig.PostWorkaround && request->method != METHOD_GET) {
 633             /* Ugly workaround for certain very broken browsers using the
 634              * wrong method to calculate the request-digest on POST request.
 635              * This should be deleted once Digest authentication becomes more
 636              * widespread and such broken browsers no longer are commonly
 637              * used.
 638              */
 639             DigestCalcResponse(SESSIONKEY, authenticateDigestNonceNonceb64(digest_request->nonce),
 640                                digest_request->nc, digest_request->cnonce, digest_request->qop,
 641                                RequestMethodStr[METHOD_GET], digest_request->uri, HA2, Response);
 642
 643             if (strcasecmp(digest_request->response, Response)) {
 644                 credentials(Failed);
 645                 digest_request->setDenyMessage("Incorrect password");
 646                 return;
 647             } else {
 648                 const char *useragent = request->header.getStr(HDR_USER_AGENT);
 649
 650                 static IPAddress last_broken_addr;
 651                 static int seen_broken_client = 0;
 652
 653                 if (!seen_broken_client) {
 654                     last_broken_addr.SetNoAddr();
 655                     seen_broken_client = 1;
 656                 }
 657
 658                 if (last_broken_addr != request->client_addr) {
 659                     debugs(29, 1, "\nDigest POST bug detected from " <<
 660                            request->client_addr << " using '" <<
 661                            (useragent ? useragent : "-") <<
 662                            "'. Please upgrade browser. See Bug #630 for details.");
 663
 664                     last_broken_addr = request->client_addr;
 665                 }
 666             }
 667         } else {
 668             credentials(Failed);
 669             digest_request->setDenyMessage("Incorrect password");
 670             return;
 671         }
 672
 673         /* check for stale nonce */
 674         if (!authDigestNonceIsValid(digest_request->nonce, digest_request->nc)) {
 675             debugs(29, 3, "authenticateDigestAuthenticateuser: user '" << digest_user->username() << "' validated OK but nonce stale");
 676             digest_request->flags.nonce_stale = 1;
 677             credentials(Failed);
 678             digest_request->setDenyMessage("Stale nonce");
 679             return;
 680         }
 681     }
 682
 683     credentials(Ok);
 684
 685     /* password was checked and did match */
 686     debugs(29, 4, "authenticateDigestAuthenticateuser: user '" << digest_user->username() << "' validated OK");
 687
 688     /* auth_user is now linked, we reset these values
 689      * after external auth occurs anyway */
 690     auth_user->expiretime = current_time.tv_sec;
 691     return;
 692 }
 693
 694 int
 695 AuthDigestUserRequest::module_direction()
 696 {
 697     switch (credentials()) {
 698
 699     case Unchecked:
 700         return -1;
 701
 702     case Ok:
 703
 704         return 0;
 705
 706     case Pending:
 707         return -1;
 708
 709     case Failed:
 710
 711         if (flags.nonce_stale)
 712             /* nonce is stale, send new challenge */
 713             return 1;
 714
 715         return -2;
 716     }
 717
 718     return -2;
 719 }
 720
 721 /* add the [proxy]authorisation header */
 722 void
 723 AuthDigestUserRequest::addHeader(HttpReply * rep, int accel)
 724 {
 725     http_hdr_type type;
 726
 727     /* don't add to authentication error pages */
 728
 729     if ((!accel && rep->sline.status == HTTP_PROXY_AUTHENTICATION_REQUIRED)
 730             || (accel && rep->sline.status == HTTP_UNAUTHORIZED))
 731         return;
 732
 733     type = accel ? HDR_AUTHENTICATION_INFO : HDR_PROXY_AUTHENTICATION_INFO;
 734
 735 #if WAITING_FOR_TE
 736     /* test for http/1.1 transfer chunked encoding */
 737     if (chunkedtest)
 738         return;
 739
 740 #endif
 741
 742     if ((digestConfig.authenticate) && authDigestNonceLastRequest(nonce)) {
 743         flags.authinfo_sent = 1;
 744         debugs(29, 9, "authDigestAddHead: Sending type:" << type << " header: 'nextnonce=\"" << authenticateDigestNonceNonceb64(nonce) << "\"");
 745         httpHeaderPutStrf(&rep->header, type, "nextnonce=\"%s\"", authenticateDigestNonceNonceb64(nonce));
 746     }
 747 }
 748
 749 #if WAITING_FOR_TE
 750 /* add the [proxy]authorisation header */
 751 void
 752 AuthDigestUserRequest::addTrailer(HttpReply * rep, int accel)
 753 {
 754     int type;
 755
 756     if (!auth_user_request)
 757         return;
 758
 759
 760     /* has the header already been send? */
 761     if (flags.authinfo_sent)
 762         return;
 763
 764     /* don't add to authentication error pages */
 765     if ((!accel && rep->sline.status == HTTP_PROXY_AUTHENTICATION_REQUIRED)
 766             || (accel && rep->sline.status == HTTP_UNAUTHORIZED))
 767         return;
 768
 769     type = accel ? HDR_AUTHENTICATION_INFO : HDR_PROXY_AUTHENTICATION_INFO;
 770
 771     if ((digestConfig.authenticate) && authDigestNonceLastRequest(nonce)) {
 772         debugs(29, 9, "authDigestAddTrailer: Sending type:" << type << " header: 'nextnonce=\"" << authenticateDigestNonceNonceb64(nonce) << "\"");
 773         httpTrailerPutStrf(&rep->header, type, "nextnonce=\"%s\"", authenticateDigestNonceNonceb64(nonce));
 774     }
 775 }
 776
 777 #endif
 778
 779 /* add the [www-|Proxy-]authenticate header on a 407 or 401 reply */
 780 void
 781 AuthDigestConfig::fixHeader(AuthUserRequest *auth_user_request, HttpReply *rep, http_hdr_type type, HttpRequest * request)
 782 {
 783     if (!authenticate)
 784         return;
 785
 786     int stale = 0;
 787
 788     if (auth_user_request) {
 789         AuthDigestUserRequest *digest_request;
 790         digest_request = dynamic_cast < AuthDigestUserRequest * >(auth_user_request);
 791         assert (digest_request != NULL);
 792
 793         stale = digest_request->flags.nonce_stale;
 794     }
 795
 796     /* on a 407 or 401 we always use a new nonce */
 797     digest_nonce_h *nonce = authenticateDigestNonceNew();
 798
 799     debugs(29, 9, "authenticateFixHeader: Sending type:" << type <<
 800            " header: 'Digest realm=\"" << digestAuthRealm << "\", nonce=\"" <<
 801            authenticateDigestNonceNonceb64(nonce) << "\", qop=\"" << QOP_AUTH <<
 802            "\", stale=" << (stale ? "true" : "false"));
 803
 804     /* in the future, for WWW auth we may want to support the domain entry */
 805     httpHeaderPutStrf(&rep->header, type, "Digest realm=\"%s\", nonce=\"%s\", qop=\"%s\", stale=%s", digestAuthRealm, authenticateDigestNonceNonceb64(nonce), QOP_AUTH, stale ? "true" : "false");
 806 }
 807
 808 DigestUser::~DigestUser()
 809 {
 810
 811     dlink_node *link, *tmplink;
 812     link = nonces.head;
 813
 814     while (link) {
 815         tmplink = link;
 816         link = link->next;
 817         dlinkDelete(tmplink, &nonces);
 818         authDigestNoncePurge(static_cast < digest_nonce_h * >(tmplink->data));
 819         authDigestNonceUnlink(static_cast < digest_nonce_h * >(tmplink->data));
 820         dlinkNodeDelete(tmplink);
 821     }
 822 }
 823
 824 static void
 825 authenticateDigestHandleReply(void *data, char *reply)
 826 {
 827     DigestAuthenticateStateData *replyData = static_cast < DigestAuthenticateStateData * >(data);
 828     AuthUserRequest *auth_user_request;
 829     AuthDigestUserRequest *digest_request;
 830     digest_user_h *digest_user;
 831     char *t = NULL;
 832     void *cbdata;
 833     debugs(29, 9, "authenticateDigestHandleReply: {" << (reply ? reply : "<NULL>") << "}");
 834
 835     if (reply) {
 836         if ((t = strchr(reply, ' ')))
 837             *t++ = '\0';
 838
 839         if (*reply == '\0' || *reply == '\n')
 840             reply = NULL;
 841     }
 842
 843     assert(replyData->auth_user_request != NULL);
 844     auth_user_request = replyData->auth_user_request;
 845     digest_request = dynamic_cast < AuthDigestUserRequest * >(auth_user_request);
 846     assert(digest_request);
 847
 848     digest_user = dynamic_cast < digest_user_h * >(auth_user_request->user());
 849     assert(digest_user != NULL);
 850
 851     if (reply && (strncasecmp(reply, "ERR", 3) == 0)) {
 852         digest_request->credentials(AuthDigestUserRequest::Failed);
 853
 854         if (t && *t)
 855             digest_request->setDenyMessage(t);
 856     } else if (reply) {
 857         CvtBin(reply, digest_user->HA1);
 858         digest_user->HA1created = 1;
 859     }
 860
 861     if (cbdataReferenceValidDone(replyData->data, &cbdata))
 862         replyData->handler(cbdata, NULL);
 863
 864     //we know replyData->auth_user_request != NULL, or we'd have asserted
 865     AUTHUSERREQUESTUNLOCK(replyData->auth_user_request, "replyData");
 866
 867     cbdataFree(replyData);
 868 }
 869
 870 /* Initialize helpers and the like for this auth scheme. Called AFTER parsing the
 871  * config file */
 872 void
 873 AuthDigestConfig::init(AuthConfig * scheme)
 874 {
 875     if (authenticate) {
 876         authenticateDigestNonceSetup();
 877         authdigest_initialised = 1;
 878
 879         if (digestauthenticators == NULL)
 880             digestauthenticators = helperCreate("digestauthenticator");
 881
 882         digestauthenticators->cmdline = authenticate;
 883
 884         digestauthenticators->n_to_start = authenticateChildren;
 885
 886         digestauthenticators->ipc_type = IPC_STREAM;
 887
 888         helperOpenServers(digestauthenticators);
 889
 890         CBDATA_INIT_TYPE(DigestAuthenticateStateData);
 891     }
 892 }
 893
 894 void
 895 AuthDigestConfig::registerWithCacheManager(CacheManager & manager)
 896 {
 897     manager.registerAction("digestauthenticator",
 898                            "Digest User Authenticator Stats",
 899                            authenticateDigestStats, 0, 1);
 900 }
 901
 902 /* free any allocated configuration details */
 903 void
 904 AuthDigestConfig::done()
 905 {
 906     if (authenticate)
 907         wordlistDestroy(&authenticate);
 908
 909     safe_free(digestAuthRealm);
 910 }
 911
 912
 913 AuthDigestConfig::AuthDigestConfig()
 914 {
 915     /* TODO: move into initialisation list */
 916     authenticateChildren = 5;
 917     /* 5 minutes */
 918     nonceGCInterval = 5 * 60;
 919     /* 30 minutes */
 920     noncemaxduration = 30 * 60;
 921     /* 50 requests */
 922     noncemaxuses = 50;
 923     /* Not strict nonce count behaviour */
 924     NonceStrictness = 0;
 925     /* Verify nonce count */
 926     CheckNonceCount = 1;
 927 }
 928
 929 void
 930 AuthDigestConfig::parse(AuthConfig * scheme, int n_configured, char *param_str)
 931 {
 932     if (strcasecmp(param_str, "program") == 0) {
 933         if (authenticate)
 934             wordlistDestroy(&authenticate);
 935
 936         parse_wordlist(&authenticate);
 937
 938         requirePathnameExists("authparam digest program", authenticate->key);
 939     } else if (strcasecmp(param_str, "children") == 0) {
 940         parse_int(&authenticateChildren);
 941     } else if (strcasecmp(param_str, "realm") == 0) {
 942         parse_eol(&digestAuthRealm);
 943     } else if (strcasecmp(param_str, "nonce_garbage_interval") == 0) {
 944         parse_time_t(&nonceGCInterval);
 945     } else if (strcasecmp(param_str, "nonce_max_duration") == 0) {
 946         parse_time_t(&noncemaxduration);
 947     } else if (strcasecmp(param_str, "nonce_max_count") == 0) {
 948         parse_int((int *) &noncemaxuses);
 949     } else if (strcasecmp(param_str, "nonce_strictness") == 0) {
 950         parse_onoff(&NonceStrictness);
 951     } else if (strcasecmp(param_str, "check_nonce_count") == 0) {
 952         parse_onoff(&CheckNonceCount);
 953     } else if (strcasecmp(param_str, "post_workaround") == 0) {
 954         parse_onoff(&PostWorkaround);
 955     } else {
 956         debugs(29, 0, "unrecognised digest auth scheme parameter '" << param_str << "'");
 957     }
 958 }
 959
 960 const char *
 961 AuthDigestConfig::type() const
 962 {
 963     return digestScheme::GetInstance().type();
 964 }
 965
 966
 967 static void
 968 authenticateDigestStats(StoreEntry * sentry)
 969 {
 970     helperStats(sentry, digestauthenticators, "Digest Authenticator Statistics");
 971 }
 972
 973 /* NonceUserUnlink: remove the reference to auth_user and unlink the node from the list */
 974
 975 static void
 976 authDigestNonceUserUnlink(digest_nonce_h * nonce)
 977 {
 978     digest_user_h *digest_user;
 979     dlink_node *link, *tmplink;
 980
 981     if (!nonce)
 982         return;
 983
 984     if (!nonce->user)
 985         return;
 986
 987     digest_user = nonce->user;
 988
 989     /* unlink from the user list. Yes we're crossing structures but this is the only
 990      * time this code is needed
 991      */
 992     link = digest_user->nonces.head;
 993
 994     while (link) {
 995         tmplink = link;
 996         link = link->next;
 997
 998         if (tmplink->data == nonce) {
 999             dlinkDelete(tmplink, &digest_user->nonces);
1000             authDigestNonceUnlink(static_cast < digest_nonce_h * >(tmplink->data));
1001             dlinkNodeDelete(tmplink);
1002             link = NULL;
1003         }
1004     }
1005
1006     /* this reference to user was not locked because freeeing the user frees
1007      * the nonce too.
1008      */
1009     nonce->user = NULL;
1010 }
1011
1012 /* authDigestUserLinkNonce: add a nonce to a given user's struct */
1013
1014 static void
1015 authDigestUserLinkNonce(DigestUser * user, digest_nonce_h * nonce)
1016 {
1017     dlink_node *node;
1018     digest_user_h *digest_user;
1019
1020     if (!user || !nonce)
1021         return;
1022
1023     digest_user = user;
1024
1025     node = digest_user->nonces.head;
1026
1027     while (node && (node->data != nonce))
1028         node = node->next;
1029
1030     if (node)
1031         return;
1032
1033     node = dlinkNodeNew();
1034
1035     dlinkAddTail(nonce, node, &digest_user->nonces);
1036
1037     authDigestNonceLink(nonce);
1038
1039     /* ping this nonce to this auth user */
1040     assert((nonce->user == NULL) || (nonce->user = user));
1041
1042     /* we don't lock this reference because removing the user removes the
1043      * hash too. Of course if that changes we're stuffed so read the code huh?
1044      */
1045     nonce->user = user;
1046 }
1047
1048 /* setup the necessary info to log the username */
1049 static AuthUserRequest *
1050 authDigestLogUsername(char *username)
1051 {
1052     AuthDigestUserRequest *auth_user_request = new AuthDigestUserRequest();
1053     assert(auth_user_request != NULL);
1054
1055     /* log the username */
1056     debugs(29, 9, "authDigestLogUsername: Creating new user for logging '" << username << "'");
1057     digest_user_h *digest_user = new DigestUser(&digestConfig);
1058     /* save the credentials */
1059     digest_user->username(username);
1060     /* set the auth_user type */
1061     digest_user->auth_type = AUTH_BROKEN;
1062     /* link the request to the user */
1063     auth_user_request->authUser(digest_user);
1064     auth_user_request->user(digest_user);
1065     digest_user->addRequest (auth_user_request);
1066     return auth_user_request;
1067 }
1068
1069 /*
1070  * Decode a Digest [Proxy-]Auth string, placing the results in the passed
1071  * Auth_user structure.
1072  */
1073 AuthUserRequest *
1074 AuthDigestConfig::decode(char const *proxy_auth)
1075 {
1076     const char *item;
1077     const char *p;
1078     const char *pos = NULL;
1079     char *username = NULL;
1080     digest_nonce_h *nonce;
1081     int ilen;
1082
1083     debugs(29, 9, "authenticateDigestDecodeAuth: beginning");
1084
1085     AuthDigestUserRequest *digest_request = new AuthDigestUserRequest();
1086
1087     /* trim DIGEST from string */
1088
1089     while (xisgraph(*proxy_auth))
1090         proxy_auth++;
1091
1092     /* Trim leading whitespace before decoding */
1093     while (xisspace(*proxy_auth))
1094         proxy_auth++;
1095
1096     String temp(proxy_auth);
1097
1098     while (strListGetItem(&temp, ',', &item, &ilen, &pos)) {
1099         if ((p = strchr(item, '=')) && (p - item < ilen))
1100             ilen = p++ - item;
1101
1102         if (!strncmp(item, "username", ilen)) {
1103             /* white space */
1104
1105             while (xisspace(*p))
1106                 p++;
1107
1108             /* quote mark */
1109             p++;
1110
1111             username = xstrndup(p, strchr(p, '"') + 1 - p);
1112
1113             debugs(29, 9, "authDigestDecodeAuth: Found Username '" << username << "'");
1114         } else if (!strncmp(item, "realm", ilen)) {
1115             /* white space */
1116
1117             while (xisspace(*p))
1118                 p++;
1119
1120             /* quote mark */
1121             p++;
1122
1123             digest_request->realm = xstrndup(p, strchr(p, '"') + 1 - p);
1124
1125             debugs(29, 9, "authDigestDecodeAuth: Found realm '" << digest_request->realm << "'");
1126         } else if (!strncmp(item, "qop", ilen)) {
1127             /* white space */
1128
1129             while (xisspace(*p))
1130                 p++;
1131
1132             if (*p == '\"')
1133                 /* quote mark */
1134                 p++;
1135
1136             digest_request->qop = xstrndup(p, strcspn(p, "\" \t\r\n()<>@,;:\\/[]?={}") + 1);
1137
1138             debugs(29, 9, "authDigestDecodeAuth: Found qop '" << digest_request->qop << "'");
1139         } else if (!strncmp(item, "algorithm", ilen)) {
1140             /* white space */
1141
1142             while (xisspace(*p))
1143                 p++;
1144
1145             if (*p == '\"')
1146                 /* quote mark */
1147                 p++;
1148
1149             digest_request->algorithm = xstrndup(p, strcspn(p, "\" \t\r\n()<>@,;:\\/[]?={}") + 1);
1150
1151             debugs(29, 9, "authDigestDecodeAuth: Found algorithm '" << digest_request->algorithm << "'");
1152         } else if (!strncmp(item, "uri", ilen)) {
1153             /* white space */
1154
1155             while (xisspace(*p))
1156                 p++;
1157
1158             /* quote mark */
1159             p++;
1160
1161             digest_request->uri = xstrndup(p, strchr(p, '"') + 1 - p);
1162
1163             debugs(29, 9, "authDigestDecodeAuth: Found uri '" << digest_request->uri << "'");
1164         } else if (!strncmp(item, "nonce", ilen)) {
1165             /* white space */
1166
1167             while (xisspace(*p))
1168                 p++;
1169
1170             /* quote mark */
1171             p++;
1172
1173             digest_request->nonceb64 = xstrndup(p, strchr(p, '"') + 1 - p);
1174
1175             debugs(29, 9, "authDigestDecodeAuth: Found nonce '" << digest_request->nonceb64 << "'");
1176         } else if (!strncmp(item, "nc", ilen)) {
1177             /* white space */
1178
1179             while (xisspace(*p))
1180                 p++;
1181
1182             xstrncpy(digest_request->nc, p, 9);
1183
1184             debugs(29, 9, "authDigestDecodeAuth: Found noncecount '" << digest_request->nc << "'");
1185         } else if (!strncmp(item, "cnonce", ilen)) {
1186             /* white space */
1187
1188             while (xisspace(*p))
1189                 p++;
1190
1191             /* quote mark */
1192             p++;
1193
1194             digest_request->cnonce = xstrndup(p, strchr(p, '"') + 1 - p);
1195
1196             debugs(29, 9, "authDigestDecodeAuth: Found cnonce '" << digest_request->cnonce << "'");
1197         } else if (!strncmp(item, "response", ilen)) {
1198             /* white space */
1199
1200             while (xisspace(*p))
1201                 p++;
1202
1203             /* quote mark */
1204             p++;
1205
1206             digest_request->response = xstrndup(p, strchr(p, '"') + 1 - p);
1207
1208             debugs(29, 9, "authDigestDecodeAuth: Found response '" << digest_request->response << "'");
1209         }
1210     }
1211
1212     temp.clean();
1213
1214
1215     /* now we validate the data given to us */
1216
1217     /*
1218      * TODO: on invalid parameters we should return 400, not 407.
1219      * Find some clean way of doing this. perhaps return a valid
1220      * struct, and set the direction to clientwards combined with
1221      * a change to the clientwards handling code (ie let the
1222      * clientwards call set the error type (but limited to known
1223      * correct values - 400/401/407
1224      */
1225
1226     /* first the NONCE count */
1227
1228     if (digest_request->cnonce && strlen(digest_request->nc) != 8) {
1229         debugs(29, 4, "authenticateDigestDecode: nonce count length invalid");
1230         delete digest_request;
1231         return authDigestLogUsername(username);
1232     }
1233
1234     /* now the nonce */
1235     nonce = authenticateDigestNonceFindNonce(digest_request->nonceb64);
1236
1237     if (!nonce) {
1238         /* we couldn't find a matching nonce! */
1239         debugs(29, 4, "authenticateDigestDecode: Unexpected or invalid nonce received");
1240         delete digest_request;
1241         return authDigestLogUsername(username);
1242     }
1243
1244     digest_request->nonce = nonce;
1245     authDigestNonceLink(nonce);
1246
1247     /* check the qop is what we expected. Note that for compatability with
1248      * RFC 2069 we should support a missing qop. Tough. */
1249
1250     if (!digest_request->qop || strcmp(digest_request->qop, QOP_AUTH)) {
1251         /* we received a qop option we didn't send */
1252         debugs(29, 4, "authenticateDigestDecode: Invalid qop option received");
1253         delete digest_request;
1254         return authDigestLogUsername(username);
1255     }
1256
1257     /* we can't check the URI just yet. We'll check it in the
1258      * authenticate phase */
1259
1260     /* is the response the correct length? */
1261
1262     if (!digest_request->response || strlen(digest_request->response) != 32) {
1263         debugs(29, 4, "authenticateDigestDecode: Response length invalid");
1264         delete digest_request;
1265         return authDigestLogUsername(username);
1266     }
1267
1268     /* do we have a username ? */
1269     if (!username || username[0] == '\0') {
1270         debugs(29, 4, "authenticateDigestDecode: Empty or not present username");
1271         delete digest_request;
1272         return authDigestLogUsername(username);
1273     }
1274
1275     /* check that we're not being hacked / the username hasn't changed */
1276     if (nonce->user && strcmp(username, nonce->user->username())) {
1277         debugs(29, 4, "authenticateDigestDecode: Username for the nonce does not equal the username for the request");
1278         delete digest_request;
1279         return authDigestLogUsername(username);
1280     }
1281
1282     /* if we got a qop, did we get a cnonce or did we get a cnonce wihtout a qop? */
1283     if ((digest_request->qop && !digest_request->cnonce)
1284             || (!digest_request->qop && digest_request->cnonce)) {
1285         debugs(29, 4, "authenticateDigestDecode: qop without cnonce, or vice versa!");
1286         delete digest_request;
1287         return authDigestLogUsername(username);
1288     }
1289
1290     /* check the algorithm is present and supported */
1291     if (!digest_request->algorithm)
1292         digest_request->algorithm = xstrndup("MD5", 4);
1293     else if (strcmp(digest_request->algorithm, "MD5")
1294              && strcmp(digest_request->algorithm, "MD5-sess")) {
1295         debugs(29, 4, "authenticateDigestDecode: invalid algorithm specified!");
1296         delete digest_request;
1297         return authDigestLogUsername(username);
1298     }
1299
1300     /* the method we'll check at the authenticate step as well */
1301
1302
1303     /* we don't send or parse opaques. Ok so we're flexable ... */
1304
1305     /* find the user */
1306     digest_user_h *digest_user;
1307
1308     auth_user_t *auth_user;
1309
1310     if ((auth_user = authDigestUserFindUsername(username)) == NULL) {
1311         /* the user doesn't exist in the username cache yet */
1312         debugs(29, 9, "authDigestDecodeAuth: Creating new digest user '" << username << "'");
1313         digest_user = new DigestUser (&digestConfig);
1314         /* auth_user is a parent */
1315         auth_user = digest_user;
1316         /* save the username */
1317         digest_user->username(username);
1318         /* set the user type */
1319         digest_user->auth_type = AUTH_DIGEST;
1320         /* this auth_user struct is the one to get added to the
1321          * username cache */
1322         /* store user in hash's */
1323         digest_user->addToNameCache();
1324
1325         /*
1326          * Add the digest to the user so we can tell if a hacking
1327          * or spoofing attack is taking place. We do this by assuming
1328          * the user agent won't change user name without warning.
1329          */
1330         authDigestUserLinkNonce(digest_user, nonce);
1331     } else {
1332         debugs(29, 9, "authDigestDecodeAuth: Found user '" << username << "' in the user cache as '" << auth_user << "'");
1333         digest_user = static_cast < digest_user_h * >(auth_user);
1334         xfree(username);
1335     }
1336
1337     /*link the request and the user */
1338     assert(digest_request != NULL);
1339
1340     digest_request->authUser (digest_user);
1341
1342     digest_request->user(digest_user);
1343
1344     digest_user->addRequest (digest_request);
1345
1346     debugs(29, 9, "username = '" << digest_user->username() << "'\nrealm = '" <<
1347            digest_request->realm << "'\nqop = '" << digest_request->qop <<
1348            "'\nalgorithm = '" << digest_request->algorithm << "'\nuri = '" <<
1349            digest_request->uri << "'\nnonce = '" << digest_request->nonceb64 <<
1350            "'\nnc = '" << digest_request->nc << "'\ncnonce = '" <<
1351            digest_request->cnonce << "'\nresponse = '" <<
1352            digest_request->response << "'\ndigestnonce = '" << nonce << "'");
1353
1354     return digest_request;
1355 }
1356
1357 /* send the initial data to a digest authenticator module */
1358 void
1359 AuthDigestUserRequest::module_start(RH * handler, void *data)
1360 {
1361     DigestAuthenticateStateData *r = NULL;
1362     char buf[8192];
1363     digest_user_h *digest_user;
1364     assert(user()->auth_type == AUTH_DIGEST);
1365     digest_user = dynamic_cast < digest_user_h * >(user());
1366     assert(digest_user != NULL);
1367     debugs(29, 9, "authenticateStart: '\"" << digest_user->username() << "\":\"" << realm << "\"'");
1368
1369     if (digestConfig.authenticate == NULL) {
1370         handler(data, NULL);
1371         return;
1372     }
1373
1374     r = cbdataAlloc(DigestAuthenticateStateData);
1375     r->handler = handler;
1376     r->data = cbdataReference(data);
1377     r->auth_user_request = this;
1378     AUTHUSERREQUESTLOCK(r->auth_user_request, "r");
1379     snprintf(buf, 8192, "\"%s\":\"%s\"\n", digest_user->username(), realm);
1380
1381     helperSubmit(digestauthenticators, buf, authenticateDigestHandleReply, r);
1382 }
1383
1384 DigestUser::DigestUser (AuthConfig *config) : AuthUser (config), HA1created (0)
1385 {}
1386
1387 auth_user_t *
1388 AuthDigestUserRequest::authUser() const
1389 {
1390     return const_cast<AuthUser *>(user());
1391 }
1392
1393 void
1394 AuthDigestUserRequest::authUser(auth_user_t *aUser)
1395 {
1396     assert (!authUser());
1397     user(aUser);
1398
1399     user()->lock()
1400
1401     ;
1402 }
1403
1404 AuthDigestUserRequest::CredentialsState
1405 AuthDigestUserRequest::credentials() const
1406 {
1407     return credentials_ok;
1408
1409 }
1410
1411 void
1412 AuthDigestUserRequest::credentials(CredentialsState newCreds)
1413 {
1414     credentials_ok = newCreds;
1415 }
1416
1417 AuthDigestUserRequest::AuthDigestUserRequest() : nonceb64(NULL) ,cnonce(NULL) ,realm(NULL),
1418         pszPass(NULL) ,algorithm(NULL) ,pszMethod(NULL),
1419         qop(NULL) ,uri(NULL) ,response(NULL),
1420         nonce(NULL), _theUser (NULL) ,
1421         credentials_ok (Unchecked)
1422 {}
1423
1424 /* delete the digest request structure. Does NOT delete related structures */
1425 AuthDigestUserRequest::~AuthDigestUserRequest()
1426 {
1427     safe_free (nonceb64);
1428     safe_free (cnonce);
1429     safe_free (realm);
1430     safe_free (pszPass);
1431     safe_free (algorithm);
1432     safe_free (pszMethod);
1433     safe_free (qop);
1434     safe_free (uri);
1435     safe_free (response);
1436
1437     if (nonce)
1438         authDigestNonceUnlink(nonce);
1439 }
1440
1441 AuthConfig *
1442 digestScheme::createConfig()
1443 {
1444     return &digestConfig;
1445 }
1446