1 /* $NetBSD: auth-bozo.c,v 1.16 2014/12/26 19:52:00 mrg Exp $ */
2
3 /* $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $ */
4
5 /*
6 * Copyright (c) 1997-2014 Matthew R. Green
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer and
16 * dedication in the documentation and/or other materials provided
17 * with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
26 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 */
32
33 /* this code implements "http basic authorisation" for bozohttpd */
34
35 #ifdef DO_HTPASSWD
36
37 #include <sys/param.h>
38
39 #include <string.h>
40 #include <stdlib.h>
41 #include <unistd.h>
42
43 #include "bozohttpd.h"
44
45 #ifndef AUTH_FILE
46 #define AUTH_FILE ".htpasswd"
47 #endif
48
49 static ssize_t base64_decode(const unsigned char *, size_t,
50 unsigned char *, size_t);
51
52 /*
53 * Check if HTTP authentication is required
54 */
55 int
bozo_auth_check(bozo_httpreq_t * request,const char * file)56 bozo_auth_check(bozo_httpreq_t *request, const char *file)
57 {
58 bozohttpd_t *httpd = request->hr_httpd;
59 struct stat sb;
60 char dir[MAXPATHLEN], authfile[MAXPATHLEN], *basename;
61 char user[BUFSIZ], *pass;
62 FILE *fp;
63 int len;
64
65 /* get dir=dirname(file) */
66 snprintf(dir, sizeof(dir), "%s", file);
67 if ((basename = strrchr(dir, '/')) == NULL)
68 strcpy(dir, ".");
69 else {
70 *basename++ = '\0';
71 /* ensure basename(file) != AUTH_FILE */
72 if (bozo_check_special_files(request, basename))
73 return 1;
74 }
75 request->hr_authrealm = bozostrdup(httpd, dir);
76
77 if ((size_t)snprintf(authfile, sizeof(authfile), "%s/%s", dir, AUTH_FILE) >=
78 sizeof(authfile)) {
79 return bozo_http_error(httpd, 404, request,
80 "authfile path too long");
81 }
82 if (stat(authfile, &sb) < 0) {
83 debug((httpd, DEBUG_NORMAL,
84 "bozo_auth_check realm `%s' dir `%s' authfile `%s' missing",
85 dir, file, authfile));
86 return 0;
87 }
88 if ((fp = fopen(authfile, "r")) == NULL)
89 return bozo_http_error(httpd, 403, request,
90 "no permission to open authfile");
91 debug((httpd, DEBUG_NORMAL,
92 "bozo_auth_check realm `%s' dir `%s' authfile `%s' open",
93 dir, file, authfile));
94 if (request->hr_authuser && request->hr_authpass) {
95 while (fgets(user, sizeof(user), fp) != NULL) {
96 len = strlen(user);
97 if (len > 0 && user[len-1] == '\n')
98 user[--len] = '\0';
99 if ((pass = strchr(user, ':')) == NULL)
100 continue;
101 *pass++ = '\0';
102 debug((httpd, DEBUG_NORMAL,
103 "bozo_auth_check authfile `%s':`%s' "
104 "client `%s':`%s'",
105 user, pass, request->hr_authuser,
106 request->hr_authpass));
107 if (strcmp(request->hr_authuser, user) != 0)
108 continue;
109 if (strcmp(crypt(request->hr_authpass, pass),
110 pass) != 0)
111 break;
112 fclose(fp);
113 return 0;
114 }
115 }
116 fclose(fp);
117 return bozo_http_error(httpd, 401, request, "bad auth");
118 }
119
120 void
bozo_auth_init(bozo_httpreq_t * request)121 bozo_auth_init(bozo_httpreq_t *request)
122 {
123 request->hr_authuser = NULL;
124 request->hr_authpass = NULL;
125 }
126
127 void
bozo_auth_cleanup(bozo_httpreq_t * request)128 bozo_auth_cleanup(bozo_httpreq_t *request)
129 {
130
131 if (request == NULL)
132 return;
133 free(request->hr_authuser);
134 free(request->hr_authpass);
135 free(request->hr_authrealm);
136 }
137
138 int
bozo_auth_check_headers(bozo_httpreq_t * request,char * val,char * str,ssize_t len)139 bozo_auth_check_headers(bozo_httpreq_t *request, char *val, char *str, ssize_t len)
140 {
141 bozohttpd_t *httpd = request->hr_httpd;
142
143 if (strcasecmp(val, "authorization") == 0 &&
144 strncasecmp(str, "Basic ", 6) == 0) {
145 char authbuf[BUFSIZ];
146 char *pass = NULL;
147 ssize_t alen;
148
149 alen = base64_decode((unsigned char *)str + 6,
150 (size_t)(len - 6),
151 (unsigned char *)authbuf,
152 sizeof(authbuf) - 1);
153 if (alen != -1)
154 authbuf[alen] = '\0';
155 if (alen == -1 ||
156 (pass = strchr(authbuf, ':')) == NULL)
157 return bozo_http_error(httpd, 400, request,
158 "bad authorization field");
159 *pass++ = '\0';
160 free(request->hr_authuser);
161 free(request->hr_authpass);
162 request->hr_authuser = bozostrdup(httpd, authbuf);
163 request->hr_authpass = bozostrdup(httpd, pass);
164 debug((httpd, DEBUG_FAT,
165 "decoded authorization `%s' as `%s':`%s'",
166 str, request->hr_authuser, request->hr_authpass));
167 /* don't store in request->headers */
168 return 1;
169 }
170 return 0;
171 }
172
173 int
bozo_auth_check_special_files(bozo_httpreq_t * request,const char * name)174 bozo_auth_check_special_files(bozo_httpreq_t *request,
175 const char *name)
176 {
177 bozohttpd_t *httpd = request->hr_httpd;
178
179 if (strcmp(name, AUTH_FILE) == 0)
180 return bozo_http_error(httpd, 403, request,
181 "no permission to open authfile");
182 return 0;
183 }
184
185 void
bozo_auth_check_401(bozo_httpreq_t * request,int code)186 bozo_auth_check_401(bozo_httpreq_t *request, int code)
187 {
188 bozohttpd_t *httpd = request->hr_httpd;
189
190 if (code == 401)
191 bozo_printf(httpd,
192 "WWW-Authenticate: Basic realm=\"%s\"\r\n",
193 (request && request->hr_authrealm) ?
194 request->hr_authrealm : "default realm");
195 }
196
197 #ifndef NO_CGIBIN_SUPPORT
198 void
bozo_auth_cgi_setenv(bozo_httpreq_t * request,char *** curenvpp)199 bozo_auth_cgi_setenv(bozo_httpreq_t *request,
200 char ***curenvpp)
201 {
202 bozohttpd_t *httpd = request->hr_httpd;
203
204 if (request->hr_authuser && *request->hr_authuser) {
205 bozo_setenv(httpd, "AUTH_TYPE", "Basic", (*curenvpp)++);
206 bozo_setenv(httpd, "REMOTE_USER", request->hr_authuser,
207 (*curenvpp)++);
208 }
209 }
210
211 int
bozo_auth_cgi_count(bozo_httpreq_t * request)212 bozo_auth_cgi_count(bozo_httpreq_t *request)
213 {
214 return (request->hr_authuser && *request->hr_authuser) ? 2 : 0;
215 }
216 #endif /* NO_CGIBIN_SUPPORT */
217
218 /*
219 * Decode len bytes starting at in using base64 encoding into out.
220 * Result is *not* NUL terminated.
221 * Written by Luke Mewburn <lukem@NetBSD.org>
222 */
223 const unsigned char decodetable[] = {
224 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
225 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
226 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 62, 255, 255, 255, 63,
227 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 255, 255, 255, 0, 255, 255,
228 255, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
229 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 255, 255, 255, 255, 255,
230 255, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
231 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 255, 255, 255, 255, 255,
232 };
233
234 static ssize_t
base64_decode(const unsigned char * in,size_t ilen,unsigned char * out,size_t olen)235 base64_decode(const unsigned char *in, size_t ilen, unsigned char *out,
236 size_t olen)
237 {
238 unsigned char *cp;
239 size_t i;
240
241 if (ilen == 0) {
242 if (olen)
243 *out = '\0';
244 return 0;
245 }
246
247 cp = out;
248 for (i = 0; i < ilen; i += 4) {
249 if (cp + 3 > out + olen)
250 return (-1);
251 #define IN_CHECK(x) \
252 if ((x) > sizeof(decodetable) || decodetable[(x)] == 255) \
253 return(-1)
254
255 IN_CHECK(in[i + 0]);
256 /*LINTED*/
257 *(cp++) = decodetable[in[i + 0]] << 2
258 | decodetable[in[i + 1]] >> 4;
259 IN_CHECK(in[i + 1]);
260 /*LINTED*/
261 *(cp++) = decodetable[in[i + 1]] << 4
262 | decodetable[in[i + 2]] >> 2;
263 IN_CHECK(in[i + 2]);
264 *(cp++) = decodetable[in[i + 2]] << 6
265 | decodetable[in[i + 3]];
266 #undef IN_CHECK
267 }
268 while (i > 0 && in[i - 1] == '=')
269 cp--,i--;
270 return (cp - out);
271 }
272 #endif /* DO_HTPASSWD */
273