libmicrohttpd

commit 21d8f5461bc8b999cd2c6bfa8b8cacacb267b17f
parent e1d6b7635b9c5a37fb3be5e5748278db64ec1b8b
Author: Evgeny Grin (Karlson2k) <k2k@narod.ru>
Date:   Mon, 15 Aug 2022 21:23:42 +0300

digestauth: updated the method of nonce generation in default mode

Diffstat:
M
src/include/microhttpd.h
 | 
7
++++---
M
src/microhttpd/digestauth.c
 | 
19
+++++++++++++++++--

2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/src/include/microhttpd.h b/src/include/microhttpd.h
@@ -1562,6 +1562,9 @@ enum MHD_DAuthBindNonce
    * for any request in the same "protection space".
    * CPU is loaded less when this value is used when checking client's
    * authorisation request.
+   * This mode gives MHD maximum flexibility for nonces generation and can
+   * prevent possible nonce collisions (and corresponding log warning messages)
+   * when clients' requests are intensive.
    * This value cannot be combined with other values.
    */
   MHD_DAUTH_BIND_NONCE_NONE = 0,
@@ -1596,9 +1599,6 @@ enum MHD_DAuthBindNonce
    * jump from one IP to another (mobile or Wi-Fi handover, DHCP re-assignment,
    * Multi-NAT, different proxy chain and other reasons), while IP address
    * spoofing could be used relatively easily.
-   * However, if server gets intensive requests with Digest Authentication
-   * this value helps to generate unique nonces for several requests, received
-   * exactly at the same time (within one millisecond) from different clients.
    */
   MHD_DAUTH_BIND_NONCE_CLIENT_IP = 1 << 3
 } _MHD_FLAGS_ENUM;
@@ -2014,6 +2014,7 @@ enum MHD_OPTION
    * #MHD_digest_auth_check3() and similar functions.
    * This option should be followed by an 'unsigned int` argument with value
    * formed as bitwise OR combination of #MHD_DAuthBindNonce values.
+   * When not specified, default value #MHD_DAUTH_BIND_NONCE_NONE is used.
    * @note Available since #MHD_VERSION 0x00097531
    */
   MHD_OPTION_DIGEST_AUTH_NONCE_BIND_TYPE = 36
diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
@@ -1380,6 +1380,16 @@ calculate_nonce (uint64_t nonce_time,
                    rnd_size);
     digest_update_with_colon (da);
   }
+  if ( (MHD_DAUTH_BIND_NONCE_NONE == bind_options) &&
+       (0 != saddr_size) )
+  {
+    /* Use full client address including source port to make unique nonces
+     * for requests received exactly at the same time */
+    digest_update (da,
+                   saddr,
+                   saddr_size);
+    digest_update_with_colon (da);
+  }
   if ( (0 != (bind_options & MHD_DAUTH_BIND_NONCE_CLIENT_IP)) &&
        (0 != saddr_size) )
   {
@@ -1395,7 +1405,8 @@ calculate_nonce (uint64_t nonce_time,
 #endif /* HAVE_INET6 */
     digest_update_with_colon (da);
   }
-  if (0 != (bind_options & MHD_DAUTH_BIND_NONCE_URI))
+  if ( (MHD_DAUTH_BIND_NONCE_NONE == bind_options) ||
+       (0 != (bind_options & MHD_DAUTH_BIND_NONCE_URI)))
   {
     if (MHD_HTTP_MTHD_OTHER != mthd_e)
     {
@@ -1410,7 +1421,10 @@ calculate_nonce (uint64_t nonce_time,
     }
     else
       digest_update_str (da, method);
+  }
 
+  if (0 != (bind_options & MHD_DAUTH_BIND_NONCE_URI))
+  {
     digest_update_with_colon (da);
 
     digest_update (da,
@@ -1435,7 +1449,8 @@ calculate_nonce (uint64_t nonce_time,
     }
     digest_update_with_colon (da);
   }
-  if (0 != (bind_options & MHD_DAUTH_BIND_NONCE_REALM))
+  if ( (MHD_DAUTH_BIND_NONCE_NONE == bind_options) ||
+       (0 != (bind_options & MHD_DAUTH_BIND_NONCE_REALM)))
   {
     digest_update (da,
                    realm,