request_auth_get.c (5916B)
1 /* SPDX-License-Identifier: LGPL-2.1-or-later OR (GPL-2.0-or-later WITH eCos-exception-2.0) */ 2 /* 3 This file is part of GNU libmicrohttpd. 4 Copyright (C) 2022-2024 Evgeny Grin (Karlson2k) 5 6 GNU libmicrohttpd is free software; you can redistribute it and/or 7 modify it under the terms of the GNU Lesser General Public 8 License as published by the Free Software Foundation; either 9 version 2.1 of the License, or (at your option) any later version. 10 11 GNU libmicrohttpd is distributed in the hope that it will be useful, 12 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 Lesser General Public License for more details. 15 16 Alternatively, you can redistribute GNU libmicrohttpd and/or 17 modify it under the terms of the GNU General Public License as 18 published by the Free Software Foundation; either version 2 of 19 the License, or (at your option) any later version, together 20 with the eCos exception, as follows: 21 22 As a special exception, if other files instantiate templates or 23 use macros or inline functions from this file, or you compile this 24 file and link it with other works to produce a work based on this 25 file, this file does not by itself cause the resulting work to be 26 covered by the GNU General Public License. However the source code 27 for this file must still be made available in accordance with 28 section (3) of the GNU General Public License v2. 29 30 This exception does not invalidate any other reasons why a work 31 based on this file might be covered by the GNU General Public 32 License. 33 34 You should have received copies of the GNU Lesser General Public 35 License and the GNU General Public License along with this library; 36 if not, see <https://www.gnu.org/licenses/>. 37 */ 38 39 /** 40 * @file src/mhd2/request_auth_get.c 41 * @brief The implementation of the request Authorization header parsing helper 42 * @author Karlson2k (Evgeny Grin) 43 */ 44 45 #include "mhd_sys_options.h" 46 47 #include "sys_bool_type.h" 48 #include "sys_base_types.h" 49 50 #include "mhd_assert.h" 51 #include "mhd_unreachable.h" 52 #include "mhd_cntnr_ptr.h" 53 #include "mhd_str_macros.h" 54 55 #include "mhd_str_types.h" 56 #include "mhd_request.h" 57 #include "mhd_connection.h" 58 #include "mhd_daemon.h" 59 60 #include "mhd_str.h" 61 62 #include "request_auth_get.h" 63 64 MHD_INTERNAL MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_ 65 MHD_FN_PAR_OUT_ (3) bool 66 mhd_request_get_auth_header_value (struct MHD_Request *restrict request, 67 enum mhd_AuthHeaderKind auth_type, 68 struct MHD_String *restrict header_value) 69 { 70 static const struct MHD_String hdr_name = mhd_MSTR_INIT ("Authorization"); 71 #ifdef MHD_SUPPORT_AUTH_BASIC 72 static const struct MHD_String prefix_basic = mhd_MSTR_INIT ("Basic"); 73 #endif 74 #ifdef MHD_SUPPORT_AUTH_DIGEST 75 static const struct MHD_String prefix_digest = mhd_MSTR_INIT ("Digest"); 76 #endif 77 const int strict_lvl = 78 mhd_CNTNR_PTR (request, \ 79 struct MHD_Connection, rq)->daemon->req_cfg.strictness; 80 const bool allow_tab_as_sep = (-2 >= strict_lvl); 81 const char *prefix_str; 82 size_t prefix_len; 83 struct mhd_RequestField *f; 84 size_t p_start; 85 86 mhd_assert (mhd_HTTP_STAGE_HEADERS_PROCESSED <= \ 87 mhd_CNTNR_PTR (request, struct MHD_Connection, rq)->stage); 88 89 switch (auth_type) 90 { 91 #ifdef MHD_SUPPORT_AUTH_BASIC 92 case mhd_AUTH_HDR_BASIC: 93 prefix_str = prefix_basic.cstr; 94 prefix_len = prefix_basic.len; 95 break; 96 #endif 97 #ifdef MHD_SUPPORT_AUTH_DIGEST 98 case mhd_AUTH_HDR_DIGEST: 99 prefix_str = prefix_digest.cstr; 100 prefix_len = prefix_digest.len; 101 break; 102 #endif 103 #ifdef MHD_ENUMS_NEED_TRAILING_VALUE 104 case mhd_AUTH_HDR_KIND_SENTINEL: 105 #endif 106 default: 107 mhd_UNREACHABLE (); 108 return false; 109 } 110 111 for (f = mhd_DLINKEDL_GET_FIRST (request, fields); NULL != f; 112 f = mhd_DLINKEDL_GET_NEXT (f, fields)) 113 { 114 if (hdr_name.len != f->field.nv.name.len) 115 continue; 116 if (MHD_VK_HEADER != f->field.kind) 117 continue; 118 if (prefix_len > f->field.nv.value.len) 119 continue; 120 if (! mhd_str_equal_caseless_bin_n (hdr_name.cstr, 121 f->field.nv.name.cstr, 122 hdr_name.len)) 123 continue; 124 if (! mhd_str_equal_caseless_bin_n (prefix_str, 125 f->field.nv.value.cstr, 126 prefix_len)) 127 continue; 128 /* Match only if the search token string is the full header value or 129 the search token is followed by space */ 130 if (prefix_len == f->field.nv.name.len) 131 { 132 header_value->cstr = f->field.nv.value.cstr + f->field.nv.name.len; 133 header_value->len = 0; 134 return true; /* Success exit point */ 135 } 136 if (' ' == f->field.nv.value.cstr[prefix_len]) 137 break; 138 /* Note: RFC 7235 (Section 2.1) only allows the space character. 139 However, as a slight violation of the specifications, a tab character 140 is also recognised here for additional flexibility and 141 uniformity (tabs are supported as separators between parameters). */ 142 if (allow_tab_as_sep && 143 ('\t' == f->field.nv.value.cstr[prefix_len])) 144 break; 145 } 146 if (NULL == f) 147 return false; /* Failure exit point */ 148 149 mhd_assert (prefix_len + 1 <= f->field.nv.name.len); 150 /* Skip leading whitespaces */ 151 for (p_start = prefix_len + 1; p_start < f->field.nv.name.len; ++p_start) 152 { 153 if ((' ' != f->field.nv.value.cstr[p_start]) && 154 ('\t' != f->field.nv.value.cstr[p_start])) 155 break; 156 } 157 header_value->cstr = f->field.nv.value.cstr + p_start; 158 header_value->len = f->field.nv.value.len - p_start; 159 160 mhd_assert (0 == header_value->cstr[header_value->len]); 161 mhd_assert ((0 != header_value->len) && \ 162 "Trailing header whitespaces must be already stripped"); 163 164 return true; /* Success exit point */ 165 }