Support ignoring the HTTP method.

7 files changed, 48 insertions, 8 deletions

diff --git a/daemon/bd.c b/daemon/bd.c
index 6383801..e11a56b 100644
--- a/daemon/bd.c
+++ b/daemon/bd.c
@@ -405,7 +405,7 @@ static int do_digest_response(ha_request_t* rq, bd_context_t* ctx, const char* h
         /* And do the validation ourselves */
         memcpy(dg.ha1, rec->ha1, MD5_LEN);
 
-        ret = digest_complete_check(&dg, rq->buf);
+        ret = digest_complete_check(&dg, rq->context, rq->buf);
 
         if(ret != HA_OK)
         {
diff --git a/daemon/digest.c b/daemon/digest.c
index dc0cfb9..1c68366 100644
--- a/daemon/digest.c
+++ b/daemon/digest.c
@@ -32,6 +32,11 @@
 /* A globally unique counter used to guarantee uniqueness of nonces */
 static unsigned int g_digest_unique = 0;
 
+/* All the various HTTP methods to try when ignoring the method */
+static const char* g_http_methods[] = {
+	"GET", "HEAD", "POST", "PUT", "DELETE", "TRACE", "CONNECT", NULL
+};
+
 typedef struct internal_nonce
 {
     unsigned char hash[MD5_LEN];
@@ -242,7 +247,7 @@ int digest_check(digest_context_t* dg, const ha_context_t* opts, ha_buffer_t* bu
 
     r = digest_pre_check(dg, opts, buf);
     if(r == HA_OK)
-        r = digest_complete_check(dg, buf);
+        r = digest_complete_check(dg, opts, buf);
 
     return r;
 }
@@ -396,7 +401,7 @@ int digest_pre_check(digest_context_t* dg, const ha_context_t* opts, ha_buffer_t
 }
 
 
-int digest_complete_check(digest_context_t* dg, ha_buffer_t* buf)
+static int internal_check(digest_context_t* dg, const char* http_method, ha_buffer_t* buf)
 {
     unsigned char hash[MD5_LEN];
     md5_ctx_t md5;
@@ -419,7 +424,7 @@ int digest_complete_check(digest_context_t* dg, ha_buffer_t* buf)
 
     /* Encode ha2 */
     md5_init(&md5);
-    md5_update(&md5, dg->server_method, strlen(dg->server_method));
+    md5_update(&md5, http_method, strlen(http_method));
     md5_update(&md5, ":", 1);
     md5_update(&md5, dg->client.uri, strlen(dg->client.uri));
     md5_final(hash, &md5);
@@ -479,6 +484,30 @@ int digest_complete_check(digest_context_t* dg, ha_buffer_t* buf)
     return HA_OK;
 }
 
+int digest_complete_check(digest_context_t* dg, const ha_context_t* opts, ha_buffer_t* buf)
+{
+	const char** m;
+	int ret;
+
+	if(opts->digest_ignoremethod)
+	{
+		/* Try out each and every method in HTTP */
+		for(m = g_http_methods; *m; ++m)
+		{
+			ret = internal_check (dg, *m, buf);
+			if(ret != HA_FALSE)
+				break;
+		}
+	}
+	else
+	{
+		/* Use the method sent to us */
+		ret = internal_check (dg, dg->server_method, buf);
+	}
+
+	return ret;
+}
+
 const char* digest_respond(digest_context_t* dg, ha_buffer_t* buf,
                            unsigned char* next)
 {
diff --git a/daemon/digest.h b/daemon/digest.h
index 86360c7..af8a1d7 100644
--- a/daemon/digest.h
+++ b/daemon/digest.h
@@ -73,7 +73,7 @@ int digest_check(digest_context_t* dg, const ha_context_t* opts, ha_buffer_t* bu
 int digest_pre_check(digest_context_t* dg, const ha_context_t* opts, ha_buffer_t* buf);
 
 /* This assumes a digest_context that's been prechecked successfully */
-int digest_complete_check(digest_context_t* dg, ha_buffer_t* buf);
+int digest_complete_check(digest_context_t* dg, const ha_context_t* opts, ha_buffer_t* buf);
 
 /* This assumes a digest_context that's been checked and validated successfully */
 const char* digest_respond(digest_context_t* dg, ha_buffer_t* buf, unsigned char* next);
diff --git a/daemon/httpauthd.c b/daemon/httpauthd.c
index 68c0e46..b77abcb 100644
--- a/daemon/httpauthd.c
+++ b/daemon/httpauthd.c
@@ -1514,6 +1514,16 @@ static int config_parse(const char* file, ha_buffer_t* buf)
                 recog = 1;
             }
 
+            else if(strcmp(name, "digestignoremethod") == 0)
+            {
+            	int v;
+            	if(ha_confbool(name, value, &v) < 0)
+            		exit(1); /* Message already printed */
+
+            	opts->digest_ignoremethod = v;
+            	recog = 1;
+            }
+
 #ifdef _DEBUG
             else if(strcmp(name, "digestdebugnonce") == 0)
             {
diff --git a/daemon/httpauthd.h b/daemon/httpauthd.h
index 4c7c8d6..36c8449 100644
--- a/daemon/httpauthd.h
+++ b/daemon/httpauthd.h
@@ -118,6 +118,7 @@ typedef struct ha_context
     const char* realm;
 
     /* For digest auth: */
+    unsigned int digest_ignoremethod : 1;
     unsigned int digest_ignoreuri : 1;
     unsigned int digest_ignorenc : 1;
     const char* digest_debugnonce;
diff --git a/daemon/ldap.c b/daemon/ldap.c
index b3d88fc..59e9912 100644
--- a/daemon/ldap.c
+++ b/daemon/ldap.c
@@ -695,7 +695,7 @@ static int validate_digest(ha_request_t* rq, const char* user, digest_context_t*
                 foundany = 1;
 
                 /* Run the actual check */
-                ret = digest_complete_check(dg, rq->buf);
+                ret = digest_complete_check(dg, rq->context, rq->buf);
 
                 if(ret != HA_FALSE)
                     RETURN(ret);
@@ -724,7 +724,7 @@ static int validate_digest(ha_request_t* rq, const char* user, digest_context_t*
             digest_makeha1(dg->ha1, user, rq->context->realm, *p);
 
             /* Run the actual check */
-            ret = digest_complete_check(dg, rq->buf);
+            ret = digest_complete_check(dg, rq->context, rq->buf);
 
             if(ret != HA_FALSE)
                 RETURN(ret);
diff --git a/daemon/simple.c b/daemon/simple.c
index 46b1cf1..1c37c23 100644
--- a/daemon/simple.c
+++ b/daemon/simple.c
@@ -146,7 +146,7 @@ static int validate_digest(ha_request_t* rq, const char* user, digest_context_t*
         foundgood = 1;
 
         /* Try to do the validation */
-        ret = digest_complete_check(dg, rq->buf);
+        ret = digest_complete_check(dg, rq->context, rq->buf);
 
         /* If invalid then continue search */
         if(ret == HA_FALSE)