Digest auth fixes #8912
Closed
Digest auth fixes #8912
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Karlson2k
force-pushed
the
digest_auth_fix_01
branch
4 times, most recently
from
bf044a1 to
5eae1c8
Compare
Karlson2k
force-pushed
the
digest_auth_fix_01
branch
from
5eae1c8 to
9d2ce6b
Compare
|
Failed tests:
The PR looks to be ready. |
|
The last patch also fixed wrongly hashed |
Karlson2k
force-pushed
the
digest_auth_fix_01
branch
from
9d2ce6b to
7f261af
Compare
|
Rebased |
RFC 7616 (and 2617) requires values to be "unquoted" before used for digest calculations. The only place where unquoting can be done correctly is header parsing function (realm="DOMAIN\\host" and realm=DOMAN\\host are different realms). This commit adds unquoting (de-escaping) of all values during header parsing and quoting of the values during header forming. This approach should be most straightforward and easy to read/maintain as all values are processed in the same way as required by RFC.
Invalid headers should not be processed otherwise they may create a security risk.
Server headers may not define "realm", avoid NULL pointer dereference in such cases.
Karlson2k
force-pushed
the
digest_auth_fix_01
branch
from
7f261af to
675a3e9
Compare
|
Rebased again. |
bagder
approved these changes
Jun 2, 2022
|
Thanks! |
bagder
pushed a commit
that referenced
this pull request
Jun 2, 2022
Invalid headers should not be processed otherwise they may create a security risk. Closes #8912
bagder
pushed a commit
that referenced
this pull request
Jun 2, 2022
Server headers may not define "realm", avoid NULL pointer dereference in such cases. Closes #8912
|
Thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
RFC 7616 (and 2617) requires values to be "unquoted" before used for digest calculations. The same mentioned in the code comments.
realm="DOMAIN\\host"andrealm=DOMAN\\hostare different realms, but they are processed as identical values at the moment, which is not compliant with RFC. See RFC7616.The only place where unquoting can be done correctly is header parsing function.
This PR adds unquoting (de-escaping) of all values during header parsing and quoting (escaping) of the values during header forming. This approach should be most straightforward and easy to read/maintain as all values are processed in the same way as required by RFC.
The second commit adds detection of more erroneous situation during header parsing.
The third commit adds fix for NULL dereference discovered by Fuzzer. Server header may not define
realm, so code must tolerate NULL value fordigest->realm.Can be squashed into single commit.