Digst: Add microseconds into nounce calculation
When using only 1 second precision, curl doesn't create new cnonce values quickly enough for all uses. For example, issuing the following command multiple times to a recent Tomcat causes authentication failures: curl --digest -utest:test http://tomcat.test.com:8080/manager/list This is because curl uses the same cnonce for several seconds, but doesn't increment the nonce counter. Tomcat correctly interprets this as a replay attack and rejects the request. When microsecond-precision is available, this commit causes curl to change cnonce values much more frequently. With microsecond resolution, increasing the nounce length used in the headers to 32 was made to further reduce the risk of duplication.
This commit is contained in:
		 Gabriel Sjoberg
					Gabriel Sjoberg
				
			
				
					committed by
					
						 Daniel Stenberg
						Daniel Stenberg
					
				
			
			
				
	
			
			
			 Daniel Stenberg
						Daniel Stenberg
					
				
			
						parent
						
							1c23d2b392
						
					
				
				
					commit
					e237402c47
				
			| @@ -280,7 +280,7 @@ CURLcode Curl_output_digest(struct connectdata *conn, | ||||
|   unsigned char *md5this; | ||||
|   unsigned char *ha1; | ||||
|   unsigned char ha2[33];/* 32 digits and 1 zero byte */ | ||||
|   char cnoncebuf[7]; | ||||
|   char cnoncebuf[33]; | ||||
|   char *cnonce = NULL; | ||||
|   size_t cnonce_sz = 0; | ||||
|   char *tmp = NULL; | ||||
| @@ -344,7 +344,8 @@ CURLcode Curl_output_digest(struct connectdata *conn, | ||||
|   if(!d->cnonce) { | ||||
|     /* Generate a cnonce */ | ||||
|     now = Curl_tvnow(); | ||||
|     snprintf(cnoncebuf, sizeof(cnoncebuf), "%06ld", (long)now.tv_sec); | ||||
|     snprintf(cnoncebuf, sizeof(cnoncebuf), "%32ld", | ||||
|              (long)now.tv_sec + now.tv_usec); | ||||
|  | ||||
|     rc = Curl_base64_encode(data, cnoncebuf, strlen(cnoncebuf), | ||||
|                             &cnonce, &cnonce_sz); | ||||
|   | ||||
		Reference in New Issue
	
	Block a user