generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

curl_sasl: Extended native DIGEST-MD5 cnonce to be a 32-byte hex string

Browse Source 
Rather than use a short 8-byte hex string, extended the cnonce to be
32-bytes long, like Windows SSPI does.

Used a combination of random data as well as the current date and
time for the generation.
This commit is contained in:
Steve Holme 2014-06-01 11:11:08 +01:00
parent aa6be2ef13
commit eefeb73af4
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
lib/curl_sasl.c
View File

@ -403,9 +403,6 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
const char *service, const char *service,
char **outptr, size_t *outlen) char **outptr, size_t *outlen)
{ {
#ifndef DEBUGBUILD
static const char table16[] = "0123456789abcdef";
#endif
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
size_t i; size_t i;
MD5_context *ctxt; MD5_context *ctxt;
@ -421,8 +418,14 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
char qop_options[64]; char qop_options[64];
int qop_values; int qop_values;
char cnonce[33];
unsigned int cnonce1 = 0;
unsigned int cnonce2 = 0;
unsigned int cnonce3 = 0;
unsigned int cnonce4 = 0;
struct timeval now;
char nonceCount[] = "00000001"; char nonceCount[] = "00000001";
char cnonce[] = "12345678"; /* will be changed */
char method[] = "AUTHENTICATE"; char method[] = "AUTHENTICATE";
char qop[] = DIGEST_QOP_VALUE_STRING_AUTH; char qop[] = DIGEST_QOP_VALUE_STRING_AUTH;
char uri[128]; char uri[128];
@ -449,11 +452,18 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
return CURLE_BAD_CONTENT_ENCODING; return CURLE_BAD_CONTENT_ENCODING;
#ifndef DEBUGBUILD #ifndef DEBUGBUILD
/* Generate 64 bits of random data */ /* Generate 16 bytes of random data */
for(i = 0; i < 8; i++) cnonce1 = Curl_rand(data);
cnonce[i] = table16[Curl_rand(data)%16]; cnonce2 = Curl_rand(data);
now = Curl_tvnow();
cnonce3 = now.tv_sec;
cnonce4 = now.tv_sec;
#endif #endif
/* Convert the random data into a 32 byte hex string */
snprintf(cnonce, sizeof(cnonce), "%08x%08x%08x%08x",
cnonce1, cnonce2, cnonce3, cnonce4);
/* So far so good, now calculate A1 and H(A1) according to RFC 2831 */ /* So far so good, now calculate A1 and H(A1) according to RFC 2831 */
ctxt = Curl_MD5_init(Curl_DIGEST_MD5); ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
if(!ctxt) if(!ctxt)