|
| 1 | +require 'cgi' |
| 2 | +require 'digest' |
| 3 | +require 'monitor' |
| 4 | +require 'net/http' |
| 5 | +require 'securerandom' |
| 6 | + |
| 7 | +## |
| 8 | +# An implementation of RFC 2617 Digest Access Authentication. |
| 9 | +# |
| 10 | +# http://www.rfc-editor.org/rfc/rfc2617.txt |
| 11 | +# |
| 12 | +# Here is a sample usage of DigestAuth on Net::HTTP: |
| 13 | +# |
| 14 | +# require 'uri' |
| 15 | +# require 'net/http' |
| 16 | +# require 'net/http/digest_auth' |
| 17 | +# |
| 18 | +# digest_auth = Net::HTTP::DigestAuth.new |
| 19 | +# |
| 20 | +# uri = URI.parse 'http://localhost:8000/' |
| 21 | +# uri.user = 'username' |
| 22 | +# uri.password = 'password' |
| 23 | +# |
| 24 | +# h = Net::HTTP.new uri.host, uri.port |
| 25 | +# |
| 26 | +# req = Net::HTTP::Get.new uri.request_uri |
| 27 | +# |
| 28 | +# res = h.request req |
| 29 | +# # res is a 401 response with a WWW-Authenticate header |
| 30 | +# |
| 31 | +# auth = digest_auth.auth_header uri, res['www-authenticate'], 'GET' |
| 32 | +# |
| 33 | +# # create a new request with the Authorization header |
| 34 | +# req = Net::HTTP::Get.new uri.request_uri |
| 35 | +# req.add_field 'Authorization', auth |
| 36 | +# |
| 37 | +# # re-issue request with Authorization |
| 38 | +# res = h.request req |
| 39 | + |
| 40 | +class Net::HTTP::DigestAuth |
| 41 | + |
| 42 | + include MonitorMixin |
| 43 | + |
| 44 | + ## |
| 45 | + # DigestAuth error class |
| 46 | + |
| 47 | + class Error < RuntimeError; end |
| 48 | + |
| 49 | + ## |
| 50 | + # Version of Net::HTTP::DigestAuth you are using |
| 51 | + |
| 52 | + VERSION = '1.4' |
| 53 | + |
| 54 | + ## |
| 55 | + # Creates a new DigestAuth header creator. |
| 56 | + |
| 57 | + def initialize ignored = :ignored |
| 58 | + mon_initialize |
| 59 | + @nonce_count = -1 |
| 60 | + end |
| 61 | + |
| 62 | + ## |
| 63 | + # Creates a digest auth header for +uri+ from the +www_authenticate+ header |
| 64 | + # for HTTP method +method+. |
| 65 | + # |
| 66 | + # The result of this method should be sent along with the HTTP request as |
| 67 | + # the "Authorization" header. In Net::HTTP this will look like: |
| 68 | + # |
| 69 | + # request.add_field 'Authorization', digest_auth.auth_header # ... |
| 70 | + # |
| 71 | + # See Net::HTTP::DigestAuth for a complete example. |
| 72 | + # |
| 73 | + # IIS servers handle the "qop" parameter of digest authentication |
| 74 | + # differently so you may need to set +iis+ to true for such servers. |
| 75 | + |
| 76 | + def auth_header uri, www_authenticate, method, iis = false |
| 77 | + nonce_count = next_nonce |
| 78 | + |
| 79 | + user = CGI.unescape uri.user |
| 80 | + password = CGI.unescape uri.password |
| 81 | + |
| 82 | + www_authenticate =~ /^(\w+) (.*)/ |
| 83 | + |
| 84 | + challenge = $2 |
| 85 | + |
| 86 | + params = {} |
| 87 | + challenge.gsub(/(\w+)="(.*?)"/) { params[$1] = $2 } |
| 88 | + |
| 89 | + challenge =~ /algorithm="?(.*?)"?([, ]|$)/ |
| 90 | + |
| 91 | + params['algorithm'] = $1 || 'MD5' |
| 92 | + |
| 93 | + if params['algorithm'] =~ /(.*?)(-sess)?$/ |
| 94 | + algorithm = case $1 |
| 95 | + when 'MD5' then Digest::MD5 |
| 96 | + when 'SHA1' then Digest::SHA1 |
| 97 | + when 'SHA2' then Digest::SHA2 |
| 98 | + when 'SHA256' then Digest::SHA256 |
| 99 | + when 'SHA384' then Digest::SHA384 |
| 100 | + when 'SHA512' then Digest::SHA512 |
| 101 | + when 'RMD160' then Digest::RMD160 |
| 102 | + else raise Error, "unknown algorithm \"#{$1}\"" |
| 103 | + end |
| 104 | + sess = $2 |
| 105 | + end |
| 106 | + |
| 107 | + qop = params['qop'] |
| 108 | + cnonce = make_cnonce if qop or sess |
| 109 | + |
| 110 | + a1 = if sess then |
| 111 | + [ algorithm.hexdigest("#{user}:#{params['realm']}:#{password}"), |
| 112 | + params['nonce'], |
| 113 | + cnonce, |
| 114 | + ].join ':' |
| 115 | + else |
| 116 | + "#{user}:#{params['realm']}:#{password}" |
| 117 | + end |
| 118 | + |
| 119 | + ha1 = algorithm.hexdigest a1 |
| 120 | + ha2 = algorithm.hexdigest "#{method}:#{uri.request_uri}" |
| 121 | + |
| 122 | + request_digest = [ha1, params['nonce']] |
| 123 | + request_digest.push(('%08x' % nonce_count), cnonce, qop) if qop |
| 124 | + request_digest << ha2 |
| 125 | + request_digest = request_digest.join ':' |
| 126 | + |
| 127 | + header = [ |
| 128 | + "Digest username=\"#{user}\"", |
| 129 | + "realm=\"#{params['realm']}\"", |
| 130 | + "algorithm=#{params['algorithm']}", |
| 131 | + if qop.nil? then |
| 132 | + elsif iis then |
| 133 | + "qop=\"#{qop}\"" |
| 134 | + else |
| 135 | + "qop=#{qop}" |
| 136 | + end, |
| 137 | + "uri=\"#{uri.request_uri}\"", |
| 138 | + "nonce=\"#{params['nonce']}\"", |
| 139 | + if qop then |
| 140 | + [ |
| 141 | + "nc=#{'%08x' % @nonce_count}", |
| 142 | + "cnonce=\"#{cnonce}\"", |
| 143 | + ] |
| 144 | + end, |
| 145 | + "response=\"#{algorithm.hexdigest(request_digest)[0, 32]}\"", |
| 146 | + if params.key? 'opaque' then |
| 147 | + "opaque=\"#{params['opaque']}\"" |
| 148 | + end |
| 149 | + ].compact |
| 150 | + |
| 151 | + header.join ', ' |
| 152 | + end |
| 153 | + |
| 154 | + ## |
| 155 | + # Creates a client nonce value that is used across all requests based on the |
| 156 | + # current time, process id and a random number |
| 157 | + |
| 158 | + def make_cnonce |
| 159 | + Digest::MD5.hexdigest [ |
| 160 | + Time.now.to_i, |
| 161 | + $$, |
| 162 | + SecureRandom.random_number(2**32), |
| 163 | + ].join ':' |
| 164 | + end |
| 165 | + |
| 166 | + def next_nonce |
| 167 | + synchronize do |
| 168 | + @nonce_count += 1 |
| 169 | + end |
| 170 | + end |
| 171 | + |
| 172 | +end |
| 173 | + |
0 commit comments