mirror of
https://github.com/apache/httpd.git
synced 2026-10-23 22:49:01 +03:00
Merge r1731662, r1934434, r1935944, r1935945, r1935946, r1935947, r1935948, r1935949, r1935950, r1935951, r1935952, r1935953, r1935954, r1937104, r1937105, r1937106, r1937107, r1937108, r1937109, r1937110, r1937111 from trunk:
PR59039 Digest not working with ap_expr based AuthName Stop caching the configured realm during config processing and always call ap_auth_name(r) to determine (=evaluate potential expression) the configured realm * modules/aaa/mod_auth_digest.c: Remove undocumented and unimplemented AuthDigestNonceFormat directive. PR: 70056 mod_auth_digest: Drop RFC 2069 and configurable qop support. (RFC 2617, which replaced 2069, is now 26 years old) * modules/aaa/mod_auth_digest.c (digest_config_rec): Remove qop_list field. (create_digest_dir_config): Remove qop_list initialization. (set_qop): Deprecate AuthDigestQop, only "auth" is supported. (note_digest_auth_failure): Always send qop="auth". (check_nc): Remove handling for qop=none. (old_digest): Remove function. (authenticate_digest_user): Reject requests with missing or non-"auth" qop value rather than falling back to RFC 2069. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> GitHub: PR #661 * modules/aaa/mod_auth_digest.c: Remove "weird" override of AuthName directive, which adds complexity for little benefit (avoids putting 20 bytes through SHA1 for each auth attempt). (set_realm): Remove function. (gen_nonce_hash): Create the nonce hash here from scratch. (create_digest_dir_config): Always allocate a config struct. Remove unused dir_name field from digest_config_rec. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> GitHub: PR #661 * modules/aaa/mod_auth_digest.c (set_algorithm): Note that conf->algorithm is a constant ("MD5") so there is no point in overriding it at runtime. Simplify error case. GitHub: PR #661 * modules/aaa/config.m4, modules/aaa/mod_auth_digest.c (pre_init, initialize_module): Prevent using mod_auth_digest without APR_HAS_SHARED_MEMORY. GitHub: PR #661 * modules/aaa/mod_auth_digest.c: Use apr_uint32_t for the one-time-nonce counter. (gen_nonce): Drop the fallback case for non-shmem builds where otn_counter could be NULL previously. Use atomics to increment the counter. GitHub: PR #661 * modules/aaa/mod_auth_digest.c (get_digest_rec): Parse opaque more strictly. GitHub: PR #661 * modules/aaa/mod_auth_digest.c (cleanup_tables, initialize_tables, initialize_child, gen_client): Replace mutex-protected opaque_cntr with opaque_counter, incremented via atomics. GitHub: PR #661 * modules/aaa/mod_auth_digest.c (pre_init): Don't register now-unused "authdigest-opaque" mutex type. GitHub: PR #661 * modules/aaa/mod_auth_digest.c: Remove checks for NULL client_shm throughout. GitHub: PR #661 * modules/aaa/mod_auth_digest.c: Fix comments. GitHub: PR #661 * modules/aaa/mod_auth_digest.c (add_auth_info): Don't add (Proxy-)Authentication-Info headers to 401/407 responses. GitHub: PR #661 * modules/aaa/mod_auth_digest.c: Fix AuthDigestNcCheck: track the nonce-count per-nonce, require it to increase (RFC 7616 3.4.3), and record it only for a fully verified request. * test/modules/aaa/test_007_replay.py: Add replay tests. * test/modules/aaa/test_003_nccheck.py, test/modules/aaa/conftest.py: Update for the new semantics. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c: Consolidate one-time nonce handling in check_and_record_nonce, accepting a nonce iff it is newer than the last used, and re-challenging as stale when reused. * test/modules/aaa/test_008_onetime_nccheck.py: Add tests for one-time nonces, alone and with AuthDigestNcCheck. * test/modules/aaa/conftest.py: Add an AuthDigestNonceLifetime 0 plus AuthDigestNcCheck location. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c (get_digest_rec): Rename to parse_digest_header, returning the header status the caller stores in resp->auth_hdr_sts. (parse_digest_header): Rename to init_digest_request. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c: Don't let a client_entry pointer escape the client_lock critical section; look up and release per access rather than caching the pointer across the request. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c (note_digest_auth_failure): Return 503 when the client entry cannot be allocated, rather than sending a challenge with no opaque. Default the opaque to NULL to match what check_nonce() hashes when the client sends none. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c (client_generate): Skip a client id of zero, which the counter hands out once it wraps: zero means "no client", so add_client() refuses it. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c (gc): Return unsigned long, the type the count is accumulated in and the type of the client_list counters. (add_client): Log those counters with %lu, all being unsigned. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 * modules/aaa/mod_auth_digest.c: Fail the build without APR_HAS_RANDOM or APR_HAS_SHARED_MEMORY, rather than testing at runtime. configure already declines to build the module without them. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitHub: PR #705 Submitted by: covener, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton Reviewed by: Github: closes #706 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1937721 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Jim Jagielski
8
CHANGES
8
CHANGES
@@ -1,6 +1,14 @@
|
||||
-*- coding: utf-8 -*-
|
||||
Changes with Apache 2.4.69
|
||||
|
||||
*) mod_md: MDServerStatus is now disabled by default. [Joe Orton]
|
||||
|
||||
*) mod_auth_digest: Fix compatibility with expression-based AuthName.
|
||||
PR 59039. [Eric Covener]
|
||||
*) mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory
|
||||
handling and client nonce handling; "authdigest-opaque" mutex is
|
||||
now longer needed. [Joe Orton]
|
||||
|
||||
*) mod_lbmethod_heartbeat: Use safe integer parsing with range
|
||||
validation, replacing atoi(). [Sayed Kaif <metsw24 gmail.com>]
|
||||
|
||||
|
||||
24
STATUS
24
STATUS
@@ -163,30 +163,6 @@ RELEASE SHOWSTOPPERS:
|
||||
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
|
||||
[ start all new proposals below, under PATCHES PROPOSED. ]
|
||||
|
||||
*) mod_auth_digest: Rebase to trunk.
|
||||
trunk patch: https://svn.apache.org/r1731662
|
||||
https://svn.apache.org/r1934434
|
||||
https://svn.apache.org/r1935944
|
||||
https://svn.apache.org/r1935945
|
||||
https://svn.apache.org/r1935946
|
||||
https://svn.apache.org/r1935947
|
||||
https://svn.apache.org/r1935948
|
||||
https://svn.apache.org/r1935949
|
||||
https://svn.apache.org/r1935950
|
||||
https://svn.apache.org/r1935951
|
||||
https://svn.apache.org/r1935952
|
||||
https://svn.apache.org/r1935953
|
||||
https://svn.apache.org/r1935954
|
||||
https://svn.apache.org/r1937104
|
||||
https://svn.apache.org/r1937105
|
||||
https://svn.apache.org/r1937106
|
||||
https://svn.apache.org/r1937107
|
||||
https://svn.apache.org/r1937108
|
||||
https://svn.apache.org/r1937109
|
||||
https://svn.apache.org/r1937110
|
||||
https://svn.apache.org/r1937111
|
||||
2.4.x patch: https://github.com/apache/httpd/pull/706.patch
|
||||
+1: jorton, covener, jim
|
||||
|
||||
------------------------------------------------------------------------
|
||||
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
*) mod_md: MDServerStatus is now disabled by default. [Joe Orton]
|
||||
|
||||
|
||||
@@ -70,9 +70,9 @@ APACHE_MODULE(auth_basic, basic authentication, , , yes)
|
||||
APACHE_MODULE(auth_form, form authentication, , , most)
|
||||
APACHE_MODULE(auth_digest, RFC2617 Digest authentication, , , most, [
|
||||
APR_CHECK_APR_DEFINE(APR_HAS_RANDOM)
|
||||
if test $ac_cv_define_APR_HAS_RANDOM = "no"; then
|
||||
echo "You need APR random support to use mod_auth_digest."
|
||||
echo "Look at APR configure options --with-egd and --with-devrandom."
|
||||
APR_CHECK_APR_DEFINE(APR_HAS_SHARED_MEMORY)
|
||||
if test "${ac_cv_define_APR_HAS_RANDOM}X${ac_cv_define_APR_HAS_SHARED_MEMORY}" != "yesXyes"; then
|
||||
AC_MSG_NOTICE([mod_auth_digest requires APR with random and shared memory support])
|
||||
enable_auth_digest="no"
|
||||
fi
|
||||
])
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user