github-repos/wget
1
0
Fork 0
mirror of https://github.com/mirror/wget.git synced 2026-08-23 03:13:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

[svn] Fix for bug #20299: Basic auth creds sent before challenge

Browse Source
This commit is contained in:
micah
2007-07-29 17:29:05 -07:00
parent 10da871ac4
commit e4600575bb
7 changed files with 315 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tests/ChangeLog
View File

@@ -1,3 +1,19 @@
2007-07-25 Micah Cowan <micah@cowan.name>
* HTTPServer.pm (run, send_response): Farmed out some logic from
the run method into a separate one named send_response, which
was then modified to handle simple authentication testing.
(handle_auth): Added to handle simple authentication testing.
(verify_auth_basic): Checks to make sure Basic credentials are
valid.
(verify_auth_digest): Stub added; always fails test.
* Makefile.in: Added Test-auth-basic.px to list of automatically
run tests.
* Test-auth-basic: Simple basic authentication test; mainly just
lets the server do its testing. Its current purpose is just to
ensure that correct basic creds are sent, but never until a
challenge has been sent.
2007-07-05 Micah Cowan <micah@cowan.name>
* Makefile.in:

190
tests/HTTPServer.pm
View File

@@ -24,7 +24,6 @@ sub run {
$synch_callback->();
$initialized = 1;
}
my $con = $self->accept();
print STDERR "Accepted a new connection\n" if $log;
while (my $req = $con->get_request) {
@@ -47,55 +46,8 @@ sub run {
print STDERR "Serving requested URL: ", $url_path, "\n" if $log;
next unless ($req->method eq "HEAD" || $req->method eq "GET");
# create response
my $tmp = $urls->{$url_path};
my $resp = HTTP::Response->new ($tmp->{code}, $tmp->{msg});
print STDERR "HTTP::Response: \n", $resp->as_string if $log;
#if (is_dynamic_url) { # dynamic resource
#} else { # static resource
# fill in headers
while (my ($name, $value) = each %{$tmp->{headers}}) {
# print STDERR "setting header: $name = $value\n";
$resp->header($name => $value);
}
print STDERR "HTTP::Response with headers: \n", $resp->as_string if $log;
if ($req->method eq "GET") {
if (exists($tmp->{headers}{"Content-Length"})) {
# Content-Length and length($tmp->{content}) don't match
# manually prepare the HTTP response
$con->send_basic_header($tmp->{code}, $resp->message, $resp->protocol);
print $con $resp->headers_as_string($CRLF);
print $con $CRLF;
print $con $tmp->{content};
next;
}
if ($req->header("Range")) {
$req->header("Range") =~ m/bytes=(\d*)-(\d*)/;
my $content_len = length($tmp->{content});
my $start = $1 ? $1 : 0;
my $end = $2 ? $2 : ($content_len - 1);
my $len = $2 ? ($2 - $start) : ($content_len - $start);
$resp->header("Accept-Ranges" => "bytes");
$resp->header("Content-Length" => $len);
$resp->header("Content-Range" => "bytes $start-$end/$content_len");
$resp->header("Keep-Alive" => "timeout=15, max=100");
$resp->header("Connection" => "Keep-Alive");
$con->send_basic_header(206, "Partial Content", $resp->protocol);
print $con $resp->headers_as_string($CRLF);
print $con $CRLF;
print $con substr($tmp->{content}, $start, $len);
next;
}
# fill in content
$resp->content($tmp->{content});
print STDERR "HTTP::Response with content: \n", $resp->as_string if $log;
}
#}
$con->send_response($resp);
print STDERR "HTTP::Response sent: \n", $resp->as_string if $log;
my $url_rec = $urls->{$url_path};
$self->send_response($req, $url_rec, $con);
} else {
print STDERR "Requested wrong URL: ", $url_path, "\n" if $log;
$con->send_error($HTTP::Status::RC_FORBIDDEN);
@@ -107,6 +59,144 @@ sub run {
}
}
sub send_response {
my ($self, $req, $url_rec, $con) = @_;
# create response
my ($code, $msg, $headers);
my $send_content = ($req->method eq "GET");
if (exists $url_rec->{'auth_method'}) {
($send_content, $code, $msg, $headers) =
$self->handle_auth($req, $url_rec);
} else {
($code, $msg) = @{$url_rec}{'code', 'msg'};
$headers = $url_rec->{headers};
}
my $resp = HTTP::Response->new ($code, $msg);
print STDERR "HTTP::Response: \n", $resp->as_string if $log;
while (my ($name, $value) = each %{$headers}) {
# print STDERR "setting header: $name = $value\n";
$resp->header($name => $value);
}
print STDERR "HTTP::Response with headers: \n", $resp->as_string if $log;
if ($send_content) {
my $content = $url_rec->{content};
if (exists($url_rec->{headers}{"Content-Length"})) {
# Content-Length and length($content) don't match
# manually prepare the HTTP response
$con->send_basic_header($url_rec->{code}, $resp->message, $resp->protocol);
print $con $resp->headers_as_string($CRLF);
print $con $CRLF;
print $con $content;
next;
}
if ($req->header("Range")) {
$req->header("Range") =~ m/bytes=(\d*)-(\d*)/;
my $content_len = length($content);
my $start = $1 ? $1 : 0;
my $end = $2 ? $2 : ($content_len - 1);
my $len = $2 ? ($2 - $start) : ($content_len - $start);
$resp->header("Accept-Ranges" => "bytes");
$resp->header("Content-Length" => $len);
$resp->header("Content-Range" => "bytes $start-$end/$content_len");
$resp->header("Keep-Alive" => "timeout=15, max=100");
$resp->header("Connection" => "Keep-Alive");
$con->send_basic_header(206, "Partial Content", $resp->protocol);
print $con $resp->headers_as_string($CRLF);
print $con $CRLF;
print $con substr($content, $start, $len);
next;
}
# fill in content
$resp->content($content);
print STDERR "HTTP::Response with content: \n", $resp->as_string if $log;
}
$con->send_response($resp);
print STDERR "HTTP::Response sent: \n", $resp->as_string if $log;
}
# Generates appropriate response content based on the authentication
# status of the URL.
sub handle_auth {
my ($self, $req, $url_rec) = @_;
my ($send_content, $code, $msg, $headers);
# Catch failure to set code, msg:
$code = 500;
$msg = "Didn't set response code in handle_auth";
# Most cases, we don't want to send content.
$send_content = 0;
# Initialize headers
$headers = {};
my $authhdr = $req->header('Authorization');
# Have we sent the challenge yet?
unless (defined $url_rec->{auth_challenged}
&& $url_rec->{auth_challenged}) {
# Since we haven't challenged yet, we'd better not
# have received authentication (for our testing purposes).
if ($authhdr) {
$code = 400;
$msg = "You sent auth before I sent challenge";
} else {
# Send challenge
$code = 401;
$msg = "Authorization Required";
$headers->{'WWW-Authenticate'} = $url_rec->{'auth_method'}
. " realm=\"wget-test\"";
$url_rec->{auth_challenged} = 1;
}
} elsif (!defined($authhdr)) {
# We've sent the challenge; we should have received valid
# authentication with this one. A normal server would just
# resend the challenge; but since this is a test, wget just
# failed it.
$code = 400;
$msg = "You didn't send auth after I sent challenge";
} else {
my ($sent_method) = ($authhdr =~ /^(\S+)/g);
unless ($sent_method eq $url_rec->{'auth_method'}) {
# Not the authorization type we were expecting.
$code = 400;
$msg = "Expected auth type $url_rec->{'auth_method'} but got "
. "$sent_method";
} elsif (($sent_method eq 'Digest'
&& &verify_auth_digest($authhdr, $url_rec, \$msg))
||
($sent_method eq 'Basic'
&& &verify_auth_basic($authhdr, $url_rec, \$msg))) {
# SUCCESSFUL AUTH: send expected message, headers, content.
($code, $msg) = @{$url_rec}{'code', 'msg'};
$headers = $url_rec->{headers};
$send_content = 1;
} else {
$code = 400;
}
}
return ($send_content, $code, $msg, $headers);
}
sub verify_auth_digest {
return undef; # Not yet implemented.
}
sub verify_auth_basic {
require MIME::Base64;
my ($authhdr, $url_rec, $msgref) = @_;
my $expected = MIME::Base64::encode_base64($url_rec->{'user'} . ':'
. $url_rec->{'passwd'}, '');
my ($got) = $authhdr =~ /^Basic (.*)$/;
if ($got eq $expected) {
return 1;
} else {
$$msgref = "Wanted ${expected} got ${got}";
return undef;
}
}
1;
# vim: et ts=4 sw=4

1
tests/Makefile.in
View File

@@ -106,6 +106,7 @@ run-px-tests: WgetTest.pm
./Test--spider-fail.px && echo && echo
./Test--spider.px && echo && echo
./Test--spider-r.px && echo && echo
./Test-auth-basic.px && echo && echo
WgetTest.pm: WgetTest.pm.in @top_srcdir@/config.status
cd @top_srcdir@ && ./config.status

48
tests/Test-auth-basic.px Executable file
View File

@@ -0,0 +1,48 @@
#!/usr/bin/perl -w
use strict;
use HTTPTest;
###############################################################################
my $wholefile = "You're all authenticated.\n";
# code, msg, headers, content
my %urls = (
'/needs-auth.txt' => {
auth_method => 'Basic',
user => 'fiddle-dee-dee',
passwd => 'Dodgson',
code => "200",
msg => "You want fries with that?",
headers => {
"Content-type" => "text/plain",
},
content => $wholefile,
},
);
my $cmdline = $WgetTest::WGETPATH . " --user=fiddle-dee-dee --password=Dodgson"
. " http://localhost:8080/needs-auth.txt";
my $expected_error_code = 0;
my %expected_downloaded_files = (
'needs-auth.txt' => {
content => $wholefile,
},
);
###############################################################################
my $the_test = HTTPTest->new (name => "Test-auth-basic",
input => \%urls,
cmdline => $cmdline,
errcode => $expected_error_code,
output => \%expected_downloaded_files);
exit $the_test->run();
# vim: et ts=4 sw=4