[FFmpeg-devel] [PATCH] Add support for digest auth in the http and rtsp protocols

Ronald S. Bultje rsbultje
Tue Mar 23 15:00:16 CET 2010


Hi,

On Tue, Mar 23, 2010 at 4:31 AM, Martin Storsj? <martin at martin.st> wrote:
> Hmm, I can't seem to find any examples of including multiple methods in
> the same WWW-Auth (although the RFC mentions it). If I understand the RFC
> correctly, both the individual challenges in the WWW-Auth header and the
> parameters within a single challenge are comma-separated, with no clear
> way of knowing in advance what the next token is. Parsing that would suck
> royally...
>
> If I understand this correctly, does it look something like this then?
>
> WWW-Authenticate: Basic realm="WallyWorld", Digest
> realm="testrealm at host.com", qop="auth,auth-int",
> nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
> opaque="5ccc069c403ebaf9f0171e9517f40e41"

It's hard to say. I can't find them in the wild either, which surprises me.

Let's focus for now on the case where multiple auth schemes are
provided on separate lines, that's easier (and I'm unsure if your
earlier patch handled that already.) It should pick the safest
possible, so currently digest over basic.

Once that works for HTTP, I'll go over the RTSP patches (should be
straightforward).

>> >> > + ? ? ? ?if (*inptr == '\\') {
>> >> > + ? ? ? ? ? ?if (!inptr[1]) {
>> >> > + ? ? ? ? ? ? ? ?inptr++;
>> >> > + ? ? ? ? ? ? ? ?break;
>> >> > + ? ? ? ? ? ?}
>> >> > + ? ? ? ? ? ?*outptr++ = inptr[1];
>> >> > + ? ? ? ? ? ?inptr += 2;
>> >> > + ? ? ? ?} else {
>> >>
>> >> Hm... \n or \r?
>> >
>> > No, this handles escaped quotes (or any other escaped char) within quoted
>> > strings, doesn't have anything to do with newline handling.
>>
>> I meant, what if the input contains \n? It'd lead to a "n" being
>> placed in the buffer, a bit odd... Not what you'd expect, regardless
>> of whether normal input contains those chars.
>
> As I see it, that would be exactly the thing to expect. From the spec:
>
> ? A string of text is parsed as a single word if it is quoted using
> ? double-quote marks.
>
> ? ? ? quoted-string ?= ( <"> *(qdtext | quoted-pair ) <"> )
> ? ? ? qdtext ? ? ? ? = <any TEXT except <">>
>
> ? The backslash character ("\") MAY be used as a single-character
> ? quoting mechanism only within quoted-string and comment constructs.
>
> ? ? ? quoted-pair ? ?= "\" CHAR
>
> Thus, anything following a backslash should be interpreted as a quoted
> char.

Interesting. OK that's fine then.

Ronald



More information about the ffmpeg-devel mailing list