[FFmpeg-devel] [PATCH] avformat/httpauth: add SHA-256 Digest Authorization [update]

[Stefano Sabatini]

On date Thursday 2024-04-04 02:07:17 +0000, ������ | Eugene wrote:
>  add SHA-256 Digest Authorization for RFC7616 using avutil/hash.h
> - make_digest_auth_sha() : A1hash-> a1_hash and A2hash -> a2_hash
> - combine with lint fix patch
> 
> Signed-off-by: Eugene-bitsensing <eugene at bitsensing.com>
> ---
>  libavformat/httpauth.c | 130 ++++++++++++++++++++++++++++++++++++++---
>  libavformat/httpauth.h |   8 +++
>  2 files changed, 130 insertions(+), 8 deletions(-)
> 
> diff --git a/libavformat/httpauth.c b/libavformat/httpauth.c
> index 9780928357..6069523bca 100644
> --- a/libavformat/httpauth.c
> +++ b/libavformat/httpauth.c
> @@ -25,6 +25,7 @@
>  #include "internal.h"
>  #include "libavutil/random_seed.h"
>  #include "libavutil/md5.h"
> +#include "libavutil/hash.h"
>  #include "urldecode.h"
>  

>  static void handle_basic_params(HTTPAuthState *state, const char *key,
> @@ -143,7 +144,7 @@ static char *make_digest_auth(HTTPAuthState *state, const char *username,
>      char cnonce[17];
>      char nc[9];
>      int i;
> -    char A1hash[33], A2hash[33], response[33];
> +    char a1_hash[33], a2_hash[33], response[33];
>      struct AVMD5 *md5ctx;
>      uint8_t hash[16];
>      char *authstr;
> @@ -163,14 +164,14 @@ static char *make_digest_auth(HTTPAuthState *state, const char *username,
>      av_md5_init(md5ctx);
>      update_md5_strings(md5ctx, username, ":", state->realm, ":", password, NULL);
>      av_md5_final(md5ctx, hash);
> -    ff_data_to_hex(A1hash, hash, 16, 1);
> +    ff_data_to_hex(a1_hash, hash, 16, 1);
>  
>      if (!strcmp(digest->algorithm, "") || !strcmp(digest->algorithm, "MD5")) {
>      } else if (!strcmp(digest->algorithm, "MD5-sess")) {
>          av_md5_init(md5ctx);
> -        update_md5_strings(md5ctx, A1hash, ":", digest->nonce, ":", cnonce, NULL);
> +        update_md5_strings(md5ctx, a1_hash, ":", digest->nonce, ":", cnonce, NULL);
>          av_md5_final(md5ctx, hash);
> -        ff_data_to_hex(A1hash, hash, 16, 1);
> +        ff_data_to_hex(a1_hash, hash, 16, 1);
>      } else {
>          /* Unsupported algorithm */
>          av_free(md5ctx);
> @@ -180,14 +181,14 @@ static char *make_digest_auth(HTTPAuthState *state, const char *username,
>      av_md5_init(md5ctx);
>      update_md5_strings(md5ctx, method, ":", uri, NULL);
>      av_md5_final(md5ctx, hash);
> -    ff_data_to_hex(A2hash, hash, 16, 1);
> +    ff_data_to_hex(a2_hash, hash, 16, 1);
>  
>      av_md5_init(md5ctx);
> -    update_md5_strings(md5ctx, A1hash, ":", digest->nonce, NULL);
> +    update_md5_strings(md5ctx, a1_hash, ":", digest->nonce, NULL);
>      if (!strcmp(digest->qop, "auth") || !strcmp(digest->qop, "auth-int")) {
>          update_md5_strings(md5ctx, ":", nc, ":", cnonce, ":", digest->qop, NULL);
>      }
> -    update_md5_strings(md5ctx, ":", A2hash, NULL);
> +    update_md5_strings(md5ctx, ":", a2_hash, NULL);
>      av_md5_final(md5ctx, hash);
>      ff_data_to_hex(response, hash, 16, 1);

this is fine but it would be better sent as a separate patch (to avoid
mixing functional and cosmetical changes)

>  
> @@ -236,6 +237,114 @@ static char *make_digest_auth(HTTPAuthState *state, const char *username,
>      return authstr;
>  }
>  

> +/**
> + * Generate a digest reply SHA-256, according to RFC 7616.
> + * TODO : support other RFC 7616 Algorithm 
> + */
> +static char *make_digest_auth_sha(HTTPAuthState *state, const char *username,
> +                                  const char *password, const char *uri,
> +                                  const char *method, const char *algorithm)
> +{

BTW I see this function contains much duplicated code from
make_digest_auth().

Is it possible to make make_digest_auth use this new function with the
MD5 algorithm? This would avoid much code duplication.

[...]