Description: Implement working support for authentication 'digest'.
 Using an additional dependency on libmhash, the code for Nd is
 enhanced to make it possible to use digests.
 .
 Due to limitation in 'nanohttp' invoked from libxml2, which
 enforces a mandatory following of redirected sight locations,
 and the inherent need for the digest authentication method to
 use the correct URI, the present implementation cannot avoid
 an unwanted failure to implicitly follow a redirected path.
Author: Mats Erik Andersson <debian@gisladisker.se>
Forwarded: no
Last-Update: 2010-04-10
--- nd-0.8.2.debian/auth.c
+++ nd-0.8.2/auth.c
@@ -12,12 +12,21 @@
 #include <string.h>
 #endif /* HAVE_STRING_H */
 #include <ctype.h>
+#include <time.h>
 
 #include "nd.h"
 #include <libxml/tree.h>
 
+#include <mhash.h>
+
 #define SKIP_BLANKS(p) {while(*(p)&&isspace(*(p)))(p)++;}
 
+extern const char *export_method;
+extern const char *export_uri;
+
+static int nc = 0;
+static char nonce_sensor[64] = "";
+
 struct http_auth
 {
   char            *name;
@@ -30,11 +39,13 @@ ndAuthParamPtr ndAuthParamCreateDigest (
 xmlBufferPtr ndAuthBasic (ndAuthParamPtr param);
 xmlBufferPtr ndAuthDigest (ndAuthParamPtr param);
 
+xmlBufferPtr ndAuthEncodeDigest (xmlBufferPtr a);
+
 struct http_auth www_auth [] =
   {
     {"Basic", ndAuthParamCreateBasic, ndAuthBasic},
     {"Digest", ndAuthParamCreateDigest, ndAuthDigest},
-    {NULL, NULL}
+    {NULL, NULL, NULL}
   };
 
 /* utility for convenience */
@@ -61,13 +72,13 @@ nd_extract_auth_val (char **q)
     if (*qq == '"')
       {
 	quoted = 1;
-	xmlBufferAddChar (val, *qq++);
+	++qq;
       }
     while (*qq != '\0')
       {
 	if (quoted && *qq == '"')
 	  {
-	    xmlBufferAddChar (val, *qq++);
+	    ++qq;
 	    break;
 	  }
 	if (!quoted)
@@ -141,6 +152,8 @@ ndAuthParamCreate (hauth, p)
 	      return NULL;
 	    p++;
 	    ap->val = nd_extract_auth_val (&p);
+	    if (*p == ',')
+	      ++p;
 	    break;
 	  }
       }
@@ -217,10 +230,44 @@ ndAuthParamSetValue (param, name, val)
 ndAuthParamPtr
 ndAuthParamCreateDigest ()
 {
-  /* Not Implemented */
-  fprintf(stderr, "Authentication needs 'Digest' method, which is not implemented yet.\n");
+  ndAuthParamPtr param = xmlMalloc (sizeof (ndAuthParam) * 13);
+  xmlBufferPtr cnonce = xmlBufferCreate ();
+  char timestring[12];
 
-  return NULL;
+  param[0].name  = "name";
+  param[0].val   = xmlMemStrdup ("Digest");
+  param[1].name  = "realm";
+  param[1].val   = NULL;
+  param[2].name  = "domain";
+  param[2].val   = NULL;
+  param[3].name  = "nonce";
+  param[3].val   = NULL;
+  param[4].name  = "opaque";
+  param[4].val   = NULL;
+  param[5].name  = "stale";
+  param[5].val   = NULL;
+  param[6].name  = "algorithm";
+  param[6].val   = NULL;
+  param[7].name  = "qop";
+  param[7].val   = NULL;
+  param[8].name  = "user";
+  param[8].val   = NULL;
+  param[9].name  = "password";
+  param[9].val   = NULL;
+  param[10].name  = "uri";
+  param[10].val   = NULL;
+
+  param[11].name  = "cnonce";
+  snprintf (timestring, sizeof (timestring), "%d", time (0));
+  xmlBufferAdd (cnonce, (xmlChar *) timestring, -1);
+  xmlBufferAdd (cnonce, (xmlChar *) ":123e5d7ff:nd", -1);
+  param[11].val   = (char *) xmlBufferContent (ndAuthEncodeDigest (cnonce));
+  xmlBufferFree (cnonce);
+
+  param[12].name  = NULL;
+  param[12].val   = NULL;
+
+  return param;
 }
 
 /* Delived from mimehead.c */
@@ -272,6 +319,25 @@ ndAuthEncodeB(char *a)
 }
 
 xmlBufferPtr
+ndAuthEncodeDigest (xmlBufferPtr a)
+{
+  int j;
+  char octet[3];
+  unsigned char hash[16];
+  MHASH context;
+  xmlBufferPtr w = xmlBufferCreate ();
+
+  context = mhash_init (MHASH_MD5);
+  mhash (context, (char *) xmlBufferContent (a), xmlBufferLength (a));
+  mhash_deinit (context, hash);
+  for (j = 0; j < sizeof (hash); ++j) {
+    snprintf (octet, sizeof (octet), "%02x", hash[j]);
+    xmlBufferAdd (w, octet, strlen (octet));
+  }
+
+  return w;
+}
+xmlBufferPtr
 ndAuthBasic (param)
      ndAuthParamPtr param;
 {
@@ -282,11 +348,95 @@ ndAuthBasic (param)
   return ndAuthEncodeB ((char *) xmlBufferContent (buf));
 }
 
+void
+add_quoted_param (buf, param, name_str, param_name, flag)
+     xmlBufferPtr buf;
+     ndAuthParamPtr param;
+     const char * name_str;
+     char * param_name;
+     int flag;
+{
+  if (flag)
+    xmlBufferAdd (buf, (xmlChar *) ", ", -1);
+
+  xmlBufferAdd (buf, (xmlChar *) name_str, -1);
+  xmlBufferAdd (buf, (xmlChar *) "=\"", -1);
+  xmlBufferAdd (buf, (xmlChar *) ndAuthParamValue (param, param_name), -1);
+  xmlBufferAdd (buf, (xmlChar *) "\"", -1);
+}
+
 xmlBufferPtr
 ndAuthDigest (param)
      ndAuthParamPtr param;
 {
-  return NULL;
+  char nc_string[9], *sensor;
+  xmlBufferPtr buf1 = xmlBufferCreate ();
+  xmlBufferPtr A1 = xmlBufferCreate ();
+  xmlBufferPtr A2 = xmlBufferCreate ();
+  xmlBufferPtr response;
+
+  /* Identify the authenticated udr. */
+  xmlBufferAdd (A1, (xmlChar *) ndAuthParamValue (param, "user"), -1);
+  xmlBufferAdd (A1, (xmlChar *) ":", -1);
+  xmlBufferAdd (A1, (xmlChar *) ndAuthParamValue (param, "realm"), -1);
+  xmlBufferAdd (A1, (xmlChar *) ":", -1);
+  xmlBufferAdd (A1, (xmlChar *) ndAuthParamValue (param, "password"), -1);
+
+  response = ndAuthEncodeDigest (A1);
+
+  xmlBufferAdd (A2, (xmlChar *) export_method, -1);
+  xmlBufferAdd (A2, (xmlChar *) ":", -1);
+  xmlBufferAdd (A2, (xmlChar *) export_uri, -1);
+
+  add_quoted_param (buf1, param, "username", "user", 0);
+
+  add_quoted_param (buf1, param, "realm", "realm", 1);
+
+  add_quoted_param (buf1, param, "nonce", "nonce", 1);
+
+  xmlBufferAdd (response, (xmlChar *) ":", -1);
+  xmlBufferAdd (response, (xmlChar *) ndAuthParamValue (param, "nonce"), -1);
+
+  /* Check if 'nonce' has changed. If so, increment 'nonce_count'. */
+  if ( strncmp (nonce_sensor, ndAuthParamValue (param, "nonce"),
+		sizeof (nonce_sensor)) ) {
+    ++nc;
+    strncpy (nonce_sensor, ndAuthParamValue (param, "nonce"),
+		sizeof (nonce_sensor));
+  }
+
+  xmlBufferAdd (buf1, (xmlChar *) ", uri=\"", -1);
+  xmlBufferAdd (buf1, (xmlChar *) export_uri, -1);
+  xmlBufferAdd (buf1, (xmlChar *) "\"", -1);
+
+  xmlBufferAdd (buf1, (xmlChar *) ", algorithm=\"MD5\"", -1);
+
+  /* Use the new nonce_counter. */
+  snprintf (nc_string, sizeof (nc_string), "%08x", nc);
+  xmlBufferAdd (buf1, (xmlChar *) ", qop=\"auth\", nc=", -1);
+  xmlBufferAdd (response, (xmlChar *) ":", -1);
+
+  xmlBufferAdd (buf1, (xmlChar *) nc_string, -1);
+  xmlBufferAdd (response, (xmlChar *) nc_string, -1);
+
+  add_quoted_param (buf1, param, "cnonce", "cnonce", 1);
+
+  xmlBufferAdd (response, (xmlChar *) ":", -1);
+  xmlBufferAdd (response, (xmlChar *) ndAuthParamValue (param, "cnonce"), -1);
+  xmlBufferAdd (response, (xmlChar *) ":auth:", -1);
+  xmlBufferAdd (response, xmlBufferContent (ndAuthEncodeDigest (A2)), -1);
+
+  xmlBufferFree (A2); /* Used inside 'response'. */
+
+  xmlBufferAdd (buf1, (xmlChar *) ", response=\"", -1);
+  xmlBufferAdd (buf1, xmlBufferContent (ndAuthEncodeDigest (response)), -1);
+  xmlBufferAdd (buf1, (xmlChar *) "\"", -1);
+  xmlBufferFree (response);
+
+  if (ndAuthParamValue (param, "opaque"))
+    add_quoted_param (buf1, param, "opaque", "opaque", 1);
+
+  return buf1;
 }
 
 int
--- nd-0.8.2.debian/nd.c
+++ nd-0.8.2/nd.c
@@ -25,6 +25,9 @@
 
 #include "nd.h"
 
+const char *export_method = "";
+const char *export_uri = "";
+
 ndNodeInfoPtr
 ndNodeInfoNew ()
 {
@@ -345,6 +348,18 @@ ndHTTPMethod (URL, auth, method, input, 
   xmlBufferPtr header_buf = NULL;
   char line [ND_HEADER_LINE_MAX];
   xmlBufferPtr temp_buf = NULL;
+  char * uri = (char *) URL;
+
+  if (URL == NULL) return NULL;
+
+  if ( !(uri = strchr(uri, '/')) || !(uri = strchr(++uri, '/')) || ! *uri)
+    return NULL;
+
+  if ( !(uri = strchr(++uri, '/')))
+    return NULL;
+
+  export_method = method;
+  export_uri = uri;
 
   header_buf = xmlBufferCreate ();
   if (header_buf == NULL) return NULL;
--- nd-0.8.2/nd.1.debian
+++ nd-0.8.2/nd.1
@@ -169,6 +169,15 @@
 .B USER
 When manipulating a lock without an explicit owner option, the value
 of USER is used to set the owner of the file lock.
+.SH BUGS
+A maintainer of the Debian package has implemented Digest authentication
+on top of the original software. However, the upstream source uses the
+nanoHTTP code from libxml2 to implement the HTTP transport. Due to properties
+inherent in that code for detecting and following redirected target sites,
+there is no way to pull out the new address in order to insert it into the
+hashes necessary for the Digest method. Nd will therefore incorrectly answer
+with 'Bad request' to any method call aimed at such sites. Using the correct
+logical name for the target will, however, produce a correct response from Nd.
 .SH AUTHORS
 Yuuichi Teranishi (teranisi@gohome.org).
 .SH SEE ALSO