Skip to content

[2.4.x] mod_auth_digest rebase to trunk - #706

Open
notroj wants to merge 22 commits into
apache:2.4.xfrom
notroj:24x-digested
Open

[2.4.x] mod_auth_digest rebase to trunk#706
notroj wants to merge 22 commits into
apache:2.4.xfrom
notroj:24x-digested

Conversation

@notroj

@notroj notroj commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator

Many changes but a net reduction in LoC, partly but not entirely due to the removal of RFC 2069 support.

 mod_auth_digest.c |  804 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------------------------------------------------------------------------------------------------------
 1 file changed, 359 insertions(+), 445 deletions(-)

covener and others added 22 commits August 13, 2026 17:44
@covener @notroj
PR59039 Digest not working with ap_expr based AuthName
5151152 
Stop caching the configured realm during config processing and always
call ap_auth_name(r) to determine (=evaluate potential expression)
the configured realm

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1731662 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit c52f4a8)
@notroj
* modules/aaa/mod_auth_digest.c: Remove undocumented and unimplemented
c4faadc 
  AuthDigestNonceFormat directive.

PR: 70056

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934434 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 29b83f4)
@notroj
mod_auth_digest: Drop RFC 2069 and configurable qop support.
0e0ceb9 
(RFC 2617, which replaced 2069, is now 26 years old)

* modules/aaa/mod_auth_digest.c (digest_config_rec): Remove qop_list
  field.
  (create_digest_dir_config): Remove qop_list initialization.
  (set_qop): Deprecate AuthDigestQop, only "auth" is supported.
  (note_digest_auth_failure): Always send qop="auth".
  (check_nc): Remove handling for qop=none.
  (old_digest): Remove function.
  (authenticate_digest_user): Reject requests with missing or
  non-"auth" qop value rather than falling back to RFC 2069.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935944 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 358a567)
@notroj
* modules/aaa/mod_auth_digest.c: Remove "weird" override of AuthName
68657cf 
  directive, which adds complexity for little benefit (avoids putting
  20 bytes through SHA1 for each auth attempt).
  (set_realm): Remove function.
  (gen_nonce_hash): Create the nonce hash here from scratch.
  (create_digest_dir_config): Always allocate a config struct.
  Remove unused dir_name field from digest_config_rec.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935945 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 0267536)
@notroj
* modules/aaa/mod_auth_digest.c (set_algorithm): Note that
91e9625 
  conf->algorithm is a constant ("MD5") so there is no point
  in overriding it at runtime. Simplify error case.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935946 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 6bb2685)
@notroj
* modules/aaa/config.m4,
023ba57 
  modules/aaa/mod_auth_digest.c (pre_init, initialize_module):
  Prevent using mod_auth_digest without APR_HAS_SHARED_MEMORY.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935947 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit dc9e137)
@notroj
* modules/aaa/mod_auth_digest.c: Use apr_uint32_t for the
6a01772 
  one-time-nonce counter.
  (gen_nonce): Drop the fallback case for non-shmem builds
  where otn_counter could be NULL previously. Use atomics
  to increment the counter.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935948 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 584eb25)
@notroj
* modules/aaa/mod_auth_digest.c (get_digest_rec):
ef959e1 
  Parse opaque more strictly.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935949 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 81a13c6)
@notroj
* modules/aaa/mod_auth_digest.c (cleanup_tables, initialize_tables,
69e1cad 
  initialize_child, gen_client): Replace mutex-protected opaque_cntr
  with opaque_counter, incremented via atomics.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935950 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit a23632f)
@notroj
* modules/aaa/mod_auth_digest.c (pre_init): Don't register
e96a658 
  now-unused "authdigest-opaque" mutex type.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935951 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 9edc7f5)
@notroj
* modules/aaa/mod_auth_digest.c: Remove checks for NULL client_shm
644945e 
  throughout.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935952 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit acc2d56)
@notroj
* modules/aaa/mod_auth_digest.c: Fix comments.
d9af54b 
GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935953 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 41dce17)
@notroj
* modules/aaa/mod_auth_digest.c (add_auth_info): Don't add
ba85c11 
  (Proxy-)Authentication-Info headers to 401/407 responses.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935954 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 4e4c7fb)
@notroj
* modules/aaa/mod_auth_digest.c: Fix AuthDigestNcCheck: track the
e07f879 
  nonce-count per-nonce, require it to increase (RFC 7616 3.4.3), and
  record it only for a fully verified request.

* test/modules/aaa/test_007_replay.py: Add replay tests.
* test/modules/aaa/test_003_nccheck.py, test/modules/aaa/conftest.py:
  Update for the new semantics.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937104 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 113f027)
@notroj
* modules/aaa/mod_auth_digest.c: Consolidate one-time nonce handling
69fc3ff 
  in check_and_record_nonce, accepting a nonce iff it is newer than
  the last used, and re-challenging as stale when reused.

* test/modules/aaa/test_008_onetime_nccheck.py: Add tests for one-time
  nonces, alone and with AuthDigestNcCheck.

* test/modules/aaa/conftest.py: Add an AuthDigestNonceLifetime 0 plus
  AuthDigestNcCheck location.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937105 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 0c2b5b3)
@notroj
* modules/aaa/mod_auth_digest.c (get_digest_rec): Rename to
08a2143 
  parse_digest_header, returning the header status the caller stores
  in resp->auth_hdr_sts. (parse_digest_header): Rename to
  init_digest_request.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937106 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 6b25169)
@notroj
* modules/aaa/mod_auth_digest.c: Don't let a client_entry pointer
88bee92 
  escape the client_lock critical section; look up and release per
  access rather than caching the pointer across the request.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937107 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 2137354)
@notroj
* modules/aaa/mod_auth_digest.c (note_digest_auth_failure): Return 503
f52faf7 
  when the client entry cannot be allocated, rather than sending a
  challenge with no opaque. Default the opaque to NULL to match what
  check_nonce() hashes when the client sends none.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937108 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 25bd92b)
@notroj
* modules/aaa/mod_auth_digest.c (client_generate): Skip a client id
19ba61e 
  of zero, which the counter hands out once it wraps: zero means "no
  client", so add_client() refuses it.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937109 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 5216183)
@notroj
* modules/aaa/mod_auth_digest.c (gc): Return unsigned long, the type
396a3b8 
  the count is accumulated in and the type of the client_list counters.
  (add_client): Log those counters with %lu, all being unsigned.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937110 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 5e7b2c8)
@notroj
* modules/aaa/mod_auth_digest.c: Fail the build without APR_HAS_RANDOM
895dd8b 
  or APR_HAS_SHARED_MEMORY, rather than testing at runtime. configure
  already declines to build the module without them.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937111 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 37d7311)
@notroj
Document changes.
f72f17c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@notroj @covener