[2.4.x] mod_auth_digest rebase to trunk - #706

  AuthDigestNonceFormat directive.

PR: 70056

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934434 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 29b83f4)

(RFC 2617, which replaced 2069, is now 26 years old)

* modules/aaa/mod_auth_digest.c (digest_config_rec): Remove qop_list
  field.
  (create_digest_dir_config): Remove qop_list initialization.
  (set_qop): Deprecate AuthDigestQop, only "auth" is supported.
  (note_digest_auth_failure): Always send qop="auth".
  (check_nc): Remove handling for qop=none.
  (old_digest): Remove function.
  (authenticate_digest_user): Reject requests with missing or
  non-"auth" qop value rather than falling back to RFC 2069.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935944 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 358a567)

  directive, which adds complexity for little benefit (avoids putting
  20 bytes through SHA1 for each auth attempt).
  (set_realm): Remove function.
  (gen_nonce_hash): Create the nonce hash here from scratch.
  (create_digest_dir_config): Always allocate a config struct.
  Remove unused dir_name field from digest_config_rec.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935945 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 0267536)

  conf->algorithm is a constant ("MD5") so there is no point
  in overriding it at runtime. Simplify error case.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935946 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 6bb2685)

  modules/aaa/mod_auth_digest.c (pre_init, initialize_module):
  Prevent using mod_auth_digest without APR_HAS_SHARED_MEMORY.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935947 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit dc9e137)

  one-time-nonce counter.
  (gen_nonce): Drop the fallback case for non-shmem builds
  where otn_counter could be NULL previously. Use atomics
  to increment the counter.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935948 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 584eb25)

  Parse opaque more strictly.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935949 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 81a13c6)

  initialize_child, gen_client): Replace mutex-protected opaque_cntr
  with opaque_counter, incremented via atomics.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935950 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit a23632f)

  now-unused "authdigest-opaque" mutex type.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935951 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 9edc7f5)

  throughout.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935952 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit acc2d56)

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935953 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 41dce17)

  (Proxy-)Authentication-Info headers to 401/407 responses.

GitHub: PR apache#661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935954 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 4e4c7fb)

  nonce-count per-nonce, require it to increase (RFC 7616 3.4.3), and
  record it only for a fully verified request.

* test/modules/aaa/test_007_replay.py: Add replay tests.
* test/modules/aaa/test_003_nccheck.py, test/modules/aaa/conftest.py:
  Update for the new semantics.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937104 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 113f027)

  in check_and_record_nonce, accepting a nonce iff it is newer than
  the last used, and re-challenging as stale when reused.

* test/modules/aaa/test_008_onetime_nccheck.py: Add tests for one-time
  nonces, alone and with AuthDigestNcCheck.

* test/modules/aaa/conftest.py: Add an AuthDigestNonceLifetime 0 plus
  AuthDigestNcCheck location.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937105 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 0c2b5b3)

  parse_digest_header, returning the header status the caller stores
  in resp->auth_hdr_sts. (parse_digest_header): Rename to
  init_digest_request.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937106 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 6b25169)

  escape the client_lock critical section; look up and release per
  access rather than caching the pointer across the request.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937107 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 2137354)

  when the client entry cannot be allocated, rather than sending a
  challenge with no opaque. Default the opaque to NULL to match what
  check_nonce() hashes when the client sends none.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937108 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 25bd92b)

  of zero, which the counter hands out once it wraps: zero means "no
  client", so add_client() refuses it.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937109 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 5216183)

  the count is accumulated in and the type of the client_list counters.
  (add_client): Log those counters with %lu, all being unsigned.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937110 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 5e7b2c8)

  or APR_HAS_SHARED_MEMORY, rather than testing at runtime. configure
  already declines to build the module without them.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#705

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937111 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 37d7311)