http.cpp File Reference

#include "gtest/gtest.h"
#include "net/http_auth.h"
#include <boost/algorithm/string/predicate.hpp>
#include <boost/algorithm/string/join.hpp>
#include <boost/fusion/adapted/std_pair.hpp>
#include <boost/range/algorithm/find_if.hpp>
#include <boost/range/iterator_range_core.hpp>
#include <boost/spirit/include/karma_char.hpp>
#include <boost/spirit/include/karma_list.hpp>
#include <boost/spirit/include/karma_generate.hpp>
#include <boost/spirit/include/karma_right_alignment.hpp>
#include <boost/spirit/include/karma_sequence.hpp>
#include <boost/spirit/include/karma_string.hpp>
#include <boost/spirit/include/karma_uint.hpp>
#include <boost/spirit/include/qi_alternative.hpp>
#include <boost/spirit/include/qi_char.hpp>
#include <boost/spirit/include/qi_char_class.hpp>
#include <boost/spirit/include/qi_difference.hpp>
#include <boost/spirit/include/qi_eoi.hpp>
#include <boost/spirit/include/qi_list.hpp>
#include <boost/spirit/include/qi_parse.hpp>
#include <boost/spirit/include/qi_plus.hpp>
#include <boost/spirit/include/qi_sequence.hpp>
#include <boost/spirit/include/qi_string.hpp>
#include <cstdint>
#include <iterator>
#include <string>
#include <unordered_map>
#include <utility>
#include <vector>
#include "md5_l.h"
#include "string_tools.h"
#include "crypto/crypto.h"

Include dependency graph for http.cpp:

Go to the source code of this file.

Functions
	TEST (HTTP_Server_Auth, NotRequired)
	TEST (HTTP_Server_Auth, MissingAuth)
	TEST (HTTP_Server_Auth, BadSyntax)
	TEST (HTTP_Server_Auth, MD5)
	TEST (HTTP_Server_Auth, MD5_sess)
	TEST (HTTP_Server_Auth, MD5_auth)
	TEST (HTTP_Server_Auth, MD5_sess_auth)
	TEST (HTTP_Auth, DogFood)
	TEST (HTTP_Client_Auth, Unavailable)
	TEST (HTTP_Client_Auth, MissingAuthenticate)
	TEST (HTTP_Client_Auth, BadSyntax)
	TEST (HTTP_Client_Auth, MD5)
	TEST (HTTP_Client_Auth, MD5_auth)
	TEST (HTTP, Add_Field)

Function Documentation

TEST() [1/14]

TEST	(	HTTP	,
		Add_Field	)

Definition at line 738 of file http.cpp.

{
  std::string str{"leading text"};
  epee::net_utils::http::add_field(str, "foo", "bar");
  epee::net_utils::http::add_field(str, std::string("bar"), std::string("foo"));
  epee::net_utils::http::add_field(str, {"moarbars", "moarfoo"});
 
  EXPECT_STREQ("leading textfoo: bar\r\nbar: foo\r\nmoarbars: moarfoo\r\n", str.c_str());
}

TEST() [2/14]

TEST	(	HTTP_Auth	,
		DogFood	)

Definition at line 519 of file http.cpp.

{
  const auto add_auth_field = [] (http::http_request_info& request, http::http_client_auth& client)
  {
    auto field = client.get_auth_field(request.m_http_method_str, request.m_URI);
    EXPECT_TRUE(bool(field));
    if (!field)
      return false;
    request.m_header_info.m_etc_fields.push_back(std::move(*field));
    return true;
  };
 
  const http::login user{"some_user", "ultimate password"};
 
  http::http_server_auth server{user, rng};
  http::http_client_auth client{user};
 
  http::http_request_info request{};
  request.m_http_method_str = "GET";
  request.m_URI = "/FOO";
 
  auto response = server.get_response(request);
  ASSERT_TRUE(bool(response));
  EXPECT_TRUE(is_unauthorized(*response));
  EXPECT_TRUE(response->m_header_info.m_etc_fields.empty());
  response->m_header_info.m_etc_fields = response->m_additional_fields;
 
  EXPECT_EQ(http::http_client_auth::kSuccess, client.handle_401(*response));
  EXPECT_TRUE(add_auth_field(request, client));
  EXPECT_FALSE(bool(server.get_response(request)));
 
  for (unsigned i = 0; i < 1000; ++i)
  {
    request.m_http_method_str += std::to_string(i);
    request.m_header_info.m_etc_fields.clear();
    EXPECT_TRUE(add_auth_field(request, client));
    EXPECT_FALSE(bool(server.get_response(request)));
  }
 
  // resetting counter should be rejected by server
  request.m_header_info.m_etc_fields.clear();
  client = http::http_client_auth{user};
  EXPECT_EQ(http::http_client_auth::kSuccess, client.handle_401(*response));
  EXPECT_TRUE(add_auth_field(request, client));
 
  auto response2 = server.get_response(request);
  ASSERT_TRUE(bool(response2));
  EXPECT_TRUE(is_unauthorized(*response2));
  EXPECT_TRUE(response2->m_header_info.m_etc_fields.empty());
  response2->m_header_info.m_etc_fields = response2->m_additional_fields;
 
  const auth_responses parsed1 = parse_response(*response);
  const auth_responses parsed2 = parse_response(*response2);
  ASSERT_LE(1u, parsed1.size());
  ASSERT_LE(1u, parsed2.size());
  EXPECT_NE(parsed1[0].at(u8"nonce"), parsed2[0].at(u8"nonce"));
 
  // with stale=true client should reset
  request.m_header_info.m_etc_fields.clear();
  EXPECT_EQ(http::http_client_auth::kSuccess, client.handle_401(*response2));
  EXPECT_TRUE(add_auth_field(request, client));
  EXPECT_FALSE(bool(server.get_response(request)));
 
  // client should give up if stale=false
  EXPECT_EQ(http::http_client_auth::kBadPassword, client.handle_401(*response));
}

TEST() [3/14]

TEST	(	HTTP_Client_Auth	,
		BadSyntax	)

Definition at line 606 of file http.cpp.

{
  http::http_client_auth auth{{"foo", "bar"}};
  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(make_response({{{u8"realm", "fo\xFF"}}})));
  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(make_response({{{u8"domain", "fo\xFF"}}})));
  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(make_response({{{u8"nonce", "fo\xFF"}}})));
  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(make_response({{{u8"nonce \xFF =", "fo\xFF"}}})));
  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(make_response({{{u8" \xFF nonce", "fo\xFF"}}})));
}

TEST() [4/14]

TEST	(	HTTP_Client_Auth	,
		MD5	)

Definition at line 616 of file http.cpp.

{
  constexpr char method[] = "NOP";
  constexpr char nonce[] = "some crazy nonce";
  constexpr char realm[] = "the only realm";
  constexpr char uri[] = "/some_file";
 
  const http::login user{"foo", "bar"};
  http::http_client_auth auth{user};
 
  auto response = make_response({
    {
      {u8"domain", quoted("ignored")},
      {u8"nonce", quoted(nonce)},
      {u8"REALM", quoted(realm)}
    },
    {
      {u8"algorithm", "null"},
      {u8"domain", quoted("ignored")},
      {u8"nonce", quoted(std::string{"e"} + nonce)},
      {u8"realm", quoted(std::string{"e"} + realm)}
    },
  });
 
  EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
  const auto auth_field = auth.get_auth_field(method, uri);
  ASSERT_TRUE(bool(auth_field));
 
  const auto parsed = parse_fields(auth_field->second);
  EXPECT_STREQ(u8"Authorization", auth_field->first.c_str());
  EXPECT_EQ(parsed.end(), parsed.find(u8"opaque"));
  EXPECT_EQ(parsed.end(), parsed.find(u8"qop"));
  EXPECT_EQ(parsed.end(), parsed.find(u8"nc"));
  EXPECT_STREQ(u8"MD5", parsed.at(u8"algorithm").c_str());
  EXPECT_STREQ(nonce, parsed.at(u8"nonce").c_str());
  EXPECT_STREQ(uri, parsed.at(u8"uri").c_str());
  EXPECT_EQ(user.username, parsed.at(u8"username"));
  EXPECT_STREQ(realm, parsed.at(u8"realm").c_str());
 
  const std::string a1 = get_a1(user, parsed);
  const std::string a2 = get_a2(uri);
  const std::string auth_code = md5_hex(
    boost::join(std::vector<std::string>{md5_hex(a1), nonce, md5_hex(a2)}, u8":")
  );
  EXPECT_TRUE(boost::iequals(auth_code, parsed.at(u8"response")));
  {
    const auto auth_field_dup = auth.get_auth_field(method, uri);
    ASSERT_TRUE(bool(auth_field_dup));
    EXPECT_EQ(*auth_field, *auth_field_dup);
  }
 
 
  EXPECT_EQ(http::http_client_auth::kBadPassword, auth.handle_401(response));
  response.m_header_info.m_etc_fields.front().second.append(u8"," + write_fields({{u8"stale", u8"TRUE"}}));
  EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
}

TEST() [5/14]

TEST	(	HTTP_Client_Auth	,
		MD5_auth	)

Definition at line 673 of file http.cpp.

{
  constexpr char cnonce[] = "";
  constexpr char method[] = "NOP";
  constexpr char nonce[] = "some crazy nonce";
  constexpr char opaque[] = "this is the opaque";
  constexpr char qop[] = u8"ignore,auth,ignore";
  constexpr char realm[] = "the only realm";
  constexpr char uri[] = "/some_file";
 
  const http::login user{"foo", "bar"};
  http::http_client_auth auth{user};
 
  auto response = make_response({
    {
      {u8"algorithm", u8"MD5"},
      {u8"domain", quoted("ignored")},
      {u8"nonce", quoted(std::string{"e"} + nonce)},
      {u8"realm", quoted(std::string{"e"} + realm)},
      {u8"qop", quoted("some,thing,to,ignore")}
    },
    {
      {u8"algorIthm", quoted(u8"md5")},
      {u8"domain", quoted("ignored")},
      {u8"noNce", quoted(nonce)},
      {u8"opaque", quoted(opaque)},
      {u8"realm", quoted(realm)},
      {u8"QoP", quoted(qop)}
    }
  });
 
  EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
 
  for (unsigned i = 1; i < 1000; ++i)
  {
    const std::string nc = get_nc(i);
 
    const auto auth_field = auth.get_auth_field(method, uri);
    ASSERT_TRUE(bool(auth_field));
 
    const auto parsed = parse_fields(auth_field->second);
    EXPECT_STREQ(u8"Authorization", auth_field->first.c_str());
    EXPECT_STREQ(u8"MD5", parsed.at(u8"algorithm").c_str());
    EXPECT_STREQ(nonce, parsed.at(u8"nonce").c_str());
    EXPECT_STREQ(opaque, parsed.at(u8"opaque").c_str());
    EXPECT_STREQ(u8"auth", parsed.at(u8"qop").c_str());
    EXPECT_STREQ(uri, parsed.at(u8"uri").c_str());
    EXPECT_EQ(user.username, parsed.at(u8"username"));
    EXPECT_STREQ(realm, parsed.at(u8"realm").c_str());
    EXPECT_EQ(nc, parsed.at(u8"nc"));
 
    const std::string a1 = get_a1(user, parsed);
    const std::string a2 = get_a2(uri);
    const std::string auth_code = md5_hex(
      boost::join(std::vector<std::string>{md5_hex(a1), nonce, nc, cnonce, u8"auth", md5_hex(a2)}, u8":")
    );
    EXPECT_TRUE(boost::iequals(auth_code, parsed.at(u8"response")));
  }
 
  EXPECT_EQ(http::http_client_auth::kBadPassword, auth.handle_401(response));
  response.m_header_info.m_etc_fields.back().second.append(u8"," + write_fields({{u8"stale", u8"trUe"}}));
  EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
}

TEST() [6/14]

TEST	(	HTTP_Client_Auth	,
		MissingAuthenticate	)

Definition at line 593 of file http.cpp.

{
  http::http_client_auth auth{{"foo", "bar"}};
  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(http::http_response_info{}));
  EXPECT_FALSE(bool(auth.get_auth_field("POST", "/\xFFname")));
  {
    http::http_response_info response{};
    response.m_additional_fields.push_back({"\xFF", "\xFF"});
    EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(response));
  }
  EXPECT_FALSE(bool(auth.get_auth_field("DELETE", "/file/does/not/exist")));
}

TEST() [7/14]

TEST	(	HTTP_Client_Auth	,
		Unavailable	)

Definition at line 586 of file http.cpp.

{
  http::http_client_auth auth{};
  EXPECT_EQ(http::http_client_auth::kBadPassword, auth.handle_401(http::http_response_info{}));
  EXPECT_FALSE(bool(auth.get_auth_field("GET", "/file")));
}

TEST() [8/14]

TEST	(	HTTP_Server_Auth	,
		BadSyntax	)

Definition at line 275 of file http.cpp.

{
  http::http_server_auth auth{{"foo", "bar"}, rng};
  EXPECT_TRUE(bool(auth.get_response(make_request({{u8"algorithm", "fo\xFF"}}))));
  EXPECT_TRUE(bool(auth.get_response(make_request({{u8"cnonce", "\"000\xFF\""}}))));
  EXPECT_TRUE(bool(auth.get_response(make_request({{u8"cnonce \xFF =", "\"000\xFF\""}}))));
  EXPECT_TRUE(bool(auth.get_response(make_request({{u8" \xFF cnonce", "\"000\xFF\""}}))));
}

TEST() [9/14]

TEST	(	HTTP_Server_Auth	,
		MD5	)

Definition at line 284 of file http.cpp.

{
  http::login user{"foo", "bar"};
  http::http_server_auth auth{user, rng};
 
  const auto response = auth.get_response(make_request(fields{}));
  ASSERT_TRUE(bool(response));
  EXPECT_TRUE(is_unauthorized(*response));
 
  const auto fields = parse_response(*response);
  ASSERT_LE(2u, fields.size());
  EXPECT_TRUE(has_same_fields(fields));
 
  const std::string& nonce = fields[0].at(u8"nonce");
  EXPECT_EQ(24, nonce.size());
 
  const std::string uri{"/some_foo_thing"};
 
  const std::string a1 = get_a1(user, fields);
  const std::string a2 = get_a2(uri);
 
  const std::string auth_code = md5_hex(
    boost::join(std::vector<std::string>{md5_hex(a1), nonce, md5_hex(a2)}, u8":")
  );
 
  const auto request = make_request({
    {u8"nonce", quoted(nonce)},
    {u8"realm", quoted(fields[0].at(u8"realm"))},
    {u8"response", quoted(auth_code)},
    {u8"uri", quoted(uri)},
    {u8"username", quoted(user.username)}
  });
 
  EXPECT_FALSE(bool(auth.get_response(request)));
 
  const auto response2 = auth.get_response(request);
  ASSERT_TRUE(bool(response2));
  EXPECT_TRUE(is_unauthorized(*response2));
 
  const auto fields2 = parse_response(*response2);
  ASSERT_LE(2u, fields2.size());
  EXPECT_TRUE(has_same_fields(fields2));
 
  EXPECT_NE(nonce, fields2[0].at(u8"nonce"));
  EXPECT_STREQ(u8"true", fields2[0].at(u8"stale").c_str());
}

TEST() [10/14]

TEST	(	HTTP_Server_Auth	,
		MD5_auth	)

Definition at line 382 of file http.cpp.

{
  constexpr const char cnonce[] = "not a nonce";
  constexpr const char qop[] = "auth";
 
  http::login user{"foo", "bar"};
  http::http_server_auth auth{user, rng};
 
  const auto response = auth.get_response(make_request(fields{}));
  ASSERT_TRUE(bool(response));
  EXPECT_TRUE(is_unauthorized(*response));
 
  const auto parsed = parse_response(*response);
  ASSERT_LE(2u, parsed.size());
  EXPECT_TRUE(has_same_fields(parsed));
 
  const std::string& nonce = parsed[0].at(u8"nonce");
  EXPECT_EQ(24, nonce.size());
 
  const std::string uri{"/some_foo_thing"};
 
  const std::string a1 = get_a1(user, parsed);
  const std::string a2 = get_a2(uri);
  std::string nc = get_nc(1);
 
  const auto generate_auth = [&] {
    return md5_hex(
      boost::join(
        std::vector<std::string>{md5_hex(a1), nonce, nc, cnonce, qop, md5_hex(a2)}, u8":"
      )
    );
  };
 
  fields args{
    {u8"algorithm", quoted(u8"md5")},
    {u8"cnonce", quoted(cnonce)},
    {u8"nc", nc},
    {u8"nonce", quoted(nonce)},
    {u8"qop", quoted(qop)},
    {u8"realm", quoted(parsed[0].at(u8"realm"))},
    {u8"response", quoted(generate_auth())},
    {u8"uri", quoted(uri)},
    {u8"username", quoted(user.username)}
  };
 
  const auto request = make_request(args);
  EXPECT_FALSE(bool(auth.get_response(request)));
 
  for (unsigned i = 2; i < 20; ++i)
  {
    nc = get_nc(i);
    args.at(u8"nc") = nc;
    args.at(u8"response") = quoted(generate_auth());
    EXPECT_FALSE(auth.get_response(make_request(args)));
  }
 
  const auto replay = auth.get_response(request);
  ASSERT_TRUE(bool(replay));
  EXPECT_TRUE(is_unauthorized(*replay));
 
  const auto parsed_replay = parse_response(*replay);
  ASSERT_LE(2u, parsed_replay.size());
  EXPECT_TRUE(has_same_fields(parsed_replay));
 
  EXPECT_NE(nonce, parsed_replay[0].at(u8"nonce"));
  EXPECT_STREQ(u8"true", parsed_replay[0].at(u8"stale").c_str());
}

TEST() [11/14]

TEST	(	HTTP_Server_Auth	,
		MD5_sess	)

Definition at line 331 of file http.cpp.

{
  constexpr const char cnonce[] = "not a good cnonce";
 
  http::login user{"foo", "bar"};
  http::http_server_auth auth{user, rng};
 
  const auto response = auth.get_response(make_request(fields{}));
  ASSERT_TRUE(bool(response));
  EXPECT_TRUE(is_unauthorized(*response));
 
  const auto fields = parse_response(*response);
  ASSERT_LE(2u, fields.size());
  EXPECT_TRUE(has_same_fields(fields));
 
  const std::string& nonce = fields[0].at(u8"nonce");
  EXPECT_EQ(24, nonce.size());
 
  const std::string uri{"/some_foo_thing"};
 
  const std::string a1 = get_a1_sess(user, cnonce, fields);
  const std::string a2 = get_a2(uri);
 
  const std::string auth_code = md5_hex(
    boost::join(std::vector<std::string>{md5_hex(a1), nonce, md5_hex(a2)}, u8":")
  );
 
  const auto request = make_request({
    {u8"algorithm", u8"md5-sess"},
    {u8"cnonce", quoted(cnonce)},
    {u8"nonce", quoted(nonce)},
    {u8"realm", quoted(fields[0].at(u8"realm"))},
    {u8"response", quoted(auth_code)},
    {u8"uri", quoted(uri)},
    {u8"username", quoted(user.username)}
  });
 
  EXPECT_FALSE(bool(auth.get_response(request)));
 
  const auto response2 = auth.get_response(request);
  ASSERT_TRUE(bool(response2));
  EXPECT_TRUE(is_unauthorized(*response2));
 
  const auto fields2 = parse_response(*response2);
  ASSERT_LE(2u, fields2.size());
  EXPECT_TRUE(has_same_fields(fields2));
 
  EXPECT_NE(nonce, fields2[0].at(u8"nonce"));
  EXPECT_STREQ(u8"true", fields2[0].at(u8"stale").c_str());
}

TEST() [12/14]

TEST	(	HTTP_Server_Auth	,
		MD5_sess_auth	)

Definition at line 450 of file http.cpp.

{
  constexpr const char cnonce[] = "not a nonce";
  constexpr const char qop[] = "auth";
 
  http::login user{"foo", "bar"};
  http::http_server_auth auth{user, rng};
 
  const auto response = auth.get_response(make_request(fields{}));
  ASSERT_TRUE(bool(response));
  EXPECT_TRUE(is_unauthorized(*response));
 
  const auto parsed = parse_response(*response);
  ASSERT_LE(2u, parsed.size());
  EXPECT_TRUE(has_same_fields(parsed));
 
  const std::string& nonce = parsed[0].at(u8"nonce");
  EXPECT_EQ(24, nonce.size());
 
  const std::string uri{"/some_foo_thing"};
 
  const std::string a1 = get_a1_sess(user, cnonce, parsed);
  const std::string a2 = get_a2(uri);
  std::string nc = get_nc(1);
 
  const auto generate_auth = [&] {
    return md5_hex(
      boost::join(
        std::vector<std::string>{md5_hex(a1), nonce, nc, cnonce, qop, md5_hex(a2)}, u8":"
      )
    );
  };
 
  fields args{
    {u8"algorithm", u8"md5-sess"},
    {u8"cnonce", quoted(cnonce)},
    {u8"nc", nc},
    {u8"nonce", quoted(nonce)},
    {u8"qop", qop},
    {u8"realm", quoted(parsed[0].at(u8"realm"))},
    {u8"response", quoted(generate_auth())},
    {u8"uri", quoted(uri)},
    {u8"username", quoted(user.username)}
  };
 
  const auto request = make_request(args);
  EXPECT_FALSE(bool(auth.get_response(request)));
 
  for (unsigned i = 2; i < 20; ++i)
  {
    nc = get_nc(i);
    args.at(u8"nc") = nc;
    args.at(u8"response") = quoted(generate_auth());
    EXPECT_FALSE(auth.get_response(make_request(args)));
  }
 
  const auto replay = auth.get_response(request);
  ASSERT_TRUE(bool(replay));
  EXPECT_TRUE(is_unauthorized(*replay));
 
  const auto parsed_replay = parse_response(*replay);
  ASSERT_LE(2u, parsed_replay.size());
  EXPECT_TRUE(has_same_fields(parsed_replay));
 
  EXPECT_NE(nonce, parsed_replay[0].at(u8"nonce"));
  EXPECT_STREQ(u8"true", parsed_replay[0].at(u8"stale").c_str());
}

TEST() [13/14]

TEST	(	HTTP_Server_Auth	,
		MissingAuth	)

Definition at line 264 of file http.cpp.

{
  http::http_server_auth auth{{"foo", "bar"}, rng};
  EXPECT_TRUE(bool(auth.get_response(http::http_request_info{})));
  {
    http::http_request_info request{};
    request.m_header_info.m_etc_fields.push_back({"\xFF", "\xFF"});
    EXPECT_TRUE(bool(auth.get_response(request)));
  }
}

TEST() [14/14]

TEST	(	HTTP_Server_Auth	,
		NotRequired	)

Definition at line 258 of file http.cpp.

{
  http::http_server_auth auth{}; // no rng here
  EXPECT_FALSE(auth.get_response(http::http_request_info{}));
}