narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[http] Gracefully handle offers of multiple authentication schemes 

Servers may provide multiple WWW-Authenticate headers, each offering a
different authentication scheme.  We currently fail the request as
soon as we encounter an unrecognised scheme, which prevents subsequent
offers from succeeding.

Fix by silently ignoring headers for schemes that we do not recognise.
If no schemes are recognised then the request will eventually fail
anyway due to the 401 response code.

If multiple schemes are supported, arbitrarily choose the scheme
appearing first within the response headers.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/179/head
Michael Brown 2017-11-07 11:33:13 +00:00
parent fc2f0dd930
commit c49acbb4d2
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/net/tcp/httpauth.c
View File

@ -104,6 +104,7 @@ static struct http_www_authenticate_field http_www_auth_fields[] = {
static int http_parse_www_authenticate ( struct http_transaction *http,
char *line ) {
struct http_www_authenticate_field *field;
struct http_authentication *auth;
char *name;
char *key;
char *value;
@ -118,13 +119,19 @@ static int http_parse_www_authenticate ( struct http_transaction *http,
}
/* Identify scheme */
http->response.auth.auth = http_authentication ( name );
if ( ! http->response.auth.auth ) {
auth = http_authentication ( name );
if ( ! auth ) {
DBGC ( http, "HTTP %p unrecognised authentication scheme "
"\"%s\"\n", http, name );
return -ENOTSUP;
/* Ignore; the server may offer other schemes */
return 0;
}
/* Use first supported scheme */
if ( http->response.auth.auth )
return 0;
http->response.auth.auth = auth;
/* Process fields */
while ( ( key = http_token ( &line, &value ) ) ) {
for ( i = 0 ; i < ( sizeof ( http_www_auth_fields ) /