108 lines
3.2 KiB
JavaScript
108 lines
3.2 KiB
JavaScript
/**
|
|
* Copyright 2013-2018 Zaid Abdulla
|
|
*
|
|
* This file is part of GenieACS.
|
|
*
|
|
* GenieACS is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as
|
|
* published by the Free Software Foundation, either version 3 of the
|
|
* License, or (at your option) any later version.
|
|
*
|
|
* GenieACS is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with GenieACS. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
"use strict";
|
|
|
|
const crypto = require("crypto");
|
|
|
|
function parseAuthHeader(authHeader) {
|
|
authHeader = authHeader.trim();
|
|
const method = authHeader.split(" ", 1)[0];
|
|
const res = {method: method};
|
|
const parts = authHeader.slice(method.length + 1).split(",");
|
|
|
|
let part;
|
|
while ((part = parts.shift()) != null) {
|
|
const name = part.split("=", 1)[0];
|
|
if (name.length === part.length)
|
|
throw new Error("Unable to parse auth header");
|
|
|
|
let value = part.slice(name.length + 1);
|
|
if (!/^\s*"/.test(value)) {
|
|
value = value.trim();
|
|
} else {
|
|
while (!/[^\\]"\s*$/.test(value)) {
|
|
const p = parts.shift();
|
|
if (p == null)
|
|
throw new Error("Unable to parse auth header");
|
|
value += "," + p;
|
|
}
|
|
|
|
try {
|
|
value = JSON.parse(value);
|
|
} catch (error) {
|
|
throw new Error("Unable to parse auth header");
|
|
}
|
|
}
|
|
res[name.trim()] = value;
|
|
}
|
|
return res;
|
|
}
|
|
|
|
function basic(username, password) {
|
|
return "Basic " + (new Buffer(`${username}:${password}`).toString("base64"));
|
|
}
|
|
|
|
function digest(username, password, uri, httpMethod, body, authHeader) {
|
|
const cnonce = "0a4f113b";
|
|
const nc = "00000001";
|
|
let qop;
|
|
|
|
if (authHeader.qop) {
|
|
if (authHeader.qop.indexOf(",") !== -1)
|
|
qop = "auth"; // Either auth or auth-int, prefer auth
|
|
else
|
|
qop = authHeader.qop;
|
|
}
|
|
|
|
let ha1 = crypto.createHash("md5");
|
|
ha1.update(username).update(":").update(authHeader.realm).update(":").update(password);
|
|
// TODO support "MD5-sess" algorithm directive
|
|
ha1 = ha1.digest("hex");
|
|
|
|
let ha2 = crypto.createHash("md5");
|
|
ha2.update(httpMethod).update(":").update(uri);
|
|
if (qop === "auth-int")
|
|
ha2.update(":").update(body);
|
|
ha2 = ha2.digest("hex");
|
|
|
|
let hash = crypto.createHash("md5");
|
|
hash.update(ha1).update(":").update(authHeader.nonce);
|
|
if (qop)
|
|
hash.update(":").update(nc).update(":").update(cnonce).update(":").update(qop);
|
|
hash.update(":").update(ha2);
|
|
|
|
let authString = `Digest username="${username}"`;
|
|
authString += `,realm="${authHeader.realm}"`;
|
|
authString += `,nonce="${authHeader.nonce}"`;
|
|
authString += `,uri="${url}"`;
|
|
if (authHeader.algorithm)
|
|
authString += `,algorithm=${authHeader.algorithm}`;
|
|
if (qop)
|
|
authString += `,qop=${qop},nc=${nc},cnonce="${cnonce}"`;
|
|
authString += `,response="${hash.digest("hex")}"`;
|
|
if (authHeader.opaque)
|
|
authString += `,opaque="${authHeader.opaque}"`;
|
|
|
|
return authString;
|
|
}
|
|
|
|
exports.parseAuthHeader = parseAuthHeader;
|
|
exports.basic = basic;
|
|
exports.digest = digest;
|