<commit_before>#include "config.h"

#ifdef HAVE_CRYPT_H
# include <crypt.h>
#elif defined(__linux__)
/* linux needs _XOPEN_SOURCE */
# define _XOPEN_SOURCE
#endif

#ifdef HAVE_LIBCRYPT
# define HAVE_CRYPT
#endif

#include <sys/types.h>
#include <sys/stat.h>

#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <unistd.h>
#include <ctype.h>

#include "server.h"
#include "log.h"
#include "http_auth.h"
#include "http_auth_digest.h"
#include "stream.h"

#ifdef USE_OPENSSL
# include <openssl/md5.h>
#else
# include "md5_global.h"
# include "md5.h"
#endif


#ifdef USE_PAM
#include <security/pam_appl.h>
#include <security/pam_misc.h>

static struct pam_conv conv = {
	misc_conv,
		NULL
};
#endif

static const char base64_pad = '=';

static const short base64_reverse_table[256] = {
	        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
		        52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
		        -1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
		        15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
		        -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
		        41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
};


static unsigned char * base64_decode(buffer *out, const char *in) {
	unsigned char *result;
	int ch, j = 0, k;
	size_t i;
	
	size_t in_len = strlen(in);
	
	buffer_prepare_copy(out, in_len);
	
	result = (unsigned char *)out->ptr;
	
	ch = in[0];
	/* run through the whole string, converting as we go */
	for (i = 0; i < in_len; i++) {
		ch = in[i];
		
		if (ch == '\0') break;
		
		if (ch == base64_pad) break;
		
		ch = base64_reverse_table[ch];
		if (ch < 0) continue;
		
		switch(i % 4) {
		case 0:
			result[j] = ch << 2;
			break;
		case 1:
			result[j++] |= ch >> 4;
			result[j] = (ch & 0x0f) << 4;
			break;
		case 2:
			result[j++] |= ch >>2;
			result[j] = (ch & 0x03) << 6;
			break;
		case 3:
			result[j++] |= ch;
			break;
		}
	}
	k = j;
	/* mop things up if we ended on a boundary */
	if (ch == base64_pad) {
		switch(i % 4) {
		case 0:
		case 1:
			return NULL;
		case 2:
			k++;
		case 3:
			result[k++] = 0;
		}
	}
	result[k] = '\0';
	
	out->used = k;
	
	return result;
}

static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) {
	int ret = -1;
	
	if (!username->used|| !realm->used) return -1;
	
	if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
		stream f;
		char * f_line;
		
		if (buffer_is_empty(p->conf.auth_htdigest_userfile)) return -1;
		
		if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) {
			log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno));
			
			return -1;
		}
		
		f_line = f.start;
		
		while (f_line - f.start != f.size) {
			char *f_user, *f_pwd, *e, *f_realm;
			size_t u_len, pwd_len, r_len;
			
			f_user = f_line;
			
			/* 
			 * htdigest format
			 * 
			 * user:realm:md5(user:realm:password) 
			 */
			
			if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
				log_error_write(srv, __FILE__, __LINE__, "sbs", 
						"parsed error in", p->conf.auth_htdigest_userfile, 
						"expected 'username:realm:hashed password'");
				
				stream_close(&f);
				
				return -1;
			}
			
			if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) {
				log_error_write(srv, __FILE__, __LINE__, "sbs", 
						"parsed error in", p->conf.auth_plain_userfile, 
						"expected 'username:realm:hashed password'");
				
				stream_close(&f);
				
				return -1;
			}
			
			/* get pointers to the fields */
			u_len = f_realm - f_user; 
			f_realm++;
			r_len = f_pwd - f_realm;
			f_pwd++;
			
			if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
				pwd_len = e - f_pwd;
			} else {
				pwd_len = f.size - (f_pwd - f.start);
			}
			
			if (username->used - 1 == u_len &&
			    (realm->used - 1 == r_len) &&
			    (0 == strncmp(username->ptr, f_user, u_len)) &&
			    (0 == strncmp(realm->ptr, f_realm, r_len))) {
				/* found */
				
				buffer_copy_string_len(password, f_pwd, pwd_len);
				
				ret = 0;
				break;
			}
			
			/* EOL */
			if (!e) break;
			
			f_line = e + 1;
		}
		
		stream_close(&f);
	} else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD ||
		   p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
		stream f;
		char * f_line;
		buffer *auth_fn;
		
		auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile;
		
		if (buffer_is_empty(auth_fn)) return -1;
		
		if (0 != stream_open(&f, auth_fn)) {
			log_error_write(srv, __FILE__, __LINE__, "sbss", 
					"opening plain-userfile", auth_fn, "failed:", strerror(errno));
			
			return -1;
		}
		
		f_line = f.start;
		
		while (f_line - f.start != f.size) {
			char *f_user, *f_pwd, *e;
			size_t u_len, pwd_len;
			
			f_user = f_line;
			
			/* 
			 * htpasswd format
			 * 
			 * user:crypted passwd
			 */
			
			if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
				log_error_write(srv, __FILE__, __LINE__, "sbs", 
						"parsed error in", auth_fn, 
						"expected 'username:hashed password'");
				
				stream_close(&f);
				
				return -1;
			}
			
			/* get pointers to the fields */
			u_len = f_pwd - f_user; 
			f_pwd++;
			
			if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
				pwd_len = e - f_pwd;
			} else {
				pwd_len = f.size - (f_pwd - f.start);
			}
			
			if (username->used - 1 == u_len &&
			    (0 == strncmp(username->ptr, f_user, u_len))) {
				/* found */
				
				buffer_copy_string_len(password, f_pwd, pwd_len);
				
				ret = 0;
				break;
			}
			
			/* EOL */
			if (!e) break;
			
			f_line = e + 1;
		}
		
		stream_close(&f);
	} else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
		ret = 0;
	} else {
		return -1;
	}
	
	return ret;
}

static int http_auth_match_rules(server *srv, mod_auth_plugin_data *p, const char *url, const char *username, const char *group, const char *host) {
	const char *r = NULL, *rules = NULL;
	size_t i;
	int username_len;
	data_string *require;
	array *req;
	
	UNUSED(group);
	UNUSED(host);

	/* check what has to be match to fullfil the request */
	/* search auth-directives for path */
	for (i = 0; i < p->conf.auth_require->used; i++) {
		if (p->conf.auth_require->data[i]->key->used == 0) continue;
		
		if (0 == strncmp(url, p->conf.auth_require->data[i]->key->ptr, p->conf.auth_require->data[i]->key->used - 1)) {
			break;
		}
	}
	
	if (i == p->conf.auth_require->used) {
		return -1;
	}
	
	req = ((data_array *)(p->conf.auth_require->data[i]))->value;

	require = (data_string *)array_get_element(req, "require");
	
	/* user=name1|group=name3|host=name4 */
	
	/* seperate the string by | */
#if 0
	log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value);
#endif	
	
	username_len = username ? strlen(username) : 0;
	
	r = rules = require->value->ptr;
	
	while (1) {
		const char *eq;
		const char *k, *v, *e;
		int k_len, v_len, r_len;
		
		e = strchr(r, '|');
		
		if (e) {
			r_len = e - r;
		} else {
			r_len = strlen(rules) - (r - rules);
		}
		
		/* from r to r + r_len is a rule */
		
		/* search for = in the rules */
		if (NULL == (eq = strchr(r, '='))) {
			log_error_write(srv, __FILE__, __LINE__, "s", "= is missing");
			return -1;
		}
		
		/* = out of range */
		if (eq > r + r_len) {
			log_error_write(srv, __FILE__, __LINE__, "s", "= out of range");
			
			return -1;
		}
		
		/* the part before the = is user|group|host */
		
		k = r;
		k_len = eq - r;
		v = eq + 1;
		v_len = r_len - k_len - 1;
		
		if (k_len == 4) {
			if (0 == strncmp(k, "user", k_len)) {
				if (username && 
				    username_len == v_len &&
				    0 == strncmp(username, v, v_len)) {
					return 0;
				}
			} else if (0 == strncmp(k, "host", k_len)) {
				log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)");
			} else {
				log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
				return -1;
			}
		} else if (k_len == 5) {
			if (0 == strncmp(k, "group", k_len)) {
				log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)");
			} else {
				log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k);
				return -1;
			}
		} else {
			log_error_write(srv, __FILE__, __LINE__, "s", "unknown  key");
			return -1;
		}
		
		if (!e) break;
		r = e + 1;
	}
	
	log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched");
	
	return -1;
}

/**
 * 
 * 
 * @param password password-string from the auth-backend
 * @param pw       password-string from the client
 */

static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) {
	UNUSED(srv);
	UNUSED(req);

	if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
		/* 
		 * htdigest format
		 * 
		 * user:realm:md5(user:realm:password) 
		 */
		
		MD5_CTX Md5Ctx;
		HASH HA1;
		char a1[256];
		
		MD5_Init(&Md5Ctx);
		MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
		MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
		MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
		MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
		MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
		MD5_Final(HA1, &Md5Ctx);
		
		CvtHex(HA1, a1);
		
		if (0 == strcmp(password->ptr, a1)) {
			return 0;
		}
	} else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) { 
#ifdef HAVE_CRYPT	
		char salt[3];
		char *crypted;
		/* 
		 * htpasswd format
		 * 
		 * user:crypted password
		 */
		
		salt[0] = password->ptr[0];
		salt[1] = password->ptr[1];
		salt[2] = '\0';
		crypted = crypt(pw, salt);

		if (0 == strcmp(password->ptr, crypted)) {
			return 0;
		}
#endif	
	} else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) { 
		if (0 == strcmp(password->ptr, pw)) {
			return 0;
		}
	} else if (p->conf.auth_backend == AUTH_BACKEND_PAM) { 
#ifdef USE_PAM
		pam_handle_t *pamh=NULL;
		int retval;
		
		retval = pam_start("login", username->ptr, &conv, &pamh);
		
		if (retval == PAM_SUCCESS)
			retval = pam_authenticate(pamh, 0);    /* is user really user? */
		
		if (retval == PAM_SUCCESS)
			retval = pam_acct_mgmt(pamh, 0);       /* permitted access? */<commit_msg>fixed #148 and let PAM use the lighttpd-handle (if someone implements it)<commit_after>#include "config.h"

#ifdef HAVE_CRYPT_H
# include <crypt.h>
#elif defined(__linux__)
/* linux needs _XOPEN_SOURCE */
# define _XOPEN_SOURCE
#endif

#ifdef HAVE_LIBCRYPT
# define HAVE_CRYPT
#endif

#include <sys/types.h>
#include <sys/stat.h>

#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <unistd.h>
#include <ctype.h>

#include "server.h"
#include "log.h"
#include "http_auth.h"
#include "http_auth_digest.h"
#include "stream.h"

#ifdef USE_OPENSSL
# include <openssl/md5.h>
#else
# include "md5_global.h"
# include "md5.h"
#endif


#ifdef USE_PAM
#include <security/pam_appl.h>
#include <security/pam_misc.h>

static struct pam_conv conv = {
	misc_conv,
		NULL
};
#endif

static const char base64_pad = '=';

static const short base64_reverse_table[256] = {
	        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
		        52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
		        -1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
		        15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
		        -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
		        41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
		        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
};


static unsigned char * base64_decode(buffer *out, const char *in) {
	unsigned char *result;
	int ch, j = 0, k;
	size_t i;
	
	size_t in_len = strlen(in);
	
	buffer_prepare_copy(out, in_len);
	
	result = (unsigned char *)out->ptr;
	
	ch = in[0];
	/* run through the whole string, converting as we go */
	for (i = 0; i < in_len; i++) {
		ch = in[i];
		
		if (ch == '\0') break;
		
		if (ch == base64_pad) break;
		
		ch = base64_reverse_table[ch];
		if (ch < 0) continue;
		
		switch(i % 4) {
		case 0:
			result[j] = ch << 2;
			break;
		case 1:
			result[j++] |= ch >> 4;
			result[j] = (ch & 0x0f) << 4;
			break;
		case 2:
			result[j++] |= ch >>2;
			result[j] = (ch & 0x03) << 6;
			break;
		case 3:
			result[j++] |= ch;
			break;
		}
	}
	k = j;
	/* mop things up if we ended on a boundary */
	if (ch == base64_pad) {
		switch(i % 4) {
		case 0:
		case 1:
			return NULL;
		case 2:
			k++;
		case 3:
			result[k++] = 0;
		}
	}
	result[k] = '\0';
	
	out->used = k;
	
	return result;
}

static int http_auth_get_password(server *srv, mod_auth_plugin_data *p, buffer *username, buffer *realm, buffer *password) {
	int ret = -1;
	
	if (!username->used|| !realm->used) return -1;
	
	if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
		stream f;
		char * f_line;
		
		if (buffer_is_empty(p->conf.auth_htdigest_userfile)) return -1;
		
		if (0 != stream_open(&f, p->conf.auth_htdigest_userfile)) {
			log_error_write(srv, __FILE__, __LINE__, "sbss", "opening digest-userfile", p->conf.auth_htdigest_userfile, "failed:", strerror(errno));
			
			return -1;
		}
		
		f_line = f.start;
		
		while (f_line - f.start != f.size) {
			char *f_user, *f_pwd, *e, *f_realm;
			size_t u_len, pwd_len, r_len;
			
			f_user = f_line;
			
			/* 
			 * htdigest format
			 * 
			 * user:realm:md5(user:realm:password) 
			 */
			
			if (NULL == (f_realm = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
				log_error_write(srv, __FILE__, __LINE__, "sbs", 
						"parsed error in", p->conf.auth_htdigest_userfile, 
						"expected 'username:realm:hashed password'");
				
				stream_close(&f);
				
				return -1;
			}
			
			if (NULL == (f_pwd = memchr(f_realm + 1, ':', f.size - (f_realm + 1 - f.start)))) {
				log_error_write(srv, __FILE__, __LINE__, "sbs", 
						"parsed error in", p->conf.auth_plain_userfile, 
						"expected 'username:realm:hashed password'");
				
				stream_close(&f);
				
				return -1;
			}
			
			/* get pointers to the fields */
			u_len = f_realm - f_user; 
			f_realm++;
			r_len = f_pwd - f_realm;
			f_pwd++;
			
			if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
				pwd_len = e - f_pwd;
			} else {
				pwd_len = f.size - (f_pwd - f.start);
			}
			
			if (username->used - 1 == u_len &&
			    (realm->used - 1 == r_len) &&
			    (0 == strncmp(username->ptr, f_user, u_len)) &&
			    (0 == strncmp(realm->ptr, f_realm, r_len))) {
				/* found */
				
				buffer_copy_string_len(password, f_pwd, pwd_len);
				
				ret = 0;
				break;
			}
			
			/* EOL */
			if (!e) break;
			
			f_line = e + 1;
		}
		
		stream_close(&f);
	} else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD ||
		   p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
		stream f;
		char * f_line;
		buffer *auth_fn;
		
		auth_fn = (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) ? p->conf.auth_htpasswd_userfile : p->conf.auth_plain_userfile;
		
		if (buffer_is_empty(auth_fn)) return -1;
		
		if (0 != stream_open(&f, auth_fn)) {
			log_error_write(srv, __FILE__, __LINE__, "sbss", 
					"opening plain-userfile", auth_fn, "failed:", strerror(errno));
			
			return -1;
		}
		
		f_line = f.start;
		
		while (f_line - f.start != f.size) {
			char *f_user, *f_pwd, *e;
			size_t u_len, pwd_len;
			
			f_user = f_line;
			
			/* 
			 * htpasswd format
			 * 
			 * user:crypted passwd
			 */
			
			if (NULL == (f_pwd = memchr(f_user, ':', f.size - (f_user - f.start) ))) {
				log_error_write(srv, __FILE__, __LINE__, "sbs", 
						"parsed error in", auth_fn, 
						"expected 'username:hashed password'");
				
				stream_close(&f);
				
				return -1;
			}
			
			/* get pointers to the fields */
			u_len = f_pwd - f_user; 
			f_pwd++;
			
			if (NULL != (e = memchr(f_pwd, '\n', f.size - (f_pwd - f.start)))) {
				pwd_len = e - f_pwd;
			} else {
				pwd_len = f.size - (f_pwd - f.start);
			}
			
			if (username->used - 1 == u_len &&
			    (0 == strncmp(username->ptr, f_user, u_len))) {
				/* found */
				
				buffer_copy_string_len(password, f_pwd, pwd_len);
				
				ret = 0;
				break;
			}
			
			/* EOL */
			if (!e) break;
			
			f_line = e + 1;
		}
		
		stream_close(&f);
	} else if (p->conf.auth_backend == AUTH_BACKEND_LDAP) {
		ret = 0;
	} else {
		return -1;
	}
	
	return ret;
}

static int http_auth_match_rules(server *srv, mod_auth_plugin_data *p, const char *url, const char *username, const char *group, const char *host) {
	const char *r = NULL, *rules = NULL;
	size_t i;
	int username_len;
	data_string *require;
	array *req;
	
	UNUSED(group);
	UNUSED(host);

	/* check what has to be match to fullfil the request */
	/* search auth-directives for path */
	for (i = 0; i < p->conf.auth_require->used; i++) {
		if (p->conf.auth_require->data[i]->key->used == 0) continue;
		
		if (0 == strncmp(url, p->conf.auth_require->data[i]->key->ptr, p->conf.auth_require->data[i]->key->used - 1)) {
			break;
		}
	}
	
	if (i == p->conf.auth_require->used) {
		return -1;
	}
	
	req = ((data_array *)(p->conf.auth_require->data[i]))->value;

	require = (data_string *)array_get_element(req, "require");
	
	/* user=name1|group=name3|host=name4 */
	
	/* seperate the string by | */
#if 0
	log_error_write(srv, __FILE__, __LINE__, "sb", "rules", require->value);
#endif	
	
	username_len = username ? strlen(username) : 0;
	
	r = rules = require->value->ptr;
	
	while (1) {
		const char *eq;
		const char *k, *v, *e;
		int k_len, v_len, r_len;
		
		e = strchr(r, '|');
		
		if (e) {
			r_len = e - r;
		} else {
			r_len = strlen(rules) - (r - rules);
		}
		
		/* from r to r + r_len is a rule */
		
		/* search for = in the rules */
		if (NULL == (eq = strchr(r, '='))) {
			log_error_write(srv, __FILE__, __LINE__, "s", "= is missing");
			return -1;
		}
		
		/* = out of range */
		if (eq > r + r_len) {
			log_error_write(srv, __FILE__, __LINE__, "s", "= out of range");
			
			return -1;
		}
		
		/* the part before the = is user|group|host */
		
		k = r;
		k_len = eq - r;
		v = eq + 1;
		v_len = r_len - k_len - 1;
		
		if (k_len == 4) {
			if (0 == strncmp(k, "user", k_len)) {
				if (username && 
				    username_len == v_len &&
				    0 == strncmp(username, v, v_len)) {
					return 0;
				}
			} else if (0 == strncmp(k, "host", k_len)) {
				log_error_write(srv, __FILE__, __LINE__, "s", "host ... (not implemented)");
			} else {
				log_error_write(srv, __FILE__, __LINE__, "s", "unknown key");
				return -1;
			}
		} else if (k_len == 5) {
			if (0 == strncmp(k, "group", k_len)) {
				log_error_write(srv, __FILE__, __LINE__, "s", "group ... (not implemented)");
			} else {
				log_error_write(srv, __FILE__, __LINE__, "ss", "unknown key", k);
				return -1;
			}
		} else {
			log_error_write(srv, __FILE__, __LINE__, "s", "unknown  key");
			return -1;
		}
		
		if (!e) break;
		r = e + 1;
	}
	
	log_error_write(srv, __FILE__, __LINE__, "s", "nothing matched");
	
	return -1;
}

/**
 * 
 * 
 * @param password password-string from the auth-backend
 * @param pw       password-string from the client
 */

static int http_auth_basic_password_compare(server *srv, mod_auth_plugin_data *p, array *req, buffer *username, buffer *realm, buffer *password, const char *pw) {
	UNUSED(srv);
	UNUSED(req);

	if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
		/* 
		 * htdigest format
		 * 
		 * user:realm:md5(user:realm:password) 
		 */
		
		MD5_CTX Md5Ctx;
		HASH HA1;
		char a1[256];
		
		MD5_Init(&Md5Ctx);
		MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
		MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
		MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
		MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
		MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
		MD5_Final(HA1, &Md5Ctx);
		
		CvtHex(HA1, a1);
		
		if (0 == strcmp(password->ptr, a1)) {
			return 0;
		}
	} else if (p->conf.auth_backend == AUTH_BACKEND_HTPASSWD) { 
#ifdef HAVE_CRYPT	
		char salt[3];
		char *crypted;
		/* 
		 * htpasswd format
		 * 
		 * user:crypted password
		 */
		
		salt[0] = password->ptr[0];
		salt[1] = password->ptr[1];
		salt[2] = '\0';
		crypted = crypt(pw, salt);

		if (0 == strcmp(password->ptr, crypted)) {
			return 0;
		}
#endif	
	} else if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) { 
		if (0 == strcmp(password->ptr, pw)) {
			return 0;
		}
	} else if (p->conf.auth_backend == AUTH_BACKEND_PAM) { 
#ifdef USE_PAM
		pam_handle_t *pamh=NULL;
		int retval;
		
		retval = pam_start("lighttpd", username->ptr, &conv, &pamh);
		
		if (retval == PAM_SUCCESS)
			retval = pam_authenticate(pamh, 0);    /* is user really user? */
		
		if (retval == PAM_SUCCESS)
			retval = pam_acct_mgmt(pamh, 0);       /* permitted access? */
{'fraction_non_alphanumeric': 0.1887573698186237, 'fraction_numerical': 0.039470723254871956, 'mean_word_length': 2.46483704974271, 'pattern_counts': {'":': 4, '<': 47, '<?xml version=': 0, '>': 155, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 120, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3549485', 'n_tokens_mistral': 11252, 'n_tokens_neox': 9450, 'n_words': 2359}