Fixed AMT HTTP stack client nonce format.
Ylian Saint-Hilaire committed
Mar 22, 2022 at 20:05 UTC
20ba165dc36321965cc90fc12334cae8fce31ac3
2 files changed
+9
-9
amt/amt-wsman-comm.js
+5
-6
@@ -48,9 +48,6 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
48
obj.amtVersion = null;
49
50
obj.Address = '/wsman';
51
- obj.challengeParams = null;
52
- obj.noncecounter = 1;
53
- obj.authcounter = 0;
51
obj.cnonce = obj.crypto.randomBytes(16).toString('hex'); // Generate a random client nonce
52
53
obj.host = host;
@@ -164,8 +161,8 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
161
obj.kerberosDone = 1;
162
}
163
} else if (obj.challengeParams != null) {
167
- var response = hex_md5(hex_md5(obj.user + ':' + obj.challengeParams['realm'] + ':' + obj.pass) + ':' + obj.challengeParams['nonce'] + ':' + obj.noncecounter + ':' + obj.cnonce + ':' + obj.challengeParams['qop'] + ':' + hex_md5(action + ':' + url + ((obj.challengeParams['qop'] == 'auth-int') ? (':' + hex_md5(postdata)) : '')));
168
- h += 'Authorization: ' + obj.renderDigest({ 'username': obj.user, 'realm': obj.challengeParams['realm'], 'nonce': obj.challengeParams['nonce'], 'uri': url, 'qop': obj.challengeParams['qop'], 'response': response, 'nc': obj.noncecounter++, 'cnonce': obj.cnonce }) + '\r\n';
164
+ var response = hex_md5(hex_md5(obj.user + ':' + obj.challengeParams['realm'] + ':' + obj.pass) + ':' + obj.challengeParams['nonce'] + ':' + nonceHex(obj.noncecounter) + ':' + obj.cnonce + ':' + obj.challengeParams['qop'] + ':' + hex_md5(action + ':' + url + ((obj.challengeParams['qop'] == 'auth-int') ? (':' + hex_md5(postdata)) : '')));
165
+ h += 'Authorization: ' + obj.renderDigest({ 'username': obj.user, 'realm': obj.challengeParams['realm'], 'nonce': obj.challengeParams['nonce'], 'uri': url, 'qop': obj.challengeParams['qop'], 'response': response, 'nc': nonceHex(obj.noncecounter++), 'cnonce': obj.cnonce }) + '\r\n';
166
}
167
h += 'Host: ' + obj.host + ':' + obj.port + '\r\nContent-Length: ' + postdata.length + '\r\n\r\n' + postdata; // Use Content-Length
168
//h += 'Host: ' + obj.host + ':' + obj.port + '\r\nTransfer-Encoding: chunked\r\n\r\n' + postdata.length.toString(16).toUpperCase() + '\r\n' + postdata + '\r\n0\r\n\r\n'; // Use Chunked-Encoding
@@ -180,11 +177,13 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
177
return t.reduce(function (obj, s) { var parts = s.split('='); obj[parts[0]] = parts[1].replace(new RegExp('\"', 'g'), ''); return obj; }, {})
178
}
179
180
+ function nonceHex(v) { var s = ('00000000' + v.toString(16)); return s.substring(s.length - 8); }
181
+
182
// NODE.js specific private method
183
obj.renderDigest = function (params) {
184
var paramsnames = [];
185
for (var i in params) { paramsnames.push(i); }
187
- return 'Digest ' + paramsnames.reduce(function (s1, ii) { return s1 + ',' + ii + '="' + params[ii] + '"' }, '').substring(1);
186
+ return 'Digest ' + paramsnames.reduce(function (s1, ii) { return s1 + ',' + (((ii == 'nc') || (ii == 'qop')) ? (ii + '=' + params[ii]) : (ii + '="' + params[ii] + '"')); }, '').substring(1);
187
}
188
189
// NODE.js specific private method
public/scripts/amt-wsman-ws-0.2.0.js
+4
-3
@@ -86,8 +86,8 @@ var CreateWsmanComm = function (host, port, user, pass, tls) {
86
action = action ? action : 'POST';
87
var h = action + ' ' + url + ' HTTP/1.1\r\n';
88
if (obj.challengeParams != null) {
89
- var response = hex_md5(hex_md5(obj.user + ':' + obj.challengeParams['realm'] + ':' + obj.pass) + ':' + obj.challengeParams['nonce'] + ':' + obj.noncecounter + ':' + obj.cnonce + ':' + obj.challengeParams['qop'] + ':' + hex_md5(action + ':' + url + ((obj.challengeParams['qop'] == 'auth-int') ? (':' + hex_md5(postdata)) : '')));
90
- h += 'Authorization: ' + obj.renderDigest({ 'username': obj.user, 'realm': obj.challengeParams['realm'], 'nonce': obj.challengeParams['nonce'], 'uri': url, 'qop': obj.challengeParams['qop'], 'response': response, 'nc': obj.noncecounter++, 'cnonce': obj.cnonce }) + '\r\n';
89
+ var response = hex_md5(hex_md5(obj.user + ':' + obj.challengeParams['realm'] + ':' + obj.pass) + ':' + obj.challengeParams['nonce'] + ':' + nonceHex(obj.noncecounter) + ':' + obj.cnonce + ':' + obj.challengeParams['qop'] + ':' + hex_md5(action + ':' + url + ((obj.challengeParams['qop'] == 'auth-int') ? (':' + hex_md5(postdata)) : '')));
90
+ h += 'Authorization: ' + obj.renderDigest({ 'username': obj.user, 'realm': obj.challengeParams['realm'], 'nonce': obj.challengeParams['nonce'], 'uri': url, 'qop': obj.challengeParams['qop'], 'response': response, 'nc': nonceHex(obj.noncecounter++), 'cnonce': obj.cnonce }) + '\r\n';
91
}
92
//h += 'Host: ' + obj.host + ':' + obj.port + '\r\nContent-Length: ' + postdata.length + '\r\n\r\n' + postdata; // Use Content-Length
93
h += 'Host: ' + obj.host + ':' + obj.port + '\r\nTransfer-Encoding: chunked\r\n\r\n' + postdata.length.toString(16).toUpperCase() + '\r\n' + postdata + '\r\n0\r\n\r\n'; // Use Chunked-Encoding
@@ -100,12 +100,13 @@ var CreateWsmanComm = function (host, port, user, pass, tls) {
100
101
// Split a string on quotes but do not do it when in quotes
102
function correctedQuoteSplit(str) { return str.split(',').reduce(function (a, c) { if (a.ic) { a.st[a.st.length - 1] += ',' + c } else { a.st.push(c) } if (c.split('"').length % 2 == 0) { a.ic = !a.ic } return a; }, { st: [], ic: false }).st }
103
+ function nonceHex(v) { var s = ('00000000' + v.toString(16)); return s.substring(s.length - 8); }
104
105
// Websocket relay specific private method
106
obj.renderDigest = function (params) {
107
var paramsnames = [];
108
for (i in params) { paramsnames.push(i); }
108
- return 'Digest ' + paramsnames.reduce(function (s1, ii) { return s1 + ',' + ii + '="' + params[ii] + '"' }, '').substring(1);
109
+ return 'Digest ' + paramsnames.reduce(function (s1, ii) { return s1 + ',' + (((ii == 'nc') || (ii == 'qop')) ? (ii + '=' + params[ii]) : (ii + '="' + params[ii] + '"')); }, '').substring(1);
110
}
111
112
// Websocket relay specific private method