Merge branch 'v6' into backport-1872

squid-cache · Oct 11, 2024 · 0632120 · 0632120
2 parents 09bd44a + 2847a11
commit 0632120
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 7 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,9 @@
+Changes in squid-6.12 (12 Oct 2024)
+	- Fix validation of Digest auth header parameters
+	- Fix build with libtool v2.4 + automake v1.17
+	- Use git to extract default build-info when enabled
+	- ... and a minor source-maintenance portability fix
+
 Changes in squid-6.11 (15 Sep 2024)
 	- Fix Kerberos detection when cross-compiling
 	- Improve robustness of DNS code on reconfigure

diff --git a/src/auth/digest/Config.cc b/src/auth/digest/Config.cc
@@ -966,13 +966,19 @@ Auth::Digest::Config::decode(char const *proxy_auth, const HttpRequest *request,
             return rv;
         }
     } else {
-        /* cnonce and nc both require qop */
-        if (digest_request->cnonce || digest_request->nc[0] != '\0') {
-            debugs(29, 2, "missing qop!");
-            rv = authDigestLogUsername(username, digest_request, aRequestRealm);
-            safe_free(username);
-            return rv;
-        }
+        /* RFC7616 section 3.3, qop:
+         *  "MUST be used by all implementations"
+         *
+         * RFC7616 section 3.4, qop:
+         *  "value MUST be one of the alternatives the server
+         *   indicated it supports in the WWW-Authenticate header field"
+         *
+         * Squid sends qop=auth, reject buggy or outdated clients.
+        */
+        debugs(29, 2, "missing qop!");
+        rv = authDigestLogUsername(username, digest_request, aRequestRealm);
+        safe_free(username);
+        return rv;
     }
 
     /** below nonce state dependent **/