http: server-side Digest Auth with htdigest file support

Add server-side HTTP Digest Auth support using the standard htdigest
file format (username:realm:HA1_hex per line).

- New mount auth mode LWSAUTHM_DIGEST_AUTH
- New mount field basic_auth_realm for the auth realm
- lws_check_digest_auth() parses Authorization: Digest headers and
  validates against the htdigest file
- lws_unauthorised_digest_auth() sends 401 with a fresh random nonce
- Nonce is stored per-wsi and verified on keep-alive retries
- Constant-time response comparison via lws_timingsafe_bcmp
- Wired into HTTP/1.1, HTTP/2 and WS upgrade paths
- Added minimal example minimal-http-server-digestauth
- LWS_WITH_HTTP_DIGEST_AUTH now implies LWS_WITH_HTTP_BASIC_AUTH so
  the shared lws_authorization_rewrite helper is available

Signed-off-by: Bastian Germann <bage@debian.org>
Co-developed-by: Claude Sonnet 4.6

Author: bgermann

CMakeLists-implied-options.txt

@@ -274,6 +274,7 @@ endif()
 
 if (LWS_WITH_HTTP_DIGEST_AUTH)
 	set(LWS_WITH_GENCRYPTO 1)
+	set(LWS_WITH_HTTP_BASIC_AUTH 1)
 endif()
 
 if (APPLE)

include/libwebsockets/lws-context-vhost.h

@@ -1505,7 +1505,8 @@ enum lws_mount_protocols {
  */
 enum lws_authentication_mode {
 	LWSAUTHM_DEFAULT = 0, /**< default authenticate only if basic_auth_login_file is provided */
-	LWSAUTHM_BASIC_AUTH_CALLBACK = 1 << 28 /**< Basic auth with a custom verifier */
+	LWSAUTHM_BASIC_AUTH_CALLBACK = 1 << 28, /**< Basic auth with a custom verifier */
+	LWSAUTHM_DIGEST_AUTH = 2 << 28  /**< Digest auth via htdigest-format file (requires LWS_WITH_HTTP_DIGEST_AUTH) */
 };
 
 /** The authentication mode is stored in the top 4 bits of lws_http_mount.auth_mask */
@@ -1557,6 +1558,12 @@ struct lws_http_mount {
 	const char *basic_auth_login_file;
 	/**<NULL, or filepath to use to check basic auth logins against. (requires LWSAUTHM_DEFAULT) */
 
+	const char *basic_auth_realm;
+	/**< NULL (defaults to "lwsws"), or realm string sent in the WWW-Authenticate challenge
+	 * for both Basic and Digest auth. For Digest auth (LWSAUTHM_DIGEST_AUTH), this must
+	 * match the realm stored in the htdigest file.
+	 */
+
 	const char *cgi_chroot_path;
 	/**< NULL, or chroot patch for child cgi process */
 

lib/core-net/close.c

@@ -144,6 +144,11 @@ __lws_reset_wsi(struct lws *wsi)
 		lws_free(wsi->http.digest_auth_hdr);
 		wsi->http.digest_auth_hdr = NULL;
 	}
+	if (wsi->http.digest_auth_nonce) {
+		lws_free(wsi->http.digest_auth_nonce);
+		wsi->http.digest_auth_nonce = NULL;
+	}
+	wsi->http.digest_auth_nc = 0;
 #endif
 #endif
 

lib/roles/h2/ops-h2.c

@@ -938,6 +938,27 @@ lws_h2_bind_for_post_before_action(struct lws *wsi)
 			lws_return_http_status(wsi, HTTP_STATUS_FORBIDDEN, NULL);
 			return lws_http_transaction_completed(wsi);
 		}
+#endif
+#if defined(LWS_WITH_HTTP_DIGEST_AUTH)
+
+		/* digest auth? */
+
+		if ((hit->auth_mask & AUTH_MODE_MASK) == LWSAUTHM_DIGEST_AUTH) {
+			switch (lws_check_digest_auth(wsi,
+						      hit->basic_auth_login_file,
+						      hit->basic_auth_realm)) {
+			case LCBA_CONTINUE:
+			case LCBA_AUTH_RETRY_KEEPALIVE:
+				break;
+			case LCBA_FAILED_AUTH:
+				return lws_unauthorised_digest_auth(wsi,
+						hit->basic_auth_realm);
+			case LCBA_END_TRANSACTION:
+				lws_return_http_status(wsi,
+						HTTP_STATUS_FORBIDDEN, NULL);
+				return lws_http_transaction_completed(wsi);
+			}
+		}
 #endif
 	}
 

lib/roles/http/private-lib-roles-http.h

@@ -306,6 +306,10 @@ struct _lws_http_mode_related {
 	char auth_username[64];
 	char auth_password[64];
 	char *digest_auth_hdr;
+#if defined(LWS_WITH_HTTP_DIGEST_AUTH)
+	char *digest_auth_nonce;  /**< nonce sent in last Digest 401 challenge (server-side) */
+	uint32_t digest_auth_nc;  /**< last nc value seen on this connection */
+#endif
 	char *extra_onward_headers;
 };
 
@@ -342,6 +346,14 @@ lws_check_basic_auth(struct lws *wsi, const char *basic_auth_login_file, unsigne
 int
 lws_unauthorised_basic_auth(struct lws *wsi);
 
+#if defined(LWS_WITH_HTTP_DIGEST_AUTH)
+enum lws_check_basic_auth_results
+lws_check_digest_auth(struct lws *wsi, const char *htdigest_file, const char *realm);
+
+int
+lws_unauthorised_digest_auth(struct lws *wsi, const char *realm);
+#endif
+
 #if defined(LWS_ROLE_H1)
 int
 lws_read_h1(struct lws *wsi, unsigned char *buf, lws_filepos_t len);