|  | @@ -1,28 +1,28 @@
 | 
	
		
			
				|  |  |  /*
 | 
	
		
			
				|  |  | -* Conditions Of Use
 | 
	
		
			
				|  |  | -*
 | 
	
		
			
				|  |  | -* This software was developed by employees of the National Institute of
 | 
	
		
			
				|  |  | -* Standards and Technology (NIST), an agency of the Federal Government.
 | 
	
		
			
				|  |  | -* Pursuant to title 15 Untied States Code Section 105, works of NIST
 | 
	
		
			
				|  |  | -* employees are not subject to copyright protection in the United States
 | 
	
		
			
				|  |  | -* and are considered to be in the public domain.  As a result, a formal
 | 
	
		
			
				|  |  | -* license is not needed to use the software.
 | 
	
		
			
				|  |  | -*
 | 
	
		
			
				|  |  | -* This software is provided by NIST as a service and is expressly
 | 
	
		
			
				|  |  | -* provided "AS IS."  NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED
 | 
	
		
			
				|  |  | -* OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF
 | 
	
		
			
				|  |  | -* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT
 | 
	
		
			
				|  |  | -* AND DATA ACCURACY.  NIST does not warrant or make any representations
 | 
	
		
			
				|  |  | -* regarding the use of the software or the results thereof, including but
 | 
	
		
			
				|  |  | -* not limited to the correctness, accuracy, reliability or usefulness of
 | 
	
		
			
				|  |  | -* the software.
 | 
	
		
			
				|  |  | -*
 | 
	
		
			
				|  |  | -* Permission to use this software is contingent upon your acceptance
 | 
	
		
			
				|  |  | -* of the terms of this agreement
 | 
	
		
			
				|  |  | -*
 | 
	
		
			
				|  |  | -* .
 | 
	
		
			
				|  |  | -*
 | 
	
		
			
				|  |  | -*/
 | 
	
		
			
				|  |  | + * Conditions Of Use
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * This software was developed by employees of the National Institute of
 | 
	
		
			
				|  |  | + * Standards and Technology (NIST), an agency of the Federal Government.
 | 
	
		
			
				|  |  | + * Pursuant to title 15 Untied States Code Section 105, works of NIST
 | 
	
		
			
				|  |  | + * employees are not subject to copyright protection in the United States
 | 
	
		
			
				|  |  | + * and are considered to be in the public domain.  As a result, a formal
 | 
	
		
			
				|  |  | + * license is not needed to use the software.
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * This software is provided by NIST as a service and is expressly
 | 
	
		
			
				|  |  | + * provided "AS IS."  NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED
 | 
	
		
			
				|  |  | + * OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF
 | 
	
		
			
				|  |  | + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT
 | 
	
		
			
				|  |  | + * AND DATA ACCURACY.  NIST does not warrant or make any representations
 | 
	
		
			
				|  |  | + * regarding the use of the software or the results thereof, including but
 | 
	
		
			
				|  |  | + * not limited to the correctness, accuracy, reliability or usefulness of
 | 
	
		
			
				|  |  | + * the software.
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * Permission to use this software is contingent upon your acceptance
 | 
	
		
			
				|  |  | + * of the terms of this agreement
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * .
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + */
 | 
	
		
			
				|  |  |  package com.genersoft.iot.vmp.gb28181.auth;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  import java.security.MessageDigest;
 | 
	
	
		
			
				|  | @@ -42,18 +42,18 @@ import gov.nist.core.InternalErrorHandler;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  /**
 | 
	
		
			
				|  |  |   * Implements the HTTP digest authentication method server side functionality.
 | 
	
		
			
				|  |  | - * 
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  |   * @author M. Ranganathan
 | 
	
		
			
				|  |  |   * @author Marc Bednarek
 | 
	
		
			
				|  |  |   */
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  | -    
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |      private MessageDigest messageDigest;
 | 
	
		
			
				|  |  | -    
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |      public static final String DEFAULT_ALGORITHM = "MD5";
 | 
	
		
			
				|  |  |      public static final String DEFAULT_SCHEME = "Digest";
 | 
	
		
			
				|  |  | -    
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  
 | 
	
	
		
			
				|  | @@ -63,11 +63,11 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |      /**
 | 
	
		
			
				|  |  |       * Default constructor.
 | 
	
		
			
				|  |  | -     * @throws NoSuchAlgorithmException 
 | 
	
		
			
				|  |  | +     * @throws NoSuchAlgorithmException
 | 
	
		
			
				|  |  |       */
 | 
	
		
			
				|  |  | -    public DigestServerAuthenticationHelper() 
 | 
	
		
			
				|  |  | -        throws NoSuchAlgorithmException {
 | 
	
		
			
				|  |  | -            messageDigest = MessageDigest.getInstance(DEFAULT_ALGORITHM);
 | 
	
		
			
				|  |  | +    public DigestServerAuthenticationHelper()
 | 
	
		
			
				|  |  | +            throws NoSuchAlgorithmException {
 | 
	
		
			
				|  |  | +        messageDigest = MessageDigest.getInstance(DEFAULT_ALGORITHM);
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |      public static String toHexString(byte b[]) {
 | 
	
	
		
			
				|  | @@ -79,7 +79,7 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  |          return new String(c);
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  | -    
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |      /**
 | 
	
		
			
				|  |  |       * Generate the challenge string.
 | 
	
		
			
				|  |  |       *
 | 
	
	
		
			
				|  | @@ -121,34 +121,34 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |       *
 | 
	
		
			
				|  |  |       * @param request - the request to authenticate.
 | 
	
		
			
				|  |  |       * @param hashedPassword -- the MD5 hashed string of username:realm:plaintext password.
 | 
	
		
			
				|  |  | -     * 
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  |       * @return true if authentication succeded and false otherwise.
 | 
	
		
			
				|  |  |       */
 | 
	
		
			
				|  |  |      public boolean doAuthenticateHashedPassword(Request request, String hashedPassword) {
 | 
	
		
			
				|  |  | -    	AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME);
 | 
	
		
			
				|  |  | +        AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME);
 | 
	
		
			
				|  |  |          if ( authHeader == null ) return false;
 | 
	
		
			
				|  |  |          String realm = authHeader.getRealm();
 | 
	
		
			
				|  |  |          String username = authHeader.getUsername();
 | 
	
		
			
				|  |  | -      
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |          if ( username == null || realm == null ) {
 | 
	
		
			
				|  |  |              return false;
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  | -       
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |          String nonce = authHeader.getNonce();
 | 
	
		
			
				|  |  |          URI uri = authHeader.getURI();
 | 
	
		
			
				|  |  |          if (uri == null) {
 | 
	
		
			
				|  |  |              return false;
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  | -        
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -      
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |          String A2 = request.getMethod().toUpperCase() + ":" + uri.toString();
 | 
	
		
			
				|  |  |          String HA1 = hashedPassword;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -       
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |          byte[] mdbytes = messageDigest.digest(A2.getBytes());
 | 
	
		
			
				|  |  |          String HA2 = toHexString(mdbytes);
 | 
	
		
			
				|  |  | -      
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |          String cnonce = authHeader.getCNonce();
 | 
	
		
			
				|  |  |          String KD = HA1 + ":" + nonce;
 | 
	
		
			
				|  |  |          if (cnonce != null) {
 | 
	
	
		
			
				|  | @@ -158,7 +158,7 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |          mdbytes = messageDigest.digest(KD.getBytes());
 | 
	
		
			
				|  |  |          String mdString = toHexString(mdbytes);
 | 
	
		
			
				|  |  |          String response = authHeader.getResponse();
 | 
	
		
			
				|  |  | -       
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |          return mdString.equals(response);
 | 
	
		
			
				|  |  |      }
 | 
	
	
		
			
				|  | @@ -168,11 +168,11 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |       *
 | 
	
		
			
				|  |  |       * @param request - the request to authenticate.
 | 
	
		
			
				|  |  |       * @param pass -- the plain text password.
 | 
	
		
			
				|  |  | -     * 
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  |       * @return true if authentication succeded and false otherwise.
 | 
	
		
			
				|  |  |       */
 | 
	
		
			
				|  |  |      public boolean doAuthenticatePlainTextPassword(Request request, String pass) {
 | 
	
		
			
				|  |  | -    	AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME);
 | 
	
		
			
				|  |  | +        AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME);
 | 
	
		
			
				|  |  |          if ( authHeader == null ) return false;
 | 
	
		
			
				|  |  |          String realm = authHeader.getRealm().trim();
 | 
	
		
			
				|  |  |          String username = authHeader.getUsername().trim();
 | 
	
	
		
			
				|  | @@ -184,7 +184,7 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |          String nonce = authHeader.getNonce();
 | 
	
		
			
				|  |  |          URI uri = authHeader.getURI();
 | 
	
		
			
				|  |  |          if (uri == null) {
 | 
	
		
			
				|  |  | -           return false;
 | 
	
		
			
				|  |  | +            return false;
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  |          // qop 保护质量 包含auth(默认的)和auth-int(增加了报文完整性检测)两种策略
 | 
	
		
			
				|  |  |          String qop = authHeader.getQop();
 | 
	
	
		
			
				|  | @@ -233,6 +233,6 @@ public class DigestServerAuthenticationHelper  {
 | 
	
		
			
				|  |  |          String response = authHeader.getResponse();
 | 
	
		
			
				|  |  |          System.out.println("response: " + response);
 | 
	
		
			
				|  |  |          return mdString.equals(response);
 | 
	
		
			
				|  |  | -        
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |  }
 |