Changeset 215

Timestamp:

09/26/06 15:45:32 (2 years ago)

Author:

jwalt

Message:

• do not overwrite an existing Last-Modified header in serve_file
  
• implement HTTP Digest auth (qop=auth only for now)
  

Files:

• trunk/lib/AxKit2/HTTPHeaders.pm (modified) (1 diff)
• trunk/plugins/aio/serve_file (modified) (1 diff)
• trunk/plugins/authenticate (modified) (12 diffs)
• trunk/plugins/serve_file (modified) (1 diff)

trunk/lib/AxKit2/HTTPHeaders.pm

@@ -42 +42 @@
-            'origcase',     # href; lowercase header -> provided case
-            'hdorder',      # aref; order headers were received (canonical order)
- (if GET request)
+
-            'uri',          # scalar; request URI (if GET request)
-            'file',         # scalar; request File

trunk/plugins/aio/serve_file

@@ -78 +78 @@
-            }
-            
-
+$client->headers_out->header("Last-Modified") || 
-            my $ifmod = $client->headers_in->header('If-Modified-Since') || "";
-            

trunk/plugins/authenticate

@@ -16 +16 @@
-#
-
-
+ md5_hex md5
-use MIME::Base64;
+use bytes;
+use constant DEFAULT_REALM => 'Protected Area';
+
+# regexes for RFC2616/2617
+my $TOKEN = "[!#$%&'*+.0-9`^_|~a-zA-Z-]+";
+my $CTRL = "\x00-\x08\x0b\x0c\x0e-\x1f";
+my $QUOTED_STRING = "\"(?:[^$CTRL\"\\\\]+\\\\[^$CTRL])*[^$CTRL\"\\\\]*\"";
-
-BEGIN {
@@ -25 +32 @@
-    my $has_sha = !$@;
-
+    # If called standalone, manage passwd files
-    if ($0 =~ m{(^|/)authenticate$}) {
-3
-password>
+4
+realm> [ <password> ]
-            exit(1);
-        }
-
-
+realm, $new
-        my %data;
-
@@ -38 +46 @@
-                next if $line =~ m/^\s*(#.*)?$/;
-                $line =~ s/\s*$//;
-
-
+
+
+
+
+
+
+
+
+
+
-            }
-            close($fh);
@@ -47 +63 @@
-            delete $data{$newpass};
-        } else {
+            $newrealm = DEFAULT_REALM unless defined $newrealm;
+            $newrealm =~ s/[\x00-\x08\x0b\x0c\x0e-\x1f:]//g;
-            if (!defined $newpass) {
-                $|++;
@@ -61 +79 @@
-                print "\n";
-
-                $term->getattr;
-                $term->setlflag($term->getlflag | &POSIX::ECHO);
-                $term->setattr;
@@ -68 +85 @@
-            }
-
+            $data{"$newuser:$newrealm"} = md5_hex($newuser.':'.$newrealm.':'.$newpass);
-            my $salt = join("", map({ ('a'..'z','A'..'Z',0..9,'/','.')[int(rand(64))] } 0..7) );
-            if ($has_sha) {
-$newuser} = '
+"$newuser:$newrealm"} .= ':
-            } else {
-$newuser} = '
+"$newuser:$newrealm"} .= ':
-            }
-        }
@@ -108 +126 @@
-or other mechanisms. Any user in C<AuthFile> is granted access.
-
+If you use Digest authentication, you also gain a free session ID for all
+authenticated users without needing cookies or URL parameters. It is generated
+at login and can be retrieved through C<< $client->headers_in->header('Digest-Session') >>.
+If you use that mechanism, you can even log out users using the logout function.
+
-=head1 CONFIG
-
@@ -131 +154 @@
-=head2 C<AuthFile> I<filename>
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=cut
@@ -145 +178 @@
-sub conf_AuthType : Validate(sub { _die("Invalid type") if $_[1] !~ m/^(basic|digest)$/i; lc($_[1]); });
-sub conf_AuthRealm : Default("Protected Area");
+sub conf_AuthDomain : Default("/");
-sub conf_AuthFile : Validate(FILE) Default({}) {
-    my ($parser, $file) = @_;
@@ -152 +186 @@
-        next if $line =~ m/^\s*(#.*)?$/;
-        $line =~ s/\s*$//;
-
-
+
+
+
+
+
+
+
+
+
+
-    }
-    close($fh);
@@ -159 +201 @@
-}
-
+sub quoted_string($) {
+    my $str = shift;
+    $str =~ s/(["\\])/\\$1/g;
+    return "\"$str\"";
+}
+
+my $_SERVER_SECRET = rand().rand(); # FIXME: get some kind of cryptographically secure randomness
+my %_NC;
+
+=head2 C<< logout >>
+
+Inhvalidates (logs out) the current session. Any further attempt to access protected
+pages will result in a new login prompt.
+
+=cut
+
+sub logout {
+    my ($self) = @_;
+    my $session = $self->client->headers_in->header('Digest-Session');
+    return unless defined $session;
+    for my $nonce (grep { m/^\d+:\Q$session:/ } keys %_NC) {
+        delete $_NC{$nonce};
+    }
+}
+
+sub send_digest_challenge {
+    my ($self, $oldnonce, $session) = @_;
+    delete $_NC{$oldnonce} if defined $oldnonce; # This is not failsafe in the face of pipelined requests; it doesn't need to be.
+    my $nonce = time().':'.(defined $session?$session:md5_hex(rand(time())));
+    $nonce .= ":".md5($nonce.":".$_SERVER_SECRET);
+    $_NC{$nonce} = 0 if defined $session;
+    my $header = "Digest realm=" . quoted_string($self->config->auth_realm) . ", " .
+        "domain=".quoted_string($self->config->auth_domain).", " .
+        "qop=\"auth,auth-int\", " .
+        "algorithm=MD5, " .
+        "stale=" . (defined $session?'true':'false') . ", " .
+        "nonce=".quoted_string(encode_base64($nonce,""));
+    $self->log(LOGINFO,"Sent header [$header]");
+    $self->client->headers_out->header("WWW-Authenticate",$header);
+
+    return UNAUTHORIZED;
+}
+
+sub send_digest_forbidden {
+    my ($self, $msg) = @_;
+    $self->log(LOGWARN,"Invalid access! Possible hacking attempt. $msg");
+    return FORBIDDEN;
+}
+
-sub hook_authentication {
-    my ($self, $hd) = @_;
@@ -166 +257 @@
-
-    my $auth = $hd->header('Authorization');
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            }
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    }
-
-    if ($want_type eq 'basic') {
-        $self->client->headers_out->header('WWW-Authenticate','Basic realm="'.$self->config->auth_realm.'"');
-    }
-
-    return UNAUTHORIZED;
-}

trunk/plugins/serve_file

@@ -67 +67 @@
-            }
-            
-
+$client->headers_out->header("Last-Modified") || 
-            my $ifmod = $client->headers_in->header('If-Modified-Since') || "";
-