Changeset 216

Timestamp:

09/26/06 23:44:38 (2 years ago)

Author:

jwalt

Message:

• implement qop=auth for HTTP digest
  
• add generic message passing interface for plugins
  
• add notes helper
  

Files:

• trunk/lib/AxKit2/Client.pm (modified) (2 diffs)
• trunk/lib/AxKit2/HTTPHeaders.pm (modified) (1 diff)
• trunk/lib/AxKit2/Plugin.pm (modified) (3 diffs)
• trunk/plugins/authenticate (modified) (10 diffs)

trunk/lib/AxKit2/Client.pm

@@ -100 +100 @@
-    my ($self, $hook) = (shift, shift);
-    
-
+ && $hook ne 'message'
-    local $current_hook = $hook;
-    
@@ -178 +178 @@
-}
-
+sub send {
+    my $self = shift;
+    my @rc = $self->run_hooks('message', @_);
+    $self->log(LOGWARN,"Unhandled message: $_[0]") if shift(@rc) != OK;
+    return @_ if wantarray;
+    return $_[0];
+}
+
-sub hook_connect {
-    my $self = shift;

trunk/lib/AxKit2/HTTPHeaders.pm

@@ -543 +543 @@
-}
-
+=head2 C<< $obj->header_remove( KEY ) >>
+
+Remove a given header.
+
+=cut
+sub header_remove {
+    my AxKit2::HTTPHeaders $self = shift;
+    my $key = lc(shift);
+
+    delete $self->{headers}{$key};
+    @{$self->{hdorder}} = grep { $_ ne $key } @{$self->{hdorder}};
+    delete $self->{origcase}{$key};
+}
+
-=head2 C<< $obj->lame_request >>
-

trunk/lib/AxKit2/Plugin.pm

@@ -29 +29 @@
-    logging connect pre_request post_read_request body_data uri_translation
-    mime_map access_control authentication authorization fixup write_body_data
-
+ message
-);
-our %hooks = map { $_ => 1 } @hooks;
@@ -80 +80 @@
-}
-
+sub send {
+    my $self = shift;
+    $self->client->send(@_);
+}
+
+sub notes {
+    my $self = shift;
+    my $name = shift;
+    $self->client->notes($self->plugin_name.'::'.$name,@_);
+}
+
-sub log {
-    my $self = shift;
@@ -100 +111 @@
-        $self->register_hook( $hook, $hooksub ) if ($self->can($hooksub));
-    }
+
+    my $package = ref($self);
+    no strict 'refs';
+    foreach my $key (keys %{*{$package."::"}}) {
+        next unless $key =~ m/^message_/ && $package->can($key);
+        $self->register_hook('message','dispatch_message');
+        last;
+    }
+}
+
+sub dispatch_message {
+    my $self = shift;
+    my $message = shift;
+    if (my $sub = $self->can("message_$message")) {
+        return OK, $sub->($self,@_);
+    }
+    return DECLINED;
-}
-

trunk/plugins/authenticate

@@ -172 +172 @@
-for different hosts in that list. Default value is "/", i.e., the whole server.
-
-API
+MESSAGES HANDLED
-
-=cut
@@ -207 +207 @@
-}
-
+sub hook_body_data {
+    my ($self, $bref) = @_;
+    
+    $self->notes('bodyhash', Digest::MD5->new) if !$self->notes('bodyhash');
+    my $ctx = $self->notes('bodyhash');
+    $ctx->add($$bref);
+
+    return DECLINED;
+}
+
-my $_SERVER_SECRET = rand().rand(); # FIXME: get some kind of cryptographically secure randomness
-my %_NC;
@@ -215 +225 @@
-pages will result in a new login prompt.
-
+=head1 MESSAGES SENT
+
+=head2 C<< login >>
+
+This message is sent when a user successfully starts a new login session.
+
+=head2 C<< login_failed >>
+
+This message is sent whenever a real login failure is detected. Your application code
+might want to lock out users after a certain number of failed attempts.
+
+=head2 C<< login_timeout >>
+
+This message is sent whenever a login session times out. This can happen I<after> the user
+has logged in with another session, but it will sooner or later be sent for every session
+not logged out via message C<logout>.
+
-=cut
-
-
+message_
-    my ($self) = @_;
-    my $session = $self->client->headers_in->header('Digest-Session');
@@ -240 +267 @@
-    $self->log(LOGINFO,"Sent header [$header]");
-    $self->client->headers_out->header("WWW-Authenticate",$header);
+    $self->client->headers_out->header_remove('Authentication-Info');
-
-    return UNAUTHORIZED;
@@ -247 +275 @@
-    my ($self, $msg) = @_;
-    $self->log(LOGWARN,"Invalid access! Possible hacking attempt. $msg");
+    $self->client->headers_out->header_remove('Authentication-Info');
+
-    return FORBIDDEN;
-}
@@ -278 +308 @@
-            return OK if ($hash =~ m/^{SHA}(.{27})/ && sha1_base64($pass) eq $1);
-            return OK if (crypt($pass,$hash) eq $hash);
+            $self->send('login_failed',$user);
-        }
-
@@ -294 +325 @@
-                $value =~ s/\\(.)/$1/g;
-            }
-            warn("Param: $param, Value: $value\n");
-            $param{lc($param)} = $value;
-        }
@@ -318 +348 @@
-        return $self->send_digest_forbidden("impossible nonce") if (int($timestamp) ne $timestamp || !defined $nonce || int($timestamp) > time());
-
-; # TODO
+ = ($self->notes('bodyhash')? $self->notes('bodyhash')->hexdigest : '0' x 32);
-        my $A2 = md5_hex( $hd->request_method . ':' . $param{uri} . ($param{qop} eq 'auth-int'? ':' . $bodyhash : '') );
-        my $response = md5_hex( $hash->[0] . ':' . encode_base64($param{nonce},"") . ':' .
-                                ($param{qop}? $param{nc} . ':' . $param{cnonce} . ':' . $param{qop} . ':' : '') .
-                                $A2 );
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-        # This could be a hacking attempt, or a server restart.
-        return $self->send_digest_challenge($param{nonce},$session) if ($param{nonce} ne $nonce);
-
-
-        $hd->header('Digest-Session',$session);
@@ -335 +370 @@
-            # Force relogin if the first challenge response takes too long (2 minutes).
-            return $self->send_digest_challenge if int($timestamp) < time()-120;
-
-# TODO: add a 'successful login' callback
+$
+$self->send('login',$param{username});
-        }
-
@@ -351 +386 @@
-        return $self->send_digest_forbidden("replay attack") if ($param{nc} ne sprintf("%08x",++$_NC{$nonce}));
-
-        # TODO: add an "idle-time" callback
-
-        # All checks passed.
-        return OK;