X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_httpd_acl.cpp;h=c25cabc0ae5eb40cc135ed4acf268718ca835914;hb=09186df9f8c0d4f699b5abb4325d7dd583a8a0b1;hp=903e83f26e8ea1dc92b8a3a9da0d61f7264860a7;hpb=8f7f74cf0f297e2b8476fc4c670515f8940580ea;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/modules/m_httpd_acl.cpp b/src/modules/m_httpd_acl.cpp index 903e83f26..c25cabc0a 100644 --- a/src/modules/m_httpd_acl.cpp +++ b/src/modules/m_httpd_acl.cpp @@ -1,60 +1,66 @@ -/* +------------------------------------+ - * | Inspire Internet Relay Chat Daemon | - * +------------------------------------+ +/* + * InspIRCd -- Internet Relay Chat Daemon * - * InspIRCd: (C) 2002-2008 InspIRCd Development Team - * See: http://www.inspircd.org/wiki/index.php/Credits + * Copyright (C) 2009-2010 Daniel De Graaf + * Copyright (C) 2008 Craig Edwards * - * This program is free but copyrighted software; see - * the file COPYING for details. + * This file is part of InspIRCd. InspIRCd is free software: you can + * redistribute it and/or modify it under the terms of the GNU General Public + * License as published by the Free Software Foundation, version 2. * - * --------------------------------------------------- + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . */ + #include "inspircd.h" #include "httpd.h" #include "protocol.h" -#include "wildcard.h" /* $ModDesc: Provides access control lists (passwording of resources, ip restrictions etc) to m_httpd.so dependent modules */ -/* $ModDep: httpd.h */ -class ACL : public Extensible +class HTTPACL { public: std::string path; + std::string username; std::string password; std::string whitelist; std::string blacklist; - ACL(const std::string &set_path, const std::string &set_password, + HTTPACL(const std::string &set_path, const std::string &set_username, const std::string &set_password, const std::string &set_whitelist, const std::string &set_blacklist) - : path(set_path), password(set_password), whitelist(set_whitelist), + : path(set_path), username(set_username), password(set_password), whitelist(set_whitelist), blacklist(set_blacklist) { } - ~ACL() { } + ~HTTPACL() { } }; class ModuleHTTPAccessList : public Module { - + std::string stylesheet; - bool changed; - std::vector acl_list; + std::vector acl_list; public: - void ReadConfig() + void OnRehash(User* user) { acl_list.clear(); - ConfigReader c(ServerInstance); - int n_items = c.Enumerate("httpacl"); - for (int i = 0; i < n_items; ++i) + ConfigTagList acls = ServerInstance->Config->ConfTags("httpdacl"); + for (ConfigIter i = acls.first; i != acls.second; i++) { - std::string path = c.ReadValue("httpacl", "path", i); - std::string types = c.ReadValue("httpacl", "types", i); + ConfigTag* c = i->second; + std::string path = c->getString("path"); + std::string types = c->getString("types"); irc::commasepstream sep(types); std::string type; + std::string username; std::string password; std::string whitelist; std::string blacklist; @@ -63,15 +69,16 @@ class ModuleHTTPAccessList : public Module { if (type == "password") { - password = c.ReadValue("httpacl", "password", i); + username = c->getString("username"); + password = c->getString("password"); } else if (type == "whitelist") { - whitelist = c.ReadValue("httpacl", "whitelist", i); + whitelist = c->getString("whitelist"); } else if (type == "blacklist") { - blacklist = c.ReadValue("httpacl", "blacklist", i); + blacklist = c->getString("blacklist"); } else { @@ -79,39 +86,42 @@ class ModuleHTTPAccessList : public Module } } - acl_list.push_back(ACL(path, password, whitelist, blacklist)); + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Read ACL: path=%s pass=%s whitelist=%s blacklist=%s", path.c_str(), + password.c_str(), whitelist.c_str(), blacklist.c_str()); + + acl_list.push_back(HTTPACL(path, username, password, whitelist, blacklist)); } } - ModuleHTTPAccessList(InspIRCd* Me) : Module(Me) + void init() { - ReadConfig(); - this->changed = true; - Implementation eventlist[] = { I_OnEvent, I_OnRequest }; - ServerInstance->Modules->Attach(eventlist, this, 2); + OnRehash(NULL); + Implementation eventlist[] = { I_OnEvent, I_OnRehash }; + ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation)); } - void BlockAccess(HTTPRequest* http, Event* event) + void BlockAccess(HTTPRequest* http, int returnval, const std::string &extraheaderkey = "", const std::string &extraheaderval="") { + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "BlockAccess (%d)", returnval); + std::stringstream data("Access to this resource is denied by an access control list. Please contact your IRC administrator."); - HTTPDocument response(http->sock, &data, 403); + HTTPDocumentResponse response(this, *http, &data, returnval); response.headers.SetHeader("X-Powered-By", "m_httpd_acl.so"); - Request req((char*)&response, (Module*)this, event->GetSource()); - req.Send(); + if (!extraheaderkey.empty()) + response.headers.SetHeader(extraheaderkey, extraheaderval); + response.Send(); } - void OnEvent(Event* event) + void OnEvent(Event& event) { - std::stringstream data(""); - - if (event->GetEventID() == "httpd_url") + if (event.id == "httpd_acl") { - ServerInstance->Logs->Log("m_http_stats", DEBUG,"Handling httpd event"); - HTTPRequest* http = (HTTPRequest*)event->GetData(); + ServerInstance->Logs->Log("m_http_stats", DEBUG,"Handling httpd acl event"); + HTTPRequest* http = (HTTPRequest*)&event; - for (std::vector::const_iterator this_acl = acl_list.begin(); this_acl != acl_list.end(); ++this_acl) + for (std::vector::const_iterator this_acl = acl_list.begin(); this_acl != acl_list.end(); ++this_acl) { - if (match(http->GetURI(), this_acl->path)) + if (InspIRCd::Match(http->GetURI(), this_acl->path, ascii_case_insensitive_map)) { if (!this_acl->blacklist.empty()) { @@ -121,9 +131,11 @@ class ModuleHTTPAccessList : public Module while (sep.GetToken(entry)) { - if (match(http->GetIP(), entry)) + if (InspIRCd::Match(http->GetIP(), entry, ascii_case_insensitive_map)) { - BlockAccess(http, event); + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Denying access to blacklisted resource %s (matched by pattern %s) from ip %s (matched by entry %s)", + http->GetURI().c_str(), this_acl->path.c_str(), http->GetIP().c_str(), entry.c_str()); + BlockAccess(http, 403); return; } } @@ -137,37 +149,86 @@ class ModuleHTTPAccessList : public Module while (sep.GetToken(entry)) { - if (match(http->GetIP(), entry)) + if (InspIRCd::Match(http->GetIP(), entry, ascii_case_insensitive_map)) allow_access = true; } if (!allow_access) { - BlockAccess(http, event); + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Denying access to whitelisted resource %s (matched by pattern %s) from ip %s (Not in whitelist)", + http->GetURI().c_str(), this_acl->path.c_str(), http->GetIP().c_str()); + BlockAccess(http, 403); return; } } - if (!this_acl->password.empty()) + if (!this_acl->password.empty() && !this_acl->username.empty()) { /* Password auth, first look to see if we have a basic authentication header */ + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Checking HTTP auth password for resource %s (matched by pattern %s) from ip %s, against username %s", + http->GetURI().c_str(), this_acl->path.c_str(), http->GetIP().c_str(), this_acl->username.c_str()); + + if (http->headers->IsSet("Authorization")) + { + /* Password has been given, validate it */ + std::string authorization = http->headers->GetHeader("Authorization"); + irc::spacesepstream sep(authorization); + std::string authtype; + std::string base64; + + sep.GetToken(authtype); + if (authtype == "Basic") + { + std::string user; + std::string pass; + + sep.GetToken(base64); + std::string userpass = Base64ToBin(base64); + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "HTTP authorization: %s (%s)", userpass.c_str(), base64.c_str()); + + irc::sepstream userpasspair(userpass, ':'); + if (userpasspair.GetToken(user)) + { + userpasspair.GetToken(pass); + + /* Access granted if username and password are correct */ + if (user == this_acl->username && pass == this_acl->password) + { + ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "HTTP authorization: password and username match"); + return; + } + else + /* Invalid password */ + BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\""); + } + else + /* Malformed user:pass pair */ + BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\""); + } + else + /* Unsupported authentication type */ + BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\""); + } + else + { + /* No password given at all, access denied */ + BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\""); + } } + + /* A path may only match one ACL (the first it finds in the config file) */ + return; } } } } - const char* OnRequest(Request* request) - { - return NULL; - } - virtual ~ModuleHTTPAccessList() { } virtual Version GetVersion() { - return Version(1, 2, 0, 0, VF_VENDOR, API_VERSION); + return Version("Provides access control lists (passwording of resources, ip restrictions etc) to m_httpd.so dependent modules", VF_VENDOR); } };