File ngx_http_auth_memcookie_module.c of Package nginx-mod-http-auth-memcookie

Overview Repositories Revisions Requests Users Attributes Meta

File ngx_http_auth_memcookie_module.c of Package nginx-mod-http-auth-memcookie

#include <ngx_config.h>
#include <ngx_core.h>
#include <ngx_http.h>
#include <ngx_crypt.h>

#include "libmemcached-1.0/memcached.h"

#define MODULE_NAME "auth_memcookie"

typedef struct {
    ngx_http_complex_value_t  *memcached;
    ngx_http_complex_value_t  *cookiename;
    ngx_array_t               *require_group;
} ngx_http_auth_memcookie_loc_conf_t;

static ngx_int_t ngx_http_auth_memcookie_handler(ngx_http_request_t *r);
static void *ngx_http_auth_memcookie_create_loc_conf(ngx_conf_t *cf);
static char *ngx_http_auth_memcookie_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child);
static ngx_int_t ngx_http_auth_memcookie_init(ngx_conf_t *cf);
static char *ngx_http_auth_memcookie_require(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
static ngx_int_t ngx_http_auth_memcookie_str_in_array(ngx_str_t *group, ngx_array_t *groups);

static ngx_command_t  ngx_http_auth_memcookie_commands[] = {
    { ngx_string("auth_memcookie_memcached"),
      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
                        |NGX_CONF_TAKE1,
      ngx_http_set_complex_value_slot,
      NGX_HTTP_LOC_CONF_OFFSET,
      offsetof(ngx_http_auth_memcookie_loc_conf_t, memcached),
      NULL },

{ ngx_string("auth_memcookie_cookiename"),
      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
                        |NGX_CONF_TAKE1,
      ngx_http_set_complex_value_slot,
      NGX_HTTP_LOC_CONF_OFFSET,
      offsetof(ngx_http_auth_memcookie_loc_conf_t, cookiename),
      NULL },

{ ngx_string("auth_memcookie_require_group"),
      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
                        |NGX_CONF_TAKE1,
      ngx_http_auth_memcookie_require,
      NGX_HTTP_LOC_CONF_OFFSET,
      offsetof(ngx_http_auth_memcookie_loc_conf_t, require_group),
      NULL },

ngx_null_command
};

static ngx_http_module_t  ngx_http_auth_memcookie_module_ctx = {
    NULL,                                    /* preconfiguration */
    ngx_http_auth_memcookie_init,            /* postconfiguration */

NULL,                                    /* create main configuration */
    NULL,                                    /* init main configuration */

NULL,                                    /* create server configuration */
    NULL,                                    /* merge server configuration */

ngx_http_auth_memcookie_create_loc_conf, /* create location configuration */
    ngx_http_auth_memcookie_merge_loc_conf   /* merge location configuration */
};

ngx_module_t  ngx_http_auth_memcookie_module = {
    NGX_MODULE_V1,
    &ngx_http_auth_memcookie_module_ctx,   /* module context */
    ngx_http_auth_memcookie_commands,      /* module directives */
    NGX_HTTP_MODULE,                       /* module type */
    NULL,                                  /* init master */
    NULL,                                  /* init module */
    NULL,                                  /* init process */
    NULL,                                  /* init thread */
    NULL,                                  /* exit thread */
    NULL,                                  /* exit process */
    NULL,                                  /* exit master */
    NGX_MODULE_V1_PADDING
};

static ngx_int_t
ngx_http_auth_memcookie_handler(ngx_http_request_t *r)
{
    ngx_int_t                           rc;
    ngx_str_t                           connect;
    ngx_str_t                           cookiename;
    ngx_str_t                           cookievalue;
    ngx_http_auth_memcookie_loc_conf_t  *alcf;

memcached_st                        *memc;

uint32_t                            flags=0;
    uint32_t                            mrc=0;

alcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_memcookie_module);

if (alcf->memcached == NULL || alcf->cookiename == NULL) {
        return NGX_DECLINED;
    }

if (ngx_http_complex_value(r, alcf->memcached, &connect) != NGX_OK) {
        return NGX_ERROR;
    }

if (connect.len == 3 && ngx_strncmp(connect.data, "off", 3) == 0) {
        return NGX_DECLINED;
    }

if (ngx_http_complex_value(r, alcf->cookiename, &cookiename) != NGX_OK) {
        return NGX_ERROR;
    }
    ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, MODULE_NAME " cookie name: %V", &cookiename);

rc = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &cookiename, &cookievalue);
    if (rc != NGX_DECLINED) {
        ngx_str_t prefix = ngx_string("--SERVER=");
        ngx_str_t server;

ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, MODULE_NAME " cookie value: %V", &cookievalue);

server.len = prefix.len + connect.len;
        server.data = (unsigned char *) ngx_pnalloc(r->pool, server.len);
        if (!server.data) {
            return NGX_ERROR;
        }

ngx_memcpy(server.data, prefix.data, prefix.len);
        ngx_memcpy(server.data + prefix.len, connect.data, connect.len);

ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, MODULE_NAME " memcached: %V", &server);

memc = memcached((const char *)server.data, server.len);

if (!memc) {
            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, MODULE_NAME " memcache lib init failed");
            return NGX_ERROR;
        }

ngx_str_t memvalue;
        memvalue.data = (u_char *) memcached_get(memc, (const char *) cookievalue.data, cookievalue.len, &memvalue.len, &flags, &mrc);

memcached_free(memc);

if (!memvalue.data) {
            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, MODULE_NAME " cookie not found in memcached", mrc);
            return NGX_HTTP_UNAUTHORIZED;
        }

ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, MODULE_NAME " memcached cookie value: %V", &memvalue);

if (alcf->require_group != NULL) {
            ngx_regex_compile_t rc;
            u_char errstr[NGX_MAX_CONF_ERRSTR];
            ngx_str_t pattern = ngx_string("\"(ID=.*)\"");

ngx_memzero(&rc, sizeof(ngx_regex_compile_t));

rc.pattern = pattern;
            rc.pool = r->pool;
            rc.err.len = NGX_MAX_CONF_ERRSTR;
            rc.err.data = errstr;
            rc.options = PCRE_MULTILINE | PCRE_DOTALL | PCRE_UNGREEDY;

if (ngx_regex_compile(&rc) != NGX_OK) {
                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, MODULE_NAME " regex error: %V", &rc.err);
                return NGX_ERROR;
            }

ngx_int_t n;
            int captures[(1 + rc.captures) * 3];

n = ngx_regex_exec(rc.regex, &memvalue, captures, (1 + rc.captures) * 3);
            if (n != 2) {
                ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, MODULE_NAME " pattern %V not found in %V", &pattern, &memvalue);
                free(memvalue.data);
                return NGX_ERROR;
            }

ngx_str_t lines;

lines.data = memvalue.data + captures[2];
            lines.len = captures[3] - captures[2];

ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, MODULE_NAME " parsed value from memcache: %V", &lines);

ngx_str_t kvpattern = ngx_string("^(\\w+)=(.+)\\R");

ngx_memzero(&rc, sizeof(ngx_regex_compile_t));

rc.pattern = kvpattern;
            rc.pool = r->pool;
            rc.err.len = NGX_MAX_CONF_ERRSTR;
            rc.err.data = errstr;
            rc.options = PCRE_UTF8 | PCRE_NEWLINE_ANY;

if (ngx_regex_compile(&rc) != NGX_OK) {
                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, MODULE_NAME " regex error: %V", &rc.err);
                free(memvalue.data);
                return NGX_ERROR;
            }

int kvcaptures[(1 + rc.captures) * 3];

ngx_str_t groups_key = ngx_string("Groups");

while ((n = ngx_regex_exec(rc.regex, &lines, kvcaptures, (1 + rc.captures) * 3)) == 3) {
                ngx_str_t key, val;

key.data = lines.data + kvcaptures[2];
                key.len = kvcaptures[3] - kvcaptures[2];

val.data = lines.data + kvcaptures[4];
                val.len = kvcaptures[5] - kvcaptures[4];

ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, MODULE_NAME " found: %V = %V", &key, &val);

if (key.len == groups_key.len && ngx_strncmp(key.data, groups_key.data, groups_key.len) == 0) {
                    ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, MODULE_NAME " groups: %V", &val);

ngx_str_t token = val;
                    u_char *ptr = val.data;
                    u_char *end = token.data + token.len;

do {
                        ptr = ngx_strlchr(token.data, end, ',');
                        if (ptr == NULL) {
                            ptr = token.data + token.len;
                        }
                        token.len = ptr - token.data;

if (ngx_http_auth_memcookie_str_in_array(&token, alcf->require_group) == NGX_OK) {
                            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, MODULE_NAME " user in group %V, granting access", &token);

free(memvalue.data);
                            return NGX_DECLINED;
                        }

token.data += token.len + 1;
                        token.len = val.len - (token.data - val.data);
                    } while(ptr != end);
                }

lines.data += kvcaptures[1];
                lines.len -= kvcaptures[1];
            }

free(memvalue.data);

ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, MODULE_NAME " user is not in any required group");
        } else {
            free(memvalue.data);

ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, MODULE_NAME " no groups required, granting access");
            
            return NGX_DECLINED;
        }
    }

return NGX_HTTP_UNAUTHORIZED;
}

static ngx_int_t
ngx_http_auth_memcookie_str_in_array(ngx_str_t *group, ngx_array_t *groups)
{
    ngx_uint_t i;
    for (i = 0; i < groups->nelts; ++ i) {
        ngx_str_t *elts = groups->elts;
        if (group->len == elts[i].len && !ngx_strncmp(group->data, elts[i].data, group->len)) {
            return NGX_OK;
        }
    }

return NGX_DECLINED;
}

static void *
ngx_http_auth_memcookie_create_loc_conf(ngx_conf_t *cf)
{
    ngx_http_auth_memcookie_loc_conf_t  *conf;

conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_auth_memcookie_loc_conf_t));
    if (conf == NULL) {
        return NULL;
    }

return conf;
}

static char *
ngx_http_auth_memcookie_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
{
    ngx_http_auth_memcookie_loc_conf_t  *prev = parent;
    ngx_http_auth_memcookie_loc_conf_t  *conf = child;

if (conf->memcached == NULL) {
        conf->memcached = prev->memcached;
    }

return NGX_CONF_OK;
}

static ngx_int_t
ngx_http_auth_memcookie_init(ngx_conf_t *cf)
{
    ngx_http_handler_pt        *h;
    ngx_http_core_main_conf_t  *cmcf;

cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);

h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
    if (h == NULL) {
        return NGX_ERROR;
    }

*h = ngx_http_auth_memcookie_handler;

return NGX_OK;
}

static char *
ngx_http_auth_memcookie_require(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_http_auth_memcookie_loc_conf_t  *alcf = conf;

ngx_str_t  *value, *element;

if (alcf->require_group == NULL) {
        alcf->require_group = ngx_array_create(cf->pool, 1, sizeof(ngx_str_t));
        if (alcf->require_group == NULL) {
            return NGX_CONF_ERROR;
        }
    }

value = cf->args->elts;

element = ngx_array_push(alcf->require_group);
    ngx_memcpy(element, &value[1], sizeof(ngx_str_t));

ngx_log_error(NGX_LOG_DEBUG, cf->log, 0, MODULE_NAME " require group: %V", element);

return NGX_CONF_OK;
}

Places

File ngx_http_auth_memcookie_module.c of Package nginx-mod-http-auth-memcookie

Places