Changeset 8351

Timestamp:

May 8, 2009, 2:37:46 AM (14 years ago)

Author:

charles

Message:

(trunk libT) add a session_id cookie to the rpc server

Location:

trunk

Files:

• daemon/remote.c (modified) (4 diffs)
• libtransmission/rpc-server.c (modified) (6 diffs)
• qt/session.cc (modified) (3 diffs)
• qt/session.h (modified) (1 diff)

trunk/daemon/remote.c

@@ -133 +133 @@
 static char * auth = NULL;
 static char * netrc = NULL;
+static char * cookies = NULL;
 
 static char*
@@ -1274 +1275 @@
 }
 
+/* very basic handling of cookies: when we get Set-Cookie, throw out all
+ * the previous cookies...  T only uses one cookie (session_id) */
+static size_t
+parseResponseHeader( void *ptr, size_t size, size_t nmemb, void * stream UNUSED )
+{
+    const char * line = ptr;
+    const size_t linelen = size * nmemb;
+    const char * lineend = line + linelen;
+    const char * key = "Set-Cookie: ";
+    const size_t keylen = strlen( key );
+    if( ( linelen >= keylen ) && !memcmp( line, key, keylen ) ) {
+        const char * begin = line + keylen;
+        const char * end = begin;
+        while(( end!=lineend ) && !strchr("\r\n",*end))
+            ++end;
+        tr_free( cookies );
+        cookies = tr_strndup( begin, end-begin );
+    }
+
+    return linelen;
+}
+
+static CURL*
+tr_curl_easy_init( struct evbuffer * writebuf )
+{
+    CURL * curl = curl_easy_init( );
+    curl_easy_setopt( curl, CURLOPT_USERAGENT, MY_NAME "/" LONG_VERSION_STRING );
+    curl_easy_setopt( curl, CURLOPT_WRITEFUNCTION, writeFunc );
+    curl_easy_setopt( curl, CURLOPT_WRITEDATA, writebuf );
+    curl_easy_setopt( curl, CURLOPT_HEADERFUNCTION, parseResponseHeader );
+    curl_easy_setopt( curl, CURLOPT_POST, 1 );
+    curl_easy_setopt( curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL );
+    curl_easy_setopt( curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY );
+    curl_easy_setopt( curl, CURLOPT_TIMEOUT, 60L );
+    curl_easy_setopt( curl, CURLOPT_VERBOSE, debug );
+#ifdef HAVE_ZLIB
+    curl_easy_setopt( curl, CURLOPT_ENCODING, "deflate" );
+#endif
+    if( cookies )
+        curl_easy_setopt( curl, CURLOPT_COOKIE, cookies );
+    if( netrc )
+        curl_easy_setopt( curl, CURLOPT_NETRC_FILE, netrc );
+    if( auth )
+        curl_easy_setopt( curl, CURLOPT_USERPWD, auth );
+    return curl;
+}
+    
+
 static void
 processRequests( const char *  host,
@@ -1280 +1329 @@
                  int           reqCount )
 {
-    int               i;
-    CURL *            curl;
+    int i;
+    CURL * curl = NULL;
     struct evbuffer * buf = evbuffer_new( );
-    char *            url = tr_strdup_printf(
-        "http://%s:%d/transmission/rpc", host, port );
-
-    curl = curl_easy_init( );
-    curl_easy_setopt( curl, CURLOPT_VERBOSE, debug );
-#ifdef HAVE_ZLIB
-    curl_easy_setopt( curl, CURLOPT_ENCODING, "deflate" );
-#endif
-    curl_easy_setopt( curl, CURLOPT_USERAGENT, MY_NAME "/" LONG_VERSION_STRING );
-    curl_easy_setopt( curl, CURLOPT_WRITEFUNCTION, writeFunc );
-    curl_easy_setopt( curl, CURLOPT_WRITEDATA, buf );
-    curl_easy_setopt( curl, CURLOPT_POST, 1 );
-    curl_easy_setopt( curl, CURLOPT_URL, url );
-    curl_easy_setopt( curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL );
-    curl_easy_setopt( curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY );
-    curl_easy_setopt( curl, CURLOPT_TIMEOUT, 60L );
-    if( netrc )
-        curl_easy_setopt( curl, CURLOPT_NETRC_FILE, netrc );
-    if( auth )
-        curl_easy_setopt( curl, CURLOPT_USERPWD, auth );
-
-    for( i = 0; i < reqCount; ++i )
+    char * url = tr_strdup_printf( "http://%s:%d/transmission/rpc", host, port );
+
+    for( i=0; i<reqCount; ++i )
     {
         CURLcode res;
+        evbuffer_drain( buf, EVBUFFER_LENGTH( buf ) );
+
+        if( curl == NULL )
+        {
+            curl = tr_curl_easy_init( buf );
+            curl_easy_setopt( curl, CURLOPT_URL, url );
+        }
+
         curl_easy_setopt( curl, CURLOPT_POSTFIELDS, reqs[i] );
+
         if( debug )
             fprintf( stderr, "posting:\n--------\n%s\n--------\n", reqs[i] );
         if( ( res = curl_easy_perform( curl ) ) )
-            tr_nerr( MY_NAME, "(%s:%d) %s", host, port,
-                    curl_easy_strerror( res ) );
-        else
-            processResponse( host, port, EVBUFFER_DATA(
-                                buf ), EVBUFFER_LENGTH( buf ) );
-
-        evbuffer_drain( buf, EVBUFFER_LENGTH( buf ) );
+            tr_nerr( MY_NAME, "(%s:%d) %s", host, port, curl_easy_strerror( res ) );
+        else {
+            long response;
+            curl_easy_getinfo( curl, CURLINFO_RESPONSE_CODE, &response );
+            switch( response ) {
+                case 200:
+                    processResponse( host, port, EVBUFFER_DATA(buf), EVBUFFER_LENGTH(buf) );
+                    break;
+                case 409:
+                    /* session_id cookie expired.  by the time we reach line this our
+                     * curl header func has already found the new session_id, so make
+                     * a new CURL* and try again... */
+                    curl_easy_cleanup( curl );
+                    curl = NULL;
+                    --i;
+                    break;
+                default:
+                    fprintf( stderr, "Unexpected response: %s\n", (char*)EVBUFFER_DATA(buf) );
+                    break;
+            }
+        }
     }
 
@@ -1323 +1376 @@
     tr_free( url );
     evbuffer_free( buf );
-    curl_easy_cleanup( curl );
+    if( curl != NULL )
+        curl_easy_cleanup( curl );
 }
 

trunk/libtransmission/rpc-server.c

@@ -57 +57 @@
     struct evhttp *    httpd;
     tr_session *       session;
+    char *             sessionId;
     char *             username;
     char *             password;
@@ -451 +452 @@
 }
 
-static void
-handle_request( struct evhttp_request * req,
-                void *                  arg )
+static char*
+session_id_new( void )
+{
+    int i;
+    const int n = 48;
+    const char * pool = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    const size_t pool_size = strlen( pool );
+    char * buf = tr_new( char, n+1 );
+    for( i=0; i<n; ++i )
+        buf[i] = pool[ tr_cryptoRandInt( pool_size ) ];
+    buf[n] = '\0';
+    return buf;
+}
+
+static tr_bool
+test_session_id( struct tr_rpc_server * server, struct evhttp_request * req )
+{
+    char * needle = tr_strdup_printf( "session_id=%s", server->sessionId );
+    const char * haystack = evhttp_find_header( req->input_headers, "Cookie" );
+    const tr_bool success = (haystack!=NULL) && (strstr(haystack,needle)!=NULL);
+    tr_free( needle );
+    return success;
+}
+
+static void
+handle_request( struct evhttp_request * req, void * arg )
 {
     struct tr_rpc_server * server = arg;
@@ -460 +484 @@
     {
         const char * auth;
-        char *       user = NULL;
-        char *       pass = NULL;
+        char * user = NULL;
+        char * pass = NULL;
+        char * cookie;
 
         evhttp_add_header( req->output_headers, "Server", MY_REALM );
+        cookie = tr_strdup_printf( "session_id=%s;Path=/;Discard", server->sessionId );
+        evhttp_add_header( req->output_headers, "Set-Cookie", cookie );
+        tr_free( cookie );
 
         auth = evhttp_find_header( req->input_headers, "Authorization" );
-
         if( auth && !strncasecmp( auth, "basic ", 6 ) )
         {
@@ -480 +507 @@
         if( !isAddressAllowed( server, req->remote_host ) )
         {
-            send_simple_response( req, 401,
+            send_simple_response( req, 403,
                 "<p>Unauthorized IP Address.</p>"
                 "<p>Either disable the IP address whitelist or add your address to it.</p>"
@@ -511 +538 @@
         {
             handle_clutch( req, server );
+        }
+        else if( !test_session_id( server, req ) )
+        {
+            send_simple_response( req, 409, "<p>Invalid session_id cookie.</p>" );
         }
         else if( !strncmp( req->uri, "/transmission/rpc", 17 ) )
@@ -767 +798 @@
     s = tr_new0( tr_rpc_server, 1 );
     s->session = session;
+    s->sessionId = session_id_new( );
 
     found = tr_bencDictFindBool( settings, TR_PREFS_KEY_RPC_ENABLED, &boolVal );

trunk/qt/session.cc

@@ -542 +542 @@
         header.setValue( "User-Agent", QCoreApplication::instance()->applicationName() + "/" + LONG_VERSION_STRING );
         header.setValue( "Content-Type", "application/json; charset=UTF-8" );
-        myHttp.request( header, data, &myBuffer );
+        if( !myCookies.isEmpty( ) )
+            header.setValue( "Cookie", myCookies );
+        QBuffer * buf = new QBuffer;
+        buf->setData( data );
+        myHttp.request( header, buf, &myBuffer );
 #ifdef DEBUG_HTTP
         std::cerr << "sending " << qPrintable(header.toString()) << "\nBody:\n" << request << std::endl;
@@ -561 +565 @@
 {
     Q_UNUSED( id );
+
+    QHttpResponseHeader response = myHttp.lastResponse();
+    QIODevice * sourceDevice = myHttp.currentSourceDevice( );
 
 #ifdef DEBUG_HTTP
@@ -570 +577 @@
 #endif
 
-    if( error )
+    // very basic handling of cookies: when we get Set-Cookie, throw out all
+    // the previous cookies...  T only uses one cookie (session_id)
+    const QString responseCookies = response.value( "Set-Cookie" );
+    if( !responseCookies.isEmpty( ) )
+        myCookies = responseCookies;
+        
+    if( response.statusCode() == 409 )
+    {
+        // we got a 409 telling us our session cookie has expired.
+        // now that we've updated our cookie, try again.
+        exec( qobject_cast<QBuffer*>(sourceDevice)->buffer().constData( ) );
+    }
+    else if( error )
+    {
         std::cerr << "http error: " << qPrintable(myHttp.errorString()) << std::endl;
-    else {
+    }
+    else
+    {
         const QByteArray& response( myBuffer.buffer( ) );
         const char * json( response.constData( ) );
         int jsonLength( response.size( ) );
         if( jsonLength>0 && json[jsonLength-1] == '\n' ) --jsonLength;
-
         parseResponse( json, jsonLength );
     }
 
+    delete sourceDevice;
     myBuffer.buffer( ).clear( );
     myBuffer.reset( );

trunk/qt/session.h

@@ -133 +133 @@
         tr_session * mySession;
         QString myConfigDir;
+        QString myCookies;
         QUrl myUrl;
         QBuffer myBuffer;