Changeset 8352

Timestamp:

May 8, 2009, 2:38:08 AM (14 years ago)

Author:

charles

Message:

(1.5x) add a session_id cookie to the rpc server

Location:

branches/1.5x

Files:

• daemon/remote.c (modified) (4 diffs)
• libtransmission/rpc-server.c (modified) (7 diffs)

branches/1.5x/daemon/remote.c

@@ -127 +127 @@
 static char * auth = NULL;
 static char * netrc = NULL;
+static char * cookies = NULL;
 
 static char*
@@ -1223 +1224 @@
 }
 
+/* very basic handling of cookies: when we get Set-Cookie, throw out all
+ * the previous cookies...  T only uses one cookie (session_id) */
+static size_t
+parseResponseHeader( void *ptr, size_t size, size_t nmemb, void * stream UNUSED )
+{
+    const char * line = ptr;
+    const size_t linelen = size * nmemb;
+    const char * lineend = line + linelen;
+    const char * key = "Set-Cookie: ";
+    const size_t keylen = strlen( key );
+    if( ( linelen >= keylen ) && !memcmp( line, key, keylen ) ) {
+        const char * begin = line + keylen;
+        const char * end = begin;
+        while(( end!=lineend ) && !strchr("\r\n",*end))
+            ++end;
+        tr_free( cookies );
+        cookies = tr_strndup( begin, end-begin );
+    }
+
+    return linelen;
+}
+
+static CURL*
+tr_curl_easy_init( struct evbuffer * writebuf )
+{
+    CURL * curl = curl_easy_init( );
+    curl_easy_setopt( curl, CURLOPT_USERAGENT, MY_NAME "/" LONG_VERSION_STRING );
+    curl_easy_setopt( curl, CURLOPT_WRITEFUNCTION, writeFunc );
+    curl_easy_setopt( curl, CURLOPT_WRITEDATA, writebuf );
+    curl_easy_setopt( curl, CURLOPT_HEADERFUNCTION, parseResponseHeader );
+    curl_easy_setopt( curl, CURLOPT_POST, 1 );
+    curl_easy_setopt( curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL );
+    curl_easy_setopt( curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY );
+    curl_easy_setopt( curl, CURLOPT_TIMEOUT, 60L );
+    curl_easy_setopt( curl, CURLOPT_VERBOSE, debug );
+#ifdef HAVE_ZLIB
+    curl_easy_setopt( curl, CURLOPT_ENCODING, "deflate" );
+#endif
+    if( cookies )
+        curl_easy_setopt( curl, CURLOPT_COOKIE, cookies );
+    if( netrc )
+        curl_easy_setopt( curl, CURLOPT_NETRC_FILE, netrc );
+    if( auth )
+        curl_easy_setopt( curl, CURLOPT_USERPWD, auth );
+    return curl;
+}
+
 static void
 processRequests( const char *  host,
@@ -1229 +1277 @@
                  int           reqCount )
 {
-    int               i;
-    CURL *            curl;
+    int i;
+    CURL * curl = NULL;
     struct evbuffer * buf = evbuffer_new( );
-    char *            url = tr_strdup_printf(
-        "http://%s:%d/transmission/rpc", host, port );
-
-    curl = curl_easy_init( );
-    curl_easy_setopt( curl, CURLOPT_VERBOSE, debug );
-#ifdef HAVE_LIBZ
-    curl_easy_setopt( curl, CURLOPT_ENCODING, "deflate" );
-#endif
-    curl_easy_setopt( curl, CURLOPT_USERAGENT, MY_NAME "/" LONG_VERSION_STRING );
-    curl_easy_setopt( curl, CURLOPT_WRITEFUNCTION, writeFunc );
-    curl_easy_setopt( curl, CURLOPT_WRITEDATA, buf );
-    curl_easy_setopt( curl, CURLOPT_POST, 1 );
-    curl_easy_setopt( curl, CURLOPT_URL, url );
-    curl_easy_setopt( curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL );
-    curl_easy_setopt( curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY );
-    curl_easy_setopt( curl, CURLOPT_TIMEOUT, 60L );
-    if( netrc )
-        curl_easy_setopt( curl, CURLOPT_NETRC_FILE, netrc );
-    if( auth )
-        curl_easy_setopt( curl, CURLOPT_USERPWD, auth );
-
-    for( i = 0; i < reqCount; ++i )
+    char * url = tr_strdup_printf( "http://%s:%d/transmission/rpc", host, port );
+
+    for( i=0; i<reqCount; ++i )
     {
         CURLcode res;
+        evbuffer_drain( buf, EVBUFFER_LENGTH( buf ) );
+
+        if( curl == NULL )
+        {
+            curl = tr_curl_easy_init( buf );
+            curl_easy_setopt( curl, CURLOPT_URL, url );
+        }
+
         curl_easy_setopt( curl, CURLOPT_POSTFIELDS, reqs[i] );
+
         if( debug )
             fprintf( stderr, "posting:\n--------\n%s\n--------\n", reqs[i] );
         if( ( res = curl_easy_perform( curl ) ) )
-            tr_nerr( MY_NAME, "(%s:%d) %s", host, port,
-                    curl_easy_strerror( res ) );
-        else
-            processResponse( host, port, EVBUFFER_DATA(
-                                buf ), EVBUFFER_LENGTH( buf ) );
-
-        evbuffer_drain( buf, EVBUFFER_LENGTH( buf ) );
+            tr_nerr( MY_NAME, "(%s:%d) %s", host, port, curl_easy_strerror( res ) );
+        else {
+            long response;
+            curl_easy_getinfo( curl, CURLINFO_RESPONSE_CODE, &response );
+            switch( response ) {
+                case 200:
+                    processResponse( host, port, EVBUFFER_DATA(buf), EVBUFFER_LENGTH(buf) );
+                    break;
+                case 409:
+                    /* session_id cookie expired.  by the time we reach line this our
+                     * curl header func has already found the new session_id, so make
+                     * a new CURL* and try again... */
+                    curl_easy_cleanup( curl );
+                    curl = NULL;
+                    --i;
+                    break;
+                default:
+                    fprintf( stderr, "Unexpected response: %s\n", (char*)EVBUFFER_DATA(buf) );
+                    break;
+            }
+        }
     }
 
@@ -1272 +1324 @@
     tr_free( url );
     evbuffer_free( buf );
-    curl_easy_cleanup( curl );
+    if( curl != NULL )
+        curl_easy_cleanup( curl );
 }
 

branches/1.5x/libtransmission/rpc-server.c

@@ -30 +30 @@
 #include "transmission.h"
 #include "bencode.h"
+#include "crypto.h"
 #include "list.h"
 #include "platform.h"
@@ -54 +55 @@
     struct evhttp *    httpd;
     tr_session *       session;
+    char *             sessionId;
     char *             username;
     char *             password;
@@ -446 +448 @@
 }
 
-static void
-handle_request( struct evhttp_request * req,
-                void *                  arg )
+static char*
+session_id_new( void )
+{
+    int i;
+    const int n = 48;
+    const char * pool = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    const size_t pool_size = strlen( pool );
+    char * buf = tr_new( char, n+1 );
+    for( i=0; i<n; ++i )
+        buf[i] = pool[ tr_cryptoRandInt( pool_size ) ];
+    buf[n] = '\0';
+    return buf;
+}
+
+static tr_bool
+test_session_id( struct tr_rpc_server * server, struct evhttp_request * req )
+{
+    char * needle = tr_strdup_printf( "session_id=%s", server->sessionId );
+    const char * haystack = evhttp_find_header( req->input_headers, "Cookie" );
+    const tr_bool success = (haystack!=NULL) && (strstr(haystack,needle)!=NULL);
+    tr_free( needle );
+    return success;
+}
+
+static void
+handle_request( struct evhttp_request * req, void * arg )
 {
     struct tr_rpc_server * server = arg;
@@ -455 +480 @@
     {
         const char * auth;
-        char *       user = NULL;
-        char *       pass = NULL;
+        char * user = NULL;
+        char * pass = NULL;
+        char * cookie;
 
         evhttp_add_header( req->output_headers, "Server", MY_REALM );
+        cookie = tr_strdup_printf( "session_id=%s;Path=/;Discard", server->sessionId );
+        evhttp_add_header( req->output_headers, "Set-Cookie", cookie );
+        tr_free( cookie );
 
         auth = evhttp_find_header( req->input_headers, "Authorization" );
-
         if( auth && !strncasecmp( auth, "basic ", 6 ) )
         {
@@ -475 +503 @@
         if( !isAddressAllowed( server, req->remote_host ) )
         {
-            send_simple_response( req, 401,
+            send_simple_response( req, 403,
                 "<p>Unauthorized IP Address.</p>"
                 "<p>Either disable the IP address whitelist or add your address to it.</p>"
@@ -505 +533 @@
         {
             handle_clutch( req, server );
+        }
+        else if( !test_session_id( server, req ) )
+        {
+            send_simple_response( req, 409, "<p>Invalid session_id cookie.</p>" );
         }
         else if( !strncmp( req->uri, "/transmission/rpc", 17 ) )
@@ -742 +774 @@
     s = tr_new0( tr_rpc_server, 1 );
     s->session = session;
+    s->sessionId = session_id_new( );
 
     found = tr_bencDictFindInt( settings, TR_PREFS_KEY_RPC_ENABLED, &i );