Beesnest/DcLoginManager.cpp

Go to the documentation of this file.

/*
Copyright 2007 Erez Bibi (erezbibi@users.sourceforge.net)
This file is part of Beesnest.

Beesnest is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

Beesnest is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with Beesnest; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*/


/**
 * DcLoginManager.cpp: implementation of the CdcLoginManager class.
 * for documentation see the header file.
 */

#include "DcLoginManager.h"


/* Static variables. */
CdcLoginManager::t_users_vector CdcLoginManager::vUsers;
CdcLoginManager::t_challenges_map CdcLoginManager::mChallenges;
CdcMutex CdcLoginManager::oMapMutex;
CdcString CdcLoginManager::sLoginFileName;
CdcString CdcLoginManager::sDenyFileName;
bool CdcLoginManager::bBuiltInLogin;
bool CdcLoginManager::bAutoCookie;
int CdcLoginManager::nStaleNonce;
int CdcLoginManager::nExpireNonce;
int CdcLoginManager::nOldCodeValid;
CdcThread CdcLoginManager::oCleanThread;
CdcSemaphore CdcLoginManager::oStartThread;
bool CdcLoginManager::isCleanThreadGo = true; /* In fact I never turn it to False
                                                    But i still have the option... */
int volatile CdcLoginManager::nSomeChalTaken = 0;

CdcLoginManager::CdcUser::CdcUser (ifstream& inf)
: nCode (EMPTY_STR), isLogedin (false)
{
    oMutex.Lock ();

    char temp [BUFF_LEN];
    inf.getline (temp, BUFF_LEN, '~');
    sUsername = CdcString (temp);
    inf.getline (temp, BUFF_LEN, '~');

    for (int i = 0; i < strlen (temp); ++i)
        temp[i] -= 127;
    sPassword = CdcString (temp);
    oMutex.Unlock ();
}

bool CdcLoginManager::CdcUser::WriteToFile (ofstream& outf)
{   /* Solve some bug I have.... */
    if (sUsername.IsEmpty ()) return false;

    oMutex.Lock ();
    outf.write (sUsername.GetBuffer (), sUsername.GetLength ());
    outf.put ('~');

    const char* ptemp = sPassword.GetBuffer ();
    for (int i = 0; i < strlen (ptemp); ++i)
        outf.put ((char)(ptemp[i] + 127));
    outf.put ('~');
    oMutex.Unlock ();
    return true;
}


void CdcLoginManager::Load (const char* file_name)
{
    sLoginFileName = CdcParameters::GetParam (
        "Login-Manager->Login-Page");
    sDenyFileName = CdcParameters::GetParam (
        "Login-Manager->Denied-Page");
    bAutoCookie = CdcParameters::GetParam (
        "Login-Manager->Auto-Cookie") == "yes";
    bBuiltInLogin = sLoginFileName.IsEmpty () == false;
    nStaleNonce = CdcParameters::ToInt (CdcParameters::GetParam (
        "Login-Manager->Stale"));
    nExpireNonce = CdcParameters::ToInt (CdcParameters::GetParam (
        "Login-Manager->Expire"));
    nOldCodeValid = CdcParameters::ToInt (CdcParameters::GetParam (
        "Login-Manager->Old-Code-Life"));

    ifstream inf (file_name);
    if (inf.is_open () == 0) return;

    while (inf.eof () == 0)
    {
        CdcUser* user = new CdcUser (inf);
        if (user == NULL)
            throw CdcException ("Out of memory.");
        vUsers.push_back (user);
    }
    inf.close ();

    /* Create the cleaning thread. */
    oCleanThread.MakeThread (DcClean, &isCleanThreadGo);
    oCleanThread.SetPriority (DC_TP_LOW);
}


void CdcLoginManager::Save (const char* file_name)
{
    ofstream outf (file_name);
    if (outf.is_open () == false)
        throw CdcExceptionFile ("Cannot open users database file.");

    t_users_vector::iterator itr;
    for (itr = vUsers.begin(); itr != vUsers.end(); itr++)
        (*itr)->WriteToFile (outf);
    outf.close ();
}


void CdcLoginManager::LoginUser (int id, CdcRequest& req, CdcResponse& res)
{
    vUsers[id]->GetStatusObject ()->Login ();
    vUsers[id]->Logedin (true);
    vUsers[id]->SetIP (req.GetVariable ("BN_ClentIP"));
}

void CdcLoginManager::SetRandCode (int id, CdcRequest& req, CdcResponse& res)
{
    vUsers[id]->SetCode (CdcCrypto::GetRandomString ());
    if (bAutoCookie)
    {
        res.SetCookie (DC_USER_ID, CdcString::IntToString (id));
        res.SetCookie (DC_USER_CODE, vUsers[id]->GetCode ());
    }
    else if (bBuiltInLogin)
    {
        req.SetVariable (DC_USER_ID, CdcString::IntToString (id));
        req.SetVariable (DC_USER_CODE, vUsers[id]->GetCode ());
    }
}

void CdcLoginManager::Clean ()
{
    /* Erase all wrong, stale or old challenges. */
    if (nSomeChalTaken > 0) return;             /* Can't clean now. */
    CdcHttpTime now = CdcHttpTime::GetCurrentTime ();
    oMapMutex.Lock ();
    t_challenges_map::iterator itr = mChallenges.begin();
    while (itr != mChallenges.end())
    {
        if (nSomeChalTaken > 0) break;          /* Have to stop cleaning. */
        t_challenges_map::iterator prev = itr++;
        if (prev->second->isCanceld == true ||
            prev->second->isForDelete == true ||
            now - prev->second->oBuildTime > nExpireNonce)
        {
            delete prev->second;
            mChallenges.erase (prev);
        }
    }
    oMapMutex.Unlock ();
}

bool CdcLoginManager::CheckLogout (CdcRequest& req, CdcResponse& res)
{
    if (req.GetVariable (DC_LOGOUT) == "yes")
    {
        LogoutUser (req, res);
        return true;
    }
    return false;
}

void CdcLoginManager::LogoutUser (CdcRequest& req, CdcResponse& res)
{
    /* Find the User ID. */
    CdcDaaResponse temp;
    bool isRes = false, isVar = false;
    int id = GetUserID (req, temp, isRes, isVar);
    if (id < 0) return; /* Could not find the user id. */
    /* Clean user object. */
    vUsers[id]->GetStatusObject ()->Logout ();
    vUsers[id]->Logedin (false);
    vUsers[id]->SetCode (EMPTY_STR);
    if (bBuiltInLogin)
    {   /* Erase built-in nonce if exist and login vars. */
        if (isRes) req.SetVariable (DC_NONCE, EMPTY_STR);
        req.SetVariable (DC_USER_ID, EMPTY_STR);
        req.SetVariable (DC_USER_CODE, EMPTY_STR);
    }
    else if (isRes) /* Erase DAA header if any, and match challenge. */
        req.EraseHeaderField ("Authorization");
    if (isRes)
    {
        oMapMutex.Lock ();
        t_challenges_map::iterator itr = mChallenges.find (temp.sNonce);
        if (itr != mChallenges.end ())
        {
            itr->second->isCanceld = true;
            itr->second->isForDelete = true;
            oStartThread.Call ();
        }
        oMapMutex.Unlock ();
    }
    if (bAutoCookie)
    {   /* Erase Cookies if needed. */
        res.SetCookie (DC_USER_ID, "-1");
        res.SetCookie (DC_USER_CODE, EMPTY_STR, -1);
    }
}


bool CdcLoginManager::CheckCode (int id, CdcRequest& req, CdcResponse& res)
{
    CdcString code = req.GetVariable (DC_USER_CODE);

    if (code.IsEmpty () == false &&
        req.GetVariable ("BN_ClentIP") == vUsers[id]->GetIP ())
    {
        if (vUsers[id]->GetCode () == code)
        {
            SetRandCode (id, req, res);
            return true;
        }
        if (nOldCodeValid > 0 &&
            vUsers[id]->GetLastCode () == code &&
            CdcHttpTime::GetCurrentTime () - vUsers[id]->GetLastLoginTime ()
            < nOldCodeValid)
            return true;    /* That is multi-thread request from the same page. */
                            /* Or most likely it is... */
    }
    return false;
}


/*
1. The MD5 hash of the combined user name, authentication realm and password
    is calculated. The result is referred to as HA1.
2. The MD5 hash of the combined method and digest URI is calculated, e.g. of
    "GET" and "/dir/index.html". The result is referred to as HA2.
3. The MD5 hash of the combined HA1 result, server nonce (nonce), request
    counter (nc), client nonce (cnonce), quality of protection code (qop) and
    HA2 result is calculated. The result is the "response" value provided by
    the client.
4. connect two string with ':'.
*/
bool CdcLoginManager::CheckResponse (int id, const CdcDaaResponse& DaaRes,
    bool& stale, bool& wrong)
{   /* Get the right challenge from the map. */
    ++nSomeChalTaken;   /* Signal cleaning thread not to work. */
    oMapMutex.Lock ();  /* Wait on Mutex but release immediately. */
    oMapMutex.Unlock ();
    t_challenges_map::iterator itr = mChallenges.find (DaaRes.sNonce);
    if (itr == mChallenges.end () || itr->second->isCanceld == true)
    {   /* Didn't found a matched challenge. */
        --nSomeChalTaken;
        return false;
    }
    CdcDaaChallenge* pchal = itr->second;
    int nc = strtoul(DaaRes.sNC.GetBuffer (), NULL, 16);
    /* Check the response - first. */
    bool fail = pchal->sRealm != DaaRes.sRealm ||
                pchal->sOpaque != DaaRes.sOpaque;
    /* Check the response - second. */
    if (fail == false)
    {   /* Build the response hash on the server side. */
        CdcString HA1 = CdcCrypto::MakeHash (vUsers[id]->GetUsername () + ':'
            + DaaRes.sRealm + ':' + vUsers[id]->GetPassword ());
        CdcString HA2 = CdcCrypto::MakeHash (DaaRes.sMethod + ':' + DaaRes.sURL);
        CdcString ResHash = CdcCrypto::MakeHash (HA1 + ':' + DaaRes.sNonce +
            ':' + DaaRes.sNC + ':' + DaaRes.sCnonce + ':' + DaaRes.sQOP + ':'
            + HA2);
        fail = wrong = !(ResHash == DaaRes.sResponse);
    }
    if (fail == false)
    {   /* Check for stale or old and NC. */
        int time_diff = CdcHttpTime::GetCurrentTime () - pchal->oBuildTime;
        fail = time_diff > nStaleNonce;
        stale = (time_diff > nStaleNonce && time_diff < nExpireNonce) ||
                (pchal->nNC > nc);  /* wrong counter marks as stale because */
    }                               /* sometimes browser send wrong counter. */
    if (fail == true)
    {
        /* Response is wrong or challenge is stale. */
        pchal->isForDelete = true;
        --nSomeChalTaken;       /* Don't use this challenge any more. */
        oStartThread.Call ();   /* Signal to the cleaning thread. */
        return false;
    }
    /* Response is good. */
    pchal->nNC = nc + 1;    /* Increase counter */
    --nSomeChalTaken;       /* Don't use this challenge any more. */
    return true;
}


bool CdcLoginManager::CheckGroupAccess (int id, const CdcString& group)
{
    CdcString group_name = CdcParameters::GetFullName (group,
        "Login-Manager->Groups");
    return CdcParameters::IsUnder (group_name,
        vUsers[id]->GetUsername (), true);
}


void CdcLoginManager::BuildLoginPage (CdcRequest& req, CdcResponse& res,
                                      bool stale)
{   /* Create new challenge object. */
    CdcDaaChallenge* pchal = new CdcDaaChallenge ();
    if (pchal == NULL) throw CdcException ("Out of memory.");
    /* Fill in challenge. */
    pchal->sNonce = CdcCrypto::GetRandomString (35);
    pchal->sOpaque = CdcCrypto::GetRandomString ();
    pchal->sRealm = req.GetAliasHost ();
    pchal->isForDelete = false;
    pchal->nNC = 1;
    /*  And insert to map. No need to lock list. */
    mChallenges[pchal->sNonce] = pchal;
    /* Put challenge in header or variables. */
    if (bBuiltInLogin)
    {   /* Set Request variables for built in method. */
        req.SetVariable (DC_NONCE, pchal->sNonce);
        req.SetVariable (DC_OPAQUE, pchal->sOpaque);
        req.SetVariable (DC_REALM, pchal->sRealm);
    }
    else
    {   /* Set response header for DAA. */
        CdcString DAA = "Digest qop=\"auth\",";
        DAA = DAA + "realm=\"" + pchal->sRealm + "\",";
        DAA = DAA + "nonce=\"" + pchal->sNonce + "\",";
        if (stale)
            DAA = DAA + "stale=\"true\",";
        DAA = DAA + "opaque=\"" + pchal->sOpaque + "\"";
        res.SetHeaderField ("WWW-Authenticate", DAA);
        res.SetStatus (401);
    }
}


CdcUserStatus* CdcLoginManager::CheckAccess (const CdcString& group,
                                               CdcRequest& req,
                                               CdcResponse& res,
                                               int& ret_code,
                                               CdcString& new_page)
{   /* Get user ID and Response for challenge (if exist). */
    CdcDaaResponse DaaRes;
    bool isRes = false, isVar = false, stale = false, wrong = false, access = false;
    int id = GetUserID (req, DaaRes, isRes, isVar);
    /* Check permission in one of two ways. */
    if (id >= 0)
    {   /*  Built In first. */
        access = CheckCode (id, req, res);
        if (access == false && isRes && DaaRes.sURL == req.GetFullURL ())
        {   /* Or DAA (I try it anyway if the user code was wrong). */
            if ((access = CheckResponse (id, DaaRes, stale, wrong)) == true)
            {   /* Set random code also if user is already logged in. */
                SetRandCode (id, req, res);
                if (vUsers[id]->IsLogedin () == false)
                    LoginUser (id, req, res);   /* Login user if this is the first time. */
            }
            if (access == false && stale == false)
                PrintString ("Login Faild - " + req.GetVariable ("BN_ClentIP"), PS_SEC);
        }
    }
    /* If permission denied - send login page. */
    if (access == false)
    {
        BuildLoginPage (req, res, stale);
        ret_code = DC_LM_SEND;
        new_page = sLoginFileName;  /* May be empty if using DAA. */
        if (bBuiltInLogin)
        {
            if (id < 0) req.SetVariable (DC_LOGIN_MSG, "Please log in");
            else if (wrong) req.SetVariable (DC_LOGIN_MSG, "Username or Password is wrong!");
            else req.SetVariable (DC_LOGIN_MSG, "You have to log in again");
        }
        return NULL;
    }
    req.SetVariable (DC_USER_NAME, vUsers[id]->GetUsername ());

    if (group.IsEmpty ())
    {
        ret_code = DC_LM_NONE;  /* if group is empty - ignore this check. */
        return vUsers[id]->GetStatusObject ();  /* But return user status object. */
    }
    /* If no permission for this group - send deny page. */
    if (CheckGroupAccess (id, group) == false)
    {
        ret_code = DC_LM_SEND;
        new_page = sDenyFileName;
        return NULL;
    }
    /* return the user status object. */
    ret_code = DC_LM_OK;
    return vUsers[id]->GetStatusObject ();
}

int CdcLoginManager::GetUserID (const CdcRequest& req, CdcDaaResponse& DaaRes,
                                bool& isRes, bool& isVar)
{
    /* Try response Header/Vars first. */
    if (bBuiltInLogin)
        isRes = BuildResFromVar (req, DaaRes);
    else
        isRes = BuildResFromHeader (req, DaaRes);
    if (isRes == true)
        return FindUser (DaaRes.sUsername);
    /* If not try UserID Var. */
    int id = -1;
    CdcString user_id = req.GetVariable (DC_USER_ID);
    isVar = !user_id.IsEmpty ();
    if (isVar)
        id = CdcParameters::ToInt (user_id);
    return id > vUsers.size () ? -1 : id;
}

bool CdcLoginManager::BuildResFromVar (const CdcRequest& req, CdcDaaResponse& DaaRes)
{
    DaaRes.sNonce = req.GetVariable (DC_NONCE);
    if (DaaRes.sNonce.IsEmpty ()) return false; /* If no nonce - probably no response. */
    DaaRes.sUsername = req.GetVariable (DC_USER_NAME);
    DaaRes.sRealm = req.GetVariable (DC_REALM);
    DaaRes.sOpaque = req.GetVariable (DC_OPAQUE);
    DaaRes.sURL = req.GetVariable (DC_URL);
    DaaRes.sMethod = req.GetMethod ();
    DaaRes.sQOP = "auth";       /* I'm not using this option. */
    DaaRes.sCnonce = req.GetVariable (DC_CNONCE);
    DaaRes.sResponse = req.GetVariable (DC_RESPONSE);
    DaaRes.sNC = req.GetVariable (DC_NC);
    return true;
}

bool CdcLoginManager::BuildResFromHeader (const CdcRequest& req, CdcDaaResponse& DaaRes)
{
    CdcString Auth = req.GetHeaderField ("Authorization");
    if (Auth.IsEmpty ()) return false;
    DaaRes.sUsername = GetProp ("username", Auth);
    DaaRes.sRealm = GetProp ("realm", Auth);
    DaaRes.sNonce = GetProp ("nonce", Auth);
    DaaRes.sOpaque = GetProp ("opaque", Auth);
    DaaRes.sURL = GetProp ("uri", Auth);
    DaaRes.sMethod = req.GetMethod ();
    DaaRes.sQOP = GetProp ("qop", Auth);
    DaaRes.sCnonce = GetProp ("cnonce", Auth);
    DaaRes.sResponse = GetProp ("response", Auth);
    DaaRes.sNC = GetProp ("nc", Auth);
    return true;
}

CdcString CdcLoginManager::GetProp (const CdcString& name, const CdcString& tag)
{
    int place = tag.Find (name + '=');
    /* if no property - return empty string. */
    if (place < 0) return EMPTY_STR;
    CdcString ret = tag.Mid (place + name.GetLength () + 1);
    ret.TrimLeft ();
    ret = ret.Left (ret.FindOneOf (",\n\r"));
    ret.TrimRight ();
    if (ret[0] == '\"' && ret[ret.GetLength () - 1] == '\"')
        ret = ret.Mid (1, ret.GetLength () - 2);
    return ret;
}

int CdcLoginManager::FindUser (const CdcString& username)
{
    int id;
    if (username.IsEmpty ()) return -1;
    t_users_vector::iterator itr;
    for (itr = vUsers.begin(), id = 0; itr != vUsers.end(); itr++, id++)
    {
        if ((*itr)->GetUsername () == username)
            break;
    }
    if (itr == vUsers.end()) return -1;
    return id;
}


bool CdcLoginManager::AddUser (const CdcString& username,
                               const CdcString& password)
{
    int id = FindUser (username);
    if (id >= 0) return false;

    CdcUser* user = new CdcUser (username, password);
    if (user == NULL)
        throw CdcException ("Out of memory.");

    vUsers.push_back (user);

    return true;
}


bool CdcLoginManager::ChangePassword (const CdcString& username,
                                      const CdcString& old_password,
                                      const CdcString new_password)
{
    int id = FindUser (username);
    if (id < 0) return false;

    if (vUsers[id]->GetPassword () != old_password)
        return false;

    vUsers[id]->SetPassword (new_password);
    return true;
}


bool CdcLoginManager::RemoveUser (const CdcString& username,
                                  const CdcString& password)
{
    int id = FindUser (username);
    if (id < 0) return false;

    if (vUsers[id]->GetPassword () != password)
        return false;

    CdcUser* ptemp = vUsers[id];
    vUsers.erase(vUsers.begin() + id);
    delete ptemp;

    return true;
}


int DcClean (void* pParam)
{
    bool* pRun = (bool*)pParam;

    while (*pRun == true)
    {   /* Wait for event, and clean the challenge map. */
        CdcLoginManager::oStartThread.Wait (600000);    /* Go every 10 min any way. */
        if (*pRun == false) return 0;       /* Close this thread. */
        Sleep (DC_CHL_STL_ADD * 1000);      /* Wait a little more if other frames
                                                will use this challenge. */
        if (*pRun == false) return 0;
        CdcLoginManager::Clean ();
    }
    return 0;
}