| /* |
| |
| Licensed to the Apache Software Foundation (ASF) under one |
| or more contributor license agreements. See the NOTICE file |
| distributed with this work for additional information |
| regarding copyright ownership. The ASF licenses this file |
| to you under the Apache License, Version 2.0 (the |
| "License"); you may not use this file except in compliance |
| with the License. You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| See the License for the specific language governing permissions and |
| limitations under the License. |
| */ |
| |
| /** |
| * @file plugin.cc |
| * @brief traffic server plugin entry points. |
| */ |
| |
| #include <ctime> /* strftime */ |
| |
| #include "common.h" /* Common definitions */ |
| #include "config.h" /* AccessControlConfig */ |
| #include "access_control.h" /* AccessToken */ |
| #include "ts/remap.h" /* TSRemapInterface, TSRemapStatus, apiInfo */ |
| #include "ts/ts.h" /* ATS API */ |
| #include "utils.h" /* cryptoBase64Decode.* functions */ |
| #include "headers.h" /* getHeader, setHeader, removeHeader */ |
| |
| static const std::string_view UNKNOWN{"unknown"}; |
| |
| static const char * |
| getEventName(TSEvent event) |
| { |
| switch (event) { |
| case TS_EVENT_HTTP_CONTINUE: |
| return "TS_EVENT_HTTP_CONTINUE"; |
| case TS_EVENT_HTTP_ERROR: |
| return "TS_EVENT_HTTP_ERROR"; |
| case TS_EVENT_HTTP_READ_REQUEST_HDR: |
| return "TS_EVENT_HTTP_READ_REQUEST_HDR"; |
| case TS_EVENT_HTTP_OS_DNS: |
| return "TS_EVENT_HTTP_OS_DNS"; |
| case TS_EVENT_HTTP_SEND_REQUEST_HDR: |
| return "TS_EVENT_HTTP_SEND_REQUEST_HDR"; |
| case TS_EVENT_HTTP_READ_CACHE_HDR: |
| return "TS_EVENT_HTTP_READ_CACHE_HDR"; |
| case TS_EVENT_HTTP_READ_RESPONSE_HDR: |
| return "TS_EVENT_HTTP_READ_RESPONSE_HDR"; |
| case TS_EVENT_HTTP_SEND_RESPONSE_HDR: |
| return "TS_EVENT_HTTP_SEND_RESPONSE_HDR"; |
| case TS_EVENT_HTTP_REQUEST_TRANSFORM: |
| return "TS_EVENT_HTTP_REQUEST_TRANSFORM"; |
| case TS_EVENT_HTTP_RESPONSE_TRANSFORM: |
| return "TS_EVENT_HTTP_RESPONSE_TRANSFORM"; |
| case TS_EVENT_HTTP_SELECT_ALT: |
| return "TS_EVENT_HTTP_SELECT_ALT"; |
| case TS_EVENT_HTTP_TXN_START: |
| return "TS_EVENT_HTTP_TXN_START"; |
| case TS_EVENT_HTTP_TXN_CLOSE: |
| return "TS_EVENT_HTTP_TXN_CLOSE"; |
| case TS_EVENT_HTTP_SSN_START: |
| return "TS_EVENT_HTTP_SSN_START"; |
| case TS_EVENT_HTTP_SSN_CLOSE: |
| return "TS_EVENT_HTTP_SSN_CLOSE"; |
| case TS_EVENT_HTTP_CACHE_LOOKUP_COMPLETE: |
| return "TS_EVENT_HTTP_CACHE_LOOKUP_COMPLETE"; |
| case TS_EVENT_HTTP_PRE_REMAP: |
| return "TS_EVENT_HTTP_PRE_REMAP"; |
| case TS_EVENT_HTTP_POST_REMAP: |
| return "TS_EVENT_HTTP_POST_REMAP"; |
| default: |
| return "UNHANDLED"; |
| } |
| return "UNHANDLED"; |
| } |
| |
| /** |
| * @brief Plugin transaction data. |
| */ |
| class AccessControlTxnData |
| { |
| public: |
| AccessControlTxnData(AccessControlConfig *config) : _config(config) {} |
| const AccessControlConfig *_config; /** @brief pointer to the plugin config */ |
| String _subject = ""; /** @brief subject for debugging purposes */ |
| AccessTokenStatus _vaState = UNUSED; /** @brief VA access control token validation status */ |
| AccessTokenStatus _originState = UNUSED; /** @brief Origin access control token validation status */ |
| }; |
| |
| /** |
| * @brief Plugin initialization. |
| * @param apiInfo remap interface info pointer |
| * @param errBuf error message buffer |
| * @param errBufSize error message buffer size |
| * @return always TS_SUCCESS. |
| */ |
| TSReturnCode |
| TSRemapInit(TSRemapInterface *apiInfo, char *errBuf, int erroBufSize) |
| { |
| return TS_SUCCESS; |
| } |
| |
| /** |
| * @brief Plugin new instance entry point. |
| * |
| * Processes the configuration and initializes the plugin instance. |
| * @param argc plugin arguments number |
| * @param argv plugin arguments |
| * @param instance new plugin instance pointer (initialized in this function) |
| * @param errBuf error message buffer |
| * @param errBufSize error message buffer size |
| * @return TS_SUCCES if success or TS_ERROR if failure |
| */ |
| TSReturnCode |
| TSRemapNewInstance(int argc, char *argv[], void **instance, char *errBuf, int errBufSize) |
| { |
| AccessControlConfig *config = new AccessControlConfig(); |
| if (nullptr != config && config->init(argc, argv)) { |
| *instance = config; |
| } else { |
| AccessControlDebug("failed to initialize the " PLUGIN_NAME " plugin"); |
| *instance = nullptr; |
| delete config; |
| return TS_ERROR; |
| } |
| return TS_SUCCESS; |
| } |
| |
| /** |
| * @brief Plugin instance deletion clean-up entry point. |
| * @param plugin instance pointer. |
| */ |
| void |
| TSRemapDeleteInstance(void *instance) |
| { |
| AccessControlConfig *config = static_cast<AccessControlConfig *>(instance); |
| delete config; |
| } |
| |
| /** |
| * @brief A mapping between various failures and HTTP status code and message to be returned to the UA. |
| * @param state Access Token validation status |
| * @param config pointer to the plugin configuration to get the desired response for each failure. |
| * @return HTTP status |
| */ |
| static TSHttpStatus |
| accessTokenStateToHttpStatus(AccessTokenStatus state, AccessControlConfig *config) |
| { |
| TSHttpStatus httpStatus = TS_HTTP_STATUS_NONE; |
| const char *message = "VALID"; |
| switch (state) { |
| case VALID: |
| break; |
| case INVALID_SIGNATURE: |
| httpStatus = config->_invalidSignature; |
| message = "invalid signature"; |
| break; |
| case UNUSED: |
| httpStatus = config->_internalError; |
| message = "uninitialized token"; |
| break; |
| case INVALID_SECRET: |
| httpStatus = config->_internalError; |
| message = "failed to find secrets"; |
| break; |
| case INVALID_SYNTAX: |
| case MISSING_REQUIRED_FIELD: |
| case INVALID_FIELD: |
| case INVALID_FIELD_VALUE: |
| case INVALID_VERSION: |
| case INVALID_HASH_FUNCTION: |
| case INVALID_KEYID: |
| httpStatus = config->_invalidSyntax; |
| message = "invalid syntax"; |
| break; |
| case INVALID_SCOPE: |
| case OUT_OF_SCOPE: |
| httpStatus = config->_invalidScope; |
| message = "invalid scope"; |
| break; |
| case TOO_EARLY: |
| case TOO_LATE: |
| httpStatus = config->_invalidTiming; |
| message = "invalid timing "; |
| break; |
| default: |
| /* Validation failed. */ |
| httpStatus = config->_invalidRequest; |
| message = "unknown error"; |
| break; |
| } |
| AccessControlDebug("token validation: %s", message); |
| |
| return httpStatus; |
| } |
| |
| /** |
| * @brief a quick utility function to trim leading spaces. |
| */ |
| static void |
| ltrim(String &target) |
| { |
| String::size_type p(target.find_first_not_of(' ')); |
| |
| if (p != target.npos) { |
| target.erase(0, p); |
| } |
| } |
| |
| /** |
| * @brief a quick utility function to get next duplicate header. |
| */ |
| static TSMLoc |
| nextDuplicate(TSMBuffer buffer, TSMLoc hdr, TSMLoc field) |
| { |
| TSMLoc next = TSMimeHdrFieldNextDup(buffer, hdr, field); |
| TSHandleMLocRelease(buffer, hdr, field); |
| return next; |
| } |
| |
| /** |
| * @brief Append cookies by following the rules specified in the cookies config object. |
| * @param config cookies-related configuration containing information about which cookies need to be appended to the key. |
| * @note Add the cookies to "hier-part" (RFC 3986), always sort them in the cache key. |
| */ |
| bool |
| getCookieByName(TSHttpTxn txn, TSMBuffer buf, TSMLoc hdrs, const String &cookieName, String &cookieValue) |
| { |
| TSMLoc field; |
| |
| for (field = TSMimeHdrFieldFind(buf, hdrs, TS_MIME_FIELD_COOKIE, TS_MIME_LEN_COOKIE); field != TS_NULL_MLOC; |
| field = ::nextDuplicate(buf, hdrs, field)) { |
| int count = TSMimeHdrFieldValuesCount(buf, hdrs, field); |
| |
| for (int i = 0; i < count; ++i) { |
| const char *val; |
| int len; |
| |
| val = TSMimeHdrFieldValueStringGet(buf, hdrs, field, i, &len); |
| if (val == nullptr || len == 0) { |
| continue; |
| } |
| |
| String cookie; |
| std::istringstream istr(String(val, len)); |
| |
| while (std::getline(istr, cookie, ';')) { |
| ::ltrim(cookie); // Trim leading spaces. |
| |
| String::size_type pos(cookie.find_first_of('=')); |
| String name(cookie.substr(0, pos == String::npos ? cookie.size() : pos)); |
| |
| AccessControlDebug("cookie name: %s", name.c_str()); |
| |
| if (0 == cookieName.compare(name)) { |
| cookieValue.assign(cookie.substr(pos == String::npos ? pos : pos + 1)); |
| return true; |
| } |
| } |
| } |
| } |
| return false; |
| } |
| |
| /** |
| * @brief Handle token validation failures. |
| * @param txn transaction handle |
| * @param data transaction data |
| * @param reject true - reject requests if configured, false - don't reject |
| * @param httpStatus HTTP status |
| * @param status Access Token validation status. |
| */ |
| static TSRemapStatus |
| handleInvalidToken(TSHttpTxn txnp, AccessControlTxnData *data, bool reject, const TSHttpStatus httpStatus, AccessTokenStatus status) |
| { |
| TSRemapStatus resultStatus = TSREMAP_NO_REMAP; |
| if (reject) { |
| TSHttpTxnStatusSet(txnp, httpStatus); |
| resultStatus = TSREMAP_DID_REMAP; |
| } else { |
| data->_vaState = status; |
| } |
| TSHttpTxnConfigIntSet(txnp, TS_CONFIG_HTTP_CACHE_HTTP, 0); |
| |
| return resultStatus; |
| } |
| |
| /** |
| * @brief Formats the time stamp into expires cookie field format |
| * @param expires Unix Time |
| * @return String containing the date in the appropriate format for the Expires cookie attribute. |
| */ |
| String |
| getCookieExpiresTime(time_t expires) |
| { |
| struct tm tm; |
| char dateTime[1024]; |
| size_t dateTimeLen = 1024; |
| |
| size_t len = strftime(dateTime, dateTimeLen, "%a, %d %b %Y %H:%M:%S GMT", gmtime_r(&expires, &tm)); |
| return String(dateTime, len); |
| } |
| |
| /** |
| * @brief Callback function that handles cache lookup complete state where the access token is checked before serving from cache. |
| * |
| * If cache-miss or cache-skip don't validate - request will be forwarded to the origin and will be validated anyway. |
| * If cache-hit or cache-hit-stale - validate access token and if validation fails force a cache-miss so request will be forwarded |
| * to origin and validated. |
| * |
| * @param contp continuation associated with this function. |
| * @param event corresponding event triggered at different hooks. |
| * @param edata HTTP transaction structures (access control plugin config). |
| * @return always 0 |
| */ |
| int |
| contHandleAccessControl(const TSCont contp, TSEvent event, void *edata) |
| { |
| TSHttpTxn txnp = static_cast<TSHttpTxn>(edata); |
| AccessControlTxnData *data = static_cast<AccessControlTxnData *>(TSContDataGet(contp)); |
| const AccessControlConfig *config = data->_config; |
| TSEvent resultEvent = TS_EVENT_HTTP_CONTINUE; |
| |
| AccessControlDebug("event: '%s'", getEventName(event)); |
| |
| switch (event) { |
| case TS_EVENT_HTTP_SEND_RESPONSE_HDR: { |
| if (VALID != data->_vaState && !config->_respTokenHeaderName.empty() && !config->_cookieName.empty()) { |
| /* Set the cookie only if |
| * - the initial client cookie validation failed (missing or invalid cookie) |
| * - we expect a new access token from the origin |
| * - provided token from the origin is valid |
| * - and we know the name of the cookie to do set-cookie */ |
| |
| TSMBuffer clientRespBufp; |
| TSMLoc clientRespHdrLoc; |
| if (TS_SUCCESS == TSHttpTxnClientRespGet(txnp, &clientRespBufp, &clientRespHdrLoc)) { |
| TSMBuffer serverRespBufp; |
| TSMLoc serverRespHdrLoc; |
| if (TS_SUCCESS == TSHttpTxnServerRespGet(txnp, &serverRespBufp, &serverRespHdrLoc)) { |
| AccessControlDebug("got the response now create the cookie"); |
| |
| static const size_t MAX_HEADER_LEN = 4096; |
| |
| int tokenHdrValueLen = MAX_HEADER_LEN; |
| char tokenHdrValue[MAX_HEADER_LEN]; |
| |
| getHeader(serverRespBufp, serverRespHdrLoc, config->_respTokenHeaderName.c_str(), config->_respTokenHeaderName.size(), |
| tokenHdrValue, &tokenHdrValueLen); |
| |
| if (0 < tokenHdrValueLen) { |
| AccessControlDebug("origin response access token '%.*s'", tokenHdrValueLen, tokenHdrValue); |
| |
| AccessToken *token = config->_tokenFactory->getAccessToken(); |
| if (nullptr != token && |
| VALID == (data->_originState = token->validate(StringView(tokenHdrValue, tokenHdrValueLen), time(nullptr)))) { |
| /* |
| * From RFC 6265 "HTTP State Management Mechanism": |
| * To maximize compatibility with user agents, servers that wish to |
| * store arbitrary data in a cookie-value SHOULD encode that data, for |
| * example, using Base64 [RFC4648]. |
| */ |
| int b64TokenHdrValueLen = cryptoBase64EncodedSize(tokenHdrValueLen); |
| char b64TokenHdrValue[b64TokenHdrValueLen]; |
| size_t b64CookieLen = |
| cryptoModifiedBase64Encode(tokenHdrValue, tokenHdrValueLen, b64TokenHdrValue, b64TokenHdrValueLen); |
| |
| String cookieValue; |
| cookieValue.append(config->_cookieName).append("=").append(b64TokenHdrValue, b64CookieLen).append("; "); |
| |
| /** Currently Access Token implementation requires expiration to be set but the following is still a good |
| * consideration. Set the cookie Expires field to the token expiration field set by the origin if the time specified |
| * is invalid or not specified then don't set Expires attribute. |
| * @todo TBD may be adding a default / overriding Expires attribute configured by parameter would make sense ? */ |
| time_t t = token->getExpiration(); |
| if (0 != t) { |
| cookieValue.append("Expires=").append(getCookieExpiresTime(t)).append("; "); |
| } |
| |
| /* Secure - instructs the UA to include the cookie in an HTTP request only if the request is transmitted over |
| * a secure channel, typically HTTP over Transport Layer Security (TLS) |
| * HttpOnly - instructs the UA to omit the cookie when providing access to cookies via "non-HTTP" APIs such as a web |
| * browser API that exposes cookies to scripts */ |
| cookieValue.append("path=/; Secure; HttpOnly"); |
| |
| AccessControlDebug("%.*s: %s", TS_MIME_LEN_SET_COOKIE, TS_MIME_FIELD_SET_COOKIE, cookieValue.c_str()); |
| setHeader(clientRespBufp, clientRespHdrLoc, TS_MIME_FIELD_SET_COOKIE, TS_MIME_LEN_SET_COOKIE, cookieValue.c_str(), |
| cookieValue.size(), /* duplicateOk = */ true); |
| |
| delete token; |
| } else { |
| AccessControlDebug("failed to construct a valid origin access token, did not set-cookie with it"); |
| /* Don't set any cookie, fail the request here returning appropriate status code and body.*/ |
| TSHttpTxnStatusSet(txnp, config->_invalidOriginResponse); |
| static const char *body = "Unexpected Response From the Origin Server\n"; |
| char *buf = static_cast<char *>(TSmalloc(strlen(body) + 1)); |
| sprintf(buf, "%s", body); |
| TSHttpTxnErrorBodySet(txnp, buf, strlen(buf), nullptr); |
| |
| resultEvent = TS_EVENT_HTTP_ERROR; |
| break; |
| } |
| } else { |
| AccessControlDebug("no access token response header found"); |
| } |
| |
| /* Remove the origin response access token header. */ |
| int numberOfFields = removeHeader(clientRespBufp, clientRespHdrLoc, config->_respTokenHeaderName.c_str(), |
| config->_respTokenHeaderName.size()); |
| AccessControlDebug("removed %d %s client response header(s)", numberOfFields, config->_respTokenHeaderName.c_str()); |
| |
| TSHandleMLocRelease(serverRespBufp, TS_NULL_MLOC, serverRespHdrLoc); |
| } else { |
| int len; |
| char *url = TSHttpTxnEffectiveUrlStringGet(txnp, &len); |
| AccessControlError("failed to retrieve server response header for request url:%.*s", |
| (len ? len : static_cast<int>(UNKNOWN.size())), (url ? url : UNKNOWN.data())); |
| } |
| |
| TSHandleMLocRelease(clientRespBufp, TS_NULL_MLOC, clientRespHdrLoc); |
| } else { |
| int len; |
| char *url = TSHttpTxnEffectiveUrlStringGet(txnp, &len); |
| AccessControlError("failed to retrieve client response header for request url:%.*s", |
| (len ? len : static_cast<int>(UNKNOWN.size())), (url ? url : UNKNOWN.data())); |
| } |
| } |
| } break; |
| |
| case TS_EVENT_HTTP_TXN_CLOSE: { |
| if (!config->_extrValidationHdrName.empty()) { |
| TSMBuffer clientRespBufp; |
| TSMLoc clientRespHdrLoc; |
| |
| /* Add some debugging / logging to the client request so it can be extracted through headers */ |
| if (TS_SUCCESS == TSHttpTxnClientReqGet(txnp, &clientRespBufp, &clientRespHdrLoc)) { |
| String statusHeader; |
| StringView vaState(accessTokenStatusToString(data->_vaState)); |
| StringView originState(accessTokenStatusToString(data->_originState)); |
| |
| /* UC_ = UA Cookie, to store the token validation status when extracted from HTTP cookie */ |
| if (!vaState.empty()) { |
| statusHeader.append("UC_").append(vaState); |
| } |
| /* OH_ = origin response header, to store the token validation status when extracted from origin response header. */ |
| if (!originState.empty()) { |
| statusHeader.append(vaState.empty() ? "" : ","); |
| statusHeader.append("OH_").append(originState); |
| } |
| AccessControlDebug("adding header %s: '%s'", config->_extrValidationHdrName.c_str(), statusHeader.c_str()); |
| setHeader(clientRespBufp, clientRespHdrLoc, config->_extrValidationHdrName.c_str(), config->_extrValidationHdrName.size(), |
| statusHeader.c_str(), statusHeader.length()); |
| |
| } else { |
| AccessControlError("failed to retrieve client response header"); |
| } |
| } |
| |
| /* Destroy the txn continuation and its data */ |
| delete data; |
| TSContDestroy(contp); |
| } break; |
| default: |
| break; |
| } |
| |
| TSHttpTxnReenable(txnp, resultEvent); |
| return 0; |
| } |
| |
| /** |
| * @brief Enforces access control, currently supports access token from a cookie. |
| * |
| * @param instance plugin instance pointer |
| * @param txn transaction handle |
| * @param rri remap request info pointer |
| * @param config pointer to the plugin configuration |
| * @return TSREMAP_NO_REMAP (access validation = success) |
| * TSREMAP_DID_REMAP (access validation = failure and rejection of failed requests is configured) |
| */ |
| TSRemapStatus |
| enforceAccessControl(TSHttpTxn txnp, TSRemapRequestInfo *rri, AccessControlConfig *config) |
| { |
| if (config->_cookieName.empty()) { |
| /* For now only checking a cookie is supported and if its name is unknown (checking cookie disabled) then do nothing. */ |
| return TSREMAP_NO_REMAP; |
| } |
| |
| TSRemapStatus remapStatus = TSREMAP_NO_REMAP; |
| |
| /* Create txn data and register hooks */ |
| AccessControlTxnData *data = new AccessControlTxnData(config); |
| TSCont cont = TSContCreate(contHandleAccessControl, TSMutexCreate()); |
| TSContDataSet(cont, static_cast<void *>(data)); |
| TSHttpTxnHookAdd(txnp, TS_HTTP_SEND_RESPONSE_HDR_HOOK, cont); |
| TSHttpTxnHookAdd(txnp, TS_HTTP_TXN_CLOSE_HOOK, cont); |
| |
| /* Validate the token */ |
| bool reject = config->_rejectRequestsWithInvalidTokens; |
| String cookie; |
| bool found = getCookieByName(txnp, rri->requestBufp, rri->requestHdrp, config->_cookieName, cookie); |
| if (found) { |
| AccessControlDebug("%s cookie: '%s'", config->_cookieName.c_str(), cookie.c_str()); |
| |
| /* |
| * From RFC 6265 "HTTP State Management Mechanism": |
| * To maximize compatibility with user agents, servers that wish to |
| * store arbitrary data in a cookie-value SHOULD encode that data, for |
| * example, using Base64 [RFC4648]. |
| */ |
| size_t decodedCookieBufferSize = cryptoBase64DecodeSize(cookie.c_str(), cookie.size()); |
| char decodedCookie[decodedCookieBufferSize]; |
| size_t decryptedCookieSize = cryptoModifiedBase64Decode(cookie.c_str(), cookie.size(), decodedCookie, decodedCookieBufferSize); |
| if (0 < decryptedCookieSize) { |
| AccessToken *token = config->_tokenFactory->getAccessToken(); |
| if (nullptr != token) { |
| data->_vaState = token->validate(StringView(decodedCookie, decryptedCookieSize), time(nullptr)); |
| if (VALID != data->_vaState) { |
| remapStatus = |
| handleInvalidToken(txnp, data, reject, accessTokenStateToHttpStatus(data->_vaState, config), data->_vaState); |
| } else { |
| /* Valid token, if configured extract the token subject to a header, |
| * only if we can trust it - token is valid to prevent using it by mistake */ |
| if (!config->_extrSubHdrName.empty()) { |
| String sub(token->getSubject()); |
| setHeader(rri->requestBufp, rri->requestHdrp, config->_extrSubHdrName.c_str(), config->_extrSubHdrName.size(), |
| sub.c_str(), sub.size()); |
| } |
| } |
| /* If configure extract the UA token id into a header likely for debugging, |
| * extract it even if token validation fails and we don't trust it */ |
| if (!config->_extrTokenIdHdrName.empty()) { |
| String tokeId(token->getTokenId()); |
| setHeader(rri->requestBufp, rri->requestHdrp, config->_extrTokenIdHdrName.c_str(), config->_extrTokenIdHdrName.size(), |
| tokeId.c_str(), tokeId.size()); |
| } |
| delete token; |
| } else { |
| AccessControlDebug("failed to construct access token"); |
| remapStatus = handleInvalidToken(txnp, data, reject, config->_internalError, UNUSED); |
| } |
| } else { |
| AccessControlDebug("failed to decode cookie value"); |
| remapStatus = handleInvalidToken(txnp, data, reject, config->_invalidRequest, UNUSED); |
| } |
| } else { |
| AccessControlDebug("failed to find cookie %s", config->_cookieName.c_str()); |
| remapStatus = handleInvalidToken(txnp, data, reject, config->_invalidRequest, UNUSED); |
| } |
| |
| return remapStatus; |
| } |
| |
| /** |
| * @brief Remap and sets up access control based on whether access control is required, failed, etc. |
| * |
| * @param instance plugin instance pointer |
| * @param txn transaction handle |
| * @param rri remap request info pointer |
| * @return TSREMAP_NO_REMAP (access validation = success) |
| * TSREMAP_DID_REMAP (access validation = failure and rejection of failed requests is configured) |
| */ |
| TSRemapStatus |
| TSRemapDoRemap(void *instance, TSHttpTxn txnp, TSRemapRequestInfo *rri) |
| { |
| TSRemapStatus remapStatus = TSREMAP_NO_REMAP; |
| AccessControlConfig *config = static_cast<AccessControlConfig *>(instance); |
| |
| if (nullptr != config) { |
| /* Plugin is designed to be used only with TLS, check the scheme */ |
| int schemeLen = 0; |
| const char *scheme = TSUrlSchemeGet(rri->requestBufp, rri->requestUrl, &schemeLen); |
| if (nullptr != scheme) { |
| if (/* strlen("https") */ 5 == schemeLen && 0 == strncmp(scheme, "https", schemeLen)) { |
| AccessControlDebug("validate the access token"); |
| |
| String reqPath; |
| int pathLen = 0; |
| const char *path = TSUrlPathGet(rri->requestBufp, rri->requestUrl, &pathLen); |
| if (nullptr != path && 0 < pathLen) { |
| reqPath.assign(path, pathLen); |
| } |
| /* Check if any of the uri-path multi-pattern matched and if yes enforce access control. */ |
| String filename; |
| String pattern; |
| if (config->_uriPathScope.empty()) { |
| /* Scope match enforce access control */ |
| AccessControlDebug("no plugin scope specified, enforcing access control"); |
| remapStatus = enforceAccessControl(txnp, rri, config); |
| } else { |
| if (true == config->_uriPathScope.matchAll(reqPath, filename, pattern)) { |
| AccessControlDebug("matched plugin scope enforcing access control for path %s", reqPath.c_str()); |
| |
| /* Scope match enforce access control */ |
| remapStatus = enforceAccessControl(txnp, rri, config); |
| } else { |
| AccessControlDebug("not matching plugin scope (file: %s, pattern %s), skipping access control for path '%s'", |
| filename.c_str(), pattern.c_str(), reqPath.c_str()); |
| } |
| } |
| } else { |
| TSHttpTxnStatusSet(txnp, config->_invalidRequest); |
| AccessControlDebug("https is the only allowed scheme (plugin should be used only with TLS)"); |
| remapStatus = TSREMAP_DID_REMAP; |
| } |
| } else { |
| TSHttpTxnStatusSet(txnp, config->_internalError); |
| AccessControlError("failed to get request uri-scheme"); |
| remapStatus = TSREMAP_DID_REMAP; |
| } |
| } else { |
| /* Something is terribly wrong, we cannot get the configuration */ |
| TSHttpTxnStatusSet(txnp, TS_HTTP_STATUS_INTERNAL_SERVER_ERROR); |
| AccessControlError("configuration unavailable"); |
| remapStatus = TSREMAP_DID_REMAP; |
| } |
| |
| return remapStatus; |
| } |
