version 1.28, 2004/03/02 14:57:40
|
version 1.44, 2007/03/28 20:28:29
|
Line 36 use IO::File;
|
Line 36 use IO::File;
|
use Fcntl; |
use Fcntl; |
use POSIX; |
use POSIX; |
use Crypt::IDEA; |
use Crypt::IDEA; |
|
use LONCAPA::lonlocal; |
|
use LONCAPA::lonssl; |
|
|
|
|
|
|
|
|
my $DebugLevel=0; |
my $DebugLevel=0; |
my %hostshash; |
|
my %perlvar; |
my %perlvar; |
|
my $InsecureOk; |
|
|
# |
# |
# Set debugging level |
# Set debugging level |
Line 61 sub SetDebug {
|
Line 62 sub SetDebug {
|
my $ConfigRead = 0; |
my $ConfigRead = 0; |
|
|
# Read the configuration file for apache to get the perl |
# Read the configuration file for apache to get the perl |
# variable set. |
# variables set. |
|
|
sub ReadConfig { |
sub ReadConfig { |
|
Debug(8, "ReadConfig called"); |
|
|
my $perlvarref = read_conf('loncapa.conf'); |
my $perlvarref = read_conf('loncapa.conf'); |
%perlvar = %{$perlvarref}; |
%perlvar = %{$perlvarref}; |
my $hoststab = read_hosts( |
|
"$perlvar{lonTabDir}/hosts.tab") || |
|
die "Can't read host table!!"; |
|
%hostshash = %{$hoststab}; |
|
$ConfigRead = 1; |
$ConfigRead = 1; |
|
|
|
$InsecureOk = $perlvar{loncAllowInsecure}; |
} |
} |
|
|
# |
sub Debug { |
# Read a foreign configuration. |
|
# This sub is intended for the cases where the package |
|
# will be read from outside the LonCAPA environment, in that case |
|
# the client will need to explicitly provide: |
|
# - A file in hosts.tab format. |
|
# - Some idea of the 'lonCAPA' name of the local host (for building |
|
# the encryption key). |
|
# |
|
# Parameters: |
|
# MyHost - Name of this host as far as LonCAPA is concerned. |
|
# Filename - Name of a hosts.tab formatted file that will be used |
|
# to build up the hosts table. |
|
# |
|
sub ReadForeignConfig { |
|
my $MyHost = shift; |
|
my $Filename = shift; |
|
|
|
&Debug(4, "ReadForeignConfig $MyHost $Filename\n"); |
|
|
|
$perlvar{lonHostID} = $MyHost; # Rmember my host. |
|
my $hosttab = read_hosts($Filename) || |
|
die "Can't read hosts table!!"; |
|
%hostshash = %{$hosttab}; |
|
if($DebugLevel > 3) { |
|
foreach my $host (keys %hostshash) { |
|
print "host $host => $hostshash{$host}\n"; |
|
} |
|
} |
|
$ConfigRead = 1; |
|
|
|
} |
my ($level, $message) = @_; |
|
|
sub Debug { |
|
my $level = shift; |
|
my $message = shift; |
|
if ($level < $DebugLevel) { |
if ($level < $DebugLevel) { |
print($message."\n"); |
print STDERR ($message."\n"); |
} |
} |
} |
} |
|
|
Line 125 Dump the internal state of the object: F
|
Line 93 Dump the internal state of the object: F
|
|
|
sub Dump { |
sub Dump { |
my $self = shift; |
my $self = shift; |
|
my $level = shift; |
|
my $now = time; |
|
my $local = localtime($now); |
|
|
|
if ($level >= $DebugLevel) { |
|
return; |
|
} |
|
|
|
|
my $key; |
my $key; |
my $value; |
my $value; |
print STDERR "Dumping LondConnectionObject:\n"; |
print STDERR "[ $local ] Dumping LondConnectionObject:\n"; |
|
print STDERR join(':',caller(1))."\n"; |
while(($key, $value) = each %$self) { |
while(($key, $value) = each %$self) { |
print STDERR "$key -> $value\n"; |
print STDERR "$key -> $value\n"; |
} |
} |
Line 143 old state.
|
Line 121 old state.
|
=cut |
=cut |
|
|
sub Transition { |
sub Transition { |
my $self = shift; |
|
my $newstate = shift; |
my ($self, $newstate) = @_; |
|
|
my $oldstate = $self->{State}; |
my $oldstate = $self->{State}; |
$self->{State} = $newstate; |
$self->{State} = $newstate; |
$self->{TimeoutRemaining} = $self->{TimeoutValue}; |
$self->{TimeoutRemaining} = $self->{TimeoutValue}; |
Line 174 host the remote lond is on. This host is
|
Line 153 host the remote lond is on. This host is
|
=cut |
=cut |
|
|
sub new { |
sub new { |
my $class = shift; # class name. |
my ($class, $DnsName, $Port, $lonid) = @_; |
my $Hostname = shift; # Name of host to connect to. |
|
my $Port = shift; # Port to connect |
|
|
|
if (!$ConfigRead) { |
if (!$ConfigRead) { |
ReadConfig(); |
ReadConfig(); |
$ConfigRead = 1; |
$ConfigRead = 1; |
} |
} |
&Debug(4,$class."::new( ".$Hostname.",".$Port.")\n"); |
&Debug(4,$class."::new( ".$DnsName.",".$Port.")\n"); |
|
|
# The host must map to an entry in the hosts table: |
# The host must map to an entry in the hosts table: |
# We connect to the dns host that corresponds to that |
# We connect to the dns host that corresponds to that |
Line 190 sub new {
|
Line 167 sub new {
|
# negotion. In the objec these become the Host and |
# negotion. In the objec these become the Host and |
# LoncapaHim fields of the object respectively. |
# LoncapaHim fields of the object respectively. |
# |
# |
if (!exists $hostshash{$Hostname}) { |
# if it is me use loopback for connection |
&Debug(8, "No Such host $Hostname"); |
if ($DnsName eq &main::my_hostname()) { $DnsName="127.0.0.1"; } |
return undef; # No such host!!! |
Debug(9, "Connecting to $DnsName"); |
} |
|
my @ConfigLine = @{$hostshash{$Hostname}}; |
|
my $DnsName = $ConfigLine[3]; # 4'th item is dns of host. |
|
Debug(5, "Connecting to ".$DnsName); |
|
# Now create the object... |
# Now create the object... |
my $self = { Host => $DnsName, |
my $self = { Host => $DnsName, |
LoncapaHim => $Hostname, |
LoncapaHim => $lonid, |
Port => $Port, |
Port => $Port, |
State => "Initialized", |
State => "Initialized", |
|
AuthenticationMode => "", |
TransactionRequest => "", |
TransactionRequest => "", |
TransactionReply => "", |
TransactionReply => "", |
|
NextRequest => "", |
InformReadable => 0, |
InformReadable => 0, |
InformWritable => 0, |
InformWritable => 0, |
TimeoutCallback => undef, |
TimeoutCallback => undef, |
TransitionCallback => undef, |
TransitionCallback => undef, |
Timeoutable => 0, |
Timeoutable => 0, |
TimeoutValue => 30, |
TimeoutValue => 3, |
TimeoutRemaining => 0, |
TimeoutRemaining => 0, |
|
LocalKeyFile => "", |
CipherKey => "", |
CipherKey => "", |
LondVersion => "Unknown", |
LondVersion => "Unknown", |
Cipher => undef}; |
Cipher => undef}; |
Line 220 sub new {
|
Line 196 sub new {
|
Type => SOCK_STREAM, |
Type => SOCK_STREAM, |
Proto => "tcp", |
Proto => "tcp", |
Timeout => 3)) { |
Timeout => 3)) { |
|
Debug(8, "Error? \n$@ \n$!"); |
return undef; # Inidicates the socket could not be made. |
return undef; # Inidicates the socket could not be made. |
} |
} |
|
my $socket = $self->{Socket}; # For local use only. |
|
# If we are local, we'll first try local auth mode, otherwise, we'll try |
|
# the ssl auth mode: |
|
|
|
my $key; |
|
my $keyfile; |
|
if ($DnsName eq '127.0.0.1') { |
|
$self->{AuthenticationMode} = "local"; |
|
($key, $keyfile) = lonlocal::CreateKeyFile(); |
|
Debug(8, "Local key: $key, stored in $keyfile"); |
|
|
|
# If I can't make the key file fall back to insecure if |
|
# allowed...else give up right away. |
|
|
|
if(!(defined $key) || !(defined $keyfile)) { |
|
if($InsecureOk) { |
|
$self->{AuthenticationMode} = "insecure"; |
|
$self->{TransactionRequest} = "init\n"; |
|
} |
|
else { |
|
$socket->close; |
|
return undef; |
|
} |
|
} |
|
$self->{TransactionRequest} = "init:local:$keyfile\n"; |
|
Debug(9, "Init string is init:local:$keyfile"); |
|
if(!$self->CreateCipher($key)) { # Nothing's going our way... |
|
$socket->close; |
|
return undef; |
|
} |
|
|
|
} else { |
|
# Remote peer: I'd like to do ssl, but if my host key or certificates |
|
# are not all installed, my only choice is insecure, if that's |
|
# allowed: |
|
|
|
my ($ca, $cert) = lonssl::CertificateFile; |
|
my $sslkeyfile = lonssl::KeyFile; |
|
|
|
if((defined $ca) && (defined $cert) && (defined $sslkeyfile)) { |
|
|
|
$self->{AuthenticationMode} = "ssl"; |
|
$self->{TransactionRequest} = "init:ssl\n"; |
|
} else { |
|
if($InsecureOk) { # Allowed to do insecure: |
|
$self->{AuthenticationMode} = "insecure"; |
|
$self->{TransactionRequest} = "init\n"; |
|
} |
|
else { # Not allowed to do insecure... |
|
$socket->close; |
|
return undef; |
|
} |
|
} |
|
} |
|
|
# |
# |
# We're connected. Set the state, and the events we'll accept: |
# We're connected. Set the state, and the events we'll accept: |
# |
# |
$self->Transition("Connected"); |
$self->Transition("Connected"); |
$self->{InformWritable} = 1; # When socket is writable we send init |
$self->{InformWritable} = 1; # When socket is writable we send init |
$self->{Timeoutable} = 1; # Timeout allowed during startup negotiation. |
$self->{Timeoutable} = 1; # Timeout allowed during startup negotiation. |
$self->{TransactionRequest} = "init\n"; |
|
|
|
# |
# |
# Set socket to nonblocking I/O. |
# Set socket to nonblocking I/O. |
# |
# |
my $socket = $self->{Socket}; |
my $flags = fcntl($socket, F_GETFL,0); |
my $flags = fcntl($socket->fileno, F_GETFL,0); |
if(!$flags) { |
if($flags == -1) { |
|
$socket->close; |
$socket->close; |
return undef; |
return undef; |
} |
} |
if(fcntl($socket, F_SETFL, $flags | O_NONBLOCK) == -1) { |
if(!fcntl($socket, F_SETFL, $flags | O_NONBLOCK)) { |
$socket->close; |
$socket->close; |
return undef; |
return undef; |
} |
} |
|
|
# return the object : |
# return the object : |
|
|
|
Debug(9, "Initial object state: "); |
|
$self->Dump(9); |
|
|
return $self; |
return $self; |
} |
} |
|
|
Line 280 sub Readable {
|
Line 314 sub Readable {
|
my $socket = $self->{Socket}; |
my $socket = $self->{Socket}; |
my $data = ''; |
my $data = ''; |
my $rv; |
my $rv; |
|
my $ConnectionMode = $self->{AuthenticationMode}; |
|
|
if ($socket) { |
if ($socket) { |
eval { |
eval { |
$rv = $socket->recv($data, POSIX::BUFSIZ, 0); |
$rv = $socket->recv($data, POSIX::BUFSIZ, 0); |
Line 308 sub Readable {
|
Line 344 sub Readable {
|
|
|
&Debug(9,"Received from host: ".$data); |
&Debug(9,"Received from host: ".$data); |
$self->{TransactionReply} .= $data; |
$self->{TransactionReply} .= $data; |
if($self->{TransactionReply} =~ /(.*\n)/) { |
if($self->{TransactionReply} =~ m/\n$/) { |
&Debug(8,"Readable End of line detected"); |
&Debug(8,"Readable End of line detected"); |
|
|
|
|
if ($self->{State} eq "Initialized") { # We received the challenge: |
if ($self->{State} eq "Initialized") { # We received the challenge: |
if($self->{TransactionReply} eq "refused\n") { # Remote doesn't have |
# Our init was replied to. What happens next depends both on |
|
# the actual init we sent (AuthenticationMode member data) |
$self->Transition("Disconnected"); # in host tables. |
# and the response: |
$socket->close(); |
# AuthenticationMode == local: |
return -1; |
# Response ok: The key has been exchanged and |
|
# the key file destroyed. We can jump |
|
# into setting the host and requesting the |
|
# Later we'll also bypass key exchange. |
|
# Response digits: |
|
# Old style lond. Delete the keyfile. |
|
# If allowed fall back to insecure mode. |
|
# else close connection and fail. |
|
# Response other: |
|
# Failed local auth |
|
# Close connection and fail. |
|
# |
|
# AuthenticationMode == ssl: |
|
# Response ok:ssl |
|
# Response digits: |
|
# Response other: |
|
# Authentication mode == insecure |
|
# Response digits |
|
# Response other: |
|
|
|
my $Response = $self->{TransactionReply}; |
|
if($ConnectionMode eq "local") { |
|
if($Response =~ /^ok:local/) { # Good local auth. |
|
$self->ToVersionRequest(); |
|
return 0; |
|
} |
|
elsif ($Response =~/^[0-9]+/) { # Old style lond. |
|
return $self->CompleteInsecure(); |
|
|
|
} |
|
else { # Complete flop |
|
&Debug(3, "init:local : unrecognized reply"); |
|
$self->Transition("Disconnected"); |
|
$socket->close; |
|
return -1; |
|
} |
|
} |
|
elsif ($ConnectionMode eq "ssl") { |
|
if($Response =~ /^ok:ssl/) { # Good ssl... |
|
if($self->ExchangeKeysViaSSL()) { # Success skip to vsn stuff |
|
# Need to reset to non blocking: |
|
|
|
my $flags = fcntl($socket, F_GETFL, 0); |
|
fcntl($socket, F_SETFL, $flags | O_NONBLOCK); |
|
$self->ToVersionRequest(); |
|
return 0; |
|
} |
|
else { # Failed in ssl exchange. |
|
&Debug(3,"init:ssl failed key negotiation!"); |
|
$self->Transition("Disconnected"); |
|
$socket->close; |
|
return -1; |
|
} |
|
} |
|
elsif ($Response =~ /^[0-9]+/) { # Old style lond. |
|
return $self->CompleteInsecure(); |
|
} |
|
else { # Complete flop |
|
} |
} |
} |
|
elsif ($ConnectionMode eq "insecure") { |
|
if($self->{TransactionReply} eq "refused\n") { # Remote doesn't have |
|
|
|
$self->Transition("Disconnected"); # in host tables. |
|
$socket->close(); |
|
return -1; |
|
|
|
} |
|
return $self->CompleteInsecure(); |
|
} |
|
else { |
|
&Debug(1,"Authentication mode incorrect"); |
|
die "BUG!!! LondConnection::Readable invalid authmode"; |
|
} |
|
|
|
|
&Debug(8," Transition out of Initialized"); |
|
$self->{TransactionRequest} = $self->{TransactionReply}; |
|
$self->{InformWritable} = 1; |
|
$self->{InformReadable} = 0; |
|
$self->Transition("ChallengeReceived"); |
|
$self->{TimeoutRemaining} = $self->{TimeoutValue}; |
|
return 0; |
|
} elsif ($self->{State} eq "ChallengeReplied") { |
} elsif ($self->{State} eq "ChallengeReplied") { |
if($self->{TransactionReply} ne "ok\n") { |
if($self->{TransactionReply} ne "ok\n") { |
$self->Transition("Disconnected"); |
$self->Transition("Disconnected"); |
$socket->close(); |
$socket->close(); |
return -1; |
return -1; |
} |
} |
$self->Transition("RequestingVersion"); |
$self->ToVersionRequest(); |
$self->{InformReadable} = 0; |
|
$self->{InformWritable} = 1; |
|
$self->{TransactionRequest} = "version\n"; |
|
return 0; |
return 0; |
|
|
} elsif ($self->{State} eq "ReadingVersionString") { |
} elsif ($self->{State} eq "ReadingVersionString") { |
$self->{LondVersion} = chomp($self->{TransactionReply}); |
chomp($self->{TransactionReply}); |
|
$self->{LondVersion} = $self->{TransactionReply}; |
$self->Transition("SetHost"); |
$self->Transition("SetHost"); |
$self->{InformReadable} = 0; |
$self->{InformReadable} = 0; |
$self->{InformWritable} = 1; |
$self->{InformWritable} = 1; |
Line 350 sub Readable {
|
Line 453 sub Readable {
|
$socket->close(); |
$socket->close(); |
return -1; |
return -1; |
} |
} |
$self->Transition("RequestingKey"); |
# If the auth mode is insecure we must still |
$self->{InformReadable} = 0; |
# exchange session keys. Otherwise, |
$self->{InformWritable} = 1; |
# we can just transition to idle. |
$self->{TransactionRequest} = "ekey\n"; |
|
return 0; |
if($ConnectionMode eq "insecure") { |
|
$self->Transition("RequestingKey"); |
|
$self->{InformReadable} = 0; |
|
$self->{InformWritable} = 1; |
|
$self->{TransactionRequest} = "ekey\n"; |
|
return 0; |
|
} |
|
else { |
|
$self->ToIdle(); |
|
return 0; |
|
} |
} elsif ($self->{State} eq "ReceivingKey") { |
} elsif ($self->{State} eq "ReceivingKey") { |
my $buildkey = $self->{TransactionReply}; |
my $buildkey = $self->{TransactionReply}; |
my $key = $self->{LoncapaHim}.$perlvar{'lonHostID'}; |
my $key = $self->{LoncapaHim}.$perlvar{'lonHostID'}; |
$key=~tr/a-z/A-Z/; |
$key=~tr/a-z/A-Z/; |
$key=~tr/G-P/0-9/; |
$key=~tr/G-P/0-9/; |
$key=~tr/Q-Z/0-9/; |
$key=~tr/Q-Z/0-9/; |
$key=$key.$buildkey.$key.$buildkey.$key.$buildkey; |
$key =$key.$buildkey.$key.$buildkey.$key.$buildkey; |
$key=substr($key,0,32); |
$key = substr($key,0,32); |
my $cipherkey=pack("H32",$key); |
if(!$self->CreateCipher($key)) { |
$self->{Cipher} = new IDEA $cipherkey; |
|
if($self->{Cipher} eq undef) { |
|
$self->Transition("Disconnected"); |
$self->Transition("Disconnected"); |
$socket->close(); |
$socket->close(); |
return -1; |
return -1; |
} else { |
} else { |
$self->Transition("Idle"); |
$self->ToIdle(); |
$self->{InformWritable} = 0; |
|
$self->{InformReadable} = 0; |
|
$self->{Timeoutable} = 0; |
|
return 0; |
return 0; |
} |
} |
} elsif ($self->{State} eq "ReceivingReply") { |
} elsif ($self->{State} eq "ReceivingReply") { |
Line 383 sub Readable {
|
Line 491 sub Readable {
|
my $answer = $self->{TransactionReply}; |
my $answer = $self->{TransactionReply}; |
if($answer =~ /^enc\:/) { |
if($answer =~ /^enc\:/) { |
$answer = $self->Decrypt($answer); |
$answer = $self->Decrypt($answer); |
$self->{TransactionReply} = $answer; |
$self->{TransactionReply} = "$answer\n"; |
} |
} |
|
# if we have a NextRequest do it immeadiately |
|
if ($self->{NextRequest}) { |
|
$self->{TransactionRequest} = $self->{NextRequest}; |
|
undef( $self->{NextRequest} ); |
|
$self->{TransactionReply} = ""; |
|
$self->{InformWritable} = 1; |
|
$self->{InformReadable} = 0; |
|
$self->{Timeoutable} = 1; |
|
$self->{TimeoutRemaining} = $self->{TimeoutValue}; |
|
$self->Transition("SendingRequest"); |
|
return 0; |
|
} else { |
# finish the transaction |
# finish the transaction |
|
|
$self->{InformWritable} = 0; |
$self->ToIdle(); |
$self->{InformReadable} = 0; |
return 0; |
$self->{Timeoutable} = 0; |
} |
$self->Transition("Idle"); |
|
return 0; |
|
} elsif ($self->{State} eq "Disconnected") { # No connection. |
} elsif ($self->{State} eq "Disconnected") { # No connection. |
return -1; |
return -1; |
} else { # Internal error: Invalid state. |
} else { # Internal error: Invalid state. |
Line 535 timout, and to request writability notif
|
Line 652 timout, and to request writability notif
|
=cut |
=cut |
|
|
sub InitiateTransaction { |
sub InitiateTransaction { |
my $self = shift; |
|
my $data = shift; |
my ($self, $data) = @_; |
|
|
Debug(1, "initiating transaction: ".$data); |
Debug(1, "initiating transaction: ".$data); |
if($self->{State} ne "Idle") { |
if($self->{State} ne "Idle") { |
Line 544 sub InitiateTransaction {
|
Line 661 sub InitiateTransaction {
|
return -1; # Error indicator. |
return -1; # Error indicator. |
} |
} |
# if the transaction is to be encrypted encrypt the data: |
# if the transaction is to be encrypted encrypt the data: |
|
(my $sethost, my $server,$data)=split(/:/,$data,3); |
|
|
if($data =~ /^encrypt\:/) { |
if($data =~ /^encrypt\:/) { |
$data = $self->Encrypt($data); |
$data = $self->Encrypt($data); |
} |
} |
|
|
# Setup the trasaction |
# Setup the trasaction |
|
# currently no version of lond supports inlining the sethost |
$self->{TransactionRequest} = $data; |
if ($self->PeerVersion() <= 321) { |
|
if ($server ne $self->{LoncapaHim}) { |
|
$self->{NextRequest} = $data; |
|
$self->{TransactionRequest} = "$sethost:$server\n"; |
|
$self->{LoncapaHim} = $server; |
|
} else { |
|
$self->{TransactionRequest} = $data; |
|
} |
|
} else { |
|
$self->{LoncapaHim} = $server; |
|
$self->{TransactionRequest} = "$sethost:$server:$data"; |
|
} |
$self->{TransactionReply} = ""; |
$self->{TransactionReply} = ""; |
$self->{InformWritable} = 1; |
$self->{InformWritable} = 1; |
$self->{InformReadable} = 0; |
$self->{InformReadable} = 0; |
Line 587 established callback or undef if there w
|
Line 716 established callback or undef if there w
|
=cut |
=cut |
|
|
sub SetTimeoutCallback { |
sub SetTimeoutCallback { |
my $self = shift; |
|
my $callback = shift; |
my ($self, $callback) = @_; |
|
|
my $oldCallback = $self->{TimeoutCallback}; |
my $oldCallback = $self->{TimeoutCallback}; |
$self->{TimeoutCallback} = $callback; |
$self->{TimeoutCallback} = $callback; |
return $oldCallback; |
return $oldCallback; |
Line 716 The output string can be directly sent t
|
Line 846 The output string can be directly sent t
|
=cut |
=cut |
|
|
sub Encrypt { |
sub Encrypt { |
my $self = shift; # Reference to the object. |
|
my $request = shift; # Text to send. |
my ($self, $request) = @_; |
|
|
|
|
# Split the encrypt: off the request and figure out it's length. |
# Split the encrypt: off the request and figure out it's length. |
Line 759 Decrypt a response from the server. The
|
Line 889 Decrypt a response from the server. The
|
=cut |
=cut |
|
|
sub Decrypt { |
sub Decrypt { |
my $self = shift; # Recover reference to object |
|
my $encrypted = shift; # This is the encrypted data. |
my ($self, $encrypted) = @_; |
|
|
# Bust up the response into length, and encryptedstring: |
# Bust up the response into length, and encryptedstring: |
|
|
Line 783 sub Decrypt {
|
Line 913 sub Decrypt {
|
# $length tells us the actual length of the decrypted string: |
# $length tells us the actual length of the decrypted string: |
|
|
$decrypted = substr($decrypted, 0, $length); |
$decrypted = substr($decrypted, 0, $length); |
|
Debug(9, "Decrypted $EncryptedString to $decrypted"); |
|
|
return $decrypted; |
return $decrypted; |
|
|
} |
} |
|
# ToIdle |
|
# Called to transition to idle... done enough it's worth subbing |
|
# off to ensure it's always done right!! |
|
# |
|
sub ToIdle { |
|
my $self = shift; |
|
|
=pod |
$self->Transition("Idle"); |
|
$self->{InformWritiable} = 0; |
|
$self->{InformReadable} = 0; |
|
$self->{Timeoutable} = 0; |
|
} |
|
|
|
# ToVersionRequest |
|
# Called to transition to "RequestVersion" also done a few times |
|
# so worth subbing out. |
|
# |
|
sub ToVersionRequest { |
|
my $self = shift; |
|
|
|
$self->Transition("RequestingVersion"); |
|
$self->{InformReadable} = 0; |
|
$self->{InformWritable} = 1; |
|
$self->{TransactionRequest} = "version\n"; |
|
|
|
} |
|
# |
|
# CreateCipher |
|
# Given a cipher key stores the key in the object context, |
|
# creates the cipher object, (stores that in object context), |
|
# This is done a couple of places, so it's worth factoring it out. |
|
# |
|
# Parameters: |
|
# (self) |
|
# key - The Cipher key. |
|
# |
|
# Returns: |
|
# 0 - Failure to create IDEA cipher. |
|
# 1 - Success. |
|
# |
|
sub CreateCipher { |
|
my ($self, $key) = @_; # According to coding std. |
|
|
=head2 GetHostIterator |
$self->{CipherKey} = $key; # Save the text key... |
|
my $packedkey = pack ("H32", $key); |
|
my $cipher = new IDEA $packedkey; |
|
if($cipher) { |
|
$self->{Cipher} = $cipher; |
|
Debug("Cipher created dumping socket: "); |
|
$self->Dump(9); |
|
return 1; |
|
} |
|
else { |
|
return 0; |
|
} |
|
} |
|
# ExchangeKeysViaSSL |
|
# Called to do cipher key exchange via SSL. |
|
# The socket is promoted to an SSL socket. If that's successful, |
|
# we read out cipher key through the socket and create an IDEA |
|
# cipher object. |
|
# Parameters: |
|
# (self) |
|
# Returns: |
|
# true - Success. |
|
# false - Failure. |
|
# |
|
# Assumptions: |
|
# 1. The ssl session setup has timeout logic built in so we don't |
|
# have to worry about DOS attacks at that stage. |
|
# 2. If the ssl session gets set up we are talking to a legitimate |
|
# lond so again we don't have to worry about DOS attacks. |
|
# All this allows us just to call |
|
sub ExchangeKeysViaSSL { |
|
my $self = shift; |
|
my $socket = $self->{Socket}; |
|
|
Returns a hash iterator to the host information. Each get from |
# Get our signed certificate, the certificate authority's |
this iterator returns a reference to an array that contains |
# certificate and our private key file. All of these |
information read from the hosts configuration file. Array elements |
# are needed to create the ssl connection. |
are used as follows: |
|
|
my ($SSLCACertificate, |
[0] - LonCapa host name. |
$SSLCertificate) = lonssl::CertificateFile(); |
[1] - LonCapa domain name. |
my $SSLKey = lonssl::KeyFile(); |
[2] - Loncapa role (e.g. library or access). |
|
[3] - DNS name server hostname. |
# Promote our connection to ssl and read the key from lond. |
[4] - IP address (result of e.g. nslookup [3]). |
|
[5] - Maximum connection count. |
my $SSLSocket = lonssl::PromoteClientSocket($socket, |
[6] - Idle timeout for reducing connection count. |
$SSLCACertificate, |
[7] - Minimum connection count. |
$SSLCertificate, |
|
$SSLKey); |
|
if(defined $SSLSocket) { |
|
my $key = <$SSLSocket>; |
|
lonssl::Close($SSLSocket); |
|
if($key) { |
|
chomp($key); # \n is not part of the key. |
|
return $self->CreateCipher($key); |
|
} |
|
else { |
|
Debug(3, "Failed to read ssl key"); |
|
return 0; |
|
} |
|
} |
|
else { |
|
# Failed!! |
|
Debug(3, "Failed to negotiate SSL connection!"); |
|
return 0; |
|
} |
|
# should not get here |
|
return 0; |
|
|
=cut |
} |
|
|
sub GetHostIterator { |
|
|
|
return HashIterator->new(\%hostshash); |
|
|
# |
|
# CompleteInsecure: |
|
# This function is called to initiate the completion of |
|
# insecure challenge response negotiation. |
|
# To do this, we copy the challenge string to the transaction |
|
# request, flip to writability and state transition to |
|
# ChallengeReceived.. |
|
# All this is only possible if InsecureOk is true. |
|
# Parameters: |
|
# (self) - This object's context hash. |
|
# Return: |
|
# 0 - Ok to transition. |
|
# -1 - Not ok to transition (InsecureOk not ok). |
|
# |
|
sub CompleteInsecure { |
|
my $self = shift; |
|
if($InsecureOk) { |
|
$self->{AuthenticationMode} = "insecure"; |
|
&Debug(8," Transition out of Initialized:insecure"); |
|
$self->{TransactionRequest} = $self->{TransactionReply}; |
|
$self->{InformWritable} = 1; |
|
$self->{InformReadable} = 0; |
|
$self->Transition("ChallengeReceived"); |
|
$self->{TimeoutRemaining} = $self->{TimeoutValue}; |
|
return 0; |
|
|
|
|
|
} |
|
else { |
|
&Debug(3, "Insecure key negotiation disabled!"); |
|
my $socket = $self->{Socket}; |
|
$socket->close; |
|
return -1; |
|
} |
} |
} |
|
|
########################################################### |
########################################################### |
Line 824 sub GetHostIterator {
|
Line 1080 sub GetHostIterator {
|
# |
# |
|
|
|
|
my $confdir='/etc/httpd/conf/'; |
my @confdirs=('/etc/httpd/conf/','/etc/apache2/'); |
|
|
# ------------------- Subroutine read_conf: read LON-CAPA server configuration. |
# ------------------- Subroutine read_conf: read LON-CAPA server configuration. |
# This subroutine reads PerlSetVar values out of specified web server |
# This subroutine reads PerlSetVar values out of specified web server |
Line 832 my $confdir='/etc/httpd/conf/';
|
Line 1088 my $confdir='/etc/httpd/conf/';
|
sub read_conf |
sub read_conf |
{ |
{ |
my (@conf_files)=@_; |
my (@conf_files)=@_; |
my %perlvar; |
my (%perlvar,%configdirs); |
foreach my $filename (@conf_files,'loncapa_apache.conf') |
foreach my $filename (@conf_files,'loncapa_apache.conf') { |
{ |
my $configdir = ''; |
if($DebugLevel > 3) { |
$configdirs{$filename} = [@confdirs]; |
print("Going to read $confdir.$filename\n"); |
while ($configdir eq '' && @{$configdirs{$filename}} > 0) { |
} |
my $testdir = shift(@{$configdirs{$filename}}); |
open(CONFIG,'<'.$confdir.$filename) or |
if (-e $testdir.$filename) { |
die("Can't read $confdir$filename"); |
$configdir = $testdir; |
while (my $configline=<CONFIG>) |
} |
{ |
} |
if ($configline =~ /^[^\#]*PerlSetVar/) |
if ($configdir eq '') { |
{ |
die("Couldn't find a directory containing $filename"); |
my ($unused,$varname,$varvalue)=split(/\s+/,$configline); |
} |
|
if($DebugLevel > 3) { |
|
print STDERR ("Going to read $configdir.$filename\n"); |
|
} |
|
open(CONFIG,'<'.$configdir.$filename) or |
|
die("Can't read $configdir$filename"); |
|
while (my $configline=<CONFIG>) { |
|
if ($configline =~ /^[^\#]*PerlSetVar/) { |
|
my ($unused,$varname,$varvalue)=split(/\s+/,$configline); |
chomp($varvalue); |
chomp($varvalue); |
$perlvar{$varname}=$varvalue; |
$perlvar{$varname}=$varvalue; |
} |
} |
} |
} |
close(CONFIG); |
close(CONFIG); |
} |
} |
if($DebugLevel > 3) { |
if($DebugLevel > 3) { |
print "Dumping perlvar:\n"; |
print STDERR "Dumping perlvar:\n"; |
foreach my $var (keys %perlvar) { |
foreach my $var (keys %perlvar) { |
print "$var = $perlvar{$var}\n"; |
print STDERR "$var = $perlvar{$var}\n"; |
} |
} |
} |
} |
my $perlvarref=\%perlvar; |
my $perlvarref=\%perlvar; |
return $perlvarref; |
return $perlvarref; |
} |
} |
|
|
#---------------------- Subroutine read_hosts: Read a LON-CAPA hosts.tab |
|
# formatted configuration file. |
|
# |
|
my $RequiredCount = 5; # Required item count in hosts.tab. |
|
my $DefaultMaxCon = 5; # Default value for maximum connections. |
|
my $DefaultIdle = 1000; # Default connection idle time in seconds. |
|
my $DefaultMinCon = 0; # Default value for minimum connections. |
|
|
|
sub read_hosts { |
|
my $Filename = shift; |
|
my %HostsTab; |
|
|
|
open(CONFIG,'<'.$Filename) or die("Can't read $Filename"); |
|
while (my $line = <CONFIG>) { |
|
if (!($line =~ /^\s*\#/)) { |
|
my @items = split(/:/, $line); |
|
if(scalar @items >= $RequiredCount) { |
|
if (scalar @items == $RequiredCount) { # Only required items: |
|
$items[$RequiredCount] = $DefaultMaxCon; |
|
} |
|
if(scalar @items == $RequiredCount + 1) { # up through maxcon. |
|
$items[$RequiredCount+1] = $DefaultIdle; |
|
} |
|
if(scalar @items == $RequiredCount + 2) { # up through idle. |
|
$items[$RequiredCount+2] = $DefaultMinCon; |
|
} |
|
{ |
|
my @list = @items; # probably not needed but I'm unsure of |
|
# about the scope of item so... |
|
$HostsTab{$list[0]} = \@list; |
|
} |
|
} |
|
} |
|
} |
|
close(CONFIG); |
|
my $hostref = \%HostsTab; |
|
return ($hostref); |
|
} |
|
# |
# |
# Get the version of our peer. Note that this is only well |
# Get the version of our peer. Note that this is only well |
# defined if the state machine has hit the idle state at least |
# defined if the state machine has hit the idle state at least |
Line 907 sub read_hosts {
|
Line 1133 sub read_hosts {
|
# |
# |
sub PeerVersion { |
sub PeerVersion { |
my $self = shift; |
my $self = shift; |
|
my ($version) = ($self->{LondVersion} =~ /Revision: 1\.(\d+)/); |
return $self->{LondVersion}; |
return $version; |
} |
} |
|
|
1; |
1; |
Line 984 Socket open on the connection.
|
Line 1210 Socket open on the connection.
|
|
|
The current state. |
The current state. |
|
|
|
=item AuthenticationMode |
|
|
|
How authentication is being done. This can be any of: |
|
|
|
o local - Authenticate via a key exchanged in a file. |
|
o ssl - Authenticate via a key exchaned through a temporary ssl tunnel. |
|
o insecure - Exchange keys in an insecure manner. |
|
|
|
insecure is only allowed if the configuration parameter loncAllowInsecure |
|
is nonzero. |
|
|
=item TransactionRequest |
=item TransactionRequest |
|
|
The request being transmitted. |
The request being transmitted. |
Line 1093 true if the current state requires a wri
|
Line 1330 true if the current state requires a wri
|
|
|
true if the current state requires timeout support. |
true if the current state requires timeout support. |
|
|
=item GetHostIterator: |
|
|
|
Returns an iterator into the host file hash. |
|
|
|
=cut |
=cut |