|
|
|
|
@ -1,4 +1,5 @@
@@ -1,4 +1,5 @@
|
|
|
|
|
use headers::HeaderValue; |
|
|
|
|
use hyper::Method; |
|
|
|
|
use lazy_static::lazy_static; |
|
|
|
|
use md5::Context; |
|
|
|
|
use std::{ |
|
|
|
|
@ -7,6 +8,7 @@ use std::{
@@ -7,6 +8,7 @@ use std::{
|
|
|
|
|
}; |
|
|
|
|
use uuid::Uuid; |
|
|
|
|
|
|
|
|
|
use crate::utils::encode_uri; |
|
|
|
|
use crate::BoxResult; |
|
|
|
|
|
|
|
|
|
const REALM: &str = "DUF"; |
|
|
|
|
@ -20,6 +22,151 @@ lazy_static! {
@@ -20,6 +22,151 @@ lazy_static! {
|
|
|
|
|
}; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
#[derive(Debug, Clone)] |
|
|
|
|
pub struct AccessControl { |
|
|
|
|
rules: HashMap<String, PathControl>, |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
#[derive(Debug, Clone)] |
|
|
|
|
pub struct PathControl { |
|
|
|
|
readwrite: Account, |
|
|
|
|
readonly: Option<Account>, |
|
|
|
|
share: bool, |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
impl AccessControl { |
|
|
|
|
pub fn new(raw_rules: &[&str], uri_prefix: &str) -> BoxResult<Self> { |
|
|
|
|
let mut rules = HashMap::default(); |
|
|
|
|
if raw_rules.is_empty() { |
|
|
|
|
return Ok(Self { rules }); |
|
|
|
|
} |
|
|
|
|
for rule in raw_rules { |
|
|
|
|
let parts: Vec<&str> = rule.split('@').collect(); |
|
|
|
|
let create_err = || format!("Invalid auth `{}`", rule).into(); |
|
|
|
|
match parts.as_slice() { |
|
|
|
|
[path, readwrite] => { |
|
|
|
|
let control = PathControl { |
|
|
|
|
readwrite: Account::new(readwrite).ok_or_else(create_err)?, |
|
|
|
|
readonly: None, |
|
|
|
|
share: false, |
|
|
|
|
}; |
|
|
|
|
rules.insert(sanitize_path(path, uri_prefix), control); |
|
|
|
|
} |
|
|
|
|
[path, readwrite, readonly] => { |
|
|
|
|
let (readonly, share) = if *readonly == "*" { |
|
|
|
|
(None, true) |
|
|
|
|
} else { |
|
|
|
|
(Some(Account::new(readonly).ok_or_else(create_err)?), false) |
|
|
|
|
}; |
|
|
|
|
let control = PathControl { |
|
|
|
|
readwrite: Account::new(readwrite).ok_or_else(create_err)?, |
|
|
|
|
readonly, |
|
|
|
|
share, |
|
|
|
|
}; |
|
|
|
|
rules.insert(sanitize_path(path, uri_prefix), control); |
|
|
|
|
} |
|
|
|
|
_ => return Err(create_err()), |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
Ok(Self { rules }) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
pub fn guard( |
|
|
|
|
&self, |
|
|
|
|
path: &str, |
|
|
|
|
method: &Method, |
|
|
|
|
authorization: Option<&HeaderValue>, |
|
|
|
|
) -> GuardType { |
|
|
|
|
if self.rules.is_empty() { |
|
|
|
|
return GuardType::ReadWrite; |
|
|
|
|
} |
|
|
|
|
let mut controls = vec![]; |
|
|
|
|
for path in walk_path(path) { |
|
|
|
|
if let Some(control) = self.rules.get(path) { |
|
|
|
|
controls.push(control); |
|
|
|
|
if let Some(authorization) = authorization { |
|
|
|
|
let Account { user, pass } = &control.readwrite; |
|
|
|
|
if valid_digest(authorization, method.as_str(), user, pass).is_some() { |
|
|
|
|
return GuardType::ReadWrite; |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
if is_readonly_method(method) { |
|
|
|
|
for control in controls.into_iter() { |
|
|
|
|
if control.share { |
|
|
|
|
return GuardType::ReadOnly; |
|
|
|
|
} |
|
|
|
|
if let Some(authorization) = authorization { |
|
|
|
|
if let Some(Account { user, pass }) = &control.readonly { |
|
|
|
|
if valid_digest(authorization, method.as_str(), user, pass).is_some() { |
|
|
|
|
return GuardType::ReadOnly; |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
GuardType::Reject |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)] |
|
|
|
|
pub enum GuardType { |
|
|
|
|
Reject, |
|
|
|
|
ReadWrite, |
|
|
|
|
ReadOnly, |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
impl GuardType { |
|
|
|
|
pub fn is_reject(&self) -> bool { |
|
|
|
|
*self == GuardType::Reject |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
fn sanitize_path(path: &str, uri_prefix: &str) -> String { |
|
|
|
|
encode_uri(&format!("{}{}", uri_prefix, path.trim_matches('/'))) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
fn walk_path(path: &str) -> impl Iterator<Item = &str> { |
|
|
|
|
let mut idx = 0; |
|
|
|
|
path.split('/').enumerate().map(move |(i, part)| { |
|
|
|
|
let end = if i == 0 { 1 } else { idx + part.len() + i }; |
|
|
|
|
let value = &path[..end]; |
|
|
|
|
idx += part.len(); |
|
|
|
|
value |
|
|
|
|
}) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
fn is_readonly_method(method: &Method) -> bool { |
|
|
|
|
method == Method::GET |
|
|
|
|
|| method == Method::OPTIONS |
|
|
|
|
|| method == Method::HEAD |
|
|
|
|
|| method.as_str() == "PROPFIND" |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
#[derive(Debug, Clone)] |
|
|
|
|
struct Account { |
|
|
|
|
user: String, |
|
|
|
|
pass: String, |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
impl Account { |
|
|
|
|
fn new(data: &str) -> Option<Self> { |
|
|
|
|
let p: Vec<&str> = data.trim().split(':').collect(); |
|
|
|
|
if p.len() != 2 { |
|
|
|
|
return None; |
|
|
|
|
} |
|
|
|
|
let user = p[0]; |
|
|
|
|
let pass = p[1]; |
|
|
|
|
let mut h = Context::new(); |
|
|
|
|
h.consume(format!("{}:{}:{}", user, REALM, pass).as_bytes()); |
|
|
|
|
Some(Account { |
|
|
|
|
user: user.to_owned(), |
|
|
|
|
pass: format!("{:x}", h.compute()), |
|
|
|
|
}) |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
pub fn generate_www_auth(stale: bool) -> String { |
|
|
|
|
let str_stale = if stale { "stale=true," } else { "" }; |
|
|
|
|
format!( |
|
|
|
|
@ -30,26 +177,13 @@ pub fn generate_www_auth(stale: bool) -> String {
@@ -30,26 +177,13 @@ pub fn generate_www_auth(stale: bool) -> String {
|
|
|
|
|
) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
pub fn parse_auth(auth: &str) -> BoxResult<(String, String)> { |
|
|
|
|
let p: Vec<&str> = auth.trim().split(':').collect(); |
|
|
|
|
let err = "Invalid auth value"; |
|
|
|
|
if p.len() != 2 { |
|
|
|
|
return Err(err.into()); |
|
|
|
|
} |
|
|
|
|
let user = p[0]; |
|
|
|
|
let pass = p[1]; |
|
|
|
|
let mut h = Context::new(); |
|
|
|
|
h.consume(format!("{}:{}:{}", user, REALM, pass).as_bytes()); |
|
|
|
|
Ok((user.to_owned(), format!("{:x}", h.compute()))) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
pub fn valid_digest( |
|
|
|
|
header_value: &HeaderValue, |
|
|
|
|
authorization: &HeaderValue, |
|
|
|
|
method: &str, |
|
|
|
|
auth_user: &str, |
|
|
|
|
auth_pass: &str, |
|
|
|
|
) -> Option<()> { |
|
|
|
|
let digest_value = strip_prefix(header_value.as_bytes(), b"Digest ")?; |
|
|
|
|
let digest_value = strip_prefix(authorization.as_bytes(), b"Digest ")?; |
|
|
|
|
let user_vals = to_headermap(digest_value).ok()?; |
|
|
|
|
if let (Some(username), Some(nonce), Some(user_response)) = ( |
|
|
|
|
user_vals |
|
|
|
|
|
sigoden
3 years ago
committed by
GitHub