protocol/http/nsHttpAuthCache.cpp

/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

// HttpLog.h should generally be included first
#include "HttpLog.h"

#include "nsHttpAuthCache.h"

#include <stdlib.h>

#include "mozilla/Attributes.h"
#include "nsString.h"
#include "nsCRT.h"
#include "nsIObserverService.h"
#include "mozilla/Services.h"
#include "mozilla/DebugOnly.h"
#include "nsNetUtil.h"

namespace mozilla {
namespace net {

static inline void GetAuthKey(const char *scheme, const char *host,
                              int32_t port, nsACString const &originSuffix,
                              nsCString &key) {
  key.Truncate();
  key.Append(originSuffix);
  key.Append(':');
  key.Append(scheme);
  key.AppendLiteral("://");
  key.Append(host);
  key.Append(':');
  key.AppendInt(port);
}

// return true if the two strings are equal or both empty.  an empty string
// is either null or zero length.
static bool StrEquivalent(const char16_t *a, const char16_t *b) {
  static const char16_t emptyStr[] = {0};

  if (!a) a = emptyStr;
  if (!b) b = emptyStr;

  return nsCRT::strcmp(a, b) == 0;
}

//-----------------------------------------------------------------------------
// nsHttpAuthCache <public>
//-----------------------------------------------------------------------------

nsHttpAuthCache::nsHttpAuthCache()
    : mDB(128), mObserver(new OriginClearObserver(this)) {
  nsCOMPtr<nsIObserverService> obsSvc = services::GetObserverService();
  if (obsSvc) {
    obsSvc->AddObserver(mObserver, "clear-origin-attributes-data", false);
  }
}

nsHttpAuthCache::~nsHttpAuthCache() {
  DebugOnly<nsresult> rv = ClearAll();
  MOZ_ASSERT(NS_SUCCEEDED(rv));
  nsCOMPtr<nsIObserverService> obsSvc = services::GetObserverService();
  if (obsSvc) {
    obsSvc->RemoveObserver(mObserver, "clear-origin-attributes-data");
    mObserver->mOwner = nullptr;
  }
}

nsresult nsHttpAuthCache::GetAuthEntryForPath(const char *scheme,
                                              const char *host, int32_t port,
                                              const char *path,
                                              nsACString const &originSuffix,
                                              nsHttpAuthEntry **entry) {
  LOG(("nsHttpAuthCache::GetAuthEntryForPath [key=%s://%s:%d path=%s]\n",
       scheme, host, port, path));

  nsAutoCString key;
  nsHttpAuthNode *node = LookupAuthNode(scheme, host, port, originSuffix, key);
  if (!node) return NS_ERROR_NOT_AVAILABLE;

  *entry = node->LookupEntryByPath(path);
  return *entry ? NS_OK : NS_ERROR_NOT_AVAILABLE;
}

nsresult nsHttpAuthCache::GetAuthEntryForDomain(const char *scheme,
                                                const char *host, int32_t port,
                                                const char *realm,
                                                nsACString const &originSuffix,
                                                nsHttpAuthEntry **entry)

{
  LOG(("nsHttpAuthCache::GetAuthEntryForDomain [key=%s://%s:%d realm=%s]\n",
       scheme, host, port, realm));

  nsAutoCString key;
  nsHttpAuthNode *node = LookupAuthNode(scheme, host, port, originSuffix, key);
  if (!node) return NS_ERROR_NOT_AVAILABLE;

  *entry = node->LookupEntryByRealm(realm);
  return *entry ? NS_OK : NS_ERROR_NOT_AVAILABLE;
}

nsresult nsHttpAuthCache::SetAuthEntry(const char *scheme, const char *host,
                                       int32_t port, const char *path,
                                       const char *realm, const char *creds,
                                       const char *challenge,
                                       nsACString const &originSuffix,
                                       const nsHttpAuthIdentity *ident,
                                       nsISupports *metadata) {
  nsresult rv;

  LOG(
      ("nsHttpAuthCache::SetAuthEntry [key=%s://%s:%d realm=%s path=%s "
       "metadata=%p]\n",
       scheme, host, port, realm, path, metadata));

  nsAutoCString key;
  nsHttpAuthNode *node = LookupAuthNode(scheme, host, port, originSuffix, key);

  if (!node) {
    // create a new entry node and set the given entry
    node = new nsHttpAuthNode();
    rv = node->SetAuthEntry(path, realm, creds, challenge, ident, metadata);
    if (NS_FAILED(rv))
      delete node;
    else
      mDB.Put(key, node);
    return rv;
  }

  return node->SetAuthEntry(path, realm, creds, challenge, ident, metadata);
}

void nsHttpAuthCache::ClearAuthEntry(const char *scheme, const char *host,
                                     int32_t port, const char *realm,
                                     nsACString const &originSuffix) {
  nsAutoCString key;
  GetAuthKey(scheme, host, port, originSuffix, key);
  mDB.Remove(key);
}

nsresult nsHttpAuthCache::ClearAll() {
  LOG(("nsHttpAuthCache::ClearAll\n"));
  mDB.Clear();
  return NS_OK;
}

//-----------------------------------------------------------------------------
// nsHttpAuthCache <private>
//-----------------------------------------------------------------------------

nsHttpAuthNode *nsHttpAuthCache::LookupAuthNode(const char *scheme,
                                                const char *host, int32_t port,
                                                nsACString const &originSuffix,
                                                nsCString &key) {
  GetAuthKey(scheme, host, port, originSuffix, key);
  return mDB.Get(key);
}

NS_IMPL_ISUPPORTS(nsHttpAuthCache::OriginClearObserver, nsIObserver)

NS_IMETHODIMP
nsHttpAuthCache::OriginClearObserver::Observe(nsISupports *subject,
                                              const char *topic,
                                              const char16_t *data_unicode) {
  NS_ENSURE_TRUE(mOwner, NS_ERROR_NOT_AVAILABLE);

  OriginAttributesPattern pattern;
  if (!pattern.Init(nsDependentString(data_unicode))) {
    NS_ERROR("Cannot parse origin attributes pattern");
    return NS_ERROR_FAILURE;
  }

  mOwner->ClearOriginData(pattern);
  return NS_OK;
}

void nsHttpAuthCache::ClearOriginData(OriginAttributesPattern const &pattern) {
  for (auto iter = mDB.Iter(); !iter.Done(); iter.Next()) {
    const nsACString &key = iter.Key();

    // Extract the origin attributes suffix from the key.
    int32_t colon = key.FindChar(':');
    MOZ_ASSERT(colon != kNotFound);
    nsDependentCSubstring oaSuffix = StringHead(key, colon);

    // Build the OriginAttributes object of it...
    OriginAttributes oa;
    DebugOnly<bool> rv = oa.PopulateFromSuffix(oaSuffix);
    MOZ_ASSERT(rv);

    // ...and match it against the given pattern.
    if (pattern.Matches(oa)) {
      iter.Remove();
    }
  }
}

//-----------------------------------------------------------------------------
// nsHttpAuthIdentity
//-----------------------------------------------------------------------------

nsresult nsHttpAuthIdentity::Set(const char16_t *domain, const char16_t *user,
                                 const char16_t *pass) {
  char16_t *newUser, *newPass, *newDomain;

  int domainLen = domain ? NS_strlen(domain) : 0;
  int userLen = user ? NS_strlen(user) : 0;
  int passLen = pass ? NS_strlen(pass) : 0;

  int len = userLen + 1 + passLen + 1 + domainLen + 1;
  newUser = (char16_t *)malloc(len * sizeof(char16_t));
  if (!newUser) return NS_ERROR_OUT_OF_MEMORY;

  if (user) memcpy(newUser, user, userLen * sizeof(char16_t));
  newUser[userLen] = 0;

  newPass = &newUser[userLen + 1];
  if (pass) memcpy(newPass, pass, passLen * sizeof(char16_t));
  newPass[passLen] = 0;

  newDomain = &newPass[passLen + 1];
  if (domain) memcpy(newDomain, domain, domainLen * sizeof(char16_t));
  newDomain[domainLen] = 0;

  // wait until the end to clear member vars in case input params
  // reference our members!
  if (mUser) free(mUser);
  mUser = newUser;
  mPass = newPass;
  mDomain = newDomain;
  return NS_OK;
}

void nsHttpAuthIdentity::Clear() {
  if (mUser) {
    free(mUser);
    mUser = nullptr;
    mPass = nullptr;
    mDomain = nullptr;
  }
}

bool nsHttpAuthIdentity::Equals(const nsHttpAuthIdentity &ident) const {
  // we could probably optimize this with a single loop, but why bother?
  return StrEquivalent(mUser, ident.mUser) &&
         StrEquivalent(mPass, ident.mPass) &&
         StrEquivalent(mDomain, ident.mDomain);
}

//-----------------------------------------------------------------------------
// nsHttpAuthEntry
//-----------------------------------------------------------------------------

nsHttpAuthEntry::~nsHttpAuthEntry() {
  if (mRealm) free(mRealm);

  while (mRoot) {
    nsHttpAuthPath *ap = mRoot;
    mRoot = mRoot->mNext;
    free(ap);
  }
}

nsresult nsHttpAuthEntry::AddPath(const char *aPath) {
  // null path matches empty path
  if (!aPath) aPath = "";

  nsHttpAuthPath *tempPtr = mRoot;
  while (tempPtr) {
    const char *curpath = tempPtr->mPath;
    if (strncmp(aPath, curpath, strlen(curpath)) == 0)
      return NS_OK;  // subpath already exists in the list

    tempPtr = tempPtr->mNext;
  }

  // Append the aPath
  nsHttpAuthPath *newAuthPath;
  int newpathLen = strlen(aPath);
  newAuthPath = (nsHttpAuthPath *)malloc(sizeof(nsHttpAuthPath) + newpathLen);
  if (!newAuthPath) return NS_ERROR_OUT_OF_MEMORY;

  memcpy(newAuthPath->mPath, aPath, newpathLen + 1);
  newAuthPath->mNext = nullptr;

  if (!mRoot)
    mRoot = newAuthPath;  // first entry
  else
    mTail->mNext = newAuthPath;  // Append newAuthPath

  // update the tail pointer.
  mTail = newAuthPath;
  return NS_OK;
}

nsresult nsHttpAuthEntry::Set(const char *path, const char *realm,
                              const char *creds, const char *chall,
                              const nsHttpAuthIdentity *ident,
                              nsISupports *metadata) {
  char *newRealm, *newCreds, *newChall;

  int realmLen = realm ? strlen(realm) : 0;
  int credsLen = creds ? strlen(creds) : 0;
  int challLen = chall ? strlen(chall) : 0;

  int len = realmLen + 1 + credsLen + 1 + challLen + 1;
  newRealm = (char *)malloc(len);
  if (!newRealm) return NS_ERROR_OUT_OF_MEMORY;

  if (realm) memcpy(newRealm, realm, realmLen);
  newRealm[realmLen] = 0;

  newCreds = &newRealm[realmLen + 1];
  if (creds) memcpy(newCreds, creds, credsLen);
  newCreds[credsLen] = 0;

  newChall = &newCreds[credsLen + 1];
  if (chall) memcpy(newChall, chall, challLen);
  newChall[challLen] = 0;

  nsresult rv = NS_OK;
  if (ident) {
    rv = mIdent.Set(*ident);
  } else if (mIdent.IsEmpty()) {
    // If we are not given an identity and our cached identity has not been
    // initialized yet (so is currently empty), initialize it now by
    // filling it with nulls.  We need to do that because consumers expect
    // that mIdent is initialized after this function returns.
    rv = mIdent.Set(nullptr, nullptr, nullptr);
  }
  if (NS_FAILED(rv)) {
    free(newRealm);
    return rv;
  }

  rv = AddPath(path);
  if (NS_FAILED(rv)) {
    free(newRealm);
    return rv;
  }

  // wait until the end to clear member vars in case input params
  // reference our members!
  if (mRealm) free(mRealm);

  mRealm = newRealm;
  mCreds = newCreds;
  mChallenge = newChall;
  mMetaData = metadata;

  return NS_OK;
}

//-----------------------------------------------------------------------------
// nsHttpAuthNode
//-----------------------------------------------------------------------------

nsHttpAuthNode::nsHttpAuthNode() {
  LOG(("Creating nsHttpAuthNode @%p\n", this));
}

nsHttpAuthNode::~nsHttpAuthNode() {
  LOG(("Destroying nsHttpAuthNode @%p\n", this));

  mList.Clear();
}

nsHttpAuthEntry *nsHttpAuthNode::LookupEntryByPath(const char *path) {
  nsHttpAuthEntry *entry;

  // null path matches empty path
  if (!path) path = "";

  // look for an entry that either matches or contains this directory.
  // ie. we'll give out credentials if the given directory is a sub-
  // directory of an existing entry.
  for (uint32_t i = 0; i < mList.Length(); ++i) {
    entry = mList[i];
    nsHttpAuthPath *authPath = entry->RootPath();
    while (authPath) {
      const char *entryPath = authPath->mPath;
      // proxy auth entries have no path, so require exact match on
      // empty path string.
      if (entryPath[0] == '\0') {
        if (path[0] == '\0') return entry;
      } else if (strncmp(path, entryPath, strlen(entryPath)) == 0)
        return entry;

      authPath = authPath->mNext;
    }
  }
  return nullptr;
}

nsHttpAuthEntry *nsHttpAuthNode::LookupEntryByRealm(const char *realm) {
  nsHttpAuthEntry *entry;

  // null realm matches empty realm
  if (!realm) realm = "";

  // look for an entry that matches this realm
  uint32_t i;
  for (i = 0; i < mList.Length(); ++i) {
    entry = mList[i];
    if (strcmp(realm, entry->Realm()) == 0) return entry;
  }
  return nullptr;
}

nsresult nsHttpAuthNode::SetAuthEntry(const char *path, const char *realm,
                                      const char *creds, const char *challenge,
                                      const nsHttpAuthIdentity *ident,
                                      nsISupports *metadata) {
  // look for an entry with a matching realm
  nsHttpAuthEntry *entry = LookupEntryByRealm(realm);
  if (!entry) {
    entry = new nsHttpAuthEntry(path, realm, creds, challenge, ident, metadata);
    if (!entry) return NS_ERROR_OUT_OF_MEMORY;

    // We want the latest identity be at the begining of the list so that
    // the newest working credentials are sent first on new requests.
    // Changing a realm is sometimes used to "timeout" authrozization.
    mList.InsertElementAt(0, entry);
  } else {
    // update the entry...
    nsresult rv = entry->Set(path, realm, creds, challenge, ident, metadata);
    NS_ENSURE_SUCCESS(rv, rv);
  }

  return NS_OK;
}

void nsHttpAuthNode::ClearAuthEntry(const char *realm) {
  nsHttpAuthEntry *entry = LookupEntryByRealm(realm);
  if (entry) {
    mList.RemoveElement(entry);  // double search OK
  }
}

}  // namespace net
}  // namespace mozilla