mirror of
https://github.com/moodle/moodle.git
synced 2025-08-05 00:46:50 +02:00
mnet: core libraries and admin pages
This commit is contained in:
martinlanghoff
parent
10daca92c5
commit
71558f8502
26 changed files with 4213 additions and 0 deletions
118
mnet/environment.php
Normal file
118
mnet/environment.php
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
<?php
|
||||
/**
|
||||
* Info about the local environment, wrt RPC
|
||||
*
|
||||
* This should really be a singleton. A PHP5 Todo I guess.
|
||||
*/
|
||||
|
||||
class mnet_environment {
|
||||
|
||||
var $id = 0;
|
||||
var $wwwroot = '';
|
||||
var $ip_address = '';
|
||||
var $public_key = '';
|
||||
var $public_key_expires = 0;
|
||||
var $last_connect_time = 0;
|
||||
var $last_log_id = 0;
|
||||
var $keypair = array();
|
||||
|
||||
function mnet_environment() {
|
||||
return true;
|
||||
}
|
||||
|
||||
function init() {
|
||||
global $CFG;
|
||||
|
||||
// Bootstrap the object data on first load.
|
||||
if (empty($CFG->mnet_localhost_id) ) {
|
||||
$this->get_keypair();
|
||||
|
||||
$hostobject = new stdClass();
|
||||
$hostobject->wwwroot = $CFG->wwwroot;
|
||||
$hostobject->ip_address = $_SERVER['SERVER_ADDR'];
|
||||
$hostobject->public_key = $this->keypair['certificate'];
|
||||
$hostobject->public_key_expires = '';
|
||||
$hostobject->last_connect_time = '0';
|
||||
$hostobject->last_log_id = '0';
|
||||
$hostobject->deleted = 0;
|
||||
|
||||
$this->id = insert_record('mnet_host',$hostobject, true);
|
||||
|
||||
$temparr = (array)get_object_vars($hostobject);
|
||||
|
||||
foreach($temparr as $key => $value) {
|
||||
$this->$key = $value;
|
||||
}
|
||||
|
||||
unset($temparr, $hostobject);
|
||||
|
||||
set_config('mnet_localhost_id', $this->id);
|
||||
$CFG->mnet_localhost_id = $this->id;
|
||||
} else {
|
||||
$hostobject = get_record('mnet_host','id', $CFG->mnet_localhost_id);
|
||||
$temparr = (array)get_object_vars($hostobject);
|
||||
|
||||
foreach($temparr as $key => $value) {
|
||||
$this->$key = $value;
|
||||
}
|
||||
|
||||
unset($temparr, $hostobject);
|
||||
}
|
||||
|
||||
// We need to set up a record that represents 'all hosts'. Any rights
|
||||
// granted to this host will be conferred on all hosts.
|
||||
if (empty($CFG->mnet_all_hosts_id) ) {
|
||||
$hostobject = new stdClass();
|
||||
$hostobject->wwwroot = '';
|
||||
$hostobject->ip_address = '';
|
||||
$hostobject->public_key = '';
|
||||
$hostobject->public_key_expires = '';
|
||||
$hostobject->last_connect_time = '0';
|
||||
$hostobject->last_log_id = '0';
|
||||
$hostobject->deleted = 0;
|
||||
$hostobject->name = 'All Hosts';
|
||||
|
||||
$hostobject->id = insert_record('mnet_host',$hostobject, true);
|
||||
set_config('mnet_all_hosts_id', $hostobject->id);
|
||||
$CFG->mnet_all_hosts_id = $hostobject->id;
|
||||
unset($hostobject);
|
||||
}
|
||||
}
|
||||
|
||||
function get_keypair() {
|
||||
if (!empty($this->keypair)) return true;
|
||||
if ($result = get_record_select('config', " name = 'openssl'")) {
|
||||
$this->keypair = unserialize($result->value);
|
||||
$this->keypair['privatekey'] = openssl_pkey_get_private($this->keypair['keypair_PEM']);
|
||||
$this->keypair['publickey'] = openssl_pkey_get_public($this->keypair['certificate']);
|
||||
} else {
|
||||
$this->keypair = mnet_generate_keypair();
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
function get_private_key() {
|
||||
if (empty($this->keypair)) $this->get_keypair();
|
||||
if (isset($this->keypair['privatekey'])) return $this->keypair['privatekey'];
|
||||
$this->keypair['privatekey'] = openssl_pkey_get_private($this->keypair['keypair_PEM']);
|
||||
return $this->keypair['privatekey'];
|
||||
}
|
||||
|
||||
function get_public_key() {
|
||||
if (!isset($this->keypair)) $this->get_keypair();
|
||||
if (isset($this->keypair['publickey'])) return $this->keypair['publickey'];
|
||||
$this->keypair['publickey'] = openssl_pkey_get_public($this->keypair['certificate']);
|
||||
return $this->keypair['publickey'];
|
||||
}
|
||||
|
||||
/**
|
||||
* Note that the openssl_sign function computes the sha1 hash, and then
|
||||
* signs the hash.
|
||||
*/
|
||||
function sign_message($message) {
|
||||
$bool = openssl_sign($message, $signature, $this->get_private_key());
|
||||
return $signature;
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
491
mnet/lib.php
Normal file
491
mnet/lib.php
Normal file
|
|
@ -0,0 +1,491 @@
|
|||
<?php
|
||||
/**
|
||||
* Library functions for mnet
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
require_once $CFG->dirroot.'/mnet/xmlrpc/xmlparser.php';
|
||||
require_once $CFG->dirroot.'/mnet/peer.php';
|
||||
require_once $CFG->dirroot.'/mnet/environment.php';
|
||||
|
||||
/// CONSTANTS ///////////////////////////////////////////////////////////
|
||||
|
||||
define('RPC_OK', 0);
|
||||
define('RPC_NOSUCHFILE', 1);
|
||||
define('RPC_NOSUCHCLASS', 2);
|
||||
define('RPC_NOSUCHFUNCTION', 3);
|
||||
define('RPC_FORBIDDENFUNCTION', 4);
|
||||
define('RPC_NOSUCHMETHOD', 5);
|
||||
define('RPC_FORBIDDENMETHOD', 6);
|
||||
|
||||
$MNET = new mnet_environment();
|
||||
$MNET->init();
|
||||
|
||||
/**
|
||||
* Strip extraneous detail from a URL or URI and return the hostname
|
||||
*
|
||||
* @param string $uri The URI of a file on the remote computer, optionally
|
||||
* including its http:// prefix like
|
||||
* http://www.example.com/index.html
|
||||
* @return string Just the hostname
|
||||
*/
|
||||
function mnet_get_hostname_from_uri($uri = null) {
|
||||
$count = preg_match("@^(?:http[s]?://)?([A-Z0-9\-\.]+).*@i", $uri, $matches);
|
||||
if ($count > 0) return $matches[1];
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the remote machine's SSL Cert
|
||||
*
|
||||
* @param string $uri The URI of a file on the remote computer, including
|
||||
* its http:// or https:// prefix
|
||||
* @param bool $verify True if the SSL Cert must be signed by a trusted 3rd
|
||||
* party. [TODO! NOT IMPLEMENTED]
|
||||
* @return string A PEM formatted SSL Certificate.
|
||||
*/
|
||||
function mnet_get_public_key($uri, $verify=false) {
|
||||
global $CFG;
|
||||
// The key may be cached in the mnet_set_public_key function...
|
||||
// check this first
|
||||
$key = mnet_set_public_key($uri);
|
||||
if ($key != false) {
|
||||
return $key;
|
||||
}
|
||||
|
||||
$rq = xmlrpc_encode_request('system/keyswap', $CFG->wwwroot);
|
||||
$ch = curl_init($uri.'/mnet/xmlrpc/server.php');
|
||||
|
||||
curl_setopt($ch, CURLOPT_TIMEOUT, 60);
|
||||
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
||||
curl_setopt($ch, CURLOPT_POST, true);
|
||||
curl_setopt($ch, CURLOPT_USERAGENT, 'Moodle');
|
||||
curl_setopt($ch, CURLOPT_POSTFIELDS, $rq);
|
||||
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: text/xml charset=UTF-8"));
|
||||
|
||||
$res = xmlrpc_decode(curl_exec($ch));
|
||||
curl_close($ch);
|
||||
|
||||
if (!is_array($res)) { // ! error
|
||||
$public_certificate = $res;
|
||||
$credentials=array();
|
||||
if (strlen(trim($public_certificate))) {
|
||||
$credentials = openssl_x509_parse($public_certificate);
|
||||
$host = $credentials['subject']['CN'];
|
||||
if (strpos($uri, $host) !== false) {
|
||||
mnet_set_public_key($uri, $public_certificate);
|
||||
return $public_certificate;
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Store a URI's public key in a static variable, or retrieve the key for a URI
|
||||
*
|
||||
* @param string $uri The URI of a file on the remote computer, including its
|
||||
* https:// prefix
|
||||
* @param mixed $key A public key to store in the array OR null. If the key
|
||||
* is null, the function will return the previously stored
|
||||
* key for the supplied URI, should it exist.
|
||||
* @return mixed A public key OR true/false.
|
||||
*/
|
||||
function mnet_set_public_key($uri, $key = null) {
|
||||
static $keyarray = array();
|
||||
if (isset($keyarray[$uri]) && empty($key)) {
|
||||
return $keyarray[$uri];
|
||||
} elseif (!empty($key)) {
|
||||
$keyarray[$uri] = $key;
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sign a message and return it in an XML-Signature document
|
||||
*
|
||||
* This function can sign any content, but it was written to provide a system of
|
||||
* signing XML-RPC request and response messages. The message will be base64
|
||||
* encoded, so it does not need to be text.
|
||||
*
|
||||
* We compute the SHA1 digest of the message.
|
||||
* We compute a signature on that digest with our private key.
|
||||
* We link to the public key that can be used to verify our signature.
|
||||
* We base64 the message data.
|
||||
* We identify our wwwroot - this must match our certificate's CN
|
||||
*
|
||||
* The XML-RPC document will be parceled inside an XML-SIG document, which holds
|
||||
* the base64_encoded XML as an object, the SHA1 digest of that document, and a
|
||||
* signature of that document using the local private key. This signature will
|
||||
* uniquely identify the RPC document as having come from this server.
|
||||
*
|
||||
* See the {@Link http://www.w3.org/TR/xmldsig-core/ XML-DSig spec} at the W3c
|
||||
* site
|
||||
*
|
||||
* @param string $message The data you want to sign
|
||||
* @return string An XML-DSig document
|
||||
*/
|
||||
function mnet_sign_message($message) {
|
||||
global $CFG, $MNET;
|
||||
$digest = sha1($message);
|
||||
$sig = $MNET->sign_message($message);
|
||||
|
||||
$message = '<?xml version="1.0" encoding="iso-8859-1"?>
|
||||
<signedMessage>
|
||||
<Signature Id="MoodleSignature" xmlns="http://www.w3.org/2000/09/xmldsig#">
|
||||
<SignedInfo>
|
||||
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
|
||||
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
|
||||
<Reference URI="#XMLRPC-MSG">
|
||||
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
|
||||
<DigestValue>'.$digest.'</DigestValue>
|
||||
</Reference>
|
||||
</SignedInfo>
|
||||
<SignatureValue>'.base64_encode($sig).'</SignatureValue>
|
||||
<KeyInfo>
|
||||
<RetrievalMethod URI="'.$CFG->wwwroot.'/mnet/publickey.php"/>
|
||||
</KeyInfo>
|
||||
</Signature>
|
||||
<object ID="XMLRPC-MSG">'.base64_encode($message).'</object>
|
||||
<wwwroot>'.$MNET->wwwroot.'</wwwroot>
|
||||
</signedMessage>';
|
||||
return $message;
|
||||
}
|
||||
|
||||
/**
|
||||
* Encrypt a message and return it in an XML-Encrypted document
|
||||
*
|
||||
* This function can encrypt any content, but it was written to provide a system
|
||||
* of encrypting XML-RPC request and response messages. The message will be
|
||||
* base64 encoded, so it does not need to be text - binary data should work.
|
||||
*
|
||||
* We compute the SHA1 digest of the message.
|
||||
* We compute a signature on that digest with our private key.
|
||||
* We link to the public key that can be used to verify our signature.
|
||||
* We base64 the message data.
|
||||
* We identify our wwwroot - this must match our certificate's CN
|
||||
*
|
||||
* The XML-RPC document will be parceled inside an XML-SIG document, which holds
|
||||
* the base64_encoded XML as an object, the SHA1 digest of that document, and a
|
||||
* signature of that document using the local private key. This signature will
|
||||
* uniquely identify the RPC document as having come from this server.
|
||||
*
|
||||
* See the {@Link http://www.w3.org/TR/xmlenc-core/ XML-ENC spec} at the W3c
|
||||
* site
|
||||
*
|
||||
* @param string $message The data you want to sign
|
||||
* @param string $remote_certificate Peer's certificate in PEM format
|
||||
* @return string An XML-ENC document
|
||||
*/
|
||||
function mnet_encrypt_message($message, $remote_certificate) {
|
||||
global $MNET;
|
||||
|
||||
// Generate a key resource from the remote_certificate text string
|
||||
$publickey = openssl_get_publickey($remote_certificate);
|
||||
|
||||
if ( gettype($publickey) != 'resource' ) {
|
||||
// Remote certificate is faulty.
|
||||
return false;
|
||||
}
|
||||
|
||||
// Initialize vars
|
||||
$encryptedstring = '';
|
||||
$symmetric_keys = array();
|
||||
|
||||
// passed by ref -> &$encryptedstring &$symmetric_keys
|
||||
$bool = openssl_seal($message, $encryptedstring, $symmetric_keys, array($publickey));
|
||||
$message = $encryptedstring;
|
||||
$symmetrickey = array_pop($symmetric_keys);
|
||||
|
||||
$message = '<?xml version="1.0" encoding="iso-8859-1"?>
|
||||
<encryptedMessage>
|
||||
<EncryptedData Id="ED" xmlns="http://www.w3.org/2001/04/xmlenc#">
|
||||
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#arcfour"/>
|
||||
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
|
||||
<ds:RetrievalMethod URI="#EK" Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"/>
|
||||
<ds:KeyName>XMLENC</ds:KeyName>
|
||||
</ds:KeyInfo>
|
||||
<CipherData>
|
||||
<CipherValue>'.base64_encode($message).'</CipherValue>
|
||||
</CipherData>
|
||||
</EncryptedData>
|
||||
<EncryptedKey Id="EK" xmlns="http://www.w3.org/2001/04/xmlenc#">
|
||||
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
|
||||
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
|
||||
<ds:KeyName>SSLKEY</ds:KeyName>
|
||||
</ds:KeyInfo>
|
||||
<CipherData>
|
||||
<CipherValue>'.base64_encode($symmetrickey).'</CipherValue>
|
||||
</CipherData>
|
||||
<ReferenceList>
|
||||
<DataReference URI="#ED"/>
|
||||
</ReferenceList>
|
||||
<CarriedKeyName>XMLENC</CarriedKeyName>
|
||||
</EncryptedKey>
|
||||
<wwwroot>'.$MNET->wwwroot.'</wwwroot>
|
||||
</encryptedMessage>';
|
||||
return $message;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get your SSL keys from the database, or create them (if they don't exist yet)
|
||||
*
|
||||
* Get your SSL keys from the database, or (if they don't exist yet) call
|
||||
* mnet_generate_keypair to create them
|
||||
*
|
||||
* @param string $string The text you want to sign
|
||||
* @return string The signature over that text
|
||||
*/
|
||||
function mnet_get_keypair() {
|
||||
global $CFG;
|
||||
static $keypair = null;
|
||||
if (!is_null($keypair)) return $keypair;
|
||||
if ($result = get_record_select('config', " name = 'openssl'")) {
|
||||
$keypair = unserialize($result->value);
|
||||
$keypair['privatekey'] = openssl_pkey_get_private($keypair['keypair_PEM']);
|
||||
$keypair['publickey'] = openssl_pkey_get_public($keypair['certificate']);
|
||||
return $keypair;
|
||||
} else {
|
||||
$keypair = mnet_generate_keypair();
|
||||
return $keypair;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate public/private keys and store in the config table
|
||||
*
|
||||
* Use the distinguished name provided to create a CSR, and then sign that CSR
|
||||
* with the same credentials. Store the keypair you create in the config table.
|
||||
* If a distinguished name is not provided, create one using the fullname of
|
||||
* 'the course with ID 1' as your organization name, and your hostname (as
|
||||
* detailed in $CFG->wwwroot).
|
||||
*
|
||||
* @param array $dn The distinguished name of the server
|
||||
* @return string The signature over that text
|
||||
*/
|
||||
function mnet_generate_keypair($dn = null) {
|
||||
global $CFG;
|
||||
$host = strtolower($CFG->wwwroot);
|
||||
$host = ereg_replace("^http(s)?://",'',$host);
|
||||
$break = strpos($host.'/' , '/');
|
||||
$host = substr($host, 0, $break);
|
||||
|
||||
if ($result = get_record_select('course'," id ='1' ")) {
|
||||
$organization = $result->fullname;
|
||||
} else {
|
||||
$organization = 'None';
|
||||
}
|
||||
|
||||
$keypair = array();
|
||||
// TODO: fix this with a redirect, form, etc.
|
||||
|
||||
if (is_null($dn)) {
|
||||
$dn = array(
|
||||
"countryName" => 'NZ',
|
||||
"stateOrProvinceName" => 'Wellington',
|
||||
"localityName" => 'Wellington',
|
||||
"organizationName" => $organization,
|
||||
"organizationalUnitName" => 'Moodle',
|
||||
"commonName" => $CFG->wwwroot,
|
||||
"emailAddress" => $CFG->noreplyaddress
|
||||
);
|
||||
}
|
||||
|
||||
$new_key = openssl_pkey_new();
|
||||
$csr_rsc = openssl_csr_new($dn, $new_key, array('private_key_bits',2048));
|
||||
$selfSignedCert = openssl_csr_sign($csr_rsc, null, $new_key, 365);
|
||||
|
||||
// You'll want to keep your certificate signing request, so we'll
|
||||
// export that to a property - csr_txt.
|
||||
openssl_csr_export($csr_rsc, $csr_txt);
|
||||
unset($csr_rsc); // Free up the resource
|
||||
|
||||
// We export our self-signed certificate to a string as well.
|
||||
openssl_x509_export($selfSignedCert, $keypair['certificate']);
|
||||
openssl_x509_free($selfSignedCert);
|
||||
|
||||
// Export your public/private key pair as a PEM encoded string. You
|
||||
// can protect it with an optional passphrase if you wish.
|
||||
$export = openssl_pkey_export($new_key, $keypair['keypair_PEM'] /* , $passphrase */);
|
||||
openssl_pkey_free($new_key);
|
||||
unset($new_key); // Free up the resource
|
||||
|
||||
$record = new stdClass();
|
||||
$record->name = 'openssl';
|
||||
// Normally we would just serialize the object, but that's not
|
||||
// working, nor behaving as the docs suggest it should. Casting the
|
||||
// object to an array and serializing the array works fine.
|
||||
$record->value = serialize($keypair);
|
||||
|
||||
insert_record('config', $record);
|
||||
// unset $record
|
||||
|
||||
$keypair['privatekey'] = openssl_pkey_get_private($keypair['keypair_PEM']);
|
||||
$keypair['publickey'] = openssl_pkey_get_public($keypair['certificate']);
|
||||
|
||||
return $keypair;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check that an IP address falls within the given network/mask
|
||||
* ok for export
|
||||
*
|
||||
* @param string $address Dotted quad
|
||||
* @param string $network Dotted quad
|
||||
* @param string $mask A number, e.g. 16, 24, 32
|
||||
* @return bool
|
||||
*/
|
||||
function ip_in_range($address, $network, $mask) {
|
||||
$lnetwork = ip2long($network);
|
||||
$laddress = ip2long($address);
|
||||
|
||||
$binnet = str_pad( decbin($lnetwork),32,"0","STR_PAD_LEFT" );
|
||||
$firstpart = substr($binnet,0,$mask);
|
||||
|
||||
$binip = str_pad( decbin($laddress),32,"0","STR_PAD_LEFT" );
|
||||
$firstip = substr($binip,0,$mask);
|
||||
return(strcmp($firstpart,$firstip)==0);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check that a given function (or method) in an include file has been designated
|
||||
* ok for export
|
||||
*
|
||||
* @param string $includefile The path to the include file
|
||||
* @param string $functionname The name of the function (or method) to
|
||||
* execute
|
||||
* @param mixed $class A class name, or false if we're just testing
|
||||
* a function
|
||||
* @return int Zero (RPC_OK) if all ok - appropriate
|
||||
* constant otherwise
|
||||
*/
|
||||
function mnet_permit_rpc_call($includefile, $functionname, $class=false) {
|
||||
global $CFG, $MNET_REMOTE_CLIENT;
|
||||
|
||||
if (file_exists($CFG->dirroot . $includefile)) {
|
||||
include_once $CFG->dirroot . $includefile;
|
||||
// $callprefix matches the rpc convention
|
||||
// of not having a leading slash
|
||||
$callprefix = preg_replace('!^/!', '', $includefile);
|
||||
} else {
|
||||
return RPC_NOSUCHFILE;
|
||||
}
|
||||
|
||||
if ($functionname != clean_param($functionname, PARAM_PATH)) {
|
||||
// Under attack?
|
||||
// Todo: Should really return a much more BROKEN! response
|
||||
return RPC_FORBIDDENMETHOD;
|
||||
}
|
||||
|
||||
$id_list = $MNET_REMOTE_CLIENT->id;
|
||||
if (!empty($CFG->mnet_all_hosts_id)) {
|
||||
$id_list .= ', '.$CFG->mnet_all_hosts_id;
|
||||
}
|
||||
|
||||
// TODO: change to left-join so we can disambiguate:
|
||||
// 1. method doesn't exist
|
||||
// 2. method exists but is prohibited
|
||||
$sql = "
|
||||
SELECT
|
||||
count(r.id)
|
||||
FROM
|
||||
{$CFG->prefix}mnet_host2service h2s,
|
||||
{$CFG->prefix}mnet_service2rpc s2r,
|
||||
{$CFG->prefix}mnet_rpc r
|
||||
WHERE
|
||||
h2s.serviceid = s2r.serviceid AND
|
||||
s2r.rpcid = r.id AND
|
||||
r.xmlrpc_path = '$callprefix/$functionname' AND
|
||||
h2s.hostid in ($id_list) AND
|
||||
h2s.publish = '1'";
|
||||
|
||||
$permissionobj = record_exists_sql($sql);
|
||||
|
||||
if ($permissionobj === false) {
|
||||
return RPC_FORBIDDENMETHOD;
|
||||
}
|
||||
|
||||
// WE'RE LOOKING AT A CLASS/METHOD
|
||||
if (false != $class) {
|
||||
if (!class_exists($class)) {
|
||||
// Generate error response - unable to locate class
|
||||
return RPC_NOSUCHCLASS;
|
||||
}
|
||||
|
||||
$object = new $class();
|
||||
|
||||
if (!method_exists($object, $functionname)) {
|
||||
// Generate error response - unable to locate method
|
||||
return RPC_NOSUCHMETHOD;
|
||||
}
|
||||
|
||||
if (!method_exists($object, 'mnet_publishes')) {
|
||||
// Generate error response - the class doesn't publish
|
||||
// *any* methods, because it doesn't have an mnet_publishes
|
||||
// method
|
||||
return RPC_FORBIDDENMETHOD;
|
||||
}
|
||||
|
||||
// Get the list of published services - initialise method array
|
||||
$servicelist = $object->mnet_publishes();
|
||||
$methodapproved = false;
|
||||
|
||||
// If the method is in the list of approved methods, set the
|
||||
// methodapproved flag to true and break
|
||||
foreach($servicelist as $service) {
|
||||
if (in_array($functionname, $service['methods'])) {
|
||||
$methodapproved = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$methodapproved) {
|
||||
return RPC_FORBIDDENMETHOD;
|
||||
}
|
||||
|
||||
// Stash the object so we can call the method on it later
|
||||
$MNET_REMOTE_CLIENT->object_to_call($object);
|
||||
// WE'RE LOOKING AT A FUNCTION
|
||||
} else {
|
||||
if (!function_exists($functionname)) {
|
||||
// Generate error response - unable to locate function
|
||||
return RPC_NOSUCHFUNCTION;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return RPC_OK;
|
||||
}
|
||||
|
||||
function mnet_update_sso_access_control($username, $mnet_host_id, $access) {
|
||||
$mnethost = get_record('mnet_host', 'id', $mnet_host_id);
|
||||
if ($aclrecord = get_record('mnet_sso_access_control', 'username', $username, 'mnet_host_id', $mnet_host_id)) {
|
||||
// update
|
||||
$aclrecord->access = $access;
|
||||
if (update_record('mnet_sso_access_control', $aclrecord)) {
|
||||
add_to_log(SITEID, 'admin/mnet', 'update', 'admin/mnet/access_control.php',
|
||||
"SSO ACL: $access user '$username' from {$mnethost->name}");
|
||||
} else {
|
||||
error("Failed to write to the MNET access control list for user '$username'.");
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// insert
|
||||
$aclrecord->username = $username;
|
||||
$aclrecord->access = $access;
|
||||
$aclrecord->mnet_host_id = $mnet_host_id;
|
||||
if ($id = insert_record('mnet_sso_access_control', $aclrecord)) {
|
||||
add_to_log(SITEID, 'admin/mnet', 'add', 'admin/mnet/access_control.php',
|
||||
"SSO ACL: $access user '$username' from {$mnethost->name}");
|
||||
} else {
|
||||
error("Failed to write to the MNET access control list for user '$username'.");
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
?>
|
||||
228
mnet/peer.php
Normal file
228
mnet/peer.php
Normal file
|
|
@ -0,0 +1,228 @@
|
|||
<?php
|
||||
/**
|
||||
* An object to represent lots of information about an RPC-peer machine
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
|
||||
class mnet_peer {
|
||||
|
||||
var $id = 0;
|
||||
var $wwwroot = '';
|
||||
var $ip_address = '';
|
||||
var $name = '';
|
||||
var $public_key = '';
|
||||
var $public_key_expires = 0;
|
||||
var $last_connect_time = 0;
|
||||
var $last_log_id = 0;
|
||||
var $keypair = array();
|
||||
var $error = array();
|
||||
|
||||
function mnet_peer() {
|
||||
return true;
|
||||
}
|
||||
|
||||
function bootstrap($wwwroot) {
|
||||
|
||||
if ( ! $this->set_wwwroot($wwwroot) ) {
|
||||
$hostname = mnet_get_hostname_from_uri($wwwroot);
|
||||
|
||||
// Get the IP address for that host - if this fails, it will
|
||||
// return the hostname string
|
||||
$ip_address = gethostbyname($hostname);
|
||||
|
||||
// Couldn't find the IP address?
|
||||
if ($ip_address === $hostname && !preg_match('/^\d+\.\d+\.\d+.\d+$/',$hostname)) {
|
||||
$this->error[] = array('code' => 2, 'text' => get_string("noaddressforhost", 'mnet'));
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->name = $wwwroot;
|
||||
|
||||
// TODO: In reality, this will be prohibitively slow... need another
|
||||
// default - maybe blank string
|
||||
$homepage = file_get_contents($wwwroot);
|
||||
if (!empty($homepage)) {
|
||||
$count = preg_match("@<title>(.*)</title>@siU", $homepage, $matches);
|
||||
if ($count > 0) {
|
||||
$this->name = $matches[1];
|
||||
}
|
||||
}
|
||||
|
||||
if (substr($wwwroot, 0, -1) == '/') {
|
||||
$wwwroot = substr($wwwroot, 0, -1);
|
||||
}
|
||||
|
||||
$this->wwwroot = $wwwroot;
|
||||
$this->ip_address = $ip_address;
|
||||
$this->deleted = 0;
|
||||
$this->public_key = clean_param(mnet_get_public_key($this->wwwroot), PARAM_PEM);
|
||||
$this->public_key_expires = $this->check_common_name($this->public_key);
|
||||
$this->last_connect_time = 0;
|
||||
$this->last_log_id = 0;
|
||||
if ($this->public_key_expires == false) {
|
||||
$this->public_key == '';
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
function delete() {
|
||||
if ($this->deleted) return true;
|
||||
|
||||
$users = count_records('user','mnethostid', $this->id);
|
||||
if ($users > 0) {
|
||||
$this->deleted = 1;
|
||||
}
|
||||
|
||||
$actions = count_records('mnet_log','hostid', $this->id);
|
||||
if ($actions > 0) {
|
||||
$this->deleted = 1;
|
||||
}
|
||||
|
||||
$obj = delete_records('mnet_rpc2host', 'host_id', $this->id);
|
||||
|
||||
$this->delete_all_sessions();
|
||||
|
||||
// If we don't have any activity records for which the mnet_host table
|
||||
// provides a foreign key, then we can delete the record. Otherwise, we
|
||||
// just mark it as deleted.
|
||||
if (0 == $this->deleted) {
|
||||
delete_records('mnet_host', "id", $this->id);
|
||||
} else {
|
||||
$this->commit();
|
||||
}
|
||||
}
|
||||
|
||||
function count_live_sessions() {
|
||||
$obj = $this->delete_expired_sessions();
|
||||
return count_records('mnet_session','mnethostid', $this->id);
|
||||
}
|
||||
|
||||
function delete_expired_sessions() {
|
||||
$now = time();
|
||||
return delete_records_select('mnet_session', " mnethostid = '{$this->id}' AND expires < '$now' ");
|
||||
}
|
||||
|
||||
function delete_all_sessions() {
|
||||
global $CFG;
|
||||
// TODO: Expires each PHP session individually
|
||||
// $sessions = get_records('mnet_session', 'mnethostid', $this->id);
|
||||
$sessions = get_records('mnet_session', 'mnethostid', $this->id);
|
||||
|
||||
if (count($sessions) > 0 && file_exists($CFG->dirroot.'/auth/mnet/auth.php')) {
|
||||
require_once($CFG->dirroot.'/auth/mnet/auth.php');
|
||||
$auth = new auth_plugin_mnet();
|
||||
$auth->end_local_sessions($sessions);
|
||||
}
|
||||
|
||||
$deletereturn = delete_records_select('mnet_session', " mnethostid = '{$this->id}'");
|
||||
return true;
|
||||
}
|
||||
|
||||
function check_common_name($key) {
|
||||
$credentials = openssl_x509_parse($key);
|
||||
if ($credentials == false) {
|
||||
$this->error[] = array('code' => 3, 'text' => get_string("nonmatchingcert", 'mnet', array('','')));
|
||||
return false;
|
||||
} elseif ($credentials['subject']['CN'] != $this->wwwroot) {
|
||||
$a[] = $credentials['subject']['CN'];
|
||||
$a[] = $this->wwwroot;
|
||||
$this->error[] = array('code' => 4, 'text' => get_string("nonmatchingcert", 'mnet', $a));
|
||||
return false;
|
||||
} else {
|
||||
return $credentials['validTo_time_t'];
|
||||
}
|
||||
}
|
||||
|
||||
function commit() {
|
||||
$obj = new stdClass();
|
||||
|
||||
$obj->wwwroot = $this->wwwroot;
|
||||
$obj->ip_address = $this->ip_address;
|
||||
$obj->name = $this->name;
|
||||
$obj->public_key = $this->public_key;
|
||||
$obj->public_key_expires = $this->public_key_expires;
|
||||
$obj->deleted = $this->deleted;
|
||||
$obj->last_connect_time = $this->last_connect_time;
|
||||
$obj->last_log_id = $this->last_log_id;
|
||||
|
||||
if (isset($this->id) && $this->id > 0) {
|
||||
$obj->id = $this->id;
|
||||
return update_record('mnet_host', $obj);
|
||||
} else {
|
||||
$this->id = insert_record('mnet_host', $obj);
|
||||
return $this->id > 0;
|
||||
}
|
||||
}
|
||||
|
||||
function set_name($newname) {
|
||||
if (is_string($newname) && strlen($newname <= 80)) {
|
||||
$this->name = $newname;
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
function set_wwwroot($wwwroot) {
|
||||
global $CFG;
|
||||
|
||||
$hostinfo = get_record('mnet_host', 'wwwroot', $wwwroot);
|
||||
|
||||
if ($hostinfo != false) {
|
||||
$this->populate($hostinfo);
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
function set_id($id) {
|
||||
global $CFG;
|
||||
|
||||
if (clean_param($id, PARAM_INT) != $id) {
|
||||
$this->errno[] = 1;
|
||||
$this->errmsg[] = 'Your id ('.$id.') is not legal';
|
||||
return false;
|
||||
}
|
||||
|
||||
$sql = "
|
||||
SELECT
|
||||
h.*
|
||||
FROM
|
||||
{$CFG->prefix}mnet_host h
|
||||
WHERE
|
||||
h.id = '". $id ."'";
|
||||
|
||||
if ($hostinfo = get_record_sql($sql)) {
|
||||
$this->populate($hostinfo);
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
// PRIVATE METHOD
|
||||
function populate($hostinfo) {
|
||||
$this->id = $hostinfo->id;
|
||||
$this->wwwroot = $hostinfo->wwwroot;
|
||||
$this->ip_address = $hostinfo->ip_address;
|
||||
$this->name = $hostinfo->name;
|
||||
$this->deleted = $hostinfo->deleted;
|
||||
$this->public_key = $hostinfo->public_key;
|
||||
$this->public_key_expires = $hostinfo->public_key_expires;
|
||||
$this->last_connect_time = $hostinfo->last_connect_time;
|
||||
$this->last_log_id = $hostinfo->last_log_id;
|
||||
}
|
||||
|
||||
function get_public_key() {
|
||||
if (isset($this->public_key_ref)) return $this->public_key_ref;
|
||||
$this->public_key_ref = openssl_pkey_get_public($this->public_key);
|
||||
return $this->public_key_ref;
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
16
mnet/publickey.php
Normal file
16
mnet/publickey.php
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
<?php
|
||||
/**
|
||||
* Print this server's public key and exit
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
|
||||
require_once(dirname(dirname(__FILE__)) . '/config.php');
|
||||
require_once $CFG->dirroot.'/mnet/lib.php';
|
||||
header("Content-type: text/plain");
|
||||
$keypair = mnet_get_keypair();
|
||||
echo $keypair['certificate'];
|
||||
?>
|
||||
50
mnet/remote_client.php
Normal file
50
mnet/remote_client.php
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
<?php
|
||||
/**
|
||||
* An object to represent lots of information about an RPC-peer machine
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
|
||||
class mnet_remote_client extends mnet_peer {
|
||||
|
||||
// If the remote client is trying to execute a method on an object instead
|
||||
// of just a function, we'll instantiate the proper class and store it in
|
||||
// this 'object_to_call' property.
|
||||
var $object_to_call = false;
|
||||
var $request_was_encrypted = false;
|
||||
var $request_was_signed = false;
|
||||
|
||||
function was_encrypted() {
|
||||
$this->request_was_encrypted = true;
|
||||
}
|
||||
|
||||
function was_signed() {
|
||||
$this->request_was_signed = true;
|
||||
}
|
||||
|
||||
function object_to_call($object) {
|
||||
$this->object_to_call = $object;
|
||||
}
|
||||
|
||||
function plaintext_is_ok() {
|
||||
global $CFG;
|
||||
|
||||
$trusted_hosts = explode(',', get_config('mnet', 'mnet_trusted_hosts'));
|
||||
|
||||
foreach($trusted_hosts as $host) {
|
||||
list($network, $mask) = explode('/', $host.'/');
|
||||
if (empty($network)) continue;
|
||||
if (strlen($mask) == 0) $mask = 32;
|
||||
|
||||
if (ip_in_range($_SERVER['REMOTE_ADDR'], $network, $mask)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
?>
|
||||
80
mnet/rpclib.php
Normal file
80
mnet/rpclib.php
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
<?php
|
||||
/**
|
||||
* Some dummy functions to test XML-RPC with
|
||||
*/
|
||||
|
||||
/**
|
||||
* The xxxx_RPC_OK must exist and return TRUE for the remote call to be
|
||||
* permitted
|
||||
*
|
||||
* @return bool True if the related function can be executed remotely
|
||||
*/
|
||||
function mnet_concatenate_strings_RPC_OK() {
|
||||
return true;
|
||||
}
|
||||
|
||||
function mnet_publishes() {
|
||||
$servicelist = array();
|
||||
$service['name'] = 'sso';
|
||||
$function['name'] = 'mnet_concatenate_strings';
|
||||
|
||||
// first argument
|
||||
$argument['type'] = 'string';
|
||||
$argument['default'] = '';
|
||||
$function['arguments'][] = $argument;
|
||||
|
||||
// second argument
|
||||
$argument['type'] = 'string';
|
||||
$argument['default'] = '';
|
||||
$function['arguments'][] = $argument;
|
||||
|
||||
// third argument
|
||||
$argument['type'] = 'string';
|
||||
$argument['default'] = '';
|
||||
$function['arguments'][] = $argument;
|
||||
|
||||
$function['description'] = get_string($function['name'], 'mnet');
|
||||
$service['functions'][] = $function;
|
||||
$servicelist[] = $service;
|
||||
|
||||
return $servicelist;
|
||||
}
|
||||
//header('Content-type: text/plain');
|
||||
//var_dump(mnet_publishes());
|
||||
|
||||
/**
|
||||
* Concatenate (up to) 3 strings and return the result
|
||||
* @service sso
|
||||
* @param string $string1 Some string
|
||||
* @param string $string2 Some string
|
||||
* @param string $string3 Some string
|
||||
* @return string The parameter strings, concatenated together
|
||||
*/
|
||||
function mnet_concatenate_strings($string1='', $string2='', $string3='') {
|
||||
return $string1.$string2.$string3;
|
||||
}
|
||||
|
||||
class testClass {
|
||||
function testClass() {
|
||||
$this->first = 'last';
|
||||
$this->last = 'first';
|
||||
}
|
||||
|
||||
function augment_first($newval) {
|
||||
$this->first = $this->first.$newval;
|
||||
return $this->first;
|
||||
}
|
||||
|
||||
function augment_first_RPC_OK() {
|
||||
return true;
|
||||
}
|
||||
|
||||
function mnet_concatenate_strings_RPC_OK() {
|
||||
return true;
|
||||
}
|
||||
function mnet_concatenate_strings($string1='', $string2='', $string3='') {
|
||||
return $string1.$string2.$string3;
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
146
mnet/testclient.php
Normal file
146
mnet/testclient.php
Normal file
|
|
@ -0,0 +1,146 @@
|
|||
<?php
|
||||
/**
|
||||
* A template to test Moodle's XML-RPC feature
|
||||
*
|
||||
* This script 'remotely' executes the mnet_concatenate_strings function in
|
||||
* mnet/testlib.php
|
||||
* It steps through each stage of the process, printing some data as it goes
|
||||
* along. It should help you to get your remote method working.
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
require_once(dirname(dirname(__FILE__)) . '/config.php');
|
||||
require_once $CFG->dirroot.'/mnet/xmlrpc/client.php';
|
||||
|
||||
error_reporting(E_ALL);
|
||||
|
||||
if (isset($_GET['func']) && is_numeric($_GET['func'])) {
|
||||
$func = $_GET['func'];
|
||||
|
||||
|
||||
// Some HTML sugar
|
||||
echo '<?xml version="1.0" encoding="utf-8"?>';
|
||||
?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
|
||||
<head><title>Moodle MNET Test Client</title></head><body>
|
||||
<?php
|
||||
|
||||
// For the demo, our 'remote' host is actually our local host.
|
||||
$wwwroot = $CFG->wwwroot;
|
||||
|
||||
// Enter the complete path to the file that contains the function you want to
|
||||
// call on the remote server. In our example the function is in
|
||||
// mnet/testlib/
|
||||
// The function itself is added to that path to complete the $path_to_function
|
||||
// variable
|
||||
$path_to_function[0] = 'mnet/rpclib/mnet_concatenate_strings';
|
||||
$path_to_function[1] = 'mod/scorm/rpclib/scorm_add_floats';
|
||||
$path_to_function[2] = 'system/listMethods';
|
||||
$path_to_function[3] = 'system/methodSignature';
|
||||
$path_to_function[4] = 'system/methodHelp';
|
||||
$path_to_function[5] = 'system/listServices';
|
||||
$path_to_function[6] = 'system/listMethods';
|
||||
$path_to_function[7] = 'system/listMethods';
|
||||
|
||||
$paramArray[0] = array(array('some string, ', 'string'),
|
||||
array('some other string, ', 'string'),
|
||||
array('and a final string', 'string'));
|
||||
|
||||
$paramArray[1] = array(array(5.3, 'string'),
|
||||
array(7.1, 'string'),
|
||||
array(8.25323, 'string'));
|
||||
|
||||
$paramArray[2] = array();
|
||||
|
||||
$paramArray[3] = array(array('auth/mnet/auth/user_authorise', 'string'));
|
||||
|
||||
$paramArray[4] = array(array('auth/mnet/auth/user_authorise', 'string'));
|
||||
|
||||
$paramArray[5] = array();
|
||||
|
||||
$paramArray[6] = array(array('sso', 'string'));
|
||||
|
||||
$paramArray[7] = array(array('concatenate', 'string'));
|
||||
|
||||
echo 'Your local wwwroot appears to be <strong>'. $wwwroot ."</strong>.<br />\n";
|
||||
echo "We will use this as the local <em>and</em> remote hosts.<br /><br />\n";
|
||||
flush();
|
||||
|
||||
// mnet_peer pulls information about a remote host from the database.
|
||||
$mnet_peer = new mnet_peer();
|
||||
$mnet_peer->set_wwwroot($wwwroot);
|
||||
|
||||
echo "Your \$mnet_peer from the database looks like:<br />\n<pre>";
|
||||
$h2 = get_object_vars($mnet_peer);
|
||||
while(list($key, $val) = each($h2)) {
|
||||
if (!is_numeric($key)) echo '<strong>'.$key.':</strong> '. $val."\n";
|
||||
}
|
||||
echo "</pre><br/>It's ok if that info is not complete - the required field is:<br />\nwwwroot: <b>{$mnet_peer->wwwroot}</b>.<br /><br/>\n";
|
||||
flush();
|
||||
|
||||
// The transport id is one of:
|
||||
// RPC_HTTPS_VERIFIED 1
|
||||
// RPC_HTTPS_SELF_SIGNED 2
|
||||
// RPC_HTTP_VERIFIED 3
|
||||
// RPC_HTTP_SELF_SIGNED 4
|
||||
|
||||
if (!$mnet_peer->transport) exit('No transport method is approved for this host in your DB table. Please enable a transport method and try again.');
|
||||
$t[1] = 'http2 (port 443 encrypted) with a verified certificate.';
|
||||
$t[2] = 'https (port 443 encrypted) with a self-signed certificate.';
|
||||
$t[4] = 'http (port 80 unencrypted) with a verified certificate.';
|
||||
$t[8] = 'http (port 80 unencrypted) with a self-signed certificate.';
|
||||
$t[16] = 'http (port 80 unencrypted) unencrypted with no certificate.';
|
||||
|
||||
echo 'Your transportid is <strong>'.$mnet_peer->transport.'</strong> which represents <em>'.$t[$mnet_peer->transport]."</em><br /><br />\n";
|
||||
flush();
|
||||
|
||||
// Create a new request object
|
||||
$mnet_request = new mnet_xmlrpc_client();
|
||||
|
||||
// Tell it the path to the method that we want to execute
|
||||
$mnet_request->set_method($path_to_function[$func]);
|
||||
// Add parameters for your function. The mnet_concatenate_strings takes three
|
||||
// parameters, like mnet_concatenate_strings($string1, $string2, $string3)
|
||||
// PHP is weakly typed, so you can get away with calling most things strings,
|
||||
// unless it's non-scalar (i.e. an array or object or something).
|
||||
foreach($paramArray[$func] as $param) {
|
||||
$mnet_request->add_param($param[0], $param[1]);
|
||||
}
|
||||
|
||||
if (count($mnet_request->params)) {
|
||||
echo 'Your parameters are:<br />';
|
||||
while(list($key, $val) = each($mnet_request->params)) {
|
||||
echo ' <strong>'.$key.':</strong> '. $val."<br/>\n";
|
||||
}
|
||||
}
|
||||
flush();
|
||||
|
||||
// We send the request:
|
||||
$mnet_request->send($mnet_peer);
|
||||
|
||||
?>
|
||||
|
||||
A var_dump of the decoded response: <strong><pre><?php var_dump($mnet_request->response); ?></pre></strong><br />
|
||||
|
||||
<?php
|
||||
if (count($mnet_request->params)) {
|
||||
?>
|
||||
A var_dump of the parameters you sent: <strong><pre><?php var_dump($mnet_request->params); ?></pre></strong><br />
|
||||
<?php
|
||||
}
|
||||
}
|
||||
?>
|
||||
<p>
|
||||
Choose a function to call:<br />
|
||||
<a href="testclient.php?func=2">system/listMethods</a><br />
|
||||
<a href="testclient.php?func=3">system/methodSignature</a><br />
|
||||
<a href="testclient.php?func=4">system/methodHelp</a><br />
|
||||
<a href="testclient.php?func=5">listServices</a><br />
|
||||
<a href="testclient.php?func=6">system/listMethods(SSO)</a><br />
|
||||
<a href="testclient.php?func=7">system/listMethods(concatenate)</a><br />
|
||||
|
||||
</body></html>
|
||||
225
mnet/xmlrpc/client.php
Normal file
225
mnet/xmlrpc/client.php
Normal file
|
|
@ -0,0 +1,225 @@
|
|||
<?php
|
||||
/**
|
||||
* An XML-RPC client
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
|
||||
require_once $CFG->dirroot.'/mnet/lib.php';
|
||||
|
||||
/**
|
||||
* Class representing an XMLRPC request against a remote machine
|
||||
*/
|
||||
class mnet_xmlrpc_client {
|
||||
|
||||
var $method = '';
|
||||
var $params = array();
|
||||
var $timeout = 60;
|
||||
var $error = array();
|
||||
var $response = '';
|
||||
|
||||
/**
|
||||
* Constructor returns true
|
||||
*/
|
||||
function mnet_xmlrpc_client() {
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Allow users to override the default timeout
|
||||
* @param int $timeout Request timeout in seconds
|
||||
* $return bool True if param is an integer or integer string
|
||||
*/
|
||||
function set_timeout($timeout) {
|
||||
if (!is_integer($timeout)) {
|
||||
if (is_numeric($timeout)) {
|
||||
$this->timeout = (integer($timeout));
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
$this->timeout = $timeout;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the path to the method or function we want to execute on the remote
|
||||
* machine. Examples:
|
||||
* mod/scorm/functionname
|
||||
* auth/mnet/methodname
|
||||
* In the case of auth and enrolment plugins, an object will be created and
|
||||
* the method on that object will be called
|
||||
*/
|
||||
function set_method($xmlrpcpath) {
|
||||
if (is_string($xmlrpcpath)) {
|
||||
$this->method = $xmlrpcpath;
|
||||
$this->params = array();
|
||||
return true;
|
||||
}
|
||||
$this->method = '';
|
||||
$this->params = array();
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a parameter to the array of parameters.
|
||||
*
|
||||
* @param string $argument A transport ID, as defined in lib.php
|
||||
* @param string $type The argument type, can be one of:
|
||||
* none
|
||||
* empty
|
||||
* base64
|
||||
* boolean
|
||||
* datetime
|
||||
* double
|
||||
* int
|
||||
* string
|
||||
* array
|
||||
* struct
|
||||
* In its weakly-typed wisdom, PHP will (currently)
|
||||
* ignore everything except datetime and base64
|
||||
* @return bool True on success
|
||||
*/
|
||||
function add_param($argument, $type = 'string') {
|
||||
|
||||
$allowed_types = array('none',
|
||||
'empty',
|
||||
'base64',
|
||||
'boolean',
|
||||
'datetime',
|
||||
'double',
|
||||
'int',
|
||||
'i4',
|
||||
'string',
|
||||
'array',
|
||||
'struct');
|
||||
if (!in_array($type, $allowed_types)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ($type != 'datetime' && $type != 'base64') {
|
||||
$this->params[] = $argument;
|
||||
return true;
|
||||
}
|
||||
|
||||
// Note weirdness - The type of $argument gets changed to an object with
|
||||
// value and type properties.
|
||||
// bool xmlrpc_set_type ( string &value, string type )
|
||||
xmlrpc_set_type($argument, $type);
|
||||
$this->params[] = $argument;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Send the request to the server - decode and return the response
|
||||
*
|
||||
* @param object $mnet_peer A mnet_peer object with details of the
|
||||
* remote host we're connecting to
|
||||
* @return mixed A PHP variable, as returned by the
|
||||
* remote function
|
||||
*/
|
||||
function send($mnet_peer) {
|
||||
global $CFG, $MNET;
|
||||
|
||||
$this->uri = $mnet_peer->wwwroot.
|
||||
'/mnet/xmlrpc/server.php';
|
||||
|
||||
// Initialize with the target URL
|
||||
$ch = curl_init($this->uri);
|
||||
|
||||
$system_methods = array('system/listMethods', 'system/methodSignature', 'system/methodHelp', 'system/listServices');
|
||||
|
||||
if (in_array($this->method, $system_methods) ) {
|
||||
|
||||
// Executing any system method is permitted.
|
||||
|
||||
} else {
|
||||
|
||||
// Find methods that we subscribe to on this host
|
||||
$sql = "
|
||||
SELECT
|
||||
*
|
||||
FROM
|
||||
{$CFG->prefix}mnet_rpc r,
|
||||
{$CFG->prefix}mnet_service2rpc s2r,
|
||||
{$CFG->prefix}mnet_host2service h2s
|
||||
WHERE
|
||||
r.xmlrpc_path = '{$this->method}' AND
|
||||
s2r.rpcid = r.id AND
|
||||
s2r.serviceid = h2s.serviceid AND
|
||||
h2s.subscribe = '1'";
|
||||
|
||||
$permission = get_record_sql($sql);
|
||||
if ($permission == false) {
|
||||
// TODO: Handle attempt to call not-permitted method
|
||||
echo '<pre>'.$sql.'</pre>';
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
$this->requesttext = xmlrpc_encode_request($this->method, $this->params);
|
||||
$rq = $this->requesttext;
|
||||
$rq = mnet_sign_message($this->requesttext);
|
||||
$this->signedrequest = $rq;
|
||||
$rq = mnet_encrypt_message($rq, $mnet_peer->public_key);
|
||||
$this->encryptedrequest = $rq;
|
||||
|
||||
curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeout);
|
||||
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
||||
curl_setopt($ch, CURLOPT_POST, true);
|
||||
curl_setopt($ch, CURLOPT_USERAGENT, 'Moodle');
|
||||
curl_setopt($ch, CURLOPT_POSTFIELDS, $rq);
|
||||
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: text/xml charset=UTF-8"));
|
||||
|
||||
$this->rawresponse = curl_exec($ch);
|
||||
if ($this->rawresponse == false) {
|
||||
$this->error[] = array(curl_errno($ch), curl_error($ch));
|
||||
}
|
||||
|
||||
$crypt_parser = new mnet_encxml_parser();
|
||||
$crypt_parser->parse($this->rawresponse);
|
||||
|
||||
if ($crypt_parser->payload_encrypted) {
|
||||
|
||||
$key = array_pop($crypt_parser->cipher);
|
||||
$data = array_pop($crypt_parser->cipher);
|
||||
|
||||
$crypt_parser->free_resource();
|
||||
|
||||
// Initialize payload var
|
||||
$payload = '';
|
||||
|
||||
// &$payload
|
||||
$isOpen = openssl_open(base64_decode($data), $payload, base64_decode($key), $MNET->get_private_key());
|
||||
|
||||
if (!$isOpen) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (strpos(substr($payload, 0, 100), '<signedMessage>')) {
|
||||
$sig_parser = new mnet_encxml_parser();
|
||||
$sig_parser->parse($payload);
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
|
||||
} else {
|
||||
$crypt_parser->free_resource();
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->xmlrpcresponse = base64_decode($sig_parser->data_object);
|
||||
$this->response = xmlrpc_decode($this->xmlrpcresponse);
|
||||
curl_close($ch);
|
||||
|
||||
// xmlrpc errors are pushed onto the $this->error stack
|
||||
if (isset($this->response['faultCode'])) {
|
||||
$this->error[] = $this->response['faultCode'] . " : " . $this->response['faultString'];
|
||||
}
|
||||
return empty($this->error);
|
||||
}
|
||||
}
|
||||
?>
|
||||
669
mnet/xmlrpc/server.php
Normal file
669
mnet/xmlrpc/server.php
Normal file
|
|
@ -0,0 +1,669 @@
|
|||
<?php
|
||||
/**
|
||||
* An XML-RPC server
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
|
||||
// Make certain that config.php doesn't display any errors, and that it doesn't
|
||||
// override our do-not-display-errors setting:
|
||||
ini_set('display_errors',0);
|
||||
require_once(dirname(dirname(dirname(__FILE__))) . '/config.php');
|
||||
ini_set('display_errors',0);
|
||||
|
||||
// Include MNET stuff:
|
||||
require_once $CFG->dirroot.'/mnet/lib.php';
|
||||
require_once $CFG->dirroot.'/mnet/remote_client.php';
|
||||
|
||||
// Content type for output is not html:
|
||||
header('Content-type: text/xml');
|
||||
|
||||
if (!empty($CFG->mnet_rpcdebug)) {
|
||||
trigger_error("HTTP_RAW_POST_DATA");
|
||||
trigger_error($HTTP_RAW_POST_DATA);
|
||||
}
|
||||
|
||||
// New global variable which ONLY gets set in this server page, so you know that
|
||||
// if you've been called by a remote Moodle, this should be set:
|
||||
$MNET_REMOTE_CLIENT = new mnet_remote_client();
|
||||
|
||||
// Peek at the message to see if it's an XML-ENC document. If it is, note that
|
||||
// the client connection was encrypted, and strip the xml-encryption and
|
||||
// xml-signature wrappers from the XML-RPC payload
|
||||
if (strpos(substr($HTTP_RAW_POST_DATA, 0, 100), '<encryptedMessage>')) {
|
||||
$MNET_REMOTE_CLIENT->was_encrypted();
|
||||
// Extract the XML-RPC payload from the XML-ENC and XML-SIG wrappers.
|
||||
$payload = mnet_server_strip_wrappers($HTTP_RAW_POST_DATA);
|
||||
} else {
|
||||
$params = xmlrpc_decode_request($HTTP_RAW_POST_DATA, $method);
|
||||
if ($method == 'system.keyswap' ||
|
||||
$method == 'system/keyswap') {
|
||||
|
||||
// OK
|
||||
|
||||
} elseif ($MNET_REMOTE_CLIENT->plaintext_is_ok() == false) {
|
||||
exit(mnet_server_fault(7021, 'forbidden-transport'));
|
||||
}
|
||||
// Looks like plaintext is ok. It is assumed that a plaintext call:
|
||||
// 1. Came from a trusted host on your local network
|
||||
// 2. Is *not* from a Moodle - otherwise why skip encryption/signing?
|
||||
// 3. Is free to execute ANY function in Moodle
|
||||
// 4. Cannot execute any methods (as it can't instantiate a class first)
|
||||
// To execute a method, you'll need to create a wrapper function that first
|
||||
// instantiates the class, and then calls the method.
|
||||
$payload = $HTTP_RAW_POST_DATA;
|
||||
}
|
||||
|
||||
if (!empty($CFG->mnet_rpcdebug)) {
|
||||
trigger_error("XMLRPC Payload");
|
||||
trigger_error(print_r($payload,1));
|
||||
}
|
||||
|
||||
// Parse and action the XML-RPC payload
|
||||
$response = mnet_server_dispatch($payload);
|
||||
|
||||
/**
|
||||
* Strip the encryption (XML-ENC) and signature (XML-SIG) wrappers and return the XML-RPC payload
|
||||
*
|
||||
* IF COMMUNICATION TAKES PLACE OVER UNENCRYPTED HTTP:
|
||||
* The payload will have been encrypted with a symmetric key. This key will
|
||||
* itself have been encrypted using your public key. The key is decrypted using
|
||||
* your private key, and then used to decrypt the XML payload.
|
||||
*
|
||||
* IF COMMUNICATION TAKES PLACE OVER UNENCRYPTED HTTP *OR* ENCRYPTED HTTPS:
|
||||
* In either case, there will be an XML wrapper which contains your XML-RPC doc
|
||||
* as an object element, a signature for that doc, and various standards-
|
||||
* compliant info to aid in verifying the signature.
|
||||
*
|
||||
* This function parses the encryption wrapper, decrypts the contents, parses
|
||||
* the signature wrapper, and if the signature matches the payload, it returns
|
||||
* the payload, which should be an XML-RPC request.
|
||||
* If there is an error, or the signatures don't match, it echoes an XML-RPC
|
||||
* error and exits.
|
||||
*
|
||||
* See the W3C's {@link http://www.w3.org/TR/xmlenc-core/ XML Encryption Syntax and Processing}
|
||||
* and {@link http://www.w3.org/TR/2001/PR-xmldsig-core-20010820/ XML-Signature Syntax and Processing}
|
||||
* guidelines for more detail on the XML.
|
||||
*
|
||||
* -----XML-Envelope---------------------------------
|
||||
* | |
|
||||
* | Encrypted-Symmetric-key---------------- |
|
||||
* | |_____________________________________| |
|
||||
* | |
|
||||
* | Encrypted data------------------------- |
|
||||
* | | | |
|
||||
* | | -XML-Envelope------------------ | |
|
||||
* | | | | | |
|
||||
* | | | --Signature------------- | | |
|
||||
* | | | |______________________| | | |
|
||||
* | | | | | |
|
||||
* | | | --Signed-Payload-------- | | |
|
||||
* | | | | | | | |
|
||||
* | | | | XML-RPC Request | | | |
|
||||
* | | | |______________________| | | |
|
||||
* | | | | | |
|
||||
* | | |_____________________________| | |
|
||||
* | |_____________________________________| |
|
||||
* | |
|
||||
* |________________________________________________|
|
||||
*
|
||||
* @uses $db
|
||||
* @param string $HTTP_RAW_POST_DATA The XML that the client sent
|
||||
* @return string The XMLRPC payload.
|
||||
*/
|
||||
function mnet_server_strip_wrappers($HTTP_RAW_POST_DATA) {
|
||||
global $MNET, $MNET_REMOTE_CLIENT;
|
||||
if (isset($_SERVER)) {
|
||||
|
||||
$crypt_parser = new mnet_encxml_parser();
|
||||
$crypt_parser->parse($HTTP_RAW_POST_DATA);
|
||||
|
||||
if ($crypt_parser->payload_encrypted) {
|
||||
|
||||
$key = array_pop($crypt_parser->cipher);
|
||||
$data = array_pop($crypt_parser->cipher);
|
||||
|
||||
$crypt_parser->free_resource();
|
||||
|
||||
// Initialize payload var
|
||||
$payload = '';
|
||||
|
||||
// &$payload
|
||||
$isOpen = openssl_open(base64_decode($data), $payload, base64_decode($key), $MNET->get_private_key());
|
||||
|
||||
if (!$isOpen) {
|
||||
exit(mnet_server_fault(7023, 'encryption-invalid'));
|
||||
}
|
||||
|
||||
if (strpos(substr($payload, 0, 100), '<signedMessage>')) {
|
||||
$MNET_REMOTE_CLIENT->was_signed();
|
||||
$sig_parser = new mnet_encxml_parser();
|
||||
$sig_parser->parse($payload);
|
||||
} else {
|
||||
exit(mnet_server_fault(7022, 'verifysignature-error'));
|
||||
}
|
||||
|
||||
} else {
|
||||
exit(mnet_server_fault(7024, 'payload-not-encrypted'));
|
||||
}
|
||||
|
||||
unset($payload);
|
||||
|
||||
$host_record_exists = $MNET_REMOTE_CLIENT->set_wwwroot($sig_parser->remote_wwwroot);
|
||||
|
||||
if (false == $host_record_exists) {
|
||||
exit(mnet_server_fault(7020, 'wrong-wwwroot', $sig_parser->remote_wwwroot));
|
||||
} elseif (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] != $MNET_REMOTE_CLIENT->ip_address) {
|
||||
exit(mnet_server_fault(7017, 'wrong-ip'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the certificate (i.e. public key) from the remote server.
|
||||
*/
|
||||
$certificate = $MNET_REMOTE_CLIENT->public_key;
|
||||
|
||||
if ($certificate == false) {
|
||||
exit(mnet_server_fault(709, 'nosuchpublickey'));
|
||||
}
|
||||
|
||||
$payload = base64_decode($sig_parser->data_object);
|
||||
|
||||
// Does the signature match the data and the public cert?
|
||||
$signature_verified = openssl_verify($payload, base64_decode($sig_parser->signature), $certificate);
|
||||
if ($signature_verified == 1) {
|
||||
// Parse the XML
|
||||
} elseif ($signature_verified == 0) {
|
||||
exit(mnet_server_fault(710, 'verifysignature-invalid'));
|
||||
} else {
|
||||
exit(mnet_server_fault(711, 'verifysignature-error'));
|
||||
}
|
||||
|
||||
$sig_parser->free_resource();
|
||||
|
||||
return $payload;
|
||||
} else {
|
||||
exit(mnet_server_fault(712, "phperror"));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the proper XML-RPC content to report an error.
|
||||
*
|
||||
* @param int $code The ID code of the error message
|
||||
* @return string $text The text of the error message
|
||||
*/
|
||||
function mnet_server_fault($code, $text, $param = null) {
|
||||
if (!is_numeric($code)) {
|
||||
$code = 0;
|
||||
}
|
||||
$code = intval($code);
|
||||
|
||||
$text = get_string($text, 'mnet', $param);
|
||||
|
||||
// Replace illegal XML chars - is this already in a lib somewhere?
|
||||
$text = str_replace(array('<','>','&','"',"'"), array('<','>','&','"','''), $text);
|
||||
|
||||
$return = mnet_server_prepare_response('<?xml version="1.0"?>
|
||||
<methodResponse>
|
||||
<fault>
|
||||
<value>
|
||||
<struct>
|
||||
<member>
|
||||
<name>faultCode</name>
|
||||
<value><int>'.$code.'</int></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>faultString</name>
|
||||
<value><string>'.$text.'</string></value>
|
||||
</member>
|
||||
</struct>
|
||||
</value>
|
||||
</fault>
|
||||
</methodResponse>');
|
||||
return $return;
|
||||
}
|
||||
|
||||
/**
|
||||
* Dummy function for the XML-RPC dispatcher - use to call a method on an object
|
||||
* or to call a function
|
||||
*
|
||||
* Translate XML-RPC's strange function call syntax into a more straightforward
|
||||
* PHP-friendly alternative. This dummy function will be called by the
|
||||
* dispatcher, and can be used to call a method on an object, or just a function
|
||||
*
|
||||
* The methodName argument (eg. mnet/testlib/mnet_concatenate_strings)
|
||||
* is ignored.
|
||||
*
|
||||
* @param string $methodname We discard this - see 'functionname'
|
||||
* @param array $argsarray Each element is an argument to the real
|
||||
* function
|
||||
* @param string $functionname The name of the PHP function you want to call
|
||||
* @return mixed The return value will be that of the real
|
||||
* function, whateber it may be.
|
||||
*/
|
||||
function mnet_server_dummy_method($methodname, $argsarray, $functionname) {
|
||||
global $MNET_REMOTE_CLIENT;
|
||||
|
||||
if ($MNET_REMOTE_CLIENT->object_to_call == false) {
|
||||
return @call_user_func_array($functionname, $argsarray);
|
||||
} else {
|
||||
return @call_user_method_array($functionname, $MNET_REMOTE_CLIENT->object_to_call, $argsarray);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Package a response in any required envelope, and return it to the client
|
||||
*
|
||||
* @param string $response The XMLRPC response string
|
||||
* @return string The encoded response string
|
||||
*/
|
||||
function mnet_server_prepare_response($response) {
|
||||
global $MNET_REMOTE_CLIENT;
|
||||
|
||||
if ($MNET_REMOTE_CLIENT->request_was_signed) {
|
||||
$response = mnet_sign_message($response);
|
||||
}
|
||||
|
||||
if ($MNET_REMOTE_CLIENT->request_was_encrypted) {
|
||||
$response = mnet_encrypt_message($response, $MNET_REMOTE_CLIENT->public_key);
|
||||
}
|
||||
|
||||
return $response;
|
||||
}
|
||||
|
||||
/**
|
||||
* If security checks are passed, dispatch the request to the function/method
|
||||
*
|
||||
* The config variable 'mnet_dispatcher_mode' can be:
|
||||
* strict: Only execute functions that are in specific files
|
||||
* off: The default - don't execute anything
|
||||
*
|
||||
* @param string $payload The XML-RPC request
|
||||
* @return No return val - just echo the response
|
||||
*/
|
||||
function mnet_server_dispatch($payload) {
|
||||
global $CFG, $MNET_REMOTE_CLIENT;
|
||||
// xmlrpc_decode_request returns an array of parameters, and the $method
|
||||
// variable (which is passed by reference) is instantiated with the value from
|
||||
// the methodName tag in the xml payload
|
||||
// xmlrpc_decode_request($xml, &$method)
|
||||
$params = xmlrpc_decode_request($payload, $method);
|
||||
|
||||
// $method is something like: "mod/forum/lib/forum_add_instance"
|
||||
// $params is an array of parameters. A parameter might itself be an array.
|
||||
|
||||
// Whitelist characters that are permitted in a method name
|
||||
// The method name must not begin with a / - avoid absolute paths
|
||||
// A dot character . is only allowed in the filename, i.e. something.php
|
||||
if (0 == preg_match("@^[A-Za-z0-9]+/[A-Za-z0-9/_-]+(\.php/)?[A-Za-z0-9_-]+$@",$method)) {
|
||||
exit(mnet_server_fault(713, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
$callstack = explode('/', $method);
|
||||
// callstack will look like array('mod', 'forum', 'lib', 'forum_add_instance');
|
||||
|
||||
/**
|
||||
* What has the site administrator chosen as his dispatcher setting?
|
||||
* strict: Only execute functions that are in specific files
|
||||
* off: The default - don't execute anything
|
||||
*/
|
||||
////////////////////////////////////// OFF
|
||||
if (!isset($CFG->mnet_dispatcher_mode) ) {
|
||||
set_config('mnet_dispatcher_mode', 'off');
|
||||
exit(mnet_server_fault(704, 'nosuchservice'));
|
||||
} elseif ('off' == $CFG->mnet_dispatcher_mode) {
|
||||
exit(mnet_server_fault(704, 'nosuchservice'));
|
||||
|
||||
////////////////////////////////////// SYSTEM METHODS
|
||||
} elseif ($callstack[0] == 'system') {
|
||||
$functionname = $callstack[1];
|
||||
$xmlrpcserver = xmlrpc_server_create();
|
||||
|
||||
// I'm adding the canonical xmlrpc references here, however we've
|
||||
// already forbidden that the period (.) should be allowed in the call
|
||||
// stack, so if someone tries to access our XMLRPC in the normal way,
|
||||
// they'll already have received a RPC server fault message.
|
||||
|
||||
// Maybe we should allow an easement so that regular XMLRPC clients can
|
||||
// call our system methods, and find out what we have to offer?
|
||||
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system.listMethods', 'mnet_system');
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system/listMethods', 'mnet_system');
|
||||
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system.methodSignature', 'mnet_system');
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system/methodSignature', 'mnet_system');
|
||||
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system.methodHelp', 'mnet_system');
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system/methodHelp', 'mnet_system');
|
||||
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system.listServices', 'mnet_system');
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system/listServices', 'mnet_system');
|
||||
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system.keyswap', 'mnet_keyswap');
|
||||
xmlrpc_server_register_method($xmlrpcserver, 'system/keyswap', 'mnet_keyswap');
|
||||
|
||||
if ($method == 'system.listMethods' ||
|
||||
$method == 'system/listMethods' ||
|
||||
$method == 'system.methodSignature' ||
|
||||
$method == 'system/methodSignature' ||
|
||||
$method == 'system.methodHelp' ||
|
||||
$method == 'system/methodHelp' ||
|
||||
$method == 'system.listServices' ||
|
||||
$method == 'system/listServices' ||
|
||||
$method == 'system.keyswap' ||
|
||||
$method == 'system/keyswap') {
|
||||
|
||||
$response = xmlrpc_server_call_method($xmlrpcserver, $payload, $MNET_REMOTE_CLIENT);
|
||||
$response = mnet_server_prepare_response($response);
|
||||
} else {
|
||||
exit(mnet_server_fault(7018, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
xmlrpc_server_destroy($xmlrpcserver);
|
||||
echo $response;
|
||||
////////////////////////////////////// STRICT AUTH
|
||||
} elseif ($callstack[0] == 'auth') {
|
||||
|
||||
// Break out the callstack into its elements
|
||||
list($base, $plugin, $filename, $methodname) = $callstack;
|
||||
|
||||
// We refuse to include anything that is not auth.php
|
||||
if ($filename == 'auth.php' && is_enabled_auth($plugin)) {
|
||||
$authclass = 'auth_plugin_'.$plugin;
|
||||
$includefile = '/auth/'.$plugin.'/auth.php';
|
||||
$response = mnet_server_invoke_method($includefile, $methodname, $method, $payload, $authclass);
|
||||
$response = mnet_server_prepare_response($response);
|
||||
echo $response;
|
||||
} else {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(702, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
////////////////////////////////////// STRICT ENROL
|
||||
} elseif ($callstack[0] == 'enrol') {
|
||||
|
||||
// Break out the callstack into its elements
|
||||
list($base, $plugin, $filename, $methodname) = $callstack;
|
||||
|
||||
if ($filename == 'enrol.php' && is_enabled_enrol($plugin)) {
|
||||
$enrolclass = 'enrolment_plugin_'.$plugin;
|
||||
$includefile = '/enrol/'.$plugin.'/enrol.php';
|
||||
$response = mnet_server_invoke_method($includefile, $methodname, $method, $payload, $enrolclass);
|
||||
$response = mnet_server_prepare_response($response);
|
||||
echo $response;
|
||||
} else {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(703, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
////////////////////////////////////// STRICT MOD/*
|
||||
} elseif ($callstack[0] == 'mod' || 'promiscuous' == $CFG->mnet_dispatcher_mode) {
|
||||
list($base, $module, $filename, $functionname) = $callstack;
|
||||
|
||||
////////////////////////////////////// STRICT MOD/*
|
||||
if ($base == 'mod' && $filename == 'rpclib.php') {
|
||||
$includefile = '/mod/'.$module.'/rpclib.php';
|
||||
$response = mnet_server_invoke_method($includefile, $functionname, $method, $payload);
|
||||
$response = mnet_server_prepare_response($response);
|
||||
echo $response;
|
||||
|
||||
////////////////////////////////////// PROMISCUOUS
|
||||
} elseif ('promiscuous' == $CFG->mnet_dispatcher_mode && $MNET_REMOTE_CLIENT->plaintext_is_ok()) {
|
||||
|
||||
$functionname = array_pop($callstack);
|
||||
$filename = array_pop($callstack);
|
||||
|
||||
if ($MNET_REMOTE_CLIENT->plaintext_is_ok()) {
|
||||
|
||||
// The call stack holds the path to any include file
|
||||
$includefile = $CFG->dirroot.'/'.implode('/',$callstack).'/'.$filename.'.php';
|
||||
|
||||
$response = mnet_server_invoke_function($includefile, $functionname, $method, $payload);
|
||||
echo $response;
|
||||
}
|
||||
|
||||
} else {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7012, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
} else {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7012, 'nosuchfunction'));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Execute the system functions - mostly for introspection
|
||||
*
|
||||
* @param string $method XMLRPC method name, e.g. system.listMethods
|
||||
* @param array $params Array of parameters from the XMLRPC request
|
||||
* @param string $hostinfo Hostinfo object from the mnet_host table
|
||||
* @return mixed Response data - any kind of PHP variable
|
||||
*/
|
||||
function mnet_system($method, $params, $hostinfo) {
|
||||
global $CFG;
|
||||
|
||||
if (empty($hostinfo)) return array();
|
||||
|
||||
$id_list = $hostinfo->id;
|
||||
if (!empty($CFG->mnet_all_hosts_id)) {
|
||||
$id_list .= ', '.$CFG->mnet_all_hosts_id;
|
||||
}
|
||||
|
||||
if ('system.listMethods' == $method || 'system/listMethods' == $method) {
|
||||
if (count($params) == 0) {
|
||||
$query = '
|
||||
SELECT DISTINCT
|
||||
rpc.function_name,
|
||||
rpc.xmlrpc_path,
|
||||
rpc.enabled,
|
||||
rpc.help,
|
||||
rpc.profile
|
||||
FROM
|
||||
'.$CFG->prefix.'mnet_host2service h2s,
|
||||
'.$CFG->prefix.'mnet_service2rpc s2r,
|
||||
'.$CFG->prefix.'mnet_rpc rpc
|
||||
WHERE
|
||||
s2r.rpcid = rpc.id AND
|
||||
h2s.serviceid = s2r.serviceid AND
|
||||
h2s.hostid in ('.$id_list .')
|
||||
ORDER BY
|
||||
rpc.xmlrpc_path ASC';
|
||||
|
||||
} else {
|
||||
$query = '
|
||||
SELECT DISTINCT
|
||||
rpc.function_name,
|
||||
rpc.xmlrpc_path,
|
||||
rpc.enabled,
|
||||
rpc.help,
|
||||
rpc.profile
|
||||
FROM
|
||||
'.$CFG->prefix.'mnet_host2service h2s,
|
||||
'.$CFG->prefix.'mnet_service2rpc s2r,
|
||||
'.$CFG->prefix.'mnet_service svc,
|
||||
'.$CFG->prefix.'mnet_rpc rpc
|
||||
WHERE
|
||||
s2r.rpcid = rpc.id AND
|
||||
h2s.serviceid = s2r.serviceid AND
|
||||
h2s.hostid in ('.$id_list .') AND
|
||||
svc.id = h2s.serviceid AND
|
||||
svc.name = \''.$params[0].'\'
|
||||
ORDER BY
|
||||
rpc.xmlrpc_path ASC';
|
||||
|
||||
}
|
||||
$resultset = array_values(get_records_sql($query));
|
||||
$methods = array();
|
||||
foreach($resultset as $result) {
|
||||
$methods[] = $result->xmlrpc_path;
|
||||
}
|
||||
return $methods;
|
||||
} elseif ('system.methodSignature' == $method || 'system/methodSignature' == $method) {
|
||||
$query = '
|
||||
SELECT DISTINCT
|
||||
rpc.function_name,
|
||||
rpc.xmlrpc_path,
|
||||
rpc.enabled,
|
||||
rpc.help,
|
||||
rpc.profile
|
||||
FROM
|
||||
'.$CFG->prefix.'mnet_host2service h2s,
|
||||
'.$CFG->prefix.'mnet_service2rpc s2r,
|
||||
'.$CFG->prefix.'mnet_rpc rpc
|
||||
WHERE
|
||||
rpc.xmlrpc_path = \''.$params[0].'\' AND
|
||||
s2r.rpcid = rpc.id AND
|
||||
h2s.serviceid = s2r.serviceid AND
|
||||
h2s.hostid in ('.$id_list .')';
|
||||
|
||||
$result = get_records_sql($query);
|
||||
$methodsigs = array();
|
||||
|
||||
if (is_array($result)) {
|
||||
foreach($result as $method) {
|
||||
$methodsigs[] = unserialize($method->profile);
|
||||
}
|
||||
}
|
||||
|
||||
return $methodsigs;
|
||||
} elseif ('system.methodHelp' == $method || 'system/methodHelp' == $method) {
|
||||
$query = '
|
||||
SELECT DISTINCT
|
||||
rpc.function_name,
|
||||
rpc.xmlrpc_path,
|
||||
rpc.enabled,
|
||||
rpc.help,
|
||||
rpc.profile
|
||||
FROM
|
||||
'.$CFG->prefix.'mnet_host2service h2s,
|
||||
'.$CFG->prefix.'mnet_service2rpc s2r,
|
||||
'.$CFG->prefix.'mnet_rpc rpc
|
||||
WHERE
|
||||
rpc.xmlrpc_path = \''.$params[0].'\' AND
|
||||
s2r.rpcid = rpc.id AND
|
||||
h2s.serviceid = s2r.serviceid AND
|
||||
h2s.hostid in ('.$id_list .')';
|
||||
|
||||
$result = get_record_sql($query);
|
||||
|
||||
if (is_object($result)) {
|
||||
return $result->help;
|
||||
}
|
||||
} elseif ('system.listServices' == $method || 'system/listServices' == $method) {
|
||||
$query = '
|
||||
SELECT DISTINCT
|
||||
s.id,
|
||||
s.name,
|
||||
s.apiversion,
|
||||
h2s.publish,
|
||||
h2s.subscribe
|
||||
FROM
|
||||
'.$CFG->prefix.'mnet_host2service h2s,
|
||||
'.$CFG->prefix.'mnet_service s
|
||||
WHERE
|
||||
h2s.serviceid = s.id AND
|
||||
h2s.hostid in ('.$id_list .')
|
||||
ORDER BY
|
||||
s.name ASC';
|
||||
|
||||
$result = get_records_sql($query);
|
||||
$services = array();
|
||||
|
||||
if (is_array($result)) {
|
||||
foreach($result as $service) {
|
||||
$services[] = array('name' => $service->name,
|
||||
'apiversion' => $service->apiversion,
|
||||
'publish' => $service->publish,
|
||||
'subscribe' => $service->subscribe);
|
||||
}
|
||||
}
|
||||
|
||||
return $services;
|
||||
}
|
||||
exit(mnet_server_fault(7019, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize the object (if necessary), execute the method or function, and
|
||||
* return the response
|
||||
*
|
||||
* @param string $includefile The file that contains the object definition
|
||||
* @param string $methodname The name of the method to execute
|
||||
* @param string $method The full path to the method
|
||||
* @param string $payload The XML-RPC request payload
|
||||
* @param string $class The name of the class to instantiate (or false)
|
||||
* @return string The XML-RPC response
|
||||
*/
|
||||
function mnet_server_invoke_method($includefile, $methodname, $method, $payload, $class=false) {
|
||||
|
||||
$permission = mnet_permit_rpc_call($includefile, $methodname, $class);
|
||||
|
||||
if (RPC_NOSUCHFILE == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(705, 'nosuchfile', $includefile));
|
||||
}
|
||||
|
||||
if (RPC_NOSUCHFUNCTION == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(706, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
if (RPC_FORBIDDENFUNCTION == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(707, 'forbidden-function'));
|
||||
}
|
||||
|
||||
if (RPC_NOSUCHCLASS == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7013, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
if (RPC_NOSUCHMETHOD == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7014, 'nosuchmethod'));
|
||||
}
|
||||
|
||||
if (RPC_NOSUCHFUNCTION == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7014, 'nosuchmethod'));
|
||||
}
|
||||
|
||||
if (RPC_FORBIDDENMETHOD == $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7015, 'nosuchfunction'));
|
||||
}
|
||||
|
||||
if (0 < $permission) {
|
||||
// Generate error response - unable to locate function
|
||||
exit(mnet_server_fault(7019, 'unknownerror'));
|
||||
}
|
||||
|
||||
if (RPC_OK == $permission) {
|
||||
$xmlrpcserver = xmlrpc_server_create();
|
||||
$bool = xmlrpc_server_register_method($xmlrpcserver, $method, 'mnet_server_dummy_method');
|
||||
$response = xmlrpc_server_call_method($xmlrpcserver, $payload, $methodname);
|
||||
$bool = xmlrpc_server_destroy($xmlrpcserver);
|
||||
return $response;
|
||||
}
|
||||
}
|
||||
|
||||
function mnet_keyswap($function, $params) {
|
||||
global $CFG;
|
||||
$return = array();
|
||||
|
||||
if (!empty($CFG->mnet_register_allhosts)) {
|
||||
$mnet_peer = new mnet_peer();
|
||||
$keyok = $mnet_peer->bootstrap($params[0]);
|
||||
if ($keyok) {
|
||||
$mnet_peer->commit();
|
||||
}
|
||||
}
|
||||
$keypair = mnet_get_keypair();
|
||||
return $keypair['certificate'];
|
||||
}
|
||||
?>
|
||||
242
mnet/xmlrpc/xmlparser.php
Normal file
242
mnet/xmlrpc/xmlparser.php
Normal file
|
|
@ -0,0 +1,242 @@
|
|||
<?php
|
||||
/**
|
||||
* Custom XML parser for signed and/or encrypted XML Docs
|
||||
*
|
||||
* @author Donal McMullan donal@catalyst.net.nz
|
||||
* @version 0.0.1
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
||||
* @package mnet
|
||||
*/
|
||||
|
||||
/**
|
||||
* Custom XML parser class for signed and/or encrypted XML Docs
|
||||
*/
|
||||
class mnet_encxml_parser {
|
||||
/**
|
||||
* Constructor creates and initialises parser resource and calls initialise
|
||||
*
|
||||
* @return bool True
|
||||
*/
|
||||
function mnet_encxml_parser() {
|
||||
return $this->initialise();
|
||||
}
|
||||
|
||||
/**
|
||||
* Set default element handlers and initialise properties to empty.
|
||||
*
|
||||
* @return bool True
|
||||
*/
|
||||
function initialise() {
|
||||
$this->parser = xml_parser_create();
|
||||
xml_set_object($this->parser, $this);
|
||||
|
||||
xml_set_element_handler($this->parser, "start_element", "end_element");
|
||||
xml_set_character_data_handler($this->parser, "discard_data");
|
||||
|
||||
$this->tag_number = 0; // Just a unique ID for each tag
|
||||
$this->digest = '';
|
||||
$this->remote_wwwroot = '';
|
||||
$this->signature = '';
|
||||
$this->data_object = '';
|
||||
$this->key_URI = '';
|
||||
$this->payload_encrypted = false;
|
||||
$this->cipher = array();
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse a block of XML text
|
||||
*
|
||||
* The XML Text will be an XML-RPC request which is wrapped in an XML doc
|
||||
* with a signature from the sender. This envelope may be encrypted and
|
||||
* delivered within another XML envelope with a symmetric key. The parser
|
||||
* should first decrypt this XML, and then place the XML-RPC request into
|
||||
* the data_object property, and the signature into the signature property.
|
||||
*
|
||||
* See the W3C's {@link http://www.w3.org/TR/xmlenc-core/ XML Encryption Syntax and Processing}
|
||||
* and {@link http://www.w3.org/TR/2001/PR-xmldsig-core-20010820/ XML-Signature Syntax and Processing}
|
||||
* guidelines for more detail on the XML.
|
||||
*
|
||||
* -----XML-Envelope---------------------------------
|
||||
* | |
|
||||
* | Symmetric-key-------------------------- |
|
||||
* | |_____________________________________| |
|
||||
* | |
|
||||
* | Encrypted data------------------------- |
|
||||
* | | | |
|
||||
* | | -XML-Envelope------------------ | |
|
||||
* | | | | | |
|
||||
* | | | --Signature------------- | | |
|
||||
* | | | |______________________| | | |
|
||||
* | | | | | |
|
||||
* | | | --Signed-Payload-------- | | |
|
||||
* | | | | | | | |
|
||||
* | | | | XML-RPC Request | | | |
|
||||
* | | | |______________________| | | |
|
||||
* | | | | | |
|
||||
* | | |_____________________________| | |
|
||||
* | |_____________________________________| |
|
||||
* | |
|
||||
* |________________________________________________|
|
||||
*
|
||||
* @uses $MNET
|
||||
* @param string $data The XML that you want to parse
|
||||
* @return bool True on success - false on failure
|
||||
*/
|
||||
function parse($data) {
|
||||
global $MNET, $MNET_REMOTE_CLIENT;
|
||||
|
||||
$p = xml_parse($this->parser, $data);
|
||||
|
||||
if (count($this->cipher) > 0) {
|
||||
$this->payload_encrypted = true;
|
||||
}
|
||||
|
||||
return (bool)$p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Destroy the parser and free up any related resource.
|
||||
*/
|
||||
function free_resource() {
|
||||
$free = xml_parser_free($this->parser);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the character-data handler to the right function for each element
|
||||
*
|
||||
* For each tag (element) name, this function switches the character-data
|
||||
* handler to the function that handles that element. Note that character
|
||||
* data is referred to the handler in blocks of 1024 bytes.
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $name The name of the tag, e.g. method_call
|
||||
* @param array $attrs The tag's attributes (if any exist).
|
||||
* @return bool True
|
||||
*/
|
||||
function start_element($parser, $name, $attrs) {
|
||||
$this->tag_number++;
|
||||
$handler = 'discard_data';
|
||||
switch(strtoupper($name)) {
|
||||
case 'DIGESTVALUE':
|
||||
$handler = 'parse_digest';
|
||||
break;
|
||||
case 'SIGNATUREVALUE':
|
||||
$handler = 'parse_signature';
|
||||
break;
|
||||
case 'OBJECT':
|
||||
$handler = 'parse_object';
|
||||
break;
|
||||
case 'RETRIEVALMETHOD':
|
||||
$this->key_URI = $attrs['URI'];
|
||||
break;
|
||||
case 'WWWROOT':
|
||||
$handler = 'parse_wwwroot';
|
||||
break;
|
||||
case 'CIPHERVALUE':
|
||||
$this->cipher[$this->tag_number] = '';
|
||||
$handler = 'parse_cipher';
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
xml_set_character_data_handler($this->parser, $handler);
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add the next chunk of character data to the cipher string for that tag
|
||||
*
|
||||
* The XML parser calls the character-data handler with 1024-character
|
||||
* chunks of data. This means that the handler may be called several times
|
||||
* for a single tag, so we use the concatenate operator (.) to build the
|
||||
* tag content into a string.
|
||||
* We should not encounter more than one of each tag type, except for the
|
||||
* cipher tag. We will often see two of those. We prevent the content of
|
||||
* these two tags being concatenated together by counting each tag, and
|
||||
* using its 'number' as the key to an array of ciphers.
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $data The content of the current tag (1024 byte chunk)
|
||||
* @return bool True
|
||||
*/
|
||||
function parse_cipher($parser, $data) {
|
||||
$this->cipher[$this->tag_number] .= $data;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add the next chunk of character data to the remote_wwwroot string
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $data The content of the current tag (1024 byte chunk)
|
||||
* @return bool True
|
||||
*/
|
||||
function parse_wwwroot($parser, $data) {
|
||||
$this->remote_wwwroot .= $data;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add the next chunk of character data to the digest string
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $data The content of the current tag (1024 byte chunk)
|
||||
* @return bool True
|
||||
*/
|
||||
function parse_digest($parser, $data) {
|
||||
$this->digest .= $data;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add the next chunk of character data to the signature string
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $data The content of the current tag (1024 byte chunk)
|
||||
* @return bool True
|
||||
*/
|
||||
function parse_signature($parser, $data) {
|
||||
$this->signature .= $data;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add the next chunk of character data to the data_object string
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $data The content of the current tag (1024 byte chunk)
|
||||
* @return bool True
|
||||
*/
|
||||
function parse_object($parser, $data) {
|
||||
$this->data_object .= $data;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Discard the next chunk of character data
|
||||
*
|
||||
* This is used for tags that we're not interested in.
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $data The content of the current tag (1024 byte chunk)
|
||||
* @return bool True
|
||||
*/
|
||||
function discard_data($parser, $data) {
|
||||
// Not interested
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Switch the character-data handler to ignore the next chunk of data
|
||||
*
|
||||
* @param mixed $parser The XML parser
|
||||
* @param string $name The name of the tag, e.g. method_call
|
||||
* @return bool True
|
||||
*/
|
||||
function end_element($parser, $name) {
|
||||
$ok = xml_set_character_data_handler($this->parser, "discard_data");
|
||||
return true;
|
||||
}
|
||||
}
|
||||
?>
|
||||
Loading…
Add table
Add a link
Reference in a new issue