X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Finternal%2Fkernel%2FNodeHttp.java;h=4a6ad233799246036f73afd3748c538f81dde16c;hb=972528f4de2d00690362c01d3ce843ca9cd10250;hp=f0fbe461a1dfc8ecc5d5c5be3862c60587d48983;hpb=e038c47a876fc26692b12b10cc4ede0c79bfd549;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeHttp.java b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeHttp.java
index f0fbe461a..4a6ad2337 100644
--- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeHttp.java
+++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeHttp.java
@@ -1,36 +1,39 @@
 package org.argeo.cms.internal.kernel;
 
+import static javax.jcr.Property.JCR_DESCRIPTION;
+import static javax.jcr.Property.JCR_LAST_MODIFIED;
+import static javax.jcr.Property.JCR_TITLE;
+import static org.argeo.cms.CmsTypes.CMS_IMAGE;
+
 import java.io.IOException;
+import java.io.PrintWriter;
+import java.security.PrivilegedExceptionAction;
+import java.security.cert.X509Certificate;
+import java.util.Calendar;
+import java.util.Collection;
 import java.util.Enumeration;
-import java.util.Properties;
-import java.util.StringTokenizer;
 
+import javax.jcr.Node;
+import javax.jcr.NodeIterator;
+import javax.jcr.Repository;
+import javax.jcr.RepositoryException;
+import javax.jcr.Session;
+import javax.security.auth.Subject;
 import javax.servlet.FilterChain;
-import javax.servlet.Servlet;
 import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
+import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
-import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.argeo.cms.CmsException;
-import org.argeo.jackrabbit.servlet.OpenInViewSessionProvider;
-import org.argeo.jackrabbit.servlet.RemotingServlet;
-import org.argeo.jackrabbit.servlet.WebdavServlet;
 import org.argeo.jcr.ArgeoJcrConstants;
-import org.eclipse.equinox.http.servlet.ExtendedHttpService;
-import org.eclipse.jetty.servlets.DoSFilter;
+import org.argeo.jcr.JcrUtils;
 import org.osgi.framework.BundleContext;
-import org.osgi.service.http.NamespaceException;
-import org.osgi.util.tracker.ServiceTracker;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
+import org.osgi.framework.ServiceReference;
+import org.osgi.service.http.HttpService;
 
 /**
  * Intercepts and enriches http access, mainly focusing on security and
@@ -39,202 +42,227 @@ import org.springframework.security.core.context.SecurityContextHolder;
 class NodeHttp implements KernelConstants, ArgeoJcrConstants {
 	private final static Log log = LogFactory.getLog(NodeHttp.class);
 
-	private final static String ATTR_AUTH = "auth";
-	private final static String HEADER_AUTHORIZATION = "Authorization";
-	private final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
-
-	private final AuthenticationManager authenticationManager;
-	private final BundleContext bundleContext;
-	private ExtendedHttpService httpService;
-
-	// FIXME Make it more unique
-	private String httpAuthRealm = "Argeo";
-
 	// Filters
-	private final RootFilter rootFilter;
+	// private final RootFilter rootFilter;
+
 	// private final DoSFilter dosFilter;
 	// private final QoSFilter qosFilter;
 
-	// remoting
-	private OpenInViewSessionProvider sessionProvider;
-	private WebdavServlet publicWebdavServlet;
-	private WebdavServlet privateWebdavServlet;
-	private RemotingServlet publicRemotingServlet;
-	private RemotingServlet privateRemotingServlet;
-
-	NodeHttp(BundleContext bundleContext, JackrabbitNode node,
-			NodeSecurity authenticationManager) {
-		this.bundleContext = bundleContext;
-		this.authenticationManager = authenticationManager;
-
-		// Equinox dependency
-		ServiceTracker<ExtendedHttpService, ExtendedHttpService> st = new ServiceTracker<ExtendedHttpService, ExtendedHttpService>(
-				bundleContext, ExtendedHttpService.class, null);
-		st.open();
-		try {
-			httpService = st.waitForService(1000);
-		} catch (InterruptedException e) {
-			httpService = null;
-		}
+	private BundleContext bc;
 
-		if (httpService == null)
-			throw new CmsException("Could not find "
-					+ ExtendedHttpService.class + " service.");
-
-		// Filters
-		rootFilter = new RootFilter();
+	NodeHttp(HttpService httpService, BundleContext bc) {
+		this.bc = bc;
+		// rootFilter = new RootFilter();
 		// dosFilter = new CustomDosFilter();
 		// qosFilter = new QoSFilter();
 
-		// DAV
-		sessionProvider = new OpenInViewSessionProvider();
-		publicWebdavServlet = new WebdavServlet(node, sessionProvider);
-		privateWebdavServlet = new WebdavServlet(node, sessionProvider);
-		publicRemotingServlet = new RemotingServlet(node, sessionProvider);
-		privateRemotingServlet = new RemotingServlet(node, sessionProvider);
-	}
-
-	void publish() {
 		try {
-			registerWebdavServlet(PATH_WEBDAV_PUBLIC, ALIAS_NODE, true,
-					publicWebdavServlet);
-			registerWebdavServlet(PATH_WEBDAV_PRIVATE, ALIAS_NODE, false,
-					privateWebdavServlet);
-			registerRemotingServlet(PATH_REMOTING_PUBLIC, ALIAS_NODE, true,
-					publicRemotingServlet);
-			registerRemotingServlet(PATH_REMOTING_PRIVATE, ALIAS_NODE, false,
-					privateRemotingServlet);
-
-			// httpService.registerFilter("/", dosFilter, null, null);
-			httpService.registerFilter("/", rootFilter, null, null);
-			// httpService.registerFilter("/", qosFilter, null, null);
+			httpService.registerServlet("/!", new LinkServlet(), null, null);
+			httpService.registerServlet("/robots.txt", new RobotServlet(), null, null);
 		} catch (Exception e) {
-			throw new CmsException("Cannot publish HTTP services to OSGi", e);
+			throw new CmsException("Cannot register filters", e);
 		}
 	}
 
-	private void registerWebdavServlet(String pathPrefix, String alias,
-			Boolean anonymous, WebdavServlet webdavServlet)
-			throws NamespaceException, ServletException {
-		String path = pathPrefix + "/" + alias;
-		Properties initParameters = new Properties();
-		initParameters.setProperty(WebdavServlet.INIT_PARAM_RESOURCE_CONFIG,
-				KernelConstants.WEBDAV_CONFIG);
-		initParameters.setProperty(
-				WebdavServlet.INIT_PARAM_RESOURCE_PATH_PREFIX, path);
-		httpService.registerFilter(path, anonymous ? new AnonymousFilter()
-				: new DavFilter(), null, null);
-		// Cast to servlet because of a weird behaviour in Eclipse
-		httpService.registerServlet(path, (Servlet) webdavServlet,
-				initParameters, null);
+	public void destroy() {
 	}
 
-	private void registerRemotingServlet(String pathPrefix, String alias,
-			Boolean anonymous, RemotingServlet remotingServlet)
-			throws NamespaceException, ServletException {
-		String path = pathPrefix + "/" + alias;
-		Properties initParameters = new Properties();
-		initParameters.setProperty(
-				RemotingServlet.INIT_PARAM_RESOURCE_PATH_PREFIX, path);
-
-		// Looks like a bug in Jackrabbit remoting init
-		initParameters.setProperty(RemotingServlet.INIT_PARAM_HOME,
-				KernelUtils.getOsgiInstanceDir(bundleContext)
-						+ "/tmp/jackrabbit");
-		initParameters.setProperty(RemotingServlet.INIT_PARAM_TMP_DIRECTORY,
-				"remoting");
-		// Cast to servlet because of a weird behaviour in Eclipse
-		httpService.registerFilter(path, anonymous ? new AnonymousFilter()
-				: new DavFilter(), null, null);
-		httpService.registerServlet(path, (Servlet) remotingServlet,
-				initParameters, null);
-	}
+	class LinkServlet extends HttpServlet {
+		private static final long serialVersionUID = 3749990143146845708L;
 
-	private Boolean isSessionAuthenticated(HttpSession httpSession) {
-		SecurityContext contextFromSession = (SecurityContext) httpSession
-				.getAttribute(SPRING_SECURITY_CONTEXT_KEY);
-		return contextFromSession != null;
-	}
+		@Override
+		protected void service(HttpServletRequest request, HttpServletResponse response)
+				throws ServletException, IOException {
+			String path = request.getPathInfo();
+			String userAgent = request.getHeader("User-Agent").toLowerCase();
+			boolean isBot = false;
+			boolean isCompatibleBrowser = false;
+			if (userAgent.contains("bot") || userAgent.contains("facebook") || userAgent.contains("twitter")) {
+				isBot = true;
+			} else if (userAgent.contains("webkit") || userAgent.contains("gecko") || userAgent.contains("firefox")
+					|| userAgent.contains("msie") || userAgent.contains("chrome") || userAgent.contains("chromium")
+					|| userAgent.contains("opera") || userAgent.contains("browser")) {
+				isCompatibleBrowser = true;
+			}
 
-	private void requestBasicAuth(HttpSession httpSession,
-			HttpServletResponse response) {
-		response.setStatus(401);
-		response.setHeader(HEADER_WWW_AUTHENTICATE, "basic realm=\""
-				+ httpAuthRealm + "\"");
-		httpSession.setAttribute(ATTR_AUTH, Boolean.TRUE);
-	}
+			if (isBot) {
+				log.warn("# BOT " + request.getHeader("User-Agent"));
+				canonicalAnswer(request, response, path);
+				return;
+			}
 
-	private UsernamePasswordAuthenticationToken basicAuth(String authHeader) {
-		if (authHeader != null) {
-			StringTokenizer st = new StringTokenizer(authHeader);
-			if (st.hasMoreTokens()) {
-				String basic = st.nextToken();
-				if (basic.equalsIgnoreCase("Basic")) {
-					try {
-						String credentials = new String(Base64.decodeBase64(st
-								.nextToken()), "UTF-8");
-						// log.debug("Credentials: " + credentials);
-						int p = credentials.indexOf(":");
-						if (p != -1) {
-							String login = credentials.substring(0, p).trim();
-							String password = credentials.substring(p + 1)
-									.trim();
-
-							return new UsernamePasswordAuthenticationToken(
-									login, password.toCharArray());
-						} else {
-							throw new CmsException(
-									"Invalid authentication token");
-						}
-					} catch (Exception e) {
-						throw new CmsException(
-								"Couldn't retrieve authentication", e);
+			if (isCompatibleBrowser && log.isTraceEnabled())
+				log.trace("# BWS " + request.getHeader("User-Agent"));
+			redirectTo(response, "/#" + path);
+		}
+
+		private void redirectTo(HttpServletResponse response, String location) {
+			response.setHeader("Location", location);
+			response.setStatus(HttpServletResponse.SC_FOUND);
+		}
+
+		// private boolean canonicalAnswerNeededBy(HttpServletRequest request) {
+		// String userAgent = request.getHeader("User-Agent").toLowerCase();
+		// return userAgent.startsWith("facebookexternalhit/");
+		// }
+
+		/** For bots which don't understand RWT. */
+		private void canonicalAnswer(HttpServletRequest request, HttpServletResponse response, String path) {
+			Session session = null;
+			try {
+				PrintWriter writer = response.getWriter();
+				session = Subject.doAs(KernelUtils.anonymousLogin(), new PrivilegedExceptionAction<Session>() {
+
+					@Override
+					public Session run() throws Exception {
+						Collection<ServiceReference<Repository>> srs = bc.getServiceReferences(Repository.class, "("
+								+ ArgeoJcrConstants.JCR_REPOSITORY_ALIAS + "=" + ArgeoJcrConstants.ALIAS_NODE + ")");
+						Repository repository = bc.getService(srs.iterator().next());
+						return repository.login();
+					}
+
+				});
+				Node node = session.getNode(path);
+				String title = node.hasProperty(JCR_TITLE) ? node.getProperty(JCR_TITLE).getString() : node.getName();
+				String desc = node.hasProperty(JCR_DESCRIPTION) ? node.getProperty(JCR_DESCRIPTION).getString() : null;
+				Calendar lastUpdate = node.hasProperty(JCR_LAST_MODIFIED)
+						? node.getProperty(JCR_LAST_MODIFIED).getDate() : null;
+				String url = KernelUtils.getCanonicalUrl(node, request);
+				String imgUrl = null;
+				loop: for (NodeIterator it = node.getNodes(); it.hasNext();) {
+					// Takes the first found cms:image
+					Node child = it.nextNode();
+					if (child.isNodeType(CMS_IMAGE)) {
+						imgUrl = KernelUtils.getDataUrl(child, request);
+						break loop;
 					}
 				}
+				StringBuilder buf = new StringBuilder();
+				buf.append("<html>");
+				buf.append("<head>");
+				writeMeta(buf, "og:title", escapeHTML(title));
+				writeMeta(buf, "og:type", "website");
+				buf.append("<meta name='twitter:card' content='summary' />");
+				buf.append("<meta name='twitter:site' content='@argeo_org' />");
+				writeMeta(buf, "og:url", url);
+				if (desc != null)
+					writeMeta(buf, "og:description", escapeHTML(desc));
+				if (imgUrl != null)
+					writeMeta(buf, "og:image", imgUrl);
+				if (lastUpdate != null)
+					writeMeta(buf, "og:updated_time", Long.toString(lastUpdate.getTime().getTime()));
+				buf.append("</head>");
+				buf.append("<body>");
+				buf.append(
+						"<p><b>!! This page is meant for indexing robots, not for real people," + " visit <a href='/#")
+						.append(path).append("'>").append(escapeHTML(title)).append("</a> instead.</b></p>");
+				writeCanonical(buf, node);
+				buf.append("</body>");
+				buf.append("</html>");
+				writer.print(buf.toString());
+
+				response.setHeader("Content-Type", "text/html");
+				writer.flush();
+			} catch (Exception e) {
+				throw new CmsException("Cannot write canonical answer", e);
+			} finally {
+				JcrUtils.logoutQuietly(session);
 			}
 		}
-		throw new CmsException("Couldn't retrieve authentication");
+
+		/**
+		 * From
+		 * http://stackoverflow.com/questions/1265282/recommended-method-for-
+		 * escaping-html-in-java (+ escaping '). TODO Use
+		 * org.apache.commons.lang.StringEscapeUtils
+		 */
+		private String escapeHTML(String s) {
+			StringBuilder out = new StringBuilder(Math.max(16, s.length()));
+			for (int i = 0; i < s.length(); i++) {
+				char c = s.charAt(i);
+				if (c > 127 || c == '\'' || c == '"' || c == '<' || c == '>' || c == '&') {
+					out.append("&#");
+					out.append((int) c);
+					out.append(';');
+				} else {
+					out.append(c);
+				}
+			}
+			return out.toString();
+		}
+
+		private void writeMeta(StringBuilder buf, String tag, String value) {
+			buf.append("<meta property='").append(tag).append("' content='").append(value).append("'/>");
+		}
+
+		private void writeCanonical(StringBuilder buf, Node node) throws RepositoryException {
+			buf.append("<div>");
+			if (node.hasProperty(JCR_TITLE))
+				buf.append("<p>").append(node.getProperty(JCR_TITLE).getString()).append("</p>");
+			if (node.hasProperty(JCR_DESCRIPTION))
+				buf.append("<p>").append(node.getProperty(JCR_DESCRIPTION).getString()).append("</p>");
+			NodeIterator children = node.getNodes();
+			while (children.hasNext()) {
+				writeCanonical(buf, children.nextNode());
+			}
+			buf.append("</div>");
+		}
+	}
+
+	class RobotServlet extends HttpServlet {
+		private static final long serialVersionUID = 7935661175336419089L;
+
+		@Override
+		protected void service(HttpServletRequest request, HttpServletResponse response)
+				throws ServletException, IOException {
+			PrintWriter writer = response.getWriter();
+			writer.append("User-agent: *\n");
+			writer.append("Disallow:\n");
+			response.setHeader("Content-Type", "text/plain");
+			writer.flush();
+		}
+
 	}
 
 	/** Intercepts all requests. Authenticates. */
 	class RootFilter extends HttpFilter {
 
 		@Override
-		public void doFilter(HttpSession httpSession,
-				HttpServletRequest request, HttpServletResponse response,
+		public void doFilter(HttpSession httpSession, HttpServletRequest request, HttpServletResponse response,
 				FilterChain filterChain) throws IOException, ServletException {
 			if (log.isTraceEnabled()) {
-				log.debug(request.getContextPath());
-				log.debug(request.getServletPath());
-				log.debug(request.getRequestURI());
-				log.debug(request.getQueryString());
-				StringBuilder buf = new StringBuilder();
-				Enumeration<String> en = request.getHeaderNames();
-				while (en.hasMoreElements()) {
-					String header = en.nextElement();
-					Enumeration<String> values = request.getHeaders(header);
-					while (values.hasMoreElements())
-						buf.append("  " + header + ": " + values.nextElement());
-					buf.append('\n');
-				}
-				log.debug("\n" + buf);
+				log.trace(request.getRequestURL()
+						.append(request.getQueryString() != null ? "?" + request.getQueryString() : ""));
+				logRequest(request);
 			}
 
 			String servletPath = request.getServletPath();
 
+			// client certificate
+			X509Certificate clientCert = extractCertificate(request);
+			if (clientCert != null) {
+				// TODO authenticate
+				// if (log.isDebugEnabled())
+				// log.debug(clientCert.getSubjectX500Principal().getName());
+			}
+
 			// skip data
 			if (servletPath.startsWith(PATH_DATA)) {
 				filterChain.doFilter(request, response);
 				return;
 			}
 
+			// skip /ui (workbench) for the time being
+			if (servletPath.startsWith(PATH_WORKBENCH)) {
+				filterChain.doFilter(request, response);
+				return;
+			}
+
 			// redirect long RWT paths to anchor
-			String path = request.getRequestURI().substring(
-					servletPath.length());
+			String path = request.getRequestURI().substring(servletPath.length());
 			int pathLength = path.length();
-			if (pathLength != 0 && (path.charAt(0) == '/')
-					&& !servletPath.endsWith("rwt-resources")
-					&& !path.equals("/")) {
+			if (pathLength != 0 && (path.charAt(0) == '/') && !servletPath.endsWith("rwt-resources")
+					&& !path.startsWith(KernelConstants.PATH_WORKBENCH) && path.lastIndexOf('/') != 0) {
 				String newLocation = request.getServletPath() + "#" + path;
 				response.setHeader("Location", newLocation);
 				response.setStatus(HttpServletResponse.SC_FOUND);
@@ -246,68 +274,54 @@ class NodeHttp implements KernelConstants, ArgeoJcrConstants {
 		}
 	}
 
-	/** Intercepts all requests. Authenticates. */
-	class AnonymousFilter extends HttpFilter {
-		@Override
-		public void doFilter(HttpSession httpSession,
-				HttpServletRequest request, HttpServletResponse response,
-				FilterChain filterChain) throws IOException, ServletException {
-
-			// Authenticate from session
-			if (isSessionAuthenticated(httpSession)) {
-				filterChain.doFilter(request, response);
-				return;
-			}
-
-			KernelUtils.anonymousLogin(authenticationManager);
-			filterChain.doFilter(request, response);
+	private void logRequest(HttpServletRequest request) {
+		log.debug("contextPath=" + request.getContextPath());
+		log.debug("servletPath=" + request.getServletPath());
+		log.debug("requestURI=" + request.getRequestURI());
+		log.debug("queryString=" + request.getQueryString());
+		StringBuilder buf = new StringBuilder();
+		// headers
+		Enumeration<String> en = request.getHeaderNames();
+		while (en.hasMoreElements()) {
+			String header = en.nextElement();
+			Enumeration<String> values = request.getHeaders(header);
+			while (values.hasMoreElements())
+				buf.append("  " + header + ": " + values.nextElement());
+			buf.append('\n');
 		}
-	}
-
-	/** Intercepts all requests. Authenticates. */
-	class DavFilter extends HttpFilter {
-
-		@Override
-		public void doFilter(HttpSession httpSession,
-				HttpServletRequest request, HttpServletResponse response,
-				FilterChain filterChain) throws IOException, ServletException {
 
-			// Authenticate from session
-			// if (isSessionAuthenticated(httpSession)) {
-			// filterChain.doFilter(request, response);
-			// return;
-			// }
-
-			// Process basic auth
-			String basicAuth = request.getHeader(HEADER_AUTHORIZATION);
-			if (basicAuth != null) {
-				UsernamePasswordAuthenticationToken token = basicAuth(basicAuth);
-				Authentication auth = authenticationManager.authenticate(token);
-				SecurityContextHolder.getContext().setAuthentication(auth);
-				httpSession.setAttribute(SPRING_SECURITY_CONTEXT_KEY,
-						SecurityContextHolder.getContext());
-				httpSession.setAttribute(ATTR_AUTH, Boolean.FALSE);
-				filterChain.doFilter(request, response);
-				return;
-			}
-
-			requestBasicAuth(httpSession, response);
+		// attributed
+		Enumeration<String> an = request.getAttributeNames();
+		while (an.hasMoreElements()) {
+			String attr = an.nextElement();
+			Object value = request.getAttribute(attr);
+			buf.append("  " + attr + ": " + value);
+			buf.append('\n');
 		}
+		log.debug("\n" + buf);
 	}
 
-	class CustomDosFilter extends DoSFilter {
-		@Override
-		protected String extractUserId(ServletRequest request) {
-			HttpSession httpSession = ((HttpServletRequest) request)
-					.getSession();
-			if (isSessionAuthenticated(httpSession)) {
-				String userId = ((SecurityContext) httpSession
-						.getAttribute(SPRING_SECURITY_CONTEXT_KEY))
-						.getAuthentication().getName();
-				return userId;
-			}
-			return super.extractUserId(request);
-
+	private X509Certificate extractCertificate(HttpServletRequest req) {
+		X509Certificate[] certs = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
+		if (null != certs && certs.length > 0) {
+			return certs[0];
 		}
+		return null;
 	}
+
+	// class CustomDosFilter extends DoSFilter {
+	// @Override
+	// protected String extractUserId(ServletRequest request) {
+	// HttpSession httpSession = ((HttpServletRequest) request)
+	// .getSession();
+	// if (isSessionAuthenticated(httpSession)) {
+	// String userId = ((SecurityContext) httpSession
+	// .getAttribute(SPRING_SECURITY_CONTEXT_KEY))
+	// .getAuthentication().getName();
+	// return userId;
+	// }
+	// return super.extractUserId(request);
+	//
+	// }
+	// }
 }