[ViewVC] Diff of: cvs/AnyEvent-MP/MP/Transport.pm

Comparing AnyEvent-MP/MP/Transport.pm (file contents):
Revision 1.5 by root, Sun Aug 2 14:44:37 2009 UTC vs.
Revision 1.8 by root, Mon Aug 3 14:58:13 2009 UTC

…		…
9	=head1 DESCRIPTION	9	=head1 DESCRIPTION
10		10
11	This is the superclass for MP transports, most of which is considered an	11	This is the superclass for MP transports, most of which is considered an
12	implementation detail.	12	implementation detail.
13		13
14	Future versions might document the actual protocol.	14	See the "PROTOCOL" section below if you want to write another client for
		15	this protocol.
15		16
16	=head1 FUNCTIONS/METHODS	17	=head1 FUNCTIONS/METHODS
17		18
18	=over 4	19	=over 4
19		20
…		…
29	use JSON::XS ();	30	use JSON::XS ();
30		31
31	use AE ();	32	use AE ();
32	use AnyEvent::Socket ();	33	use AnyEvent::Socket ();
33	use AnyEvent::Handle ();	34	use AnyEvent::Handle ();
34
35	use AnyEvent::MP::Util ();
36		35
37	use base Exporter::;	36	use base Exporter::;
38		37
39	our $VERSION = '0.0';	38	our $VERSION = '0.0';
40	our $PROTOCOL_VERSION = 0;	39	our $PROTOCOL_VERSION = 0;
…		…
113	peername => $peername, # for verification	112	peername => $peername, # for verification
114	;	113	;
115		114
116	=cut	115	=cut
117		116
118	our @FRAMING_WANT = qw(json storable);#d##TODO#	117	our @FRAMINGS = qw(json storable); # the framing types we accept and send, in order of preference
		118	our @AUTH_SND = qw(hmac_md6_64_256); # auth types we send
		119	our @AUTH_RCV = (@AUTH_SND, qw(hex_secret)); # auth types we accept
		120
		121	#AnyEvent::Handle::register_write_type mp_record => sub {
		122	#};
119		123
120	sub new {	124	sub new {
121	my ($class, %arg) = @_;	125	my ($class, %arg) = @_;
122		126
123	my $self = bless \%arg, $class;	127	my $self = bless \%arg, $class;
…		…
126		130
127	{	131	{
128	Scalar::Util::weaken (my $self = $self);	132	Scalar::Util::weaken (my $self = $self);
129		133
130	if (exists $arg{connect}) {	134	if (exists $arg{connect}) {
131	$arg{tls} \|\|= "connect";
132	$arg{tls_ctx} \|\|= { sslv2 => 0, sslv3 => 0, tlsv1 => 1, verify => 1 };	135	$arg{tls_ctx} \|\|= { sslv2 => 0, sslv3 => 0, tlsv1 => 1, verify => 1 };
133	}	136	}
134		137
135	$arg{secret} = AnyEvent::MP::Base::default_secret ()	138	$arg{secret} = AnyEvent::MP::Base::default_secret ()
136	unless exists $arg{secret};	139	unless exists $arg{secret};
…		…
146	peername => delete $arg{peername},	149	peername => delete $arg{peername},
147	;	150	;
148		151
149	my $secret = $arg{secret};	152	my $secret = $arg{secret};
150	my $greeting_kv = $self->{greeting} \|\|= {};	153	my $greeting_kv = $self->{greeting} \|\|= {};
151	$greeting_kv->{"tls1.0"} \|\|= $arg{tls}	154	$greeting_kv->{"tls"} = "1.0"
152	if exists $arg{tls} && $arg{tls_ctx};	155	if $arg{tls_ctx};
153	$greeting_kv->{provider} = "AE-$VERSION";	156	$greeting_kv->{provider} = "AE-$VERSION";
		157	$greeting_kv->{peeraddr} = AnyEvent::Socket::format_hostport $self->{peerhost}, $self->{peerport};
154		158
155	# send greeting	159	# send greeting
156	my $lgreeting = "aemp;$PROTOCOL_VERSION;$PROTOCOL_VERSION" # version, min	160	my $lgreeting1 = "aemp;$PROTOCOL_VERSION;$PROTOCOL_VERSION" # version, min
157	. ";$AnyEvent::MP::Base::UNIQ"	161	. ";$AnyEvent::MP::Base::UNIQ"
158	. ";$AnyEvent::MP::Base::NODE"	162	. ";$AnyEvent::MP::Base::NODE"
159	. ";" . (MIME::Base64::encode_base64 AnyEvent::MP::Base::nonce (33), "")	163	. ";" . (join ",", @AUTH_RCV)
160	. ";hmac_md6_64_256" # hardcoded atm.	164	. ";" . (join ",", @FRAMINGS)
161	. ";json" # hardcoded atm.
162	. ";$self->{peerhost};$self->{peerport}"
163	. (join "", map ";$_=$greeting_kv->{$_}", keys %$greeting_kv);	165	. (join "", map ";$_=$greeting_kv->{$_}", keys %$greeting_kv);
		166	my $lgreeting2 = MIME::Base64::encode_base64 AnyEvent::MP::Base::nonce (33), "";
164		167
165	$self->{hdl}->push_write ("$lgreeting\012");	168	$self->{hdl}->push_write ("$lgreeting1\012$lgreeting2\012");
166		169
167	# expect greeting	170	# expect greeting
168	$self->{hdl}->push_read (line => sub {	171	$self->{hdl}->push_read (line => sub {
169	my $rgreeting = $_[1];	172	my $rgreeting1 = $_[1];
170		173
171	my ($aemp, $version, $version_min, $uniq, $rnode, undef, $auth, $framing, $peerport, $peerhost, @kv) = split /;/, $rgreeting;	174	my ($aemp, $version, $version_min, $uniq, $rnode, $auths, $framings, @kv) = split /;/, $rgreeting1;
172		175
173	if ($aemp ne "aemp") {	176	if ($aemp ne "aemp") {
174	return $self->error ("unparsable greeting");	177	return $self->error ("unparsable greeting");
175	} elsif ($version_min > $PROTOCOL_VERSION) {	178	} elsif ($version_min > $PROTOCOL_VERSION) {
176	return $self->error ("version mismatch (we: $PROTOCOL_VERSION, they: $version_min .. $version)");	179	return $self->error ("version mismatch (we: $PROTOCOL_VERSION, they: $version_min .. $version)");
177	} elsif ($auth ne "hmac_md6_64_256") {
178	return $self->error ("unsupported auth method ($auth)");
179	} elsif ($framing ne "json") {
180	return $self->error ("unsupported framing method ($auth)");
181	}	180	}
		181
		182	my $s_auth;
		183	for my $auth_ (split /,/, $auths) {
		184	if (grep $auth_ eq $_, @AUTH_SND) {
		185	$s_auth = $auth_;
		186	last;
		187	}
		188	}
		189
		190	defined $s_auth
		191	or return $self->error ("$auths: no common auth type supported");
		192
		193	die unless $s_auth eq "hmac_md6_64_256"; # hardcoded atm.
		194
		195	my $s_framing;
		196	for my $framing_ (split /,/, $framings) {
		197	if (grep $framing_ eq $_, @FRAMINGS) {
		198	$s_framing = $framing_;
		199	last;
		200	}
		201	}
		202
		203	defined $s_framing
		204	or return $self->error ("$framings: no common framing method supported");
182		205
183	$self->{remote_uniq} = $uniq;	206	$self->{remote_uniq} = $uniq;
184	$self->{remote_node} = $rnode;	207	$self->{remote_node} = $rnode;
185		208
186	$self->{remote_greeting} = {	209	$self->{remote_greeting} = {
187	map /^([^=]+)(?:=(.*))?/ ? ($1 => $2) : (),	210	map /^([^=]+)(?:=(.*))?/ ? ($1 => $2) : (),
188	@kv	211	@kv
189	};	212	};
190		213
191	if (exists $self->{tls} and $self->{tls_ctx} and exists $self->{remote_greeting}{"tls1.0"}) {	214	# read nonce
		215	$self->{hdl}->push_read (line => sub {
		216	my $rgreeting2 = $_[1];
		217
192	if ($self->{tls} ne $self->{remote_greeting}{"tls1.0"}) {	218	if ($self->{tls_ctx} and 1 == int $self->{remote_greeting}{"tls"}) {
193	return $self->error ("TLS server/client mismatch");	219	$self->{tls} = $lgreeting2 lt $rgreeting2 ? "connect" : "accept";
		220	$self->{hdl}->starttls ($self->{tls}, $self->{tls_ctx});
194	}	221	}
195	$self->{hdl}->starttls ($self->{tls}, $self->{tls_ctx});
196	}	222
197
198	# auth	223	# auth
199	require Digest::MD6;	224	require Digest::MD6;
200	require Digest::HMAC_MD6;	225	require Digest::HMAC_MD6;
201		226
202	my $key = Digest::MD6::md6_hex ($secret);	227	my $key = Digest::MD6::md6_hex ($secret);
203	my $lauth = Digest::HMAC_MD6::hmac_md6_base64 ($key, "$lgreeting\012$rgreeting", 64, 256);	228	my $lauth = Digest::HMAC_MD6::hmac_md6_base64 ($key, "$lgreeting1\012$lgreeting2\012$rgreeting1\012$rgreeting2\012", 64, 256);
204	my $rauth = Digest::HMAC_MD6::hmac_md6_base64 ($key, "$rgreeting\012$lgreeting", 64, 256);
205		229
		230	my $rauth =
		231	$s_auth eq "hmac_md6_64_256" ? Digest::HMAC_MD6::hmac_md6_base64 ($key, "$rgreeting1\012$rgreeting2\012$lgreeting1\012$lgreeting2\012", 64, 256)
		232	: $s_auth eq "hex_secret" ? unpack "H*", $secret
		233	: die;
		234
206	$lauth ne $rauth # echo attack?	235	$lauth ne $rauth # echo attack?
207	or return $self->error ("authentication error");	236	or return $self->error ("authentication error");
208		237
209	$self->{hdl}->push_write ("$auth;$lauth;$framing\012");	238	$self->{hdl}->push_write ("$s_auth;$lauth;$s_framing\012");
210		239
211	$self->{hdl}->rbuf_max (64); # enough for 44 reply bytes or so	240	$self->{hdl}->rbuf_max (64); # enough for 44 reply bytes or so
212	$self->{hdl}->push_read (line => sub {	241	$self->{hdl}->push_read (line => sub {
213	my ($hdl, $rline) = @_;	242	my ($hdl, $rline) = @_;
214		243
215	my ($auth_method, $rauth2, $r_framing) = split /;/, $rline;	244	my ($auth_method, $rauth2, $r_framing) = split /;/, $rline;
216		245
217	if ($rauth2 ne $rauth) {	246	if ($rauth2 ne $rauth) {
218	return $self->error ("authentication failure/shared secret mismatch");	247	return $self->error ("authentication failure/shared secret mismatch");
219	}	248	}
220		249
221	$self->{s_framing} = "json";#d#	250	$self->{s_framing} = $s_framing;
222		251
223	$hdl->rbuf_max (undef);	252	$hdl->rbuf_max (undef);
224	my $queue = delete $self->{queue}; # we are connected	253	my $queue = delete $self->{queue}; # we are connected
225		254
226	$self->connected;	255	$self->connected;
227		256
228	$hdl->push_write ($self->{s_framing} => $_)	257	$hdl->push_write ($self->{s_framing} => $_)
229	for @$queue;	258	for @$queue;
230		259
231	my $rmsg; $rmsg = sub {	260	my $rmsg; $rmsg = sub {
232	$_[0]->push_read ($r_framing => $rmsg);	261	$_[0]->push_read ($r_framing => $rmsg);
233		262
234	AnyEvent::MP::Base::_inject ($_[1]);	263	AnyEvent::MP::Base::_inject ($_[1]);
235	};	264	};
236	$hdl->push_read ($r_framing => $rmsg);	265	$hdl->push_read ($r_framing => $rmsg);
		266	});
237	});	267	});
238	});	268	});
239	}	269	}
240		270
241	$self	271	$self
…		…
245	my ($self, $msg) = @_;	275	my ($self, $msg) = @_;
246		276
247	if ($self->{node} && $self->{node}{transport} == $self) {	277	if ($self->{node} && $self->{node}{transport} == $self) {
248	$self->{node}->clr_transport;	278	$self->{node}->clr_transport;
249	}	279	}
250	# $self->{on_error}($self, $msg);	280	$AnyEvent::MP::Base::WARN->("$self->{peerhost}:$self->{peerport}: $msg");
251	$self->destroy;	281	$self->destroy;
252	}	282	}
253		283
254	sub connected {	284	sub connected {
255	my ($self) = @_;	285	my ($self) = @_;
…		…
276	$self->destroy;	306	$self->destroy;
277	}	307	}
278		308
279	=back	309	=back
280		310
		311	=head1 PROTOCOL
		312
		313	The protocol is relatively simple, and consists of three phases which are
		314	symmetrical for both sides: greeting (followed by optionally switching to
		315	TLS mode), authentication and packet exchange.
		316
		317	the protocol is designed to allow both full-text and binary streams.
		318
		319	The greeting consists of two text lines that are ended by either an ASCII
		320	CR LF pair, or a single ASCII LF (recommended).
		321
		322	=head2 GREETING
		323
		324	The first line contains strings separated (not ended) by C<;>
		325	characters. The first seven strings are fixed by the protocol, the
		326	remaining strings are C<KEY=VALUE> pairs. None of them may contain C<;>
		327	characters themselves.
		328
		329	The seven fixed strings are:
		330
		331	=over 4
		332
		333	=item C<aemp>
		334
		335	The constant C<aemp> to identify the protocol.
		336
		337	=item protocol version
		338
		339	The (maximum) protocol version supported by this end, currently C<0>.
		340
		341	=item minimum protocol version
		342
		343	The minimum protocol version supported by this end, currently C<0>.
		344
		345	=item a token uniquely identifying the current node instance
		346
		347	This is a string that must change between restarts. It usually contains
		348	things like the current time, the (OS) process id or similar values, but
		349	no meaning of the contents are assumed.
		350
		351	=item the node endpoint descriptors
		352
		353	for public nodes, this is a comma-separated list of protocol endpoints,
		354	i.e., the noderef. For slave nodes, this is a unique identifier.
		355
		356	=item the acceptable authentication methods
		357
		358	A comma-separated list of authentication methods supported by the
		359	node. Note that AnyEvent::MP supports a C<hex_secret> authentication
		360	method that accepts a cleartext password (hex-encoded), but will not use
		361	this auth method itself.
		362
		363	The receiving side should choose the first auth method it supports.
		364
		365	=item the acceptable framing formats
		366
		367	A comma-separated list of packet encoding/framign formats understood. The
		368	receiving side should choose the first framing format it supports for
		369	sending packets (which might be different from the format it has to accept).
		370
		371	=cut
		372
		373	The remaining arguments are C<KEY=VALUE> pairs. The following key-value
		374	pairs are known at this time:
		375
		376	=over 4
		377
		378	=item provider=<module-version>
		379
		380	The software provider for this implementation. For AnyEvent::MP, this is
		381	C<AE-0.0> or whatever version it currently is at.
		382
		383	=item peeraddr=<host>:<port>
		384
		385	The peer address (socket address of the other side) as seen locally, in the same format
		386	as noderef endpoints.
		387
		388	=item tls=<major>.<minor>
		389
		390	Indicates that the other side supports TLS (version should be 1.0) and
		391	wishes to do a TLS handshake.
		392
		393	=back
		394
		395	After this greeting line there will be a second line containing a
		396	cryptographic nonce, i.e. random data of high quality. To keep the
		397	protocol text-only, these are usually 32 base64-encoded octets, but
		398	it could be anything that doesn't contain any ASCII CR or ASCII LF
		399	characters.
		400
		401	Example of the two lines of greeting:
		402
		403	aemp;0;0;e7d.4a76f48f;10.0.0.1:4040;hmac_md6_64_256,hex_secret;json,storable;provider=AE-0.0;peeraddr=127.0.0.1:1235
		404	XntegV2Guvss0qNn7phCPnoU87xqxV+4Mqm/5y4iQm6a
		405
		406	=head2 TLS handshake
		407
		408	If, after the handshake, both sides indicate interest in TLS, then the
		409	connection I<must> use TLS, or fail.
		410
		411	Both sides compare their nonces, and the side who sent the lower nonce
		412	value ("string" comparison on the raw octet values) becomes the client,
		413	and the one with the higher nonce the server.
		414
		415	=head2 AUTHENTICATION PHASE
		416
		417	After the greeting is received (and the optional TLS handshake),
		418	the authentication phase begins, which consists of sending a single
		419	C<;>-separated line with three fixed strings and any number of
		420	C<KEY=VALUE> pairs.
		421
		422	The three fixed strings are:
		423
		424	=over 4
		425
		426	=item the authentication method chosen
		427
		428	This must be one of the methods offered by the other side in the greeting.
		429
		430	=item the authentication data
		431
		432	The authentication data itself, usually base64 or hex-encoded data.
		433
		434	=item the framing protocol chosen
		435
		436	This must be one of the framing protocols offered by the other side in the
		437	greeting. Each side must accept the choice of the other side.
		438
		439	=back
		440
		441	=head2 DATA PHASE
		442
		443	After this, packets get exchanged using the chosen framing protocol. It is
		444	quite possible that both sides use a different framing protocol.
		445
281	=head1 SEE ALSO	446	=head1 SEE ALSO
282		447
283	L<AnyEvent>.	448	L<AnyEvent>.
284		449
285	=head1 AUTHOR	450	=head1 AUTHOR

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing AnyEvent-MP/MP/Transport.pm (file contents): Revision 1.5 by root, Sun Aug 2 14:44:37 2009 UTC vs. Revision 1.8 by root, Mon Aug 3 14:58:13 2009 UTC

Diff Legend

Comparing AnyEvent-MP/MP/Transport.pm (file contents):
Revision 1.5 by root, Sun Aug 2 14:44:37 2009 UTC vs.
Revision 1.8 by root, Mon Aug 3 14:58:13 2009 UTC