ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/cvsroot/AnyEvent-Porttracker/Porttracker.pm
(Generate patch)

Comparing cvsroot/AnyEvent-Porttracker/Porttracker.pm (file contents):
Revision 1.17 by root, Mon Mar 11 08:43:53 2013 UTC vs.
Revision 1.19 by root, Tue Jul 26 16:12:46 2016 UTC

1=head1 NAME 1=head1 NAME
2 2
3AnyEvent::Porttracker - Porttracker/PortIQ API client interface. 3AnyEvent::Porttracker - Porttracker API client interface.
4 4
5=head1 SYNOPSIS 5=head1 SYNOPSIS
6 6
7 use AnyEvent::Porttracker; 7 use AnyEvent::Porttracker;
8 8
… …
67other things) scans switches and routers in a network and gives a coherent 67other things) scans switches and routers in a network and gives a coherent
68view of which end devices are connected to which switch ports on which 68view of which end devices are connected to which switch ports on which
69switches and routers. It also offers a JSON-based client API, for which 69switches and routers. It also offers a JSON-based client API, for which
70this module is an implementation. 70this module is an implementation.
71 71
72In addition to Porttracker, the PortIQ product is also supported, as it
73uses the same protocol.
74
75If you do not have access to either a Porttracker or PortIQ box then this 72If you do not have access to a Porttracker box then this module will be of
76module will be of little value to you. 73little value to you.
77 74
78This module is an L<AnyEvent> user, you need to make sure that you use and 75This module is an L<AnyEvent> user, you need to make sure that you use and
79run a supported event loop. 76run a supported event loop.
80 77
81To quickly understand how this module works you should read how to 78To quickly understand how this module works you should read how to
… …
104 101
105use AnyEvent (); 102use AnyEvent ();
106use AnyEvent::Handle (); 103use AnyEvent::Handle ();
107 104
108use MIME::Base64 (); 105use MIME::Base64 ();
109use Digest::HMAC_MD6 ();
110use JSON (); 106use JSON ();
111 107
112our $VERSION = '1.01'; 108our $VERSION = 1.02;
113 109
114sub call { 110sub call {
115 my ($self, $type, @args) = @_; 111 my ($self, $type, @args) = @_;
116 112
117 $self->{$type} 113 $self->{$type}
… …
121 : () 117 : ()
122} 118}
123 119
124=item $api = new AnyEvent::Porttracker [key => value...] 120=item $api = new AnyEvent::Porttracker [key => value...]
125 121
126Creates a new porttracker API connection object and tries to connect to 122Creates a new porttracker API connection object and tries to connect
127the specified host (see below). After the connection has been established, 123to the specified host (see below). After the connection has been
128the TLS handshake (if requested) will take place, followed by a login 124established, the TLS handshake (if requested) will take place, followed
129attempt using either the C<none>, C<login_cram_md6> or C<login> methods, 125by a login attempt using either the C<none>, C<login_cram_sha3>,
130in this order of preference (typically, C<login_cram_md6> is used, which 126C<login_cram_md6> or C<login> methods, in this order of preference
127(typically, C<login_cram_sha3> is used, which shields against some
131shields against some man-in-the-middle attacks and avoids transferring the 128man-in-the-middle attacks and avoids transferring the password).
132password).
133 129
134It is permissible to send requests immediately after creating the object - 130It is permissible to send requests immediately after creating the object -
135they will be queued until after successful login. 131they will be queued until after successful login.
136 132
137Possible key-value pairs are: 133Possible key-value pairs are:
… …
155 151
156Enables or disables TLS (default: disables). When enabled, then the 152Enables or disables TLS (default: disables). When enabled, then the
157connection will try to handshake a TLS connection before logging in. If 153connection will try to handshake a TLS connection before logging in. If
158unsuccessful a fatal error will be raised. 154unsuccessful a fatal error will be raised.
159 155
160Since most Porttracker/PortIQ boxes will not have a sensible/verifiable 156Since most Porttracker boxes will not have a sensible/verifiable
161certificate, no attempt at verifying it will be done (which means 157certificate, no attempt at verifying it will be done (which means
162man-in-the-middle-attacks will be trivial). If you want some form of 158man-in-the-middle-attacks will be trivial). If you want some form of
163verification you need to provide your own C<tls_ctx> object with C<< 159verification you need to provide your own C<tls_ctx> object with C<<
164verify => 1, verify_peername => [1, 1, 1] >> or whatever verification mode 160verify => 1, verify_peername => [1, 1, 1] >> or whatever verification mode
165you wish to use. 161you wish to use.
… …
411 407
412sub _login { 408sub _login {
413 my ($self) = @_; 409 my ($self) = @_;
414 410
415 my ($auths, $nonce) = @{ delete $self->{hello} or return }; 411 my ($auths, $nonce) = @{ delete $self->{hello} or return };
412 use Data::Dump; ddx $auths;#d#
416 413
417 if (grep $_ eq "none", @$auths) { 414 if (grep $_ eq "none", @$auths) {
418 $self->_login_success ("none"); 415 $self->_login_success ("none");
416 } elsif (grep $_ eq "login_cram_sha3", @$auths) {
417 my $cc = join "", map chr 256 * rand, 0..63;
419 418
419 require Digest::SHA3;
420 require Digest::HMAC;
421
422 my $hmac_sha3 = sub ($$){ # $key, $text
423 Digest::HMAC::hmac ($_[1], $_[0], \&Digest::SHA3::sha3_512, 72)
424 };
425
426 my $key = $hmac_sha3->($self->{pass}, $self->{user});
427 my $cr = $hmac_sha3->($key, "$cc$nonce");
428 my $sr = $hmac_sha3->($key, "$nonce$cc");
429
430 $cc = MIME::Base64::encode_base64 $cc;
431 $cr = MIME::Base64::encode_base64 $cr;
432
433 $self->_req (login_cram_sha3 => $self->{user}, $cr, $cc, sub {
434 my ($self, $ok, $msg) = @_;
435
436 $ok
437 or return call $self, on_login_failure => $msg;
438
439 (MIME::Base64::decode_base64 $msg) eq $sr
440 or return call $self, on_login_failure => "sr and cr mismatch, possible man in the middle attack";
441
442 $self->_login_success ("login_cram_sha3");
443 });
420 } elsif (grep $_ eq "login_cram_md6", @$auths) { 444 } elsif (grep $_ eq "login_cram_md6", @$auths) {
421 my $cc = join "", map chr 256 * rand, 0..63; 445 my $cc = join "", map chr 256 * rand, 0..63;
422 446
447 require Digest::HMAC_MD6;
448
423 my $key = Digest::HMAC_MD6::hmac_md6 $self->{pass}, $self->{user}, 64, 256; 449 my $key = Digest::HMAC_MD6::hmac_md6 ($self->{pass}, $self->{user}, 64, 256);
424 my $cr = Digest::HMAC_MD6::hmac_md6_base64 $key, "$cc$nonce", 64, 256; 450 my $cr = Digest::HMAC_MD6::hmac_md6 ($key, "$cc$nonce", 64, 256);
425 my $sr = Digest::HMAC_MD6::hmac_md6_base64 $key, "$nonce$cc", 64, 256; 451 my $sr = Digest::HMAC_MD6::hmac_md6 ($key, "$nonce$cc", 64, 256);
426 452
427 $cc = MIME::Base64::encode_base64 $cc; 453 $cc = MIME::Base64::encode_base64 $cc;
454 $cr = MIME::Base64::encode_base64 $cr;
428 455
429 $self->_req (login_cram_md6 => $self->{user}, $cr, $cc, sub { 456 $self->_req (login_cram_md6 => $self->{user}, $cr, $cc, sub {
430 my ($self, $ok, $msg) = @_; 457 my ($self, $ok, $msg) = @_;
431 458
432 $ok 459 $ok
433 or return call $self, on_login_failure => $msg; 460 or return call $self, on_login_failure => $msg;
434 461
435 $msg eq $sr 462 (MIME::Base64::decode_base64 $msg) eq $sr
436 or return call $self, on_login_failure => "sr and cr mismatch, possible man in the middle attack"; 463 or return call $self, on_login_failure => "sr and cr mismatch, possible man in the middle attack";
437 464
438 $self->_login_success ("login_cram_md6"); 465 $self->_login_success ("login_cram_md6");
439 }); 466 });
440 } elsif (grep $_ eq "login", @$auths) { 467 } elsif (grep $_ eq "login", @$auths) {
… …
586 613
587=back 614=back
588 615
589=head1 SEE ALSO 616=head1 SEE ALSO
590 617
591L<AnyEvent>, L<http://www.porttracker.com/>, L<http://www.infoblox.com/en/products/portiq.html>. 618L<AnyEvent>, L<http://www.porttracker.com/>.
592 619
593=head1 AUTHOR 620=head1 AUTHOR
594 621
595 Marc Lehmann <marc@nethype.de> 622 Marc Lehmann <marc@nethype.de>
596 623

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines