1#@!#!123s

: / usr / share / nmap / nselib /
Filename : ajp.lua
back
local base64 = require "base64"
local bin = require "bin"
local http = require "http"
local match = require "match"
local nmap = require "nmap"
local package = require "package"
local stdnse = require "stdnse"
local table = require "table"
local url = require "url"
_ENV = stdnse.module("ajp", stdnse.seeall)

---
-- A basic AJP 1.3 implementation based on documentation available from Apache
-- mod_proxy_ajp; http://httpd.apache.org/docs/2.2/mod/mod_proxy_ajp.html
--
-- @author "Patrik Karlsson <patrik@cqure.net>"
--

AJP = {
	
	-- The magic prefix that has to be present in all requests
	Magic = 0x1234,
	
	-- Methods encoded as numeric values
	Method = {
		['OPTIONS'] = 1,
		['GET'] = 2,
		['HEAD'] = 3,
		['POST'] = 4,
		['PUT']  = 5,
		['DELETE'] = 6,
		['TRACE'] = 7,
		['PROPFIND'] = 8,
		['PROPPATCH'] = 9,
		['MKCOL'] = 10,
		['COPY'] = 11,
		['MOVE'] = 12,
		['LOCK'] = 13,
		['UNLOCK'] = 14,
		['ACL'] = 15,
		['REPORT'] = 16,
		['VERSION-CONTROL'] = 17,
		['CHECKIN'] = 18,
		['CHECKOUT'] = 19,
		['UNCHECKOUT'] = 20,
		['SEARCH'] = 21,
		['MKWORKSPACE'] = 22,
		['UPDATE'] = 23,
		['LABEL'] = 24,
		['MERGE'] = 25,
		['BASELINE_CONTROL'] = 26,
		['MKACTIVITY'] = 27,
	},
	
	-- Request codes
	Code = {
		FORWARD_REQUEST = 2,
		SEND_BODY       = 3,
		SEND_HEADERS    = 4,
		END_RESPONSE    = 5,
		SHUTDOWN        = 7,
		PING            = 8,
		CPING           = 10,
	},
	
	-- Request attributes
	Attribute = {
		CONTEXT      = 0x01,
		SERVLET_PATH = 0x02,
		REMOTE_USER  = 0x03,
		AUTH_TYPE    = 0x04,
		QUERY_STRING = 0x05,
		JVM_ROUTE    = 0x06,
		SSL_CERT     = 0x07,
		SSL_CIPHER   = 0x08,
		SSL_SESSION  = 0x09,
		REQ_ATTRIBUTE= 0x0A,
		SSL_KEY_SIZE = 0x0B,
		ARE_DONE     = 0xFF,
	},
	
	ForwardRequest = {
		
		-- Common headers encoded as numeric values
		Header = {
			['accept']           = 0xA001,
			['accept-charset']   = 0xA002,
			['accept-encoding']  = 0xA003,
			['accept-language']  = 0xA004,
			['authorization']    = 0xA005,
			['connection']       = 0xA006,
			['content-type']     = 0xA007,
			['content-length']   = 0xA008,
			['cookie']           = 0xA009,
			['cookie2']          = 0xA00A,
			['host']             = 0xA00B,
			['pragma']           = 0xA00C,
			['referer']          = 0xA00D,
			['user-agent']       = 0xA00E,
		},		

		new = function(self, host, port, method, uri, headers, attributes, options)
			local o = {
				host = host,
				magic = 0x1234,
				length = 0,
				code = AJP.Code.FORWARD_REQUEST,
				method = AJP.Method[method],
				version = "HTTP/1.1",
				uri = uri,
				raddr = options.raddr or "127.0.0.1",
				rhost = options.rhost or "",
				srv = host.ip,
				port = port.number,
				is_ssl = (port.service == "https"),
				headers = headers or {},
				attributes = attributes or {},
			}
			setmetatable(o, self)
			self.__index = self
	       	return o		
		end,
		
		__tostring = function(self)
			
			-- encodes a string, prefixing it with a 2-byte length
			-- and suffixing it with a zero. P-encoding can't be used
			-- as the zero terminator should not be counted in the length
			local function encstr(str)
				if ( not(str) or #str == 0 ) then
					return bin.pack(">S", 0xFFFF)
				end
				return bin.pack(">Sz", #str, str)
			end

			-- count the number of headers
			local function headerCount()
				local i = 0
				for _, _ in pairs(self.headers) do i = i + 1 end
				return i
			end

			-- add host header if it's missing
			if ( not(self.headers['host']) ) then
				self.headers['host'] = stdnse.get_hostname(self.host)
			end
			
			-- add keep-alive connection header if missing
			if ( not(self.headers['connection']) ) then
				self.headers['connection'] = "keep-alive"
			end

			local p_url = url.parse(self.uri)

			-- save the magic and data for last
			local data = bin.pack(">CCAAAAASCS", self.code, self.method, 
				encstr(self.version), encstr(p_url.path), encstr(self.raddr),
				encstr(self.rhost), encstr(self.srv),
				self.port, (self.is_ssl and 1 or 0),
				headerCount())
			
			-- encode headers
			for k, v in pairs(self.headers) do
				local header = AJP.ForwardRequest.Header[k:lower()] or k
				if ( "string" == type(header) ) then
					data = data .. bin.pack(">Sz", #header, header)
				else
					data = data .. bin.pack(">S", header)
				end
				
				data = data .. encstr(v)
			end
			
			-- encode attributes
			if ( p_url.query ) then
			 	data = data .. bin.pack("C", AJP.Attribute.QUERY_STRING)
			 	data = data .. encstr(p_url.query)
			end
			
			-- terminate the attribute list
			data = data .. bin.pack("C", AJP.Attribute.ARE_DONE)
			
			-- returns the AJP request as a string
			return bin.pack(">SSA", AJP.Magic, #data, data)
		end,
		
	},
	
	Response = {
		
		Header = {
			['Content-Type']      = 0xA001,
			['Content-Language']  = 0xA002,
			['Content-Length']    = 0xA003,
			['Date']              = 0xA004,
			['Last-Modified']     = 0xA005,
			['Location']          = 0xA006,
			['Set-Cookie']        = 0xA007,
			['Set-Cookie2']       = 0xA008,
			['Servlet-Engine']    = 0xA009,
			['Status']            = 0xA00A,
			['WWW-Authenticate']  = 0xA00B,
		},
	
		SendHeaders = {
		
			new = function(self)
				local o = { headers = {}, rawheaders = {} }
				setmetatable(o, self)
				self.__index = self
				return o
			end,
			
			parse = function(data)
				local sh = AJP.Response.SendHeaders:new()
				local pos = 6
				local status_msg, hdr_count
				
				pos, sh.status = bin.unpack(">S", data, pos)
				pos, status_msg  = bin.unpack(">P", data, pos)
				pos = pos + 1
				sh['status-line'] = ("AJP/1.3 %d %s"):format(sh.status, status_msg)
								
				pos, hdr_count = bin.unpack(">S", data, pos)
								
				local function headerById(id)
					for k, v in pairs(AJP.Response.Header) do
						if ( v == id ) then	return k end
					end
				end
				
				
				for i=1, hdr_count do
					local key, val, len
					pos, len = bin.unpack(">S", data, pos)
					
					if ( len < 0xA000 ) then
						pos, key = bin.unpack("A"..len, data, pos)
						pos = pos + 1
					else
						key = headerById(len)
					end
					
					pos, val = bin.unpack(">P", data, pos)
					pos = pos + 1
					
					sh.headers[key:lower()] = val
					
					-- to keep the order, in which the headers were received,
					-- add them to the rawheader table as well. This is based
					-- on the same principle as the http library, however the
					-- difference being that we have to "construct"	the "raw"
					-- format of the header, as we're receiving kvp's.
					table.insert(sh.rawheaders, ("%s: %s"):format(key,val))
				end
				return sh
			end,
			
		},
						
	},
		
}

-- The Comm class handles sending and receiving AJP requests/responses
Comm = {
	
	-- Creates a new Comm instance
	new = function(self, host, port, options)
		local o = { host = host, port = port, options = options or {}}
		setmetatable(o, self)
		self.__index = self
		return o
	end,
	
	-- Connects to the AJP server
	--
	-- @return status true on success, false on failure
	-- @return err string containing error message on failure
	connect = function(self)
		self.socket = nmap.new_socket()
		self.socket:set_timeout(self.options.timeout or 5000)
		return self.socket:connect(self.host, self.port)
	end,
	
	-- Sends a request to the server
	--
	-- @param req instance of object that can be serialized with tostring
	-- @return status true on succes, false on failure
	-- @return err string containing error message on failure
	send = function(self, req)
		return self.socket:send(tostring(req))
	end,
	
	-- Receives an AJP response from the server
	--
	-- @return status true on succes, false on failure
	-- @return response table containing the following fields, or string
	--         containing error message on failure
	--         <code>status</code> - status of response (see HTTP status codes)
	--         <code>status-line</code> - the complete status line (eg. 200 OK)
	--         <code>body</code> - the response body as string
	--         <code>headers</code> - table of response headers
	--
	receive = function(self)
		local response = {}
		while(true) do
			local status, buf = self.socket:receive_buf(match.numbytes(4), true)
			if ( not(status) ) then
				return false, "Failed to receive response from server"
			end
			local pos, magic, length = bin.unpack(">A2S", buf)
			if ( magic ~= "AB" ) then
				return false, ("Invalid magic received from server (%s)"):format(magic)
			end
			local status, data = self.socket:receive_buf(match.numbytes(length), true)
			if ( not(status) ) then
				return false, "Failed to receive response from server"
			end
		
			local pos, code = bin.unpack("C", data)
			if ( AJP.Code.SEND_HEADERS == code ) then
				local sh = AJP.Response.SendHeaders.parse(buf .. data)
				response = sh
			elseif( AJP.Code.SEND_BODY == code ) then
				response.body = select(2, bin.unpack(">P", data, pos))
			elseif( AJP.Code.END_RESPONSE == code ) then
				break
			end
		end
		return true, response
	end,
	
	-- Closes the socket
	close = function(self)
		return self.socket:close()
	end,
	
}


Helper = {
	
	--- Creates a new AJP Helper instance
	--
	-- @param host table
	-- @param port table
	-- @param opt 
	-- @return o new Helper instance
	new = function(self, host, port, opt)
		local o = { host = host, port = port, opt = opt or {} }
		setmetatable(o, self)
        self.__index = self
       	return o
	end,

	--- Connects to the AJP server
	--
	-- @return status true on success, false on failure
	-- @return err string containing error message on failure
	connect = function(self)
		self.comm = Comm:new(self.host, self.port, self.opt)
		return self.comm:connect()
	end,
	
	getOption = function(self, options, key)
	
		-- first check options, then global self.opt
		if ( options and options[key] ) then
			return options[key]
		elseif ( self.opt and self.opt[key] ) then
			return self.opt[key]
		end
	
	end,
	
	--- Sends an AJP request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	request = function(self, method, url, headers, attributes, options)
		local status, lhost, lport, rhost, rport = self.comm.socket:get_info()
		if ( not(status) ) then
			return false, "Failed to get socket information"
		end
				
		local request = AJP.ForwardRequest:new(self.host, self.port, method, url, headers, attributes, { raddr = rhost })
		if ( not(self.comm:send(request)) ) then
			return false, "Failed to send request to server"
		end
		local status, result = self.comm:receive()
	
		-- support Basic authentication
		if ( status and result.status == 401 and result.headers['www-authenticate'] ) then
			
			local auth = self:getOption(options, "auth")
			if ( not(auth) or not(auth.username) and not(auth.password) ) then
				stdnse.print_debug(2, "No authentication information")
				return status, result
			end
			
			local challenges = http.parse_www_authenticate(result.headers['www-authenticate'])
			local scheme
			for _, challenge in ipairs(challenges or {}) do
				if ( challenge and challenge.scheme and challenge.scheme:lower() == "basic") then
					scheme = challenge.scheme:lower()
					break
				end
			end
						
			if ( not(scheme) ) then
				stdnse.print_debug(2, "Could not find a supported authentication scheme")
			elseif ( "basic" ~= scheme ) then
				stdnse.print_debug(2, "Unsupported authentication scheme: %s", scheme)
			else
				headers = headers or {}
				headers["Authorization"] = ("Basic %s"):format(base64.enc(auth.username .. ":" .. auth.password))
				request = AJP.ForwardRequest:new(self.host, self.port, method, url, headers, attributes, { raddr = rhost })
				if ( not(self.comm:send(request)) ) then
					return false, "Failed to send request to server"
				end
				status, result = self.comm:receive()
			end
			
		end
		return status, result
	end,

	--- Sends an AJP GET request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	get = function(self, url, headers, attributes, options)
		return self:request("GET", url, headers, attributes, options)
	end,
	
	--- Sends an AJP HEAD request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	head = function(self, url, headers, attributes, options)
		return self:request("HEAD", url, headers, attributes, options)
	end,
	
	--- Sends an AJP TRACE request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	trace = function(self, url, headers, attributes, options)
		return self:request("TRACE", url, headers, attributes, options)
	end,
	
	--- Sends an AJP PUT request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	put = function(self, url, headers, attributes, options)
		return self:request("PUT", url, headers, attributes, options)
	end,

	--- Sends an AJP DELETE request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	delete = function(self, url, headers, attributes, options)
		return self:request("DELETE", url, headers, attributes, options)
	end,
	
	--- Sends an AJP OPTIONS request to the server
	--
	-- @param url string containing the URL to query
	-- @param headers table containing optional headers
	-- @param attributes table containing optional attributes
	-- @param options table with request specific options
	-- @return status true on succes, false on failure
	-- @return response table (@see Comm.receive), or string containing error
	--         message on failure
	options = function(self, url, headers, attributes, options)
		return self:request("OPTIONS", url, headers, attributes, options)
	end,
	
	-- should only work against 127.0.0.1
	shutdownContainer = function(self)
		self.comm:send(bin.pack("H", "1234000107"))
		self.comm:receive()
	end,
	
	--- Disconnects from the server
	close = function(self)
		return self.comm:close()
	end,
	
}

return _ENV;