civetweb/examples/chat.c

/*
 * This file is part of the Mongoose project, http://code.google.com/p/mongoose
 * It implements an online chat server. For more details,
 * see the documentation on the project web site.
 * To test the application,
 *  1. type "make" in the directory where this file lives
 *  2. point your browser to http://127.0.0.1:8081
 *
 * NOTE(lsm): this file follows Google style, not BSD style as the rest of
 * Mongoose code.
 */

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <string.h>
#include <time.h>
#include <pthread.h>

#include "mongoose.h"

#define MAX_USER_LEN  20
#define MAX_MESSAGE_LEN  100
#define MAX_MESSAGES 5
#define MAX_SESSIONS 2
#define SESSION_TTL 120

static const char *login_url = "/login.html";
static const char *authorize_url = "/authorize";
static const char *web_root = "./html";
static const char *http_ports = "8081,8082s";
static const char *ssl_certificate = "ssl_cert.pem";
static const char *ajax_reply_start =
  "HTTP/1.1 200 OK\r\n"
  "Cache: no-cache\r\n"
  "Content-Type: application/x-javascript\r\n"
  "\r\n";

// Describes single message sent to a chat. If user is empty (0 length),
// the message is then originated from the server itself.
struct message {
  long id;                     // Message ID
  char user[MAX_USER_LEN];     // User that have sent the message
  char text[MAX_MESSAGE_LEN];  // Message text
  time_t timestamp;            // Message timestamp, UTC
};

// Describes web session.
struct session {
  char session_id[33];      // Session ID, must be unique
  char random[20];          // Random data used for extra user validation
  char user[MAX_USER_LEN];  // Authenticated user
  time_t expire;            // Expiration timestamp, UTC
};

static struct message messages[MAX_MESSAGES];  // Ringbuffer for messages
static struct session sessions[MAX_SESSIONS];  // Current sessions
static long last_message_id;

// Protects messages, sessions, last_message_id
static pthread_rwlock_t rwlock = PTHREAD_RWLOCK_INITIALIZER;

// Get a get of messages with IDs greater than last_id and transform them
// into a JSON string. Return that string to the caller. The string is
// dynamically allocated, caller must free it. If there are no messages,
// NULL is returned.
static char *messages_to_json(long last_id) {
  const struct message *message;
  int max_msgs, len;
  char buf[sizeof(messages)];  // Large enough to hold all messages

  // Read-lock the ringbuffer. Loop over all messages, making a JSON string.
  pthread_rwlock_rdlock(&rwlock);
  len = 0;
  max_msgs = sizeof(messages) / sizeof(messages[0]);
  // If client is too far behind, return all messages.
  if (last_message_id - last_id > max_msgs) {
    last_id = last_message_id - max_msgs;
  }
  for (; last_id < last_message_id; last_id++) {
    message = &messages[last_id % max_msgs];
    if (message->timestamp == 0) {
      break;
    }
    // buf is allocated on stack and hopefully is large enough to hold all
    // messages (it may be too small if the ringbuffer is full and all
    // messages are large. in this case asserts will trigger).
    len += snprintf(buf + len, sizeof(buf) - len,
        "{user: '%s', text: '%s', timestamp: %lu, id: %lu},",
        message->user, message->text, message->timestamp, message->id);
    assert(len > 0);
    assert((size_t) len < sizeof(buf));
  }
  pthread_rwlock_unlock(&rwlock);

  return len == 0 ? NULL : strdup(buf);
}

// If "callback" param is present in query string, this is JSONP call.
// Return 1 in this case, or 0 if "callback" is not specified.
// Wrap an output in Javascript function call.
static int handle_jsonp(struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  char cb[64];

  mg_get_qsvar(request_info, "callback", cb, sizeof(cb));
  if (cb[0] != '\0') {
    mg_printf(conn, "%s(", cb);
  }
 
  return cb[0] == '\0' ? 0 : 1;
}

// A handler for the /ajax/get_messages endpoint.
// Return a list of messages with ID greater than requested.
static void ajax_get_messages(struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  char last_id[32], *json;
  int is_jsonp;

  mg_printf(conn, "%s", ajax_reply_start);
  is_jsonp = handle_jsonp(conn, request_info);

  mg_get_qsvar(request_info, "last_id", last_id, sizeof(last_id));
  if ((json = messages_to_json(strtoul(last_id, NULL, 10))) != NULL) {
    mg_printf(conn, "[%s]", json);
    free(json);
  }

  if (is_jsonp) {
    mg_printf(conn, "%s", ")");
  }
}

// A handler for the /ajax/send_message endpoint.
static void ajax_send_message(struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  struct message *message;
  char text[sizeof(message->text) - 1];
  int is_jsonp;

  mg_printf(conn, "%s", ajax_reply_start);
  is_jsonp = handle_jsonp(conn, request_info);

  (void) mg_get_qsvar(request_info, "text", text, sizeof(text));
  if (text[0] != '\0') {
    // We have a message to store. Write-lock the ringbuffer,
    // grab the next message and copy data into it.
    pthread_rwlock_wrlock(&rwlock);
    message = &messages[last_message_id %
      (sizeof(messages) / sizeof(messages[0]))];
    // TODO(lsm): JSON-encode all text strings
    strncpy(message->text, text, sizeof(text));
    strncpy(message->user, "joe", sizeof(message->user));
    message->timestamp = time(0);
    message->id = last_message_id++;
    pthread_rwlock_unlock(&rwlock);
  }

  mg_printf(conn, "%s", text[0] == '\0' ? "false" : "true");

  if (is_jsonp) {
    mg_printf(conn, "%s", ")");
  }
}

// Redirect user to the login form. In the cookie, store the original URL
// we came from, so that after the authorization we could redirect back.
static void redirect_to_login(struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  const char *host;

  host = mg_get_header(conn, "Host");
  mg_printf(conn, "HTTP/1.1 302 Found\r\n"
      "Set-Cookie: original_url=%s://%s%s\r\n"
      "Location: %s\r\n\r\n",
      request_info->is_ssl ? "https" : "http",
      host ? host : "127.0.0.1",
      request_info->uri,
      login_url);
}

// Return 1 if username/password is allowed, 0 otherwise.
static int check_password(const char *user, const char *password) {
  // In production environment we should ask an authentication system
  // to authenticate the user.
  // Here however we do trivial check that user and password are not empty
  return (user[0] && password[0]);
}

// Allocate new session object
static struct session *new_session(void) {
  int i;
  time_t now = time(NULL);
  pthread_rwlock_wrlock(&rwlock);
  for (i = 0; i < MAX_SESSIONS; i++) {
    if (sessions[i].expire == 0 || sessions[i].expire < now) {
      sessions[i].expire = time(0) + SESSION_TTL;
      break;
    }
  }
  pthread_rwlock_unlock(&rwlock);
  return i == MAX_SESSIONS ? NULL : &sessions[i];
}

// Generate session ID. buf must be 33 bytes in size.
static void generate_session_id(char *buf, const char *random,
    const char *user, const struct mg_request_info *request_info) {
  char remote_ip[20], remote_port[20];
  snprintf(remote_ip, sizeof(remote_ip), "%ld", request_info->remote_ip);
  snprintf(remote_port, sizeof(remote_port), "%d", request_info->remote_port);
  mg_md5(buf, random, user, remote_port, remote_ip, NULL);
}

// A handler for the /authorize endpoint.
// Login page form sends user name and password to this endpoint.
static void authorize(struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  char user[MAX_USER_LEN], password[MAX_USER_LEN], original_url[200];
  struct session *session;

  // Fetch user name and password.
  mg_get_qsvar(request_info, "user", user, sizeof(user));
  mg_get_qsvar(request_info, "password", password, sizeof(password));
  mg_get_cookie(conn, "original_url", original_url, sizeof(original_url));

  if (check_password(user, password) && (session = new_session()) != NULL) {
    // Authentication success:
    //   1. create new session
    //   2. set session ID token in the cookie
    //   3. remove original_url from the cookie - not needed anymore
    //   4. redirect client back to the original URL
    //
    // The most secure way is to stay HTTPS all the time. However, just to
    // show the technique, we redirect to HTTP after the successful
    // authentication. The danger of doing this is that session cookie can
    // be stolen and an attacker may impersonate the user.
    // Secure application must use HTTPS all the time.
    strlcpy(session->user, user, sizeof(session->user));
    snprintf(session->random, sizeof(session->random), "%d", rand());
    generate_session_id(session->session_id, session->random,
        session->user, request_info);
    printf("New session, user: %s, id: %s, redirecting to %s\n",
        session->user, session->session_id, original_url);
    mg_printf(conn, "HTTP/1.1 302 Found\r\n"
        "Set-Cookie: session=%s; max-age=3600; http-only\r\n"  // Session ID
        "Set-Cookie: user=%s\r\n"  // Set user, needed by Javascript code
        "Set-Cookie: original_url=/; max-age=0\r\n"  // Delete original_url
        "Location: %s\r\n\r\n",
        session->session_id,
        session->user,
        original_url[0] == '\0' ? "/" : original_url);
  } else {
    // Authentication failure, redirect to login.
    redirect_to_login(conn, request_info);
  }
}

// Return 1 if request is authorized, 0 otherwise.
static int is_authorized(const struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  char valid_id[33], received_id[33];
  int i, authorized = 0;

  mg_get_cookie(conn, "session", received_id, sizeof(received_id));
  if (received_id[0] != '\0') {
    pthread_rwlock_rdlock(&rwlock);
    for (i = 0; i < MAX_SESSIONS; i++) {
      if (sessions[i].expire != 0 &&
          sessions[i].expire > time(NULL) &&
          strcmp(sessions[i].session_id, received_id) == 0) {
        break;
      }
    }
    if (i < MAX_SESSIONS) {
      generate_session_id(valid_id, sessions[i].random,
          sessions[i].user, request_info);
      if (strcmp(valid_id, received_id) == 0) {
        sessions[i].expire = time(0) + SESSION_TTL;
        authorized = 1;
      }
    }
    pthread_rwlock_unlock(&rwlock);
  }
  printf("session: %s, uri: %s, authorized: %s, cookie: %s\n",
      received_id, request_info->uri, authorized ? "yes" : "no", mg_get_header(conn, "Cookie"));

  return authorized;
}

// Return 1 if authorization is required for requested URL, 0 otherwise.
static int must_authorize(const struct mg_request_info *request_info) {
  return (strcmp(request_info->uri, login_url) != 0 &&
      strcmp(request_info->uri, authorize_url) != 0);
}

static enum mg_error_t process_request(struct mg_connection *conn,
    const struct mg_request_info *request_info) {
  enum mg_error_t processed = MG_SUCCESS;

  if (must_authorize(request_info) &&
      !is_authorized(conn, request_info)) {
    // If user is not authorized, redirect to the login form.
    redirect_to_login(conn, request_info);
  } else if (strcmp(request_info->uri, authorize_url) == 0) {
    authorize(conn, request_info);
  } else if (strcmp(request_info->uri, "/ajax/get_messages") == 0) {
    ajax_get_messages(conn, request_info);
  } else if (strcmp(request_info->uri, "/ajax/send_message") == 0) {
    ajax_send_message(conn, request_info);
  } else {
    // No suitable handler found, mark as not processed. Mongoose will
    // try to serve the request.
    processed = MG_ERROR;
  }

  return processed;
}

int main(void) {
  struct mg_context	*ctx;

  // Initialize random number generator. It will be used later on for
  // the session identifier creation.
  srand((unsigned) time(0));

  // Start and setup Mongoose
  ctx = mg_start();
  mg_set_option(ctx, "root", web_root);
  mg_set_option(ctx, "ssl_cert", ssl_certificate);  // Must be set before ports
  mg_set_option(ctx, "ports", http_ports);
  mg_set_option(ctx, "dir_list", "no");   // Disable directory listing
  mg_set_callback(ctx, MG_EVENT_NEW_REQUEST, &process_request);

  // Wait until enter is pressed, then exit
  printf("Chat server started on ports %s, press enter to quit.\n", http_ports);
  getchar();
  mg_stop(ctx);
  printf("%s\n", "Chat server stopped.");

  return EXIT_SUCCESS;
}

// vim:ts=2:sw=2:et