CVS log for loncom/auth/lontokacc.pm

Up to [LON-CAPA] / loncom / auth

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()
- Domain configuration to allow domain's LON-CAPA nodes to operate behind a
  WAF/Reverse Proxy using aliased hostname (CNAME).
- Web requests from other nodes bypass the WAF as their requests are made
  directly to the server hostname (A record); same for internal LON-CAPA
  connections for lonc -> lond.

- if there is a hostid returned from get_hosts_from_ip then it's a valid host to send the file to

- maiking this get_iphost thing more targeted easier to dns with

- starting work on moving to distributed DNS, eliminate usage of the lonnet hostanme global

- Apache 2 doesn't like it when PerlCleanupHandlers don't return an Apache::Constant (like OK or DECLINED ...)

- tokacc was trying to compares lon-capa host ids and DNS name, silly tokacc

- more delayed IP rsoultion work

- need that use

- better job of finding our whose asking for stuff

- removing IP number use from webserver some of BUG#2330

- these seem to cause a bit much spew

Problem with lontokacc running twice on high school machines if cleanup
was registered dynamically.

Remove debugging code

This took way longer then it should have.

lonracc and lontokacc will now be accepting when one of two conditions
is met:

* The double-reverse lookup, according to $r->get_remote_host(REMOTE_DOUBLE_REV)
  is successful. This is identical to before.
* The claimed host is the same as the current server, which works even with
  wonky /etc/hosts files.

I was initially worried this might be a potential security problem, but I do
not believe it is. The reason is that this clause ONLY comes into effect
when you're trying to spoof yourself as the server you are talking to. Even
if you succeed, the server will then proceed to send itself a subscription
request, which is not a big deal, PLUS the reason this is occuring in the
first place is that the name maps back to 127.0.0.1, SO this request will
go through the local interface anyhow, meaning Mr. Remote Attacker can't even
see the subscription request that wouldn't help him anyhow.

So in the end, all this does is hypothetically allow an attacker to cause a
server machine to subscribe itself to resources it hosts. This does not give
the hypothetical attacker any benefit. Thus, this is not a security hole.

Routines for file upload

Towards inter-server document transfer

Completely new version, derived from lonracc, to control access to
userfile temp storage to registered servers only.

Token security file upload

Toward bug 481.

To use token-based access, use for example

'<img src="'.&Apache::lonnet::tokenwrapper($fulluri).'" />'

Bug #481
Simple token-based access mechanism.