Commit 6d81eea3 authored by Nils Goroll's avatar Nils Goroll

fgs is not the only person with a whitespace ocd

parent bb022962
...@@ -27,12 +27,12 @@ import hoailona [from "path"] ; ...@@ -27,12 +27,12 @@ import hoailona [from "path"] ;
:: ::
new OBJECT = hoailona.policy(ENUM type [, DURATION ttl] new OBJECT = hoailona.policy(ENUM type [, DURATION ttl]
[, STRING description] [, BLOB secret] [, STRING description] [, BLOB secret]
[, INT start_offset]) [, INT start_offset])
new OBJECT = hoailona.hosts() new OBJECT = hoailona.hosts()
<obj>.add(STRING host, STRING policy [, STRING path] <obj>.add(STRING host, STRING policy [, STRING path]
[, STRING description]) [, STRING description])
INT <obj>.policy(STRING host, STRING path) INT <obj>.policy(STRING host, STRING path)
STRING <obj>.token([STRING acl] [, DURATION ttl] [, STRING data]) STRING <obj>.token([STRING acl] [, DURATION ttl] [, STRING data])
BLOB <obj>.secret() BLOB <obj>.secret()
...@@ -93,12 +93,12 @@ used for authorization. For example:: ...@@ -93,12 +93,12 @@ used for authorization. For example::
# Define a policy for token authorization lasting one hour, # Define a policy for token authorization lasting one hour,
# and associate it with a shared secret. # and associate it with a shared secret.
new token_policy new token_policy
= hoailona.policy(TOKEN, 1h, = hoailona.policy(TOKEN, 1h,
blobcode.decode(encoded="secret")); blobcode.decode(encoded="secret"));
# Define a policy for open access (authorization not required) # Define a policy for open access (authorization not required)
new open_policy = hoailona.policy(OPEN); new open_policy = hoailona.policy(OPEN);
# Define an "access denied" policy # Define an "access denied" policy
new deny_policy = hoailona.policy(DENY); new deny_policy = hoailona.policy(DENY);
} }
...@@ -121,10 +121,10 @@ Policy Editor:: ...@@ -121,10 +121,10 @@ Policy Editor::
# Assign the token_policy globally to host example.com # Assign the token_policy globally to host example.com
config.add("example.com", "token_policy"); config.add("example.com", "token_policy");
# Assign the open_policy to the path /foo/bar on host example.org # Assign the open_policy to the path /foo/bar on host example.org
config.add("example.org", "open_policy", "/foo/bar"); config.add("example.org", "open_policy", "/foo/bar");
# Assign the deny_policy to any path beginning with /baz/quux # Assign the deny_policy to any path beginning with /baz/quux
# on subdomains of example.org # on subdomains of example.org
config.add("*.example.org", "deny_policy", "/baz/quux/..."); config.add("*.example.org", "deny_policy", "/baz/quux/...");
...@@ -146,19 +146,19 @@ object:: ...@@ -146,19 +146,19 @@ object::
sub vcl_recv { sub vcl_recv {
# The policy method returns 0 for policy type DENY # The policy method returns 0 for policy type DENY
if (config.policy(req.http.Host, req.url) == 0) { if (config.policy(req.http.Host, req.url) == 0) {
# Handle "access denied" by returning 403 Forbidden # Handle "access denied" by returning 403 Forbidden
return(synth(403)); return(synth(403));
} }
# .policy() returns 1 for policy type OPEN # .policy() returns 1 for policy type OPEN
if (config.policy() == 1) { if (config.policy() == 1) {
return(pass); return(pass);
} }
# .policy() returns 2 for policy type TOKEN # .policy() returns 2 for policy type TOKEN
if (config.policy() == 2) { if (config.policy() == 2) {
# Handle token authorization ... # Handle token authorization ...
# [...] # [...]
} }
} }
...@@ -178,10 +178,10 @@ HMAC for the token:: ...@@ -178,10 +178,10 @@ HMAC for the token::
sub vcl_recv { sub vcl_recv {
# .policy() returns 2 for policy type TOKEN # .policy() returns 2 for policy type TOKEN
if (config.policy(req.http.Host, req.url) == 2) { if (config.policy(req.http.Host, req.url) == 2) {
# Handle token authorization: # Handle token authorization:
# Assign the non-cryptographic part of the token to a temp # Assign the non-cryptographic part of the token to a temp
# header # header
set req.http.Tmp-Token = config.token(); set req.http.Tmp-Token = config.token();
# Use VMOD blobdigest to generate the HMAC, and VMOD blobcode # Use VMOD blobdigest to generate the HMAC, and VMOD blobcode
# to encode the result in lower case hex. # to encode the result in lower case hex.
...@@ -190,10 +190,10 @@ HMAC for the token:: ...@@ -190,10 +190,10 @@ HMAC for the token::
set req.http.Tmp-HMAC set req.http.Tmp-HMAC
= blobcode.encode(HEXLC, = blobcode.encode(HEXLC,
blobdigest.hmacf(SHA256, config.secret(), blobdigest.hmacf(SHA256, config.secret(),
blobcode.decode(IDENTITY, blobcode.decode(IDENTITY,
req.http.Tmp-Token))); req.http.Tmp-Token)));
# These two temp headers can now be combined to form the full # These two temp headers can now be combined to form the full
# token string required for authorization at the Akamai # token string required for authorization at the Akamai
# server, such as: # server, such as:
# #
...@@ -289,8 +289,8 @@ Examples:: ...@@ -289,8 +289,8 @@ Examples::
# correctly.) # correctly.)
import blobcode; import blobcode;
new token = hoailona.policy(type=TOKEN, ttl=2h, start_offset=0-10, new token = hoailona.policy(type=TOKEN, ttl=2h, start_offset=0-10,
secret=blobcode.decode(HEX, secret=blobcode.decode(HEX,
"717569636B2062726F776E20666F7879")); "717569636B2062726F776E20666F7879"));
# A policy for "access denied" # A policy for "access denied"
new forbid = hoailona.policy(DENY, description="access denied"); new forbid = hoailona.policy(DENY, description="access denied");
...@@ -425,18 +425,18 @@ Examples:: ...@@ -425,18 +425,18 @@ Examples::
# Assign a policy globally to example.com # Assign a policy globally to example.com
h.add("example.com", "p1"); h.add("example.com", "p1");
# Assign a policy to a fixed path on subdomains of example.com # Assign a policy to a fixed path on subdomains of example.com
h.add("*.example.com", "p2", "/foo/bar"); h.add("*.example.com", "p2", "/foo/bar");
# Assign a policy to any path beginning with /baz/quux/ # Assign a policy to any path beginning with /baz/quux/
# on example.org # on example.org
h.add("example.org", "p3", "/baz/quux/..."); h.add("example.org", "p3", "/baz/quux/...");
# Assign a policy to any path with three components, where # Assign a policy to any path with three components, where
# the first component is /foo/ and the last is /bar, on example.org # the first component is /foo/ and the last is /bar, on example.org
h.add("example.org", "p4", "/foo/*/bar"); h.add("example.org", "p4", "/foo/*/bar");
# Deny access to any path on evil.org, with a description to be used # Deny access to any path on evil.org, with a description to be used
# by h.explain() # by h.explain()
h.add("evil.org", "deny", description="no access to evil.org"); h.add("evil.org", "deny", description="no access to evil.org");
...@@ -596,14 +596,14 @@ Examples:: ...@@ -596,14 +596,14 @@ Examples::
# Use VMOD blobdigest to generate the HMAC, where # Use VMOD blobdigest to generate the HMAC, where
# the shared secret serves as the HMAC key. # the shared secret serves as the HMAC key.
set req.http.Tmp-HMAC set req.http.Tmp-HMAC
= blobcode.encode(HEXLC, = blobcode.encode(HEXLC,
blobdigest.hmacf(SHA256, config.secret(), blobdigest.hmacf(SHA256, config.secret(),
blobcode.decode(IDENTITY, blobcode.decode(IDENTITY,
req.http.Tmp-Token))); req.http.Tmp-Token)));
# Concatenate elements of the authorization token # Concatenate elements of the authorization token
set req.http.Token = "hdnea=" + req.http.Tmp + "~hmac=" set req.http.Token = "hdnea=" + req.http.Tmp + "~hmac="
+ req.http.Tmp-HMAC; + req.http.Tmp-HMAC;
# The contents of the Tmp header may now be used as # The contents of the Tmp header may now be used as
# a query string or cookie contents, as required for # a query string or cookie contents, as required for
...@@ -663,7 +663,7 @@ Returns the version string for this VMOD. ...@@ -663,7 +663,7 @@ Returns the version string for this VMOD.
Example:: Example::
std.log("Using VMOD hoailona version " + hoailona.version()); std.log("Using VMOD hoailona version " + hoailona.version());
REQUIREMENTS REQUIREMENTS
============ ============
......
...@@ -10,12 +10,12 @@ $Module hoailona 3 Akamai SecureHD Token Authorization VMOD ...@@ -10,12 +10,12 @@ $Module hoailona 3 Akamai SecureHD Token Authorization VMOD
:: ::
new OBJECT = hoailona.policy(ENUM type [, DURATION ttl] new OBJECT = hoailona.policy(ENUM type [, DURATION ttl]
[, STRING description] [, BLOB secret] [, STRING description] [, BLOB secret]
[, INT start_offset]) [, INT start_offset])
new OBJECT = hoailona.hosts() new OBJECT = hoailona.hosts()
<obj>.add(STRING host, STRING policy [, STRING path] <obj>.add(STRING host, STRING policy [, STRING path]
[, STRING description]) [, STRING description])
INT <obj>.policy(STRING host, STRING path) INT <obj>.policy(STRING host, STRING path)
STRING <obj>.token([STRING acl] [, DURATION ttl] [, STRING data]) STRING <obj>.token([STRING acl] [, DURATION ttl] [, STRING data])
BLOB <obj>.secret() BLOB <obj>.secret()
...@@ -76,12 +76,12 @@ used for authorization. For example:: ...@@ -76,12 +76,12 @@ used for authorization. For example::
# Define a policy for token authorization lasting one hour, # Define a policy for token authorization lasting one hour,
# and associate it with a shared secret. # and associate it with a shared secret.
new token_policy new token_policy
= hoailona.policy(TOKEN, 1h, = hoailona.policy(TOKEN, 1h,
blobcode.decode(encoded="secret")); blobcode.decode(encoded="secret"));
# Define a policy for open access (authorization not required) # Define a policy for open access (authorization not required)
new open_policy = hoailona.policy(OPEN); new open_policy = hoailona.policy(OPEN);
# Define an "access denied" policy # Define an "access denied" policy
new deny_policy = hoailona.policy(DENY); new deny_policy = hoailona.policy(DENY);
} }
...@@ -104,10 +104,10 @@ Policy Editor:: ...@@ -104,10 +104,10 @@ Policy Editor::
# Assign the token_policy globally to host example.com # Assign the token_policy globally to host example.com
config.add("example.com", "token_policy"); config.add("example.com", "token_policy");
# Assign the open_policy to the path /foo/bar on host example.org # Assign the open_policy to the path /foo/bar on host example.org
config.add("example.org", "open_policy", "/foo/bar"); config.add("example.org", "open_policy", "/foo/bar");
# Assign the deny_policy to any path beginning with /baz/quux # Assign the deny_policy to any path beginning with /baz/quux
# on subdomains of example.org # on subdomains of example.org
config.add("*.example.org", "deny_policy", "/baz/quux/..."); config.add("*.example.org", "deny_policy", "/baz/quux/...");
...@@ -129,19 +129,19 @@ object:: ...@@ -129,19 +129,19 @@ object::
sub vcl_recv { sub vcl_recv {
# The policy method returns 0 for policy type DENY # The policy method returns 0 for policy type DENY
if (config.policy(req.http.Host, req.url) == 0) { if (config.policy(req.http.Host, req.url) == 0) {
# Handle "access denied" by returning 403 Forbidden # Handle "access denied" by returning 403 Forbidden
return(synth(403)); return(synth(403));
} }
# .policy() returns 1 for policy type OPEN # .policy() returns 1 for policy type OPEN
if (config.policy() == 1) { if (config.policy() == 1) {
return(pass); return(pass);
} }
# .policy() returns 2 for policy type TOKEN # .policy() returns 2 for policy type TOKEN
if (config.policy() == 2) { if (config.policy() == 2) {
# Handle token authorization ... # Handle token authorization ...
# [...] # [...]
} }
} }
...@@ -161,10 +161,10 @@ HMAC for the token:: ...@@ -161,10 +161,10 @@ HMAC for the token::
sub vcl_recv { sub vcl_recv {
# .policy() returns 2 for policy type TOKEN # .policy() returns 2 for policy type TOKEN
if (config.policy(req.http.Host, req.url) == 2) { if (config.policy(req.http.Host, req.url) == 2) {
# Handle token authorization: # Handle token authorization:
# Assign the non-cryptographic part of the token to a temp # Assign the non-cryptographic part of the token to a temp
# header # header
set req.http.Tmp-Token = config.token(); set req.http.Tmp-Token = config.token();
# Use VMOD blobdigest to generate the HMAC, and VMOD blobcode # Use VMOD blobdigest to generate the HMAC, and VMOD blobcode
# to encode the result in lower case hex. # to encode the result in lower case hex.
...@@ -173,10 +173,10 @@ HMAC for the token:: ...@@ -173,10 +173,10 @@ HMAC for the token::
set req.http.Tmp-HMAC set req.http.Tmp-HMAC
= blobcode.encode(HEXLC, = blobcode.encode(HEXLC,
blobdigest.hmacf(SHA256, config.secret(), blobdigest.hmacf(SHA256, config.secret(),
blobcode.decode(IDENTITY, blobcode.decode(IDENTITY,
req.http.Tmp-Token))); req.http.Tmp-Token)));
# These two temp headers can now be combined to form the full # These two temp headers can now be combined to form the full
# token string required for authorization at the Akamai # token string required for authorization at the Akamai
# server, such as: # server, such as:
# #
...@@ -210,7 +210,7 @@ same backend transaction are based on the policy that was determined ...@@ -210,7 +210,7 @@ same backend transaction are based on the policy that was determined
by that call. by that call.
$Object policy(PRIV_TASK, ENUM {OPEN, DENY, TOKEN} type, DURATION ttl=0, $Object policy(PRIV_TASK, ENUM {OPEN, DENY, TOKEN} type, DURATION ttl=0,
STRING description=0, BLOB secret=0, INT start_offset=0) STRING description=0, BLOB secret=0, INT start_offset=0)
Create a policy. The ``type`` enum is required, to classify the policy Create a policy. The ``type`` enum is required, to classify the policy
as ``OPEN``, ``DENY`` or ``TOKEN``. as ``OPEN``, ``DENY`` or ``TOKEN``.
...@@ -259,8 +259,8 @@ Examples:: ...@@ -259,8 +259,8 @@ Examples::
# correctly.) # correctly.)
import blobcode; import blobcode;
new token = hoailona.policy(type=TOKEN, ttl=2h, start_offset=0-10, new token = hoailona.policy(type=TOKEN, ttl=2h, start_offset=0-10,
secret=blobcode.decode(HEX, secret=blobcode.decode(HEX,
"717569636B2062726F776E20666F7879")); "717569636B2062726F776E20666F7879"));
# A policy for "access denied" # A policy for "access denied"
new forbid = hoailona.policy(DENY, description="access denied"); new forbid = hoailona.policy(DENY, description="access denied");
...@@ -273,7 +273,7 @@ path patterns. The constructor has no parameters; the object only ...@@ -273,7 +273,7 @@ path patterns. The constructor has no parameters; the object only
becomes useful by calling the ``.add()`` method. becomes useful by calling the ``.add()`` method.
$Method VOID .add(PRIV_TASK, STRING host, STRING policy, STRING path=0, $Method VOID .add(PRIV_TASK, STRING host, STRING policy, STRING path=0,
STRING description=0) STRING description=0)
Associate ``policy`` with the ``host``, optionally restricted to the Associate ``policy`` with the ``host``, optionally restricted to the
path pattern described by ``path``. The ``host`` and ``policy`` path pattern described by ``path``. The ``host`` and ``policy``
...@@ -382,18 +382,18 @@ Examples:: ...@@ -382,18 +382,18 @@ Examples::
# Assign a policy globally to example.com # Assign a policy globally to example.com
h.add("example.com", "p1"); h.add("example.com", "p1");
# Assign a policy to a fixed path on subdomains of example.com # Assign a policy to a fixed path on subdomains of example.com
h.add("*.example.com", "p2", "/foo/bar"); h.add("*.example.com", "p2", "/foo/bar");
# Assign a policy to any path beginning with /baz/quux/ # Assign a policy to any path beginning with /baz/quux/
# on example.org # on example.org
h.add("example.org", "p3", "/baz/quux/..."); h.add("example.org", "p3", "/baz/quux/...");
# Assign a policy to any path with three components, where # Assign a policy to any path with three components, where
# the first component is /foo/ and the last is /bar, on example.org # the first component is /foo/ and the last is /bar, on example.org
h.add("example.org", "p4", "/foo/*/bar"); h.add("example.org", "p4", "/foo/*/bar");
# Deny access to any path on evil.org, with a description to be used # Deny access to any path on evil.org, with a description to be used
# by h.explain() # by h.explain()
h.add("evil.org", "deny", description="no access to evil.org"); h.add("evil.org", "deny", description="no access to evil.org");
...@@ -532,14 +532,14 @@ Examples:: ...@@ -532,14 +532,14 @@ Examples::
# Use VMOD blobdigest to generate the HMAC, where # Use VMOD blobdigest to generate the HMAC, where
# the shared secret serves as the HMAC key. # the shared secret serves as the HMAC key.
set req.http.Tmp-HMAC set req.http.Tmp-HMAC
= blobcode.encode(HEXLC, = blobcode.encode(HEXLC,
blobdigest.hmacf(SHA256, config.secret(), blobdigest.hmacf(SHA256, config.secret(),
blobcode.decode(IDENTITY, blobcode.decode(IDENTITY,
req.http.Tmp-Token))); req.http.Tmp-Token)));
# Concatenate elements of the authorization token # Concatenate elements of the authorization token
set req.http.Token = "hdnea=" + req.http.Tmp + "~hmac=" set req.http.Token = "hdnea=" + req.http.Tmp + "~hmac="
+ req.http.Tmp-HMAC; + req.http.Tmp-HMAC;
# The contents of the Tmp header may now be used as # The contents of the Tmp header may now be used as
# a query string or cookie contents, as required for # a query string or cookie contents, as required for
...@@ -585,7 +585,7 @@ Returns the version string for this VMOD. ...@@ -585,7 +585,7 @@ Returns the version string for this VMOD.
Example:: Example::
std.log("Using VMOD hoailona version " + hoailona.version()); std.log("Using VMOD hoailona version " + hoailona.version());
REQUIREMENTS REQUIREMENTS
============ ============
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment