Esercizio - Server con autenticazione Basic, ETag e GET condizionale (sul modello della prova pratica)

 client                                        server
   | GET /private/riservato.txt                  |
   |-------------------------------------------->|
   |<-- 401 Unauthorized                          |
   |    WWW-Authenticate: Basic realm="Area riservata", charset="UTF-8"
   | GET /private/riservato.txt                   |
   | Authorization: Basic bWFyaW86c2VncmV0bw==    |      (base64 di "mario:segreto")
   |-------------------------------------------->|
   |<-- 200 OK + ETag + corpo                     |

/* auth_server.c - server HTTP con autenticazione Basic, ETag e GET condizionale (304).
 *   /public/NOME   : file liberi, con Cache-Control: public, max-age=60
 *   /private/NOME  : richiedono "Authorization: Basic base64(utente:password)", altrimenti 401
 *   Per entrambi: ETag; se il client manda If-None-Match con l'ETag corrente si risponde 304 senza corpo.
 *
 * Compilare:  gcc -Wall -Wextra -o auth_server auth_server.c
 * Avviare:    ./auth_server 8080 ./www mario:segreto       (file in ./www/public e ./www/private)
 * Provare:    curl -i http://127.0.0.1:8080/private/riservato.txt                  (401 + WWW-Authenticate)
 *             curl -i -u mario:segreto http://127.0.0.1:8080/private/riservato.txt  (200 + ETag)
 *             curl -i -u mario:segreto -H 'If-None-Match: "<ETag ricevuto>"' http://127.0.0.1:8080/private/riservato.txt  (304)
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <stdint.h>
#include <ctype.h>
#include <errno.h>
#include <time.h>
#include <signal.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define MAX_LINE 2048

static const char *root_dir;
static const char *credentials;                    /* "utente:password" in chiaro (solo per l'esercizio) */

static int write_all(int fd, const char *buf, size_t n)
{
    while (n > 0) {
        ssize_t w = write(fd, buf, n);
        if (w < 0) {
            if (errno == EINTR)
                continue;
            return -1;
        }
        buf += w;
        n -= (size_t)w;
    }
    return 0;
}

struct rbuf {
    int fd;
    char buf[4096];
    size_t pos, len;
};

static int rb_line(struct rbuf *r, char *line, size_t max)
{
    size_t n = 0;
    for (;;) {
        if (r->pos == r->len) {
            ssize_t k = read(r->fd, r->buf, sizeof r->buf);
            if (k < 0 && errno == EINTR)
                continue;
            if (k <= 0)
                return -1;
            r->pos = 0;
            r->len = (size_t)k;
        }
        char c = r->buf[r->pos++];
        if (c == '\n') {
            if (n > 0 && line[n - 1] == '\r')
                n--;
            line[n] = '\0';
            return (int)n;
        }
        if (n + 1 >= max)
            return -2;
        line[n++] = c;
    }
}

/* ---------- Base64 (RFC 4648): decodifica ---------- */
/* Torna la lunghezza decodificata, -1 se l'input non e' Base64 valido. */
static int base64_decode(const char *in, uint8_t *out, size_t cap)
{
    static const char T[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    size_t n = strlen(in), o = 0;
    if (n == 0 || n % 4 != 0)
        return -1;                                 /* la lunghezza e' sempre multipla di 4 (con '=' di riempimento) */
    for (size_t i = 0; i < n; i += 4) {
        int v[4], pad = 0;
        for (int k = 0; k < 4; k++) {
            char c = in[i + (size_t)k];
            if (c == '=' && i + 4 == n && k >= 2) {   /* '=' ammesso solo nelle ultime due posizioni */
                v[k] = 0;
                pad++;
            } else {
                const char *p = (c == '\0' || pad > 0) ? NULL : strchr(T, c);
                if (p == NULL)
                    return -1;
                v[k] = (int)(p - T);
            }
        }
        uint32_t x = (uint32_t)v[0] << 18 | (uint32_t)v[1] << 12 | (uint32_t)v[2] << 6 | (uint32_t)v[3];
        if (o + 3 > cap)
            return -1;
        out[o++] = (uint8_t)(x >> 16);
        if (pad < 2)
            out[o++] = (uint8_t)(x >> 8);
        if (pad < 1)
            out[o++] = (uint8_t)x;
    }
    return (int)o;
}

/* Confronto a tempo costante: non rivela con il tempo di risposta in che posizione differiscono le stringhe. */
static int secure_equal(const char *a, const char *b)
{
    size_t la = strlen(a), lb = strlen(b);
    unsigned diff = (unsigned)(la ^ lb);
    for (size_t i = 0; i < la && i < lb; i++)
        diff |= (unsigned)(a[i] ^ b[i]);
    return diff == 0;
}

/* Vero se il valore di Authorization e' "Basic <base64 di utente:password>" corretto. */
static int check_basic(const char *auth)
{
    if (auth == NULL || strncasecmp(auth, "Basic ", 6) != 0)   /* lo schema non distingue maiuscole */
        return 0;
    const char *b64 = auth + 6;
    while (*b64 == ' ')
        b64++;
    uint8_t dec[256];
    int n = base64_decode(b64, dec, sizeof dec - 1);
    if (n < 0)
        return 0;
    dec[n] = '\0';
    return secure_equal((const char *)dec, credentials);
}

/* ---------- risposte ---------- */
static const char *mime_type(const char *name)
{
    static const struct { const char *ext, *type; } tab[] = {
        {".html", "text/html; charset=utf-8"}, {".txt", "text/plain; charset=utf-8"}, {".css", "text/css"},
        {".json", "application/json"}, {".png", "image/png"}, {".jpg", "image/jpeg"}, {".pdf", "application/pdf"},
    };
    const char *dot = strrchr(name, '.');
    if (dot != NULL)
        for (size_t i = 0; i < sizeof tab / sizeof tab[0]; i++)
            if (strcasecmp(dot, tab[i].ext) == 0)
                return tab[i].type;
    return "application/octet-stream";
}

static void http_date(char *out, size_t size)
{
    time_t t = time(NULL);
    strftime(out, size, "%a, %d %b %Y %H:%M:%S GMT", gmtime(&t));
}

/* Risposta semplice con corpo di testo. extra: header supplementari con CRLF. */
static void reply(int fd, int code, const char *reason, const char *extra, const char *text, int head_only)
{
    char head[1024], date[64];
    http_date(date, sizeof date);
    int blen = (int)strlen(text);
    int n = snprintf(head, sizeof head,
                     "HTTP/1.1 %d %s\r\nDate: %s\r\nContent-Type: text/plain; charset=utf-8\r\n"
                     "Content-Length: %d\r\nConnection: close\r\n%s\r\n",
                     code, reason, date, blen, extra);
    write_all(fd, head, (size_t)n);
    if (!head_only)
        write_all(fd, text, (size_t)blen);
}

/* ETag: identifica la VERSIONE del file con ora di modifica e dimensione, fra virgolette (RFC 9110 par. 8.8.3). */
static void make_etag(const struct stat *st, char *out, size_t size)
{
    snprintf(out, size, "\"%llx-%llx\"", (unsigned long long)st->st_mtime, (unsigned long long)st->st_size);
}

/* If-None-Match e' una lista: "\"a\", W/\"b\"" oppure "*". Vero se contiene l'ETag corrente.
 * Per If-None-Match si usa il confronto debole: il prefisso W/ si ignora. */
static int etag_matches(const char *header, const char *etag)
{
    if (header == NULL)
        return 0;
    if (strcmp(header, "*") == 0)
        return 1;
    size_t k = strlen(etag);
    for (const char *p = header; (p = strchr(p, '"')) != NULL;) {
        if (strncmp(p, etag, k) == 0)
            return 1;
        const char *q = strchr(p + 1, '"');         /* salta questo ETag fra virgolette */
        if (q == NULL)
            break;
        p = q + 1;
    }
    return 0;
}

static int name_ok(const char *s)                  /* solo lettere, cifre, '_', '-', '.'; non inizia con '.' */
{
    if (*s == '\0' || *s == '.')
        return 0;
    for (; *s; s++)
        if (!isalnum((unsigned char)*s) && *s != '_' && *s != '-' && *s != '.')
            return 0;
    return 1;
}

static void handle(int fd)
{
    struct rbuf in = {.fd = fd};
    char line[MAX_LINE], method[16], target[MAX_LINE], ver[16];
    if (rb_line(&in, line, sizeof line) < 0 || sscanf(line, "%15s %2047s %15s", method, target, ver) != 3 ||
        strncmp(ver, "HTTP/1.", 7) != 0) {
        reply(fd, 400, "Bad Request", "", "400 Bad Request\n", 0);
        return;
    }
    char auth[512] = "", inm[512] = "";
    int has_auth = 0, has_inm = 0;
    for (;;) {
        int len = rb_line(&in, line, sizeof line);
        if (len < 0) {
            reply(fd, 400, "Bad Request", "", "400 Bad Request\n", 0);
            return;
        }
        if (len == 0)
            break;
        char *colon = strchr(line, ':');
        if (colon == NULL)
            continue;
        *colon = '\0';
        const char *v = colon + 1;
        while (*v == ' ' || *v == '\t')
            v++;
        if (strcasecmp(line, "Authorization") == 0) {
            snprintf(auth, sizeof auth, "%s", v);
            has_auth = 1;
        } else if (strcasecmp(line, "If-None-Match") == 0) {
            snprintf(inm, sizeof inm, "%s", v);
            has_inm = 1;
        }
    }
    int head_only = strcmp(method, "HEAD") == 0;
    if (strcmp(method, "GET") != 0 && !head_only) {
        reply(fd, 405, "Method Not Allowed", "Allow: GET, HEAD\r\n", "405 Method Not Allowed\n", 0);
        return;
    }

    /* /public/NOME o /private/NOME */
    char *q = strchr(target, '?');
    if (q)
        *q = '\0';
    int is_private;
    const char *name;
    if (strncmp(target, "/public/", 8) == 0) {
        is_private = 0;
        name = target + 8;
    } else if (strncmp(target, "/private/", 9) == 0) {
        is_private = 1;
        name = target + 9;
    } else {
        reply(fd, 404, "Not Found", "", "404 Not Found\n", head_only);
        return;
    }
    if (!name_ok(name)) {                          /* niente '/' e niente "..": il percorso non puo' uscire dalla cartella */
        reply(fd, 404, "Not Found", "", "404 Not Found\n", head_only);
        return;
    }

    /* autenticazione: senza credenziali giuste, 401 con la sfida */
    if (is_private && !check_basic(has_auth ? auth : NULL)) {
        reply(fd, 401, "Unauthorized",
              "WWW-Authenticate: Basic realm=\"Area riservata\", charset=\"UTF-8\"\r\n", "401 Unauthorized\n", head_only);
        fprintf(stderr, "%s %s -> 401\n", method, target);
        return;
    }

    char path[MAX_LINE];
    snprintf(path, sizeof path, "%s/%s/%s", root_dir, is_private ? "private" : "public", name);
    int ffd = open(path, O_RDONLY);
    struct stat st;
    if (ffd < 0 || fstat(ffd, &st) < 0 || !S_ISREG(st.st_mode)) {
        if (ffd >= 0)
            close(ffd);
        reply(fd, 404, "Not Found", "", "404 Not Found\n", head_only);
        fprintf(stderr, "%s %s -> 404\n", method, target);
        return;
    }

    char etag[64], date[64], head[1024];
    make_etag(&st, etag, sizeof etag);
    http_date(date, sizeof date);
    /* public: riusabile dalle cache condivise per 60 s. private: no-cache = si puo' memorizzare ma
     * va RIVALIDATO a ogni uso (e' If-None-Match che evita di riscaricare); "private" esclude le cache condivise. */
    const char *cc = is_private ? "private, no-cache" : "public, max-age=60";

    if (has_inm && etag_matches(inm, etag)) {
        /* 304 Not Modified: stessi ETag e Cache-Control, NESSUN corpo */
        int n = snprintf(head, sizeof head,
                         "HTTP/1.1 304 Not Modified\r\nDate: %s\r\nETag: %s\r\nCache-Control: %s\r\nConnection: close\r\n\r\n",
                         date, etag, cc);
        write_all(fd, head, (size_t)n);
        fprintf(stderr, "%s %s -> 304\n", method, target);
        close(ffd);
        return;
    }
    int n = snprintf(head, sizeof head,
                     "HTTP/1.1 200 OK\r\nDate: %s\r\nETag: %s\r\nCache-Control: %s\r\nContent-Type: %s\r\n"
                     "Content-Length: %lld\r\nConnection: close\r\n\r\n",
                     date, etag, cc, mime_type(name), (long long)st.st_size);
    write_all(fd, head, (size_t)n);
    if (!head_only) {
        char buf[8192];
        ssize_t r;
        while ((r = read(ffd, buf, sizeof buf)) > 0)
            if (write_all(fd, buf, (size_t)r) < 0)
                break;
    }
    close(ffd);
    fprintf(stderr, "%s %s -> 200\n", method, target);
}

int main(int argc, char **argv)
{
    if (argc != 4 || strchr(argv[3], ':') == NULL) {
        fprintf(stderr, "uso: %s porta radice utente:password\n", argv[0]);
        return 1;
    }
    root_dir = argv[2];
    credentials = argv[3];
    signal(SIGPIPE, SIG_IGN);
    int lfd = socket(AF_INET, SOCK_STREAM, 0);
    if (lfd < 0) {
        perror("socket");
        return 1;
    }
    int yes = 1;
    setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof yes);
    struct sockaddr_in addr;
    memset(&addr, 0, sizeof addr);
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = htonl(INADDR_ANY);
    addr.sin_port = htons((unsigned short)atoi(argv[1]));
    if (bind(lfd, (struct sockaddr *)&addr, sizeof addr) < 0 || listen(lfd, 16) < 0) {
        perror("bind/listen");
        return 1;
    }
    for (;;) {
        int cfd = accept(lfd, NULL, NULL);
        if (cfd < 0) {
            if (errno == EINTR)
                continue;
            perror("accept");
            break;
        }
        handle(cfd);
        close(cfd);
    }
    return 0;
}

$ mkdir -p www/public www/private
$ echo pubblico > www/public/info.txt && echo segreto > www/private/riservato.txt
$ gcc -Wall -Wextra -o auth_server auth_server.c
$ ./auth_server 8080 ./www mario:segreto &

$ curl -i http://127.0.0.1:8080/private/riservato.txt
HTTP/1.1 401 Unauthorized
Content-Type: text/plain; charset=utf-8
Content-Length: 17
WWW-Authenticate: Basic realm="Area riservata", charset="UTF-8"

401 Unauthorized

$ curl -i -u mario:segreto http://127.0.0.1:8080/private/riservato.txt
HTTP/1.1 200 OK
Date: Sun, 11 Oct 2026 20:24:59 GMT
ETag: "6acbf093-8"
Cache-Control: private, no-cache
Content-Type: text/plain; charset=utf-8
Content-Length: 8
Connection: close

segreto

$ curl -i http://127.0.0.1:8080/public/info.txt
HTTP/1.1 200 OK
ETag: "6acbf093-9"
Cache-Control: public, max-age=60
Content-Length: 9
...
$ curl -i -H 'If-None-Match: "6acbf093-9"' http://127.0.0.1:8080/public/info.txt
HTTP/1.1 304 Not Modified
Date: Sun, 11 Oct 2026 20:24:59 GMT
ETag: "6acbf093-9"
Cache-Control: public, max-age=60
Connection: close

$ touch www/public/info.txt                      # il file cambia: cambia l'ETag
$ curl -i -H 'If-None-Match: "6acbf093-9"' http://127.0.0.1:8080/public/info.txt
HTTP/1.1 200 OK     (ETag nuovo, corpo completo)