Compatibilitypatch for the module ngx_http_secure_link_module

[Mario]

Hi nginx team,

as I replaced some lighttpd service by nginx (without touching the web 
application) I had to apply some changes to the source of the 
ngx_http_secure_link_module. Some of the changes I found already as a 
patch in a forum but I had to extend this to have a 100% compatibility 
to the lighttpd mod_secdownload. Here are the differences in short:

- lighttpd/secdownload expects the hash to be encoded as hexdecimal of 
the md5 instead of base64
- lighttpd/secdownload adds the timestamp hexdecimal encoded es well - 
instead of decimal
- lighttpd/secdownload expects the timestamp to be the create time and 
calculates a delta itself

My nginx config is basically like this (relevant part only):

# 1st match: hash(hex), 2nd match: time(hex), 3rd match: real location
location ~* "^/([a-fA-F0-9]{32,32})/([a-fA-f0-9]{8,8})/(.*)$" {
   ## this is the key compared to 'secdownload.secret'
   set $sec_key 'my-secret-key';

   ## this is the location of hash and time;
   ## combinded with this context it equals
   ## secdownload.uri-prefix = '/' and secdownload.timeout = 600
   ## my patch introduced a hex time when the timestamp starts with 0x
   secure_link $1,0x$2+600;

   ## this is default with lighttpd/secdownload (according to its 
documentation)
   secure_link_md5 $sec_key/$3$2;

   if ($secure_link = "") { # not valid
     return 403;
   }
   if ($secure_link = "0") { # expired
     return 410;
   }
   proxy_pass http://127.0.0.1:8080/$3;
   proxy_set_header Host mylocalservice.intra;
}

Does this patch make sense to your project? This would be great because 
otherwise I need to patch every version myself befor I can use it. And 
maybe there are other usecases where lighttpd needs to be replaced ;-)

Here is the patch I actually use:
----- START PATCH -----
--- ngx_http_secure_link_module.c.old	2014-08-05 13:18:35.000000000 
+0200
+++ ngx_http_secure_link_module.c	2014-08-17 12:19:00.770229341 +0200
@@ -101,13 +101,15 @@ static ngx_int_t
  ngx_http_secure_link_variable(ngx_http_request_t *r,
      ngx_http_variable_value_t *v, uintptr_t data)
  {
-    u_char                       *p, *last;
+    u_char                       *p, *q, *last;
      ngx_str_t                     val, hash;
-    time_t                        expires;
+    time_t                        expires, ttl;
      ngx_md5_t                     md5;
      ngx_http_secure_link_ctx_t   *ctx;
      ngx_http_secure_link_conf_t  *conf;
      u_char                        hash_buf[16], md5_buf[16];
+    ngx_int_t n;
+    ngx_uint_t i;

      conf = ngx_http_get_module_loc_conf(r, 
ngx_http_secure_link_module);

@@ -129,16 +131,38 @@ ngx_http_secure_link_variable(ngx_http_r
      last = val.data + val.len;

      p = ngx_strlchr(val.data, last, ',');
+
      expires = 0;
+    ttl = 0;

-    if (p) {
-        val.len = p++ - val.data;
+    if (p) { // expires
+        val.len = p - val.data;

-        expires = ngx_atotm(p, last - p);
-        if (expires <= 0) {
+	if (last - ++p < 0) {
              goto not_found;
          }

+	q = ngx_strlchr(p, last, '+');
+
+	if (q) { // ttl
+	    if (last - ++q < 0 || (ttl = ngx_atotm(q, last - q)) < 0 || --q - 
p <= 0) {
+		goto not_found;
+	    }
+	} else {
+	    q = last;
+	}
+
+	if (p[0] == '0' && p[1] == 'x' && p[2]) { /* hexdecimal time */
+	   p += 2; /* skip '0x' */
+	   if((expires = ngx_hextoi(p, q - p)) == NGX_ERROR) {
+		goto not_found;
+	   }
+        } else if ((expires = ngx_atotm(p, q - p)) <= 0) { /* decimal 
time */
+	    goto not_found;
+	}
+
+	expires += ttl;
+
          ctx = ngx_pcalloc(r->pool, sizeof(ngx_http_secure_link_ctx_t));
          if (ctx == NULL) {
              return NGX_ERROR;
@@ -146,22 +170,26 @@ ngx_http_secure_link_variable(ngx_http_r

          ngx_http_set_ctx(r, ctx, ngx_http_secure_link_module);

-        ctx->expires.len = last - p;
+	ctx->expires.len = q - p;
          ctx->expires.data = p;
      }

-    if (val.len > 24) {
-        goto not_found;
-    }
-
      hash.len = 16;
      hash.data = hash_buf;

-    if (ngx_decode_base64url(&hash, &val) != NGX_OK) {
-        goto not_found;
-    }
-
-    if (hash.len != 16) {
+    if (val.len == 32) { // hexadecimal md5
+	for (i = 0; i < 16; i++) {
+	    n = ngx_hextoi(&val.data[2 * i], 2);
+	    if (n == NGX_ERROR) {
+		goto not_found;
+	    }
+	    hash.data[i] = n;
+	}
+    } else if (val.len <= 24) { // base64 md5
+	if (ngx_decode_base64url(&hash, &val) != NGX_OK || hash.len != 16) {
+	    goto not_found;
+	}
+    } else {
          goto not_found;
      }
----- END PATCH -----


Thank you for your feedback!

/Mario