refractalize / nginx_mod_akamai_g2o Goto Github PK
View Code? Open in Web Editor NEWNginx Module for Authenticating Akamai G2O requests
Nginx Module for Authenticating Akamai G2O requests
Hello!
Although I have no doubt, the current version works, several (substantial?) improvements can/should be made. I incorporate all of these in the G2O module for Varnish, which I wrote for my employer and so speak from some experience...
The process of changing the nonce/password with Akamai is not instantaneous. This is why Akamai are using the nonce concept to begin with -- to allow for multiple (at least -- two) passwords to remain valid in parallel. For some time after you change the Akamai configuration some of their servers will still be using the old nonce, so your back-end (origin) should recognize both. I implement this with a simple array of structures -- because the number of valid nonces is small (though greater than 1), linear search through the array is the fastest method :)
You are wasting time for each hit converting the computed digest into a character string and then using strcmp
to compare it with the supplied signature. Instead, it is faster to convert the supplied signature into numbers (of type uint64_t
) and then comparing the two pairs of numbers:
union qdigest {
unsigned char bytes[16];
uint64_t numbers[2];
};
...
union qdigest expected, computed;
...
b64decode(signature, expected.bytes);
...
HMAC_Final(tcontexts + count, computed.bytes, &len);
...
if (len != 16 ||
expected.numbers[0] != computed.numbers[0] ||
expected.numbers[1] != computed.numbers[1]) {
/* Report mismatch */
Some of the HMAC computations need only be done once (for each key), yet the current code recomputes the digest anew for each hit. Each thread can keep the HMAC-context for each key and keep reusing it. These two calls need only be done once for each key (in each thread):
HMAC_CTX_init(context); /* Is this even necessary? */
HMAC_Init_ex(context, key, len, EVP_md5(), NULL);
After this, for each hit only the following needs to happen:
HMAC_Update(context, (const unsigned char *)d, strlen(d));
HMAC_Update(context, (const unsigned char *)path, strlen(path));
HMAC_Final(context, computed.bytes, &len);
HMAC_Init_ex(context, NULL, 0, NULL, NULL);
The last call resets the context back to just the key - by passing the zeros, the caller indicates, he wants to reuse the already-supplied key. Presumably, this is faster, than full reinitialization.
I can not (easily) offer a working patch, because I don't have an nginx installation readily available. But you should be able to incorporate (some of) these ideas easily yourself.
There's no licence file checked-in with the code, and the source code has (c)opyright tags at the top.
Is the source able to be copied? or open source? Is it possible to specify the licence, either here in this issue, or ideally in the code. See https://help.github.com/articles/open-source-licensing/
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.