first commit

Author: timo2

README

@@ -0,0 +1,73 @@
+Nginx HMAC Secure Link Module
+--
+
+Description:
+--
+
+The Nginx HMAC secure link module enhances the security and functionality
+of the standard secure link module. Secure token is created using secure
+HMAC construction with an arbitrary hash algorithm supported by OpenSSL,
+e.g., md5, sha1, sha256, sha512. Furthermore, secure token is created as
+described in RFC2104, that is,
+H(secret_key XOR opad,H(secret_key XOR ipad, message))
+instead of a simple 
+MD5(secret_key,message, expire).
+
+Installation:
+--
+
+You'll need to re-compile Nginx from source to include this module.
+Modify your compile of Nginx by adding the following directive
+(modified to suit your path of course):
+
+./configure --with-http_ssl_module --add-module=/absolute/path/to/nginx-hmac-secure-link
+make
+make install
+
+Usage:
+--
+
+Message to be hashed is defined by secure_link_hmac_message, secret_key 
+is given by secure_link_hmac_secret, and hashing algorithm H is defined 
+by secure_link_hmac_algorithm. The expiration timestamp can be either 
+appended to secret key, or message to be hashed, or both.
+
+Configuration example below.
+
+location ^~ /files/ {
+    secure_link $arg_st,$arg_e;
+    secure_link_hmac_secret my_secret_key$arg_e;
+    secure_link_hmac_message $uri;
+    secure_link_hmac_algorithm sha256;
+
+    if ($secure_link = "") {
+	return 403;
+    }
+
+    if ($secure_link = "0") {
+	return 410;
+    }
+
+    rewrite ^/files/(.$)$ /files/$1 break;
+}
+
+Application side should use a standard hash_hmac function to generate
+hash, which then needs to be base64 encoded. Example in PHP
+
+    $expire = time() + 3600;
+    $secret = "my_secret_key" . $expire;
+    $algo = "sha256";
+    $path = "/files/top_secret.pdf";
+    $hashmac = base64_encode(hash_hmac($algo,$path,$secret,true));
+    $hashmac = strtr($hashmac,"+/","-_"));
+    $hashmac = str_replace("=","",$hashmac);
+    $host = $_SERVER['HTTP_HOST'];
+    $loc = "https://" . $host . "/files/top_secret.pdf" . "?st=" . $hashmac . "&e=" . $expire;
+
+Contributing:
+--
+
+Git source repositories:
+http://github.com/timo2/nginx-hmac-secure-link/tree/master
+
+Please feel free to fork the project at GitHub and submit pull requests or patches.

config

@@ -0,0 +1,3 @@
+ngx_addon_name=ngx_http_hmac_secure_link_module
+HTTP_MODULES="$HTTP_MODULES ngx_http_hmac_secure_link_module"
+NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_hmac_secure_link_module.c"