Using XML-RPC in Secure Database Administration on the Web

Transcription

1 Using XML-RPC in Secure Database Administration on the Web Silvana Solomon Department of Digital Communications University Al.I.Cuza of Iasi, Romania Catalin Varvara RoEduNet Iasi Branch Abstract XML-RPC is a Remote Procedure Calling protocol that works over the Internet. An XML-RPC message is an HTTP-POST request. The body of the request is in XML. A procedure executes on the server and the value it returns is also formatted in XML. Procedure parameters can be scalars, numbers, strings, dates, etc.; and can also be complex record and list structures. The goal of this protocol is to lay a compatible foundation across different environments, no new power is provided beyond the capabilities of the CGI interface. Firewall software can watch for POSTs whose Content-Type is text/xml. We use the XML-RPC technology in order to securely transfer database contents on the Web. 1. Introduction The world gets more and more interconnected nowadays. People communicate by means of computers and there is a strong need for easy, reliable means to control and use the facilities offered by a remote machine. In a stand-alone computer, applications use procedure calls in order to realize their tasks. The same type of service is needed to make use of the capabilities that are accessible from other computers. For example, a computer can provide a service whereby it receives a number representing the year and after some calculations it returns the date of Easter for that year. Both the server machine and the client machine have to agree on the types and number of parameters to be passed and returned as well as on other details. For this, Remote Procedure Call or RPC was created. 2. RPC and XML-RPC 2.1. Overview RPC is a very simple extension to the procedure call idea. It creates connections between procedures that are running in different applications, or on different machines [3]. Conceptually, there's no difference between a local procedure call and a remote one, but they are implemented differently, perform differently and therefore are used for different tasks. RPC is much slower than a local procedure call because of the time required to establish the connection and for communication. Remote calls can be understood on both sides of the connection because the two machines implement the same protocol. The value in a standardized crossplatform approach for RPC is that it allows Unix machines to talk to Windows machines and vice versa. There are numerous possible formats for RPC. XML is a language that had a tremendous development and it has a lot of applications in almost every aspect of computer science. RPC made no exception and the two technologies combined to yield a powerful instrument that can be used on the Web. This is how XML-RPC appeared. XML-RPC is a specification and a set of implementations that allow software running on disparate operating systems, running in different environments to make procedure calls over the Internet. It is remote procedure calling using HTTP as the transport and XML as the encoding. It is designed to be as simple as possible, while still allowing complex data structures to be transmitted, processed and returned. In XML-RPC, it is easy to pass and return complex data types: arrays or structs can be employed as simple as primitive data types. This way, one can call procedures with very complicated and elaborated returned values or parameters. To what concerns the latter, they can be strongly typed. It is worth mentioning that the use of XML makes it easy to learn and implement. Up to now, there are known implementations in several programming languages. Servers are available for PHP, Frontier, Java, Perl, Tcl and Zope. Client implementations are available for PHP, Frontier, COM, Perl, TCL and Python. There is support for XML-RPC in web browsers such as Netscape. 236

2 2.2. XML-RPC vs. SOAP SOAP (Simple Object Access Protocol) is a protocol for exchange of information in a decentralized, distributed environment. It is an XML based protocol that consists of three parts: an envelope that defines a framework for describing what is in a message and how to process it, a set of encoding rules for expressing instances of application-defined datatypes, and a convention for representing remote procedure calls and responses. SOAP makes extensive use of namespacing and attribute specification tags in almost every element of a message. It implements user defined data types, the ability to specify the recipient, message specific processing control, and other features. While XML-RPC wants only to perform remote procedure call at a simple level, still remaining not complicated in format, SOAP reaches for more complex features and has more capabilities. For example, it has named structs and arrays, polymorphic ancestors and enumerations. In XML- RPC, an <array> contains a single <data> element, which can contain any number of s. The most important feature of XML-RPC is its simplicity. As the authors themselves state, it should be an easy to implement protocol that could be quickly adapted to run in different conditions. On the other hand, SOAP goes further and addresses detailed questions and therefore it has more features. Naturally, there is a trade-off for all these. XML- RPC is easy to use but has fewer capabilities, while SOAP provides more utilities and it is less natural to use [2]. SOAP involves significantly more overhead but adds much more information about what is being sent. If complex user defined data types and the ability to have each message define how it should be processed is needed, then SOAP is a better solution. Yet if standard data types and simple method calls are enough then XML-RPC makes applications faster and easier to debug and maintain Current Implementations XML-RPC is currently implemented and used in numerous applications that need to call applications from machines in a network. Web Crossing is well-known collaboration server platform [6], offering complete solutions and many features. It uses XML-RPC to share resources from a Web Crossing server, and to let a server access shared resources from other servers. It has the built-in ability to act as both an XML-RPC server and client. Through XML-RPC, a server can act as a client for another server. Also it allows to create new clients separate from a browser, to share information among servers and to make search requests on multiple co-operating servers. VisualOffice is a web-based groupware solution [5] that enables a company s staff to access their e- mails and collaborate on many tasks from one central location accessible anywhere in the world at anytime. VisualOffice uses XML-RPC internally to exchange information between the different modules, and externally to retrieve information such as news, weather, stocks, etc. For instance, it can get information from each one of them and display a summary of the events, tasks and folders that the user has. Using XML-RPC, VisualOffice can also retrieve external information from news feeds such as television channels and display it to the user. 3. XML-RPC for PHP We use a collection of PHP classes that provides a framework for writing XML-RPC clients and servers in PHP. Files in the distribution are: xmlrpc.inc - the XML-RPC classes. We must include this in our PHP files to use the classes. xmlrpcs.inc - the XML-RPC server class. We must include this too in addition to xmlrpc.inc to get server functionality The two above classes are used as libraries, and are not to be modified. The other next two classes are used in order to create XML-RPC client and server, using the two libraries. server.php - a sample server hosting six functions: 5 functions in order to decode the struct and to create the mysql command, and one to execute and to return the result of one query. client.php - client code to exercise the various functions in server.php Xmlrpc_client - the basic class used to represent a client of an XML-RPC server. Creation The constructor has the following syntax: $client=new xmlrpc_client($server_path, $server_hostname, $server_port); In our example client set up to query the server with the IP address : $client=new xmlrpc_client("rpc/server.php", " ", 80); The server_port parameter is optional, and if omitted will default to 80 when using HTTP and 443 when using HTTPS. The methods of this class used in the project are : send This method takes the form: $response=$client->send($xmlrpc_message, $timeout, $server_method); where $xmlrpc_message is an instance of xmlrpcmsg, and $response is an instance of xmlrpcresp. The $timeout is optional, and will be set to 0 (wait forever) if omitted. 237

3 The server_method parameter is optional, and if omitted will default to 'http'. The only other valid value is 'https', which will use an SSL HTTP connection to connect to the remote server. setdebug $client->setdebug($debugon); $debugon is either 0 or 1 depending on whether you require the client to print debugging information to the browser. The default is not to output this information. The debugging information includes the raw data returned from the XML-RPC server it was querying, and the PHP value the client attempts to create to represent the value returned by the server. This option can be very useful when debugging servers because it allows you to see exactly what the server returns. xmlrpc_server The current implementation of this class has been kept as simple as possible. The constructor for the server basically does all the work. Here's a minimal example: function my_select ($params) {... } $s=new xmlrpc_server (array("db_select" => array("function" => "my_select", "signature" => $my_select_sig, "docstring" => $my_select_doc) ) ); This performs everything you need to do with a server. The single argument is an associative array from method names to function names. The request is parsed and despatched to the relevant function, which is reponsible for returning a xmlrpcresp object, which gets serialized back to the caller. The first argument to the xmlrpc_server constructor is an array, called the dispatch map. In this array is the information the server needs to service the XML-RPC methods you define. The dispatch map takes the form of an associative array of associative arrays: the outer array has one entry for each method, the key being the method name. The corresponding value is another associative array, which can have the following members: function - this entry is mandatory. It must be a name of a function in the global scope which services the XML-RPC method. signature - this entry is an array containg the possible signatures for the method. If this entry is present then the server will check that the correct number and type of parameters have been sent for this method before dispatching it. docstring - this entry is a string containing documentation for the method. The documentation may contain HTML markup. Method signatures. A signature is a description of a method's return type and its parameter types. A method may have more than one signature. Within a server's dispatch map, each method has an array of possible signatures. Each signature is an array of types. The first entry is the return type. For instance, the method my_select(struct) has the signature array($xmlrpcstring, $xmlrpcstruct); and, assuming that it the only possible signature for the method, it might be used like this in server creation: $my_select_sig=array(array($xmlrpcstring, $xmlrpcstruct)); $my_select_doc='when passed a struct containing the parameters of an SQL command, it constructs the query, interrogates the BD and returns the query's result, where the tbl_id is actually the corresponding index of the interrogated table, in an array.'; For convenience the strings representing the XML-RPC types have been encoded as global variables: $xmlrpci4="i4"; $xmlrpcint="int"; $xmlrpcboolean="boolean"; $xmlrpcdouble="double"; $xmlrpcstring="string"; $xmlrpcdatetime="datetime.iso8601"; $xmlrpcbase64="base64"; $xmlrpcarray="array"; $xmlrpcstruct="struct"; Fault reporting. Fault codes for your servers should start at the value indicated by the global $xmlrpcerruser + 1. The general idea of the project's functionality is represented in the scheme below: WebClient1 XML-RPC client XML-RPC server DB server WebClient2 A.The WebClientX will make a request to the 238

4 XML-RPC client through a method called show_products_ofmycompany() for example. The XML-RPC client s functionality is to define the request to an XML-RPC server.the WebClient does not know anything about the database location and type. B. Next, the function which is called show_products_ofmycompany() in XML-RPC client calls a generic function to fill the fields of a struct object, that will look like: $select_param=new xmlrpcval (array( field_list" => new xmlrpcval (""), "tbl_id"=> new xmlrpcval("6"), "where" => new xmlrpcval(""), "group by" => new xmlrpcval(""), "order by" => new xmlrpcval(""), "having" =>new xmlrpcval("") ), "struct" ); In our case the field_list is empty and the XML- RPC server will take it as * argument of the SQL command option. Value 6 for tbl_id is the numeric correspondent of the table to be interrogated. The next steps in the XML-RPC client are : 1. represents a request to an XML-RPC server: $f = new xmlrpcmsg('db_select', array($select_param)); 2. creates an XML string representing the XML-RPC message: htmlentities($f->serialize()); In the XML-RPC request, its header has the form: POST /RPC HTTP/1.0 User-Agent: PHP/4.0.5 Host: Content-Type: text/xml Content-length: 558 The format of the URI in the first line of the header is not specified. For example, empty, a single slash, if the server is only handling XML-RPC calls. However, if the server is handling a mix of incoming HTTP requests, we allow the URI to help route the request to the code that handles XML-RPC requests. (In the example, the URI is RPC, telling to route the request to RPC responder.) A User-Agent and Host must be specified. The Content-type is text/xml. The Content-Length must be specified and must be correct. The payload is in XML, a single <methodcall> structure. The <methodcall> must contain a <methodname> sub-item, a string, containing the name of the method to be called. The string may only contain identifier characters, upper and lowercase A-Z, the numeric characters, 0-9, underscore, dot, colon and slash. It's entirely up to the server to decide how to interpret the characters in a methodname. For example, the methodname could be the name of a file containing a script that executes on an incoming request. It could be the name of a cell in a database table. Or it could be a path to a file contained within a hierarchy of folders and files. If the procedure call has parameters, the <methodcall> must contain a <params> sub-item. The <params> sub-item can contain any number of <param>s, each of which has a. The encapsulated request for the server looks like: <?xml version="1.0"?> <methodcall> <methodname>db_select</methodname> <params> <param> <struct> <member><name>field_list</name> </string> <member><name>tbl_id</name> 6</string> <member><name>where </name> </string> <member><name>group by</name> </string> <member><name>order by</name> </string> <member><name>having</name> </string> </struct> </param> </params> </methodcall> 3. creates the client instance: $client=new xmlrpc_client ("RPC/server.php", " ", 80); 4. sends the encapsulated request to the server. The result is kept in $r variable. $r=$c->send($f); C. Now, the DB_select function will be called in the server. This is the name known by the client, but the server associates to this name a different internal name, my_select. Here we unpack the struct, create the SQL query, executes it and sends back the answer to the client: $sno=$m->getparam(0); // if it's there and the correct type if (isset($sno) && ($sno->scalartyp()=="struct")) 239

5 { //create the SQL query regarding to the SQL //Server- here MySQL //calls a function that will execute effectively the //MySQL command: //query_result($query,$func_name) //returns to the XML-RPC client the result of the //query : new xmlrpcresp($q_result); //where $q_result is the XML-encapsulated //record set; this is done using a function called //rst2xml(&$rst); } D. Here is the response header format for our example: HTTP/ OK Date: Mon, 28 Apr :28:53 GMT Server: Apache/ (Win32) X-Powered-By: PHP/4.0.5 Content-length: 148 Connection: close Content-Type: text/xml Unless there s a lower-level error, always return 200OK. The Content-Type is text/xml. Content-Length must be present and correct. The body of the response is a single XML structure, a <methodresponse>, which can contain a single <params> which contains a single <record> which contains the fields of a recordset and their associated values.. The <methodresponse> could also contain a <fault> which contains a which is a <struct> containing two elements, one named <faultcode>, an <int> and one named <faultstring>, a. A <methodresponse> can not contain both a <fault> and a <params>. The XML-RPC client will get an answer that looks like: <?xml version="1.0" encoding="utf-8"?> <methodresponse> <params> <record1> <pr_id> <int> 1 <int> <pr_id> <prod_code> 0031 </prod_code> <prod_name> Painting cans </prod_name> <prod_measure_unit> liter </prod_measure_unit> <prod_price> <double> <double> </prod_price> </record1> <record2>... </record2> </params> </methodresponse> A secure way to work with a database through XML-RPC. Working with databases in a secure way, through XML-RPC. 4. Conclusion We used the XML-RPC technology in order to make the transfer of a database data on the Web. The approach: The XML-RPC client processes the request data received from the Web client and fills in the fields of a struct object. This one contains the elements of a standard SQL query. Once the Web client s request defined in this way, the struct object is packed in the XML format and sent to the XML-RPC server. Only here the SQL standard query is created in accordance with the database server s type, we make the connection, we obtain the result data. The result data is packed in the XML format and sent via HTTP to the XML- RPC client. This one generates the web page containing the SQL query result and it sends it to the Web-client. The goal of the XML-RPC client here is of a proxy between the Web-client and the XML- RPC server. 240

6 References [1] S. Buraga, Different XML-based Search Techniques on Web", Transactions on Automatic Control and Computer Science, vol.47 (61), No.2, Politehnica Press, Timisoara, 2002 [2] K. Rhodes, XML-RPC vs. SOAP, weblog.masukomi.org/writings/xmlrpc_vs_soap.htm [3] D. Winer, XML-RPC for Newbies, davenet.userland.com/1998/07/14/xmlrpcfornewbi es, 1998 [4] SOAP specification [5] VisualOffice webpage, [6] WebCrossing webpage, [7] XML-RPC Specification [8] Apple Computer, Making XML-RPC and SOAP Requests With AppleScript, 2001 [9] * * * - XML-RPC Tutorial, 241