Secure Link TTL patch
Author: Brice Figureau
Copyright (C) 2009 Days of Wonder Inc. All rights reserved.
--------------------------------------------------------------------
LICENSE::
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
--------------------------------------------------------------------------

This patch enhances Nginx 0.7 secure link download by adding url expiration.

The url should be formed like this (php example):
	define(DOWNLOAD_SECRET,"secret");
	define(URL_TIMEOUT, 3600);

  $pathtofile = 'path/to/file.txt';
  $time = pack('N', time() + URL_TIMEOUT);
 	$timeout = bin2hex($time);
 	$key = md5($url.$time.DOWNLOAD_SECRET);
  return $prefix . '/' . $key . $timeout . '/' . $pathtofile;

On the nginx side, you need a secure_link_ttl on directive to enable the url expiration check:
	location /downloads/ {
		secure_link "secret";
		secure_link_ttl on;
		root /var/www/downloads;
		
		if ($secure_link = "") {
			return 403;
		}
		
		rewrite ^ /$secure_link break;
	}

When secure_link_ttl is off, the old system is in place and the hash doesn't have to take into
accoun the timeout.	
	
diff -urN nginx-0.7.59/src/http/modules/ngx_http_secure_link_module.c nginx-0.7.59-secure-link-ttl/src/http/modules/ngx_http_secure_link_module.c
--- nginx-0.7.59/src/http/modules/ngx_http_secure_link_module.c	2008-10-21 14:33:23.000000000 +0200
+++ nginx-0.7.59-secure-link-ttl/src/http/modules/ngx_http_secure_link_module.c	2009-07-06 16:20:02.000000000 +0200
@@ -12,6 +12,7 @@
 
 typedef struct {
     ngx_str_t  secret;
+    ngx_flag_t ttl;
 } ngx_http_secure_link_conf_t;
 
 
@@ -29,7 +30,12 @@
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_secure_link_conf_t, secret),
       NULL },
-
+    {ngx_string("secure_link_ttl"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+			NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_secure_link_conf_t, ttl),
+			NULL},
       ngx_null_command
 };
 
@@ -78,7 +84,8 @@
     ngx_uint_t                     i;
     ngx_md5_t                      md5;
     ngx_http_secure_link_conf_t  *conf;
-    u_char                         hash[16];
+    u_char                         hash[16], timen[4];
+    time_t												 time;
 
     conf = ngx_http_get_module_loc_conf(r, ngx_http_secure_link_module);
 
@@ -113,12 +120,35 @@
 
     len = last - p;
 
-    if (end - start != 32 || len == 0) {
+		/* Url format is 
+				/prefix/hashtime/path/to/file 
+			 where: hashtime is md5( "path/to/file" + ttl + secret) + ttl
+			 where: ttl is the 32bits unix timestamp when the url expires in Network order (big endian)
+			 to produce the url in php:
+			 
+			 $time = pack('N',time() + 3600)
+			 $url = $prefix . '/' . md5( $file . $time . $secret ) . bin2hex($time) . '/' . $file
+			 
+		*/
+    if (end - start != (conf->ttl ? 40 : 32) || len == 0) {
         goto not_found;
     }
 
+
     ngx_md5_init(&md5);
     ngx_md5_update(&md5, p, len);
+    
+    if (conf->ttl) {
+		  for (i = 0; i < 4; i++) {
+		      n = ngx_hextoi(&start[32 + 2 * i], 2);
+		      if (n == NGX_ERROR) {
+		          goto not_found;
+		      }
+				 	timen[i] = n;
+		  }
+		  ngx_md5_update(&md5, &timen, 4);
+		}
+		
     ngx_md5_update(&md5, conf->secret.data, conf->secret.len);
     ngx_md5_final(hash, &md5);
 
@@ -128,7 +158,13 @@
             goto not_found;
         }
     }
-
+    
+    if (conf->ttl) {
+		  time = ntohl(*((unsigned long*)&timen));
+			if (ngx_time() > time)
+				goto not_found;
+		}
+		
     v->len = len;
     v->valid = 1;
     v->no_cacheable = 0;
@@ -160,6 +196,8 @@
      *
      *     conf->secret = { 0, NULL }
      */
+     
+		conf->ttl = NGX_CONF_UNSET;
 
     return conf;
 }
@@ -172,6 +210,7 @@
     ngx_http_secure_link_conf_t *conf = child;
 
     ngx_conf_merge_str_value(conf->secret, prev->secret, "");
+    ngx_conf_merge_value(conf->ttl, prev->ttl, 0);
 
     return NGX_CONF_OK;
 }
