[hcoop/debian/libapache-mod-waklog.git] / mod_waklog.c

#include "httpd.h"
#include "http_config.h"
#include "http_conf_globals.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "http_core.h"
#include "ap_config.h"
#include <krb5.h>

#if defined(sun)
#include <sys/ioccom.h>
#endif /* sun */
#include <stropts.h>
#include <kerberosIV/krb.h>
#include <kerberosIV/des.h>
#include <afs/venus.h>
#include <afs/auth.h>
#include <rx/rxkad.h>

#include <asm/bitops.h>
#include <sys/shm.h>

#define KEYTAB_PATH "/home/drh/keytab.umweb.drhtest"
#define PRINCIPAL "umweb/drhtest"
#define AFS "afs"
#define IN_TKT_SERVICE "krbtgt/UMICH.EDU"

#define K5PATH "FILE:/tmp/waklog.creds.k5"
#define K4PATH "/tmp/waklog.creds.k4"

module waklog_module;

struct ClearToken {
    long AuthHandle;
    char HandShakeKey[ 8 ];
    long ViceId;
    long BeginTimestamp;
    long EndTimestamp;
};

typedef struct {
    int		configured;
    int		protect;
    char	*keytab;
    char	*keytab_principal;
    char	*afs_instance;
} waklog_host_config;

typedef struct {
	struct ktc_token	token;
} waklog_child_config;
waklog_child_config	*child = NULL;


    static void *
waklog_create_dir_config( pool *p, char *path )
{
    waklog_host_config *cfg;

    cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
    cfg->configured = 0;
    cfg->protect = 0;
    cfg->keytab = 0;
    cfg->keytab_principal = 0;
    cfg->afs_instance = 0;

    return( cfg );
}


    static void *
waklog_create_server_config( pool *p, server_rec *s )
{
    waklog_host_config *cfg;

    cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
    cfg->configured = 0;
    cfg->protect = 0;
    cfg->keytab = 0;
    cfg->keytab_principal = 0;
    cfg->afs_instance = 0;

    return( cfg );
}


    static const char *
set_waklog_protect( cmd_parms *params, void *mconfig, int flag )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    cfg->protect = flag;
    cfg->configured = 1;
    return( NULL );
}


    static const char *
set_waklog_use_keytab( cmd_parms *params, void *mconfig, char *file  )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
	    "mod_waklog: using keytab: %s", file );

    cfg->keytab = file;
    cfg->configured = 1;
    return( NULL );
}


    static void
waklog_child_init( server_rec *s, pool *p )
{

    if ( child  == NULL ) {
	child = (waklog_child_config *) ap_palloc( p, sizeof( waklog_child_config ) );
    }

    memset( &child->token, 0, sizeof( struct ktc_token ) );

    setpag();

    return;
}


command_rec waklog_cmds[ ] =
{
    { "WaklogProtected", set_waklog_protect,
    NULL, RSRC_CONF | ACCESS_CONF, FLAG,
    "enable waklog on a location or directory basis" },

    { "WaklogUseKeytab", set_waklog_use_keytab,
    NULL, RSRC_CONF, TAKE1,
    "Use the supplied keytab file rather than the user's TGT" },

    { NULL }
};


    static void
pioctl_cleanup( void *data )
{
    request_rec		*r = (request_rec *)data;

    if ( child->token.ticketLen ) {
	memset( &child->token, 0, sizeof( struct ktc_token ) );

	ktc_ForgetAllTokens();

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: ktc_ForgetAllTokens succeeded" );
    }
    return;
}


    static int
waklog_ktinit( server_rec *s )
{
    krb5_error_code		kerror;
    krb5_context		kcontext;
    krb5_principal		kprinc;
    krb5_get_init_creds_opt	kopts;
    krb5_creds			v5creds;
    CREDENTIALS			v4creds;
    krb5_ccache			kccache;
    krb5_keytab			keytab = 0;
    char			ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
    krb5_timestamp		now;
    waklog_host_config		*cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_ktinit called" );

    if (( kerror = krb5_init_context( &kcontext ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
        	(char *)error_message( kerror ));

        goto cleanup1;
    }

    /* use the path */
    if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup2;
    }

   if (( kerror = krb5_parse_name( kcontext, PRINCIPAL, &kprinc ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

       	goto cleanup3;
    }

    krb5_get_init_creds_opt_init( &kopts );
    krb5_get_init_creds_opt_set_tkt_life( &kopts, 10*60*60 );
    krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
    krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
    krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );

    cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
	    &waklog_module );

    /* which keytab should we use? */
    strcpy( ktbuf, cfg->keytab ? cfg->keytab : KEYTAB_PATH );

    if ( strlen( ktbuf ) > MAX_KEYTAB_NAME_LEN ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		"server configuration error" );

	goto cleanup4;
    }

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	    "mod_waklog: waklog_ktinit using: %s", ktbuf );

    if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup4;
    }

    /* get the krbtgt */
    if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds, 
		kprinc, keytab, 0, IN_TKT_SERVICE, &kopts ))) {

	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup5;
    }

   if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
    	    kprinc, keytab, NULL, NULL )) != 0 ) {

	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup6;
    }

    if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup6;
    }

    if (( kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup6;
    }

#if 0
    /* convert K5 => K4 */
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	    "mod_waklog: before krb524_convert_creds" );

    if (( kerror = krb524_convert_creds_kdc( kcontext,
	    &v5creds, &v4creds )) != 0 ) {

    	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup6;
    }

    /* use the path */
    krb_set_tkt_string( (char *)K4PATH );

    /* initialize ticket cache */
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	    "mod_waklog: before in_tkt" );

    if (( kerror = in_tkt( v4creds.pname, v4creds.pinst )) != KSUCCESS ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup6;
    }

    /* stash, ticket, session key, etc for future use */
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	    "mod_waklog: before krb_save_credentials" );

    if (( kerror = krb_save_credentials( v4creds.service,
	    v4creds.instance, v4creds.realm, v4creds.session,
	    v4creds.lifetime, v4creds.kvno, &(v4creds.ticket_st),
	    v4creds.issue_date )) != 0 ) {

    	ap_log_error( APLOG_MARK, APLOG_ERR, s,
    		(char *)error_message( kerror ));

    	goto cleanup6;
    }
#endif /* 0 */

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_ktinit success" );

cleanup6: if ( v5creds.client == kprinc ) {
	      v5creds.client = 0;
	  }
	  krb5_free_cred_contents( kcontext, &v5creds );
cleanup5: (void)krb5_kt_close( kcontext, keytab );
cleanup4: krb5_free_principal( kcontext, kprinc );
cleanup3: krb5_cc_close( kcontext, kccache );
cleanup2: krb5_free_context( kcontext );
cleanup1:   

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_ktinit: exiting" );

    return( 0 );
}


    static void
waklog_aklog( request_rec *r )
{
    int				rc;
    char			buf[ 1024 ];
    const char          	*k4path = NULL;
    const char          	*k5path = NULL;
    krb5_error_code		kerror;
    krb5_context		kcontext;
    krb5_creds			increds;
    krb5_creds			*v5credsp = NULL;
    CREDENTIALS			v4creds;
    krb5_ccache			kccache;
    struct ktc_principal	server = { "afs", "", "umich.edu" };
    struct ktc_principal	client;
    struct ktc_token		token;

    k5path = ap_table_get( r->subprocess_env, "KRB5CCNAME" );
    k4path = ap_table_get( r->subprocess_env, "KRBTKFILE" );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: waklog_aklog called: k5path: %s, k4path: %s", k5path, k4path );

    if ( !k5path || !k4path ) {   
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: waklog_aklog giving up" );
	return;
    }

    /*
    ** Get/build creds from file/tgs, then see if we need to SetToken
    */

    if (( kerror = krb5_init_context( &kcontext ))) {
	/* Authentication Required ( kerberos error ) */
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		(char *)error_message( kerror ));

	return;
    }

    memset( (char *)&increds, 0, sizeof(increds));

    /* set server part */
    if (( kerror = krb5_parse_name( kcontext, AFS, &increds.server ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		(char *)error_message( kerror ));

	return;
    }

    if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
    	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
    		(char *)error_message( kerror ));
    
        return;
    }

    /* set client part */
    krb5_cc_get_principal( kcontext, kccache, &increds.client );

    increds.times.endtime = 0;
    /* Ask for DES since that is what V4 understands */
    increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;

    /* get the V5 credentials */
    if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
		&increds, &v5credsp ) ) ) {
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: krb5_get_credentials: %s", krb_err_txt[ kerror ] );
	return;
    }

    /* get the V4 credentials */
    if (( kerror = krb524_convert_creds_kdc( kcontext, v5credsp, &v4creds ) ) ) {
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: krb524_convert_creds_kdc: %s", krb_err_txt[ kerror ] );
	return;
    }

    /* assemble the token */
    token.kvno = v4creds.kvno;
    token.startTime = v4creds.issue_date;
    token.endTime = v5credsp->times.endtime;
    memmove( &token.sessionKey, v4creds.session, 8 );
    token.ticketLen = v4creds.ticket_st.length ;
    memmove( token.ticket, v4creds.ticket_st.dat, token.ticketLen );

    /* make sure we have to do this */
    if ( child->token.kvno != token.kvno ||
	    child->token.ticketLen != token.ticketLen ||
	    memcmp( &child->token.sessionKey, &token.sessionKey,
		    sizeof( token.sessionKey ) ) ||
	    memcmp( child->token.ticket, token.ticket, token.ticketLen ) ) {

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %s.%s@%s", v4creds.service, v4creds.instance,
		v4creds.realm );
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %d %d %d", v4creds.lifetime, v4creds.kvno,
		v4creds.issue_date );
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %s %s", v4creds.pname, v4creds.pinst );
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %d", v4creds.ticket_st.length );

	/* build the name */
	strcpy( buf, v4creds.pname );
	if ( v4creds.pinst[ 0 ] ) {
		strcat( buf, "." );
		strcat( buf, v4creds.pinst );
	}

	/* assemble the client */
	strncpy( client.name, buf, MAXKTCNAMELEN - 1 );
	strcpy( client.instance, "" );
	strncpy( client.cell, v4creds.realm, MAXKTCNAMELEN - 1 );

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: server: name=%s, instance=%s, cell=%s",
		server.name, server.instance, server.cell );

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: client: name=%s, instance=%s, cell=%s",
		 client.name, client.instance, client.cell );

	/* use the path */
	krb_set_tkt_string( (char *)k4path );

	/* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
	write( 2, "", 0 );

	if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
	    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: settoken returned %d", rc );
	}

	/* save this */
	memmove( &child->token, &token, sizeof( struct ktc_token ) );

	/* we'll need to unlog when this connection is done. */
	ap_register_cleanup( r->pool, (void *)r, pioctl_cleanup, ap_null_cleanup );
    }

    krb5_free_cred_contents( kcontext, v5credsp );
    krb5_free_principal( kcontext, increds.client );
    krb5_cc_close( kcontext, kccache );
    krb5_free_context( kcontext );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	        "mod_waklog: finished with waklog_aklog" );

}

    static int
waklog_child_routine( void *s, child_info *pinfo )
{
    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, s,
	    "mod_waklog: waklog_child_routine called" );

    if ( !getuid() ) {
	ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, s,
		"mod_waklog: waklog_child_routine called as root" );

	/* this was causing the credential file to get owned by root */
	setgid(ap_group_id);
	setuid(ap_user_id);
    }

    while( 1 ) {
	waklog_ktinit( s );
	sleep( 60 /* 10*60*60 - 5*60 */ );
    }

}


    static void
waklog_init( server_rec *s, pool *p )
{
    extern char	*version;
    int pid;

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, s,
	    "mod_waklog: version %s initialized.", version );

    pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
	    NULL, NULL, NULL );

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, s,
	    "mod_waklog: ap_bspawn_child: %d.", pid );
}


    static int
waklog_phase0( request_rec *r )
{
    waklog_host_config  *cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase0 called" );

    /* directory config? */
    cfg = (waklog_host_config *)ap_get_module_config(
            r->per_dir_config, &waklog_module);

    /* server config? */
    if ( !cfg->configured ) {
	cfg = (waklog_host_config *)ap_get_module_config(
	    r->server->module_config, &waklog_module);
    }

    if ( !cfg->protect ) {
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: phase0 declining" );
        return( DECLINED );
    }

    /* do this only if we are still unauthenticated */
    if ( !child->token.ticketLen ) {

	/* set our environment variables */
	ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
	ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );

	/* stuff the credentials into the kernel */
	waklog_aklog( r );
    }
    
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase0 returning" );
    return DECLINED;
}


    static int
waklog_phase7( request_rec *r )
{
    waklog_host_config	*cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase7 called" );

    /* directory config? */
    cfg = (waklog_host_config *)ap_get_module_config(
            r->per_dir_config, &waklog_module);

    /* server config? */
    if ( !cfg->configured ) {
	cfg = (waklog_host_config *)ap_get_module_config(
	    r->server->module_config, &waklog_module);
    }

    if ( !cfg->protect ) {
        return( DECLINED );
    }

    /* stuff the credentials into the kernel */
    waklog_aklog( r );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase7 returning" );

    return DECLINED;
}

    static void
waklog_new_connection( conn_rec *c ) {
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, c->server,
	"mod_waklog: new_connection called: conn_rec: 0x%08x pid: %d", c, getpid() );
    return;
}

module MODULE_VAR_EXPORT waklog_module = {
    STANDARD_MODULE_STUFF, 
    waklog_init,              /* module initializer                  */
    waklog_create_dir_config, /* create per-dir    config structures */
    NULL,                  /* merge  per-dir    config structures */
    waklog_create_server_config, /* create per-server config structures */
    NULL,                  /* merge  per-server config structures */
    waklog_cmds,           /* table of config file commands       */
    NULL,                  /* [#8] MIME-typed-dispatched handlers */
    NULL,                  /* [#1] URI to filename translation    */
    NULL,                  /* [#4] validate user id from request  */
    NULL,                  /* [#5] check if the user is ok _here_ */
    NULL,                  /* [#3] check access by host address   */
    NULL,                  /* [#6] determine MIME type            */
    waklog_phase7,         /* [#7] pre-run fixups                 */
    NULL,                  /* [#9] log a transaction              */
    NULL,                  /* [#2] header parser                  */
    waklog_child_init,     /* child_init                          */
    NULL,                  /* child_exit                          */
    waklog_phase0          /* [#0] post read-request              */
#ifdef EAPI
   ,NULL,                  /* EAPI: add_module                    */
    NULL,                  /* EAPI: remove_module                 */
    NULL,                  /* EAPI: rewrite_command               */
    waklog_new_connection  /* EAPI: new_connection                */
#endif
};
Commit	Line	Data
bed98ff9	1	#include "httpd.h"
bed98ff9	2	#include "http_config.h"
7193eb01	3	#include "http_conf_globals.h"
bed98ff9	4	#include "http_log.h"
7193eb01	5	#include "http_protocol.h"
	6	#include "http_request.h"
	7	#include "http_core.h"
bed98ff9	8	#include "ap_config.h"
4e1ae1cd	9	#include <krb5.h>
bed98ff9	10
7193eb01	11	#if defined(sun)
bed98ff9	12	#include <sys/ioccom.h>
7193eb01	13	#endif /* sun */
bed98ff9	14	#include <stropts.h>
	15	#include <kerberosIV/krb.h>
	16	#include <kerberosIV/des.h>
	17	#include <afs/venus.h>
7193eb01	18	#include <afs/auth.h>
	19	#include <rx/rxkad.h>
	20
	21	#include <asm/bitops.h>
	22	#include <sys/shm.h>
bed98ff9	23
7193eb01	24	#define KEYTAB_PATH "/home/drh/keytab.umweb.drhtest"
	25	#define PRINCIPAL "umweb/drhtest"
	26	#define AFS "afs"
4e1ae1cd	27	#define IN_TKT_SERVICE "krbtgt/UMICH.EDU"
4e1ae1cd	28
7193eb01	29	#define K5PATH "FILE:/tmp/waklog.creds.k5"
	30	#define K4PATH "/tmp/waklog.creds.k4"
	31
313dde40	32	module waklog_module;
bed98ff9	33
	34	struct ClearToken {
	35	long AuthHandle;
	36	char HandShakeKey[ 8 ];
	37	long ViceId;
	38	long BeginTimestamp;
	39	long EndTimestamp;
	40	};
	41
313dde40	42	typedef struct {
4e1ae1cd	43	int configured;
	44	int protect;
	45	char *keytab;
7193eb01	46	char *keytab_principal;
7193eb01	47	char *afs_instance;
313dde40	48	} waklog_host_config;
313dde40	49
7193eb01	50	typedef struct {
	51	struct ktc_token token;
	52	} waklog_child_config;
	53	waklog_child_config *child = NULL;
313dde40	54
e21f34f0	55
313dde40	56	static void *
	57	waklog_create_dir_config( pool p, char path )
	58	{
	59	waklog_host_config *cfg;
	60
	61	cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
	62	cfg->configured = 0;
	63	cfg->protect = 0;
7193eb01	64	cfg->keytab = 0;
	65	cfg->keytab_principal = 0;
	66	cfg->afs_instance = 0;
313dde40	67
	68	return( cfg );
	69	}
	70
	71
	72	static void *
	73	waklog_create_server_config( pool p, server_rec s )
	74	{
	75	waklog_host_config *cfg;
	76
	77	cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
	78	cfg->configured = 0;
	79	cfg->protect = 0;
7193eb01	80	cfg->keytab = 0;
	81	cfg->keytab_principal = 0;
	82	cfg->afs_instance = 0;
313dde40	83
	84	return( cfg );
	85	}
	86
	87
313dde40	88	static const char *
	89	set_waklog_protect( cmd_parms params, void mconfig, int flag )
	90	{
	91	waklog_host_config *cfg;
	92
	93	if ( params->path == NULL ) {
	94	cfg = (waklog_host_config *) ap_get_module_config(
	95	params->server->module_config, &waklog_module );
	96	} else {
	97	cfg = (waklog_host_config *)mconfig;
	98	}
	99
	100	cfg->protect = flag;
	101	cfg->configured = 1;
	102	return( NULL );
	103	}
	104
	105
4e1ae1cd	106	static const char *
	107	set_waklog_use_keytab( cmd_parms params, void mconfig, char *file )
	108	{
	109	waklog_host_config *cfg;
	110
	111	if ( params->path == NULL ) {
	112	cfg = (waklog_host_config *) ap_get_module_config(
	113	params->server->module_config, &waklog_module );
	114	} else {
	115	cfg = (waklog_host_config *)mconfig;
	116	}
	117
3ed1e28a	118	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, params->server,
	119	"mod_waklog: using keytab: %s", file );
	120
4e1ae1cd	121	cfg->keytab = file;
	122	cfg->configured = 1;
	123	return( NULL );
	124	}
	125
	126
b74fad73	127	static void
313dde40	128	waklog_child_init( server_rec s, pool p )
b74fad73	129	{
7193eb01	130
	131	if ( child == NULL ) {
	132	child = (waklog_child_config *) ap_palloc( p, sizeof( waklog_child_config ) );
	133	}
	134
	135	memset( &child->token, 0, sizeof( struct ktc_token ) );
	136
b74fad73	137	setpag();
7193eb01	138
b74fad73	139	return;
	140	}
	141
	142
313dde40	143	command_rec waklog_cmds[ ] =
	144	{
	145	{ "WaklogProtected", set_waklog_protect,
	146	NULL, RSRC_CONF \| ACCESS_CONF, FLAG,
	147	"enable waklog on a location or directory basis" },
	148
4e1ae1cd	149	{ "WaklogUseKeytab", set_waklog_use_keytab,
	150	NULL, RSRC_CONF, TAKE1,
	151	"Use the supplied keytab file rather than the user's TGT" },
	152
313dde40	153	{ NULL }
	154	};
	155
	156
bed98ff9	157	static void
	158	pioctl_cleanup( void *data )
	159	{
	160	request_rec r = (request_rec )data;
bed98ff9	161
7193eb01	162	if ( child->token.ticketLen ) {
7193eb01	163	memset( &child->token, 0, sizeof( struct ktc_token ) );
bed98ff9	164
7193eb01	165	ktc_ForgetAllTokens();
bed98ff9	166
7193eb01	167	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	168	"mod_waklog: ktc_ForgetAllTokens succeeded" );
	169	}
b74fad73	170	return;
bed98ff9	171	}
	172
	173
4e1ae1cd	174	static int
e21f34f0	175	waklog_ktinit( server_rec *s )
4e1ae1cd	176	{
	177	krb5_error_code kerror;
	178	krb5_context kcontext;
	179	krb5_principal kprinc;
4e1ae1cd	180	krb5_get_init_creds_opt kopts;
7193eb01	181	krb5_creds v5creds;
7193eb01	182	CREDENTIALS v4creds;
4e1ae1cd	183	krb5_ccache kccache;
	184	krb5_keytab keytab = 0;
	185	char ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
7193eb01	186	krb5_timestamp now;
e21f34f0	187	waklog_host_config *cfg;
4e1ae1cd	188
e21f34f0	189	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
7193eb01	190	"mod_waklog: waklog_ktinit called" );
4e1ae1cd	191
e21f34f0	192	if (( kerror = krb5_init_context( &kcontext ))) {
	193	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	194	(char *)error_message( kerror ));
4e1ae1cd	195
e21f34f0	196	goto cleanup1;
e21f34f0	197	}
4e1ae1cd	198
e21f34f0	199	/* use the path */
	200	if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
	201	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	202	(char *)error_message( kerror ));
4e1ae1cd	203
e21f34f0	204	goto cleanup2;
e21f34f0	205	}
4e1ae1cd	206
e21f34f0	207	if (( kerror = krb5_parse_name( kcontext, PRINCIPAL, &kprinc ))) {
	208	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	209	(char *)error_message( kerror ));
7193eb01	210
e21f34f0	211	goto cleanup3;
e21f34f0	212	}
7193eb01	213
e21f34f0	214	krb5_get_init_creds_opt_init( &kopts );
	215	krb5_get_init_creds_opt_set_tkt_life( &kopts, 106060 );
	216	krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
	217	krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
	218	krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );
7193eb01	219
e21f34f0	220	cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
e21f34f0	221	&waklog_module );
7193eb01	222
e21f34f0	223	/* which keytab should we use? */
e21f34f0	224	strcpy( ktbuf, cfg->keytab ? cfg->keytab : KEYTAB_PATH );
7193eb01	225
e21f34f0	226	if ( strlen( ktbuf ) > MAX_KEYTAB_NAME_LEN ) {
	227	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	228	"server configuration error" );
7193eb01	229
e21f34f0	230	goto cleanup4;
e21f34f0	231	}
7193eb01	232
e21f34f0	233	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e21f34f0	234	"mod_waklog: waklog_ktinit using: %s", ktbuf );
7193eb01	235
e21f34f0	236	if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
	237	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	238	(char *)error_message( kerror ));
7193eb01	239
e21f34f0	240	goto cleanup4;
e21f34f0	241	}
7193eb01	242
e21f34f0	243	/* get the krbtgt */
	244	if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds,
	245	kprinc, keytab, 0, IN_TKT_SERVICE, &kopts ))) {
7193eb01	246
e21f34f0	247	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	248	(char *)error_message( kerror ));
7193eb01	249
e21f34f0	250	goto cleanup5;
e21f34f0	251	}
7193eb01	252
e21f34f0	253	if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
e21f34f0	254	kprinc, keytab, NULL, NULL )) != 0 ) {
7193eb01	255
e21f34f0	256	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	257	(char *)error_message( kerror ));
7193eb01	258
e21f34f0	259	goto cleanup6;
e21f34f0	260	}
7193eb01	261
e21f34f0	262	if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
	263	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	264	(char *)error_message( kerror ));
7193eb01	265
e21f34f0	266	goto cleanup6;
e21f34f0	267	}
7193eb01	268
e21f34f0	269	if (( kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds )) != 0 ) {
	270	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	271	(char *)error_message( kerror ));
7193eb01	272
e21f34f0	273	goto cleanup6;
e21f34f0	274	}
7193eb01	275
e21f34f0	276	#if 0
	277	/* convert K5 => K4 */
	278	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
	279	"mod_waklog: before krb524_convert_creds" );
7193eb01	280
e21f34f0	281	if (( kerror = krb524_convert_creds_kdc( kcontext,
e21f34f0	282	&v5creds, &v4creds )) != 0 ) {
7193eb01	283
e21f34f0	284	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	285	(char *)error_message( kerror ));
7193eb01	286
e21f34f0	287	goto cleanup6;
e21f34f0	288	}
7193eb01	289
e21f34f0	290	/* use the path */
e21f34f0	291	krb_set_tkt_string( (char *)K4PATH );
7193eb01	292
e21f34f0	293	/* initialize ticket cache */
	294	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
	295	"mod_waklog: before in_tkt" );
7193eb01	296
e21f34f0	297	if (( kerror = in_tkt( v4creds.pname, v4creds.pinst )) != KSUCCESS ) {
	298	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	299	(char *)error_message( kerror ));
7193eb01	300
e21f34f0	301	goto cleanup6;
e21f34f0	302	}
7193eb01	303
e21f34f0	304	/* stash, ticket, session key, etc for future use */
	305	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
	306	"mod_waklog: before krb_save_credentials" );
7193eb01	307
e21f34f0	308	if (( kerror = krb_save_credentials( v4creds.service,
	309	v4creds.instance, v4creds.realm, v4creds.session,
	310	v4creds.lifetime, v4creds.kvno, &(v4creds.ticket_st),
	311	v4creds.issue_date )) != 0 ) {
4e1ae1cd	312
e21f34f0	313	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	314	(char *)error_message( kerror ));
	315
	316	goto cleanup6;
	317	}
	318	#endif /* 0 */
	319
	320	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
	321	"mod_waklog: waklog_ktinit success" );
	322
	323	cleanup6: if ( v5creds.client == kprinc ) {
	324	v5creds.client = 0;
	325	}
	326	krb5_free_cred_contents( kcontext, &v5creds );
	327	cleanup5: (void)krb5_kt_close( kcontext, keytab );
	328	cleanup4: krb5_free_principal( kcontext, kprinc );
	329	cleanup3: krb5_cc_close( kcontext, kccache );
	330	cleanup2: krb5_free_context( kcontext );
	331	cleanup1:
	332
	333	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
7193eb01	334	"mod_waklog: waklog_ktinit: exiting" );
	335
	336	return( 0 );
	337	}
	338
	339
	340	static void
	341	waklog_aklog( request_rec *r )
	342	{
	343	int rc;
	344	char buf[ 1024 ];
	345	const char *k4path = NULL;
	346	const char *k5path = NULL;
	347	krb5_error_code kerror;
	348	krb5_context kcontext;
	349	krb5_creds increds;
	350	krb5_creds *v5credsp = NULL;
	351	CREDENTIALS v4creds;
	352	krb5_ccache kccache;
	353	struct ktc_principal server = { "afs", "", "umich.edu" };
	354	struct ktc_principal client;
	355	struct ktc_token token;
	356
	357	k5path = ap_table_get( r->subprocess_env, "KRB5CCNAME" );
	358	k4path = ap_table_get( r->subprocess_env, "KRBTKFILE" );
	359
	360	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	361	"mod_waklog: waklog_aklog called: k5path: %s, k4path: %s", k5path, k4path );
	362
	363	if ( !k5path \|\| !k4path ) {
	364	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	365	"mod_waklog: waklog_aklog giving up" );
4e1ae1cd	366	return;
	367	}
	368
7193eb01	369	/*
	370	** Get/build creds from file/tgs, then see if we need to SetToken
	371	*/
	372
	373	if (( kerror = krb5_init_context( &kcontext ))) {
	374	/* Authentication Required ( kerberos error ) */
4e1ae1cd	375	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
4e1ae1cd	376	(char *)error_message( kerror ));
7193eb01	377
4e1ae1cd	378	return;
	379	}
	380
7193eb01	381	memset( (char *)&increds, 0, sizeof(increds));
4e1ae1cd	382
7193eb01	383	/* set server part */
7193eb01	384	if (( kerror = krb5_parse_name( kcontext, AFS, &increds.server ))) {
4e1ae1cd	385	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	386	(char *)error_message( kerror ));
	387
	388	return;
	389	}
	390
7193eb01	391	if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
	392	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	393	(char *)error_message( kerror ));
	394
	395	return;
	396	}
4e1ae1cd	397
7193eb01	398	/* set client part */
7193eb01	399	krb5_cc_get_principal( kcontext, kccache, &increds.client );
4e1ae1cd	400
7193eb01	401	increds.times.endtime = 0;
	402	/* Ask for DES since that is what V4 understands */
	403	increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
	404
	405	/* get the V5 credentials */
	406	if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
	407	&increds, &v5credsp ) ) ) {
	408	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	409	"mod_waklog: krb5_get_credentials: %s", krb_err_txt[ kerror ] );
4e1ae1cd	410	return;
	411	}
	412
7193eb01	413	/* get the V4 credentials */
	414	if (( kerror = krb524_convert_creds_kdc( kcontext, v5credsp, &v4creds ) ) ) {
	415	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	416	"mod_waklog: krb524_convert_creds_kdc: %s", krb_err_txt[ kerror ] );
4e1ae1cd	417	return;
	418	}
	419
7193eb01	420	/* assemble the token */
	421	token.kvno = v4creds.kvno;
	422	token.startTime = v4creds.issue_date;
	423	token.endTime = v5credsp->times.endtime;
	424	memmove( &token.sessionKey, v4creds.session, 8 );
	425	token.ticketLen = v4creds.ticket_st.length ;
	426	memmove( token.ticket, v4creds.ticket_st.dat, token.ticketLen );
	427
	428	/* make sure we have to do this */
	429	if ( child->token.kvno != token.kvno \|\|
	430	child->token.ticketLen != token.ticketLen \|\|
	431	memcmp( &child->token.sessionKey, &token.sessionKey,
	432	sizeof( token.sessionKey ) ) \|\|
	433	memcmp( child->token.ticket, token.ticket, token.ticketLen ) ) {
	434
	435	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	436	"mod_waklog: %s.%s@%s", v4creds.service, v4creds.instance,
	437	v4creds.realm );
	438	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	439	"mod_waklog: %d %d %d", v4creds.lifetime, v4creds.kvno,
	440	v4creds.issue_date );
	441	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	442	"mod_waklog: %s %s", v4creds.pname, v4creds.pinst );
	443	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	444	"mod_waklog: %d", v4creds.ticket_st.length );
	445
	446	/* build the name */
	447	strcpy( buf, v4creds.pname );
	448	if ( v4creds.pinst[ 0 ] ) {
	449	strcat( buf, "." );
	450	strcat( buf, v4creds.pinst );
	451	}
	452
	453	/* assemble the client */
	454	strncpy( client.name, buf, MAXKTCNAMELEN - 1 );
	455	strcpy( client.instance, "" );
	456	strncpy( client.cell, v4creds.realm, MAXKTCNAMELEN - 1 );
	457
	458	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	459	"mod_waklog: server: name=%s, instance=%s, cell=%s",
	460	server.name, server.instance, server.cell );
	461
	462	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	463	"mod_waklog: client: name=%s, instance=%s, cell=%s",
	464	client.name, client.instance, client.cell );
	465
	466	/* use the path */
	467	krb_set_tkt_string( (char *)k4path );
	468
	469	/* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
	470	write( 2, "", 0 );
	471
	472	if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
	473	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	474	"mod_waklog: settoken returned %d", rc );
	475	}
	476
	477	/* save this */
	478	memmove( &child->token, &token, sizeof( struct ktc_token ) );
	479
	480	/* we'll need to unlog when this connection is done. */
	481	ap_register_cleanup( r->pool, (void *)r, pioctl_cleanup, ap_null_cleanup );
	482	}
	483
484	krb5_free_cred_contents( kcontext, v5credsp );
485	krb5_free_principal( kcontext, increds.client );
4e1ae1cd	486	krb5_cc_close( kcontext, kccache );
4e1ae1cd	487	krb5_free_context( kcontext );
3ed1e28a	488
7193eb01	489	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	490	"mod_waklog: finished with waklog_aklog" );
	491
4e1ae1cd	492	}
4e1ae1cd	493
e21f34f0	494	static int
	495	waklog_child_routine( void s, child_info pinfo )
	496	{
	497	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, s,
	498	"mod_waklog: waklog_child_routine called" );
	499
	500	if ( !getuid() ) {
	501	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, s,
	502	"mod_waklog: waklog_child_routine called as root" );
	503
	504	/* this was causing the credential file to get owned by root */
	505	setgid(ap_group_id);
	506	setuid(ap_user_id);
	507	}
	508
	509	while( 1 ) {
	510	waklog_ktinit( s );
	511	sleep( 60 /* 106060 - 560 / );
	512	}
	513
	514	}
	515
	516
	517	static void
	518	waklog_init( server_rec s, pool p )
	519	{
	520	extern char *version;
	521	int pid;
	522
	523	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, s,
	524	"mod_waklog: version %s initialized.", version );
	525
	526	pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
	527	NULL, NULL, NULL );
	528
	529	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, s,
	530	"mod_waklog: ap_bspawn_child: %d.", pid );
	531	}
	532
4e1ae1cd	533
bed98ff9	534	static int
7193eb01	535	waklog_phase0( request_rec *r )
bed98ff9	536	{
313dde40	537	waklog_host_config *cfg;
313dde40	538
7193eb01	539	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	540	"mod_waklog: phase0 called" );
	541
313dde40	542	/* directory config? */
	543	cfg = (waklog_host_config *)ap_get_module_config(
	544	r->per_dir_config, &waklog_module);
bed98ff9	545
313dde40	546	/* server config? */
313dde40	547	if ( !cfg->configured ) {
7193eb01	548	cfg = (waklog_host_config *)ap_get_module_config(
7193eb01	549	r->server->module_config, &waklog_module);
313dde40	550	}
313dde40	551
7193eb01	552	if ( !cfg->protect ) {
4e1ae1cd	553	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	554	"mod_waklog: phase0 declining" );
	555	return( DECLINED );
	556	}
4e1ae1cd	557
7193eb01	558	/* do this only if we are still unauthenticated */
7193eb01	559	if ( !child->token.ticketLen ) {
4e1ae1cd	560
e21f34f0	561	/* set our environment variables */
	562	ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
	563	ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );
3ed1e28a	564
7193eb01	565	/* stuff the credentials into the kernel */
7193eb01	566	waklog_aklog( r );
4e1ae1cd	567	}
7193eb01	568
	569	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	570	"mod_waklog: phase0 returning" );
	571	return DECLINED;
	572	}
4e1ae1cd	573
1e18ef7d	574
7193eb01	575	static int
	576	waklog_phase7( request_rec *r )
	577	{
	578	waklog_host_config *cfg;
1e18ef7d	579
7193eb01	580	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	581	"mod_waklog: phase7 called" );
1e18ef7d	582
7193eb01	583	/* directory config? */
	584	cfg = (waklog_host_config *)ap_get_module_config(
	585	r->per_dir_config, &waklog_module);
1e18ef7d	586
7193eb01	587	/* server config? */
	588	if ( !cfg->configured ) {
	589	cfg = (waklog_host_config *)ap_get_module_config(
	590	r->server->module_config, &waklog_module);
bed98ff9	591	}
bed98ff9	592
7193eb01	593	if ( !cfg->protect ) {
7193eb01	594	return( DECLINED );
bed98ff9	595	}
bed98ff9	596
7193eb01	597	/* stuff the credentials into the kernel */
7193eb01	598	waklog_aklog( r );
bed98ff9	599
7193eb01	600	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	601	"mod_waklog: phase7 returning" );
bed98ff9	602
7193eb01	603	return DECLINED;
bed98ff9	604	}
bed98ff9	605
7193eb01	606	static void
	607	waklog_new_connection( conn_rec *c ) {
	608	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, c->server,
	609	"mod_waklog: new_connection called: conn_rec: 0x%08x pid: %d", c, getpid() );
	610	return;
	611	}
bed98ff9	612
313dde40	613	module MODULE_VAR_EXPORT waklog_module = {
bed98ff9	614	STANDARD_MODULE_STUFF,
313dde40	615	waklog_init, /* module initializer */
313dde40	616	waklog_create_dir_config, /* create per-dir config structures */
bed98ff9	617	NULL, /* merge per-dir config structures */
313dde40	618	waklog_create_server_config, /* create per-server config structures */
bed98ff9	619	NULL, /* merge per-server config structures */
313dde40	620	waklog_cmds, /* table of config file commands */
bed98ff9	621	NULL, /* [#8] MIME-typed-dispatched handlers */
	622	NULL, /* [#1] URI to filename translation */
	623	NULL, /* [#4] validate user id from request */
	624	NULL, /* [#5] check if the user is ok _here_ */
	625	NULL, /* [#3] check access by host address */
	626	NULL, /* [#6] determine MIME type */
7193eb01	627	waklog_phase7, /* [#7] pre-run fixups */
bed98ff9	628	NULL, /* [#9] log a transaction */
313dde40	629	NULL, /* [#2] header parser */
313dde40	630	waklog_child_init, /* child_init */
bed98ff9	631	NULL, /* child_exit */
7193eb01	632	waklog_phase0 /* [#0] post read-request */
bed98ff9	633	#ifdef EAPI
	634	,NULL, /* EAPI: add_module */
	635	NULL, /* EAPI: remove_module */
	636	NULL, /* EAPI: rewrite_command */
7193eb01	637	waklog_new_connection /* EAPI: new_connection */
bed98ff9	638	#endif
bed98ff9	639	};