X-Git-Url: http://git.hcoop.net/hcoop/debian/libapache-mod-waklog.git/blobdiff_plain/866ccfbd4e6b3df663d6261de931312a7488d833..cbc21d960f0626e33c2074d463cc6e797e69e6c6:/mod_waklog.c diff --git a/mod_waklog.c b/mod_waklog.c index b6a03fa..fae5c73 100644 --- a/mod_waklog.c +++ b/mod_waklog.c @@ -24,7 +24,7 @@ #define MAXNAMELEN 1024 #endif -#ifndef STANDARD20_MODULE_STUFF +#ifdef STANDARD20_MODULE_STUFF #define APACHE2 #endif @@ -42,18 +42,15 @@ { name, func, \ NULL , \ RSRC_CONF | ACCESS_CONF , type, usage } +module waklog_module; /********************* APACHE2 ******************************************************************************/ #else #include #include -//#include #define ap_pcalloc apr_pcalloc #define ap_pdupstr apr_pdupstr #define ap_pstrdup apr_pstrdup - -module AP_MODULE_DECLARE_DATA waklog_module; - #define MK_POOL apr_pool_t #define MK_TABLE_GET apr_table_get #define MK_TABLE_SET apr_table_set @@ -66,13 +63,10 @@ extern unixd_config_rec unixd_config; AP_INIT_ ## type (name, (void*) func, \ NULL, \ RSRC_CONF | ACCESS_CONF, usage) -typedef struct -{ - int dummy; -} -child_info; - +module AP_MODULE_DECLARE_DATA waklog_module; +typedef struct { int dummy; } child_info; const char *userdata_key = "waklog_init"; + #endif /* APACHE2 */ /**************************************************************************************************/ @@ -96,12 +90,6 @@ const char *userdata_key = "waklog_init"; #define APLOG_DEBUG APLOG_ERR #endif -#ifndef CELL_IN_PRINCIPAL -int cell_in_principal = 1; -#else -int cell_in_principal = 0; -#endif - /* this is used to turn off pag generation for the backround worker child during startup */ int pag_for_children = 1; @@ -111,11 +99,14 @@ typedef struct int configured; int protect; int usertokens; + int cell_in_principal; + int disable_token_cache; char *keytab; char *principal; char *default_principal; char *default_keytab; char *afs_cell; + char *afs_cell_realm; char *path; MK_POOL *p; } @@ -168,7 +159,6 @@ struct renew_ent renewtable[SHARED_TABLE_SIZE]; int renewcount = 0; -module waklog_module; #define getModConfig(P, X) P = (waklog_config *) ap_get_module_config( (X)->module_config, &waklog_module ); @@ -185,13 +175,6 @@ module waklog_module; #include #include -#define AFS_CELL "someplace.edu" - -/* If there's an error, retry more aggressively */ -#define ERR_SLEEP_TIME 5*60 - - -#define K5PATH "FILE:/tmp/waklog.creds.k5" static void log_error (const char *file, int line, int level, int status, @@ -249,6 +232,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta krb5_get_init_creds_opt kopts; krb5_creds v5creds; krb5_creds increds; + krb5_ccache clientccache; struct ktc_principal server = { "afs", "", "" }; struct ktc_principal client; struct ktc_token token; @@ -259,29 +243,50 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta int rc = 0; int buflen = 0; time_t oldest_time = 0; - int oldest; + int oldest = 0; int stored = -1; time_t mytime; int indentical; + int cell_in_principal; + int attempt; + int use_client_credentials = 0; - char k5user[MAXNAMELEN]; - char *k5secret; + char k5user[MAXNAMELEN] = ""; + char *k5secret = NULL; + + char *k5path = NULL; memset((char *) &increds, 0, sizeof(increds)); - /* init some stuff if it ain't already */ - + /* XXX - In what situation will these not be initialized? */ + if ( ! child.kcontext ) { - kerror = krb5_init_context(&child.kcontext); + if ((kerror = krb5_init_context(&child.kcontext))) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize Kerberos context err=%d", + kerror); + return(-1); + } } - - if ( ( ! child.ccache ) && ( kerror = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", kerror ); + + if ( !child.ccache) { + if ((kerror = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache))) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize credentials cache %s err=%d", + k5path, kerror ); + return(-1); + } } - - log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d", self, principal ? principal : "NULL", - keytab ? keytab : "NULL", storeonly); + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d, KRB5CC=%s user=%s", + self, principal ? principal : "NULL", + keytab ? keytab : "NULL", + storeonly, + k5path ? k5path : "NULL", +#ifdef APACHE2 + (r && r->user) ? r->user : "NULL" +#else + (r && r->connection && r->connection->user) ? r->connection->user : "NULL" +#endif + ); /* pull the server config record that we care about... */ @@ -296,34 +301,51 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta if ( ! cfg ) { log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: cfg is %d", cfg ); } - -#ifdef APACHE2 + + if ( self ) { /* pull out our principal name and stuff from the environment -- webauth better have sent - through. This here is also where you'd suck stuff out of KRB5CCNAME if we were - using something like Cosign */ - + through. */ + +#ifdef APACHE2 if ( ! ( r && r->connection && r->user )) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no data available"); + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: r->user=%s", (r->user==NULL ? "null" : r->user==NULL)); return -1; } strncpy(k5user, r->user, sizeof(k5user)); - - /* the other thing we need is someone's password */ - if ( ! ( k5secret = (char *) MK_TABLE_GET( r->notes, "ATTR_PASSWORD" ) ) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cant do self auth without a secret"); +#else + if ( ! (r && r->connection && r->connection->user)) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no username available"); return -1; - } + } + + strncpy(k5user, r->connection->user, sizeof(k5user)); +#endif + /* if they've supplied a credentials cache */ + k5path = (char *) MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" ); + + /* the other thing we need is someone's password */ + k5secret = (char *) MK_TABLE_GET( r->notes, "ATTR_PASSWORD" ); /* we'll pick this up later after we've checked the cache and current state */ } else -#endif if ( principal ) { - strncpy( k5user, principal, sizeof(k5user)); + strncpy(k5user, principal, sizeof(k5user)); + } else +#ifdef APACHE2 + if (r && r->user) { + strncpy(k5user, r->user, sizeof(k5user)); + } +#else + if (r && r->connection && r->connection->user) { + strncpy(k5user, r->connection->user, sizeof(k5user)); } +#endif + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: k5user=%s", k5user ? k5user : "NULL"); mytime = time(0); /* see if we should just go ahead and ignore this call, since we already should be set to these @@ -392,9 +414,8 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta } } - + /* if 'usecached' isn't set, we've got to get our tokens from somewhere... */ - if (( ! usecached ) && ( k5user )) { /* clear out the creds structure */ @@ -402,7 +423,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta /* create a principal out of our k5user string */ - if ( kerror = krb5_parse_name (child.kcontext, k5user, &kprinc ) ) { + if ( ( kerror = krb5_parse_name (child.kcontext, k5user, &kprinc ) ) ) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse_name %s", (char *) error_message(kerror) ); goto cleanup; } @@ -415,113 +436,131 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta krb5_get_init_creds_opt_set_forwardable ( &kopts, 0 ); krb5_get_init_creds_opt_set_proxiable ( &kopts, 0 ); - if ( keytab ) { + if ( keytab || k5secret ) { - /* if we've been passed a keytab, we're going to be getting our credentials from it */ + if (keytab) { + /* if we've been passed a keytab, we're going to be getting our credentials from it */ - log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using keytab %s", keytab); + log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using keytab %s", keytab); - if ( kerror = krb5_kt_resolve(child.kcontext, keytab, &krb5kt ) ) { - log_error( APLOG_MARK, APLOG_ERR, 0, s, - "mod_waklog: krb5_kt_resolve %s", error_message(kerror) ); + if ( ( kerror = krb5_kt_resolve(child.kcontext, keytab, &krb5kt ) ) ) { + log_error( APLOG_MARK, APLOG_ERR, 0, s, + "mod_waklog: krb5_kt_resolve %s", error_message(kerror) ); + goto cleanup; + } + + if ((kerror = krb5_get_init_creds_keytab (child.kcontext, &v5creds, + kprinc, krb5kt, 0, NULL, &kopts ) ) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_keytab %s", + error_message(kerror) ); + goto cleanup; + } + } else if (k5secret) { + + /* If the WebSSO is lame enough to provide a secret, then try and use that to get a token */ + + if ((kerror = krb5_get_init_creds_password ( child.kcontext, &v5creds, + kprinc, k5secret, NULL, NULL, 0, NULL, &kopts ) ) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_password %s", + error_message(kerror) ); + /* nuke the password so it doesn't end up in core files */ + memset(k5secret, 0, sizeof(k5secret)); + goto cleanup; + } + + memset(k5secret, 0, sizeof(k5secret)); + } + + /* initialize the credentials cache and store the stuff we just got */ + if ( ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc) ) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", + error_message(kerror)); + goto cleanup; + } + + if ( ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", + error_message(kerror)); goto cleanup; } - if ((kerror = krb5_get_init_creds_keytab (child.kcontext, &v5creds, - kprinc, krb5kt, 0, NULL, &kopts ) ) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_keytab %s", - error_message(kerror) ); - goto cleanup; + krb5_free_cred_contents(child.kcontext, &v5creds); + + if ( kerror ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: store cred %s", error_message(kerror)); + goto cleanup; } - } else if ( self ) { - - /* if 'self' is set, we're going to use the credentials provided in the credential information */ - /* if you're using CoSign, you'd actually just set the ccache to the KRB5CCNAME credentials */ - /* and skip ahead... Our WebSSO is lame, but has a way for us to snarf the password out of */ - /* the encrypted token for proxy-authentication stuff. We only hand out keys that allow this */ - /* functionality to VERY special people. */ - - if ((kerror = krb5_get_init_creds_password ( child.kcontext, &v5creds, - kprinc, k5secret, NULL, NULL, 0, NULL, &kopts ) ) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_password %s", - error_message(kerror) ); - /* nuke the password so it doesn't end up in core files */ - memset(k5secret, 0, sizeof(k5secret)); - goto cleanup; + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: kinit ok for %s", k5user ); + + } else if (k5path) { + /* If we've got a path to a credentials cache, then try and use that. We can't just + * replace child.creds, because we want to ensure that only this request gets access to + * that cache */ + + if ( ( kerror = krb5_cc_resolve(child.kcontext, k5path, &clientccache ) ) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, + "mod_waklog: can't open provided credentials cache %s err=%d", + k5path, kerror ); + goto cleanup; + } + + use_client_credentials = 1; + } + + /* now, to the 'aklog' portion of our program. */ + + /** we make two attempts here, one for afs@REALM and one for afs/cell@REALM */ + for(attempt = 0; attempt <= 1; attempt++) { + strncpy( buf, "afs", sizeof(buf) - 1 ); + cell_in_principal = (cfg->cell_in_principal + attempt) % 2; + + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: cell_in_principal=%d", cell_in_principal ); + if (cell_in_principal) { + strncat(buf, "/", sizeof(buf) - strlen(buf) - 1); + strncat(buf, cfg->afs_cell, sizeof(buf) - strlen(buf) - 1); + } + if (cfg->afs_cell_realm != WAKLOG_UNSET) { + strncat(buf, "@", sizeof(buf) - strlen(buf) - 1); + strncat(buf, cfg->afs_cell_realm, sizeof(buf) - strlen(buf) - 1); } - memset(k5secret, 0, sizeof(k5secret)); + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using AFS principal: %s", buf); - } else { + if ((kerror = krb5_parse_name (child.kcontext, buf, &increds.server))) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse name %s", error_message(kerror)); + goto cleanup; + } + + if (!use_client_credentials) { + clientccache = child.ccache; + } + + if ((kerror = krb5_cc_get_principal(child.kcontext, clientccache, &increds.client))) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s %p", error_message(kerror), clientccache); + goto cleanup; + } - /* degenerate case -- we don't have enough information to do anything */ + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: retrieved data from ccache for %s", k5user); - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: no keytab, no self?"); - kerror = -1; - goto cleanup; + increds.times.endtime = 0; - } - - /* initialize the credentials cache and store the stuff we just got */ + increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC; - if ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc)) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", - error_message(kerror)); - goto cleanup; - } - - if ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", - error_message(kerror)); - goto cleanup; - } - - krb5_free_cred_contents(child.kcontext, &v5creds); - - if ( kerror ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: store cred %s", error_message(kerror)); - goto cleanup; - } - - log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: kinit ok for %s", k5user ); - - /* now, to the 'aklog' portion of our program. */ - - strncpy( buf, "afs", sizeof(buf) - 1 ); - - if ( cfg->afs_cell && strcmp( cfg->afs_cell, AFS_CELL ) ) { - strncat(buf, "/", sizeof(buf) - strlen(buf) - 1); - strncat(buf, cfg->afs_cell, sizeof(buf) - strlen(buf) - 1); - } else if ( cell_in_principal ) { - strncat(buf, "/", sizeof(buf) - strlen(buf) - 1); - strncat(buf, AFS_CELL, sizeof(buf) - strlen(buf) - 1); + if ( ( kerror = krb5_get_credentials (child.kcontext, 0, clientccache, &increds, &v5credsp ) ) ) { + /* only complain once we've tried both afs@REALM and afs/cell@REALM */ + if (attempt>=1) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_credentials: %s", + error_message(kerror)); + goto cleanup; + } else { + continue; + } + } + cfg->cell_in_principal = cell_in_principal; + break; } - log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using AFS principal: %s", buf); - - if ((kerror = krb5_parse_name (child.kcontext, buf, &increds.server))) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse name %s", error_message(kerror)); - goto cleanup; - } - - if ((kerror = krb5_cc_get_principal(child.kcontext, child.ccache, &increds.client))) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s", error_message(kerror)); - goto cleanup; - } - - log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: retrieved data from ccache for %s", k5user); - - increds.times.endtime = 0; - - increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC; - - if (kerror = krb5_get_credentials (child.kcontext, 0, child.ccache, &increds, &v5credsp )) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_credentials: %s", - error_message(kerror)); - goto cleanup; - } - log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: get_credentials passed for %s", k5user); if ( v5credsp->ticket.length >= MAXKTCTICKETLEN ) { @@ -563,11 +602,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta strncpy(client.cell, buf, sizeof(client.cell)); /* assemble the server's cell */ - if ( cfg->afs_cell ) { - strncpy(server.cell, cfg->afs_cell, sizeof(server.cell) - 1); - } else { - strncpy(server.cell, AFS_CELL, sizeof(server.cell) - 1); - } + strncpy(server.cell, cfg->afs_cell, sizeof(server.cell) - 1); log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: preparing to init PTS connection for %s", server.cell); @@ -683,6 +718,8 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta } cleanup: + if (use_client_credentials) + krb5_cc_close(child.kcontext, clientccache); if ( v5credsp ) krb5_free_cred_contents(child.kcontext, v5credsp); if ( increds.client ) @@ -719,11 +756,13 @@ waklog_create_server_config (MK_POOL * p, server_rec * s) cfg->path = "(server)"; cfg->protect = WAKLOG_UNSET; cfg->usertokens = WAKLOG_UNSET; + cfg->disable_token_cache = WAKLOG_UNSET; cfg->keytab = WAKLOG_UNSET; cfg->principal = WAKLOG_UNSET; cfg->default_principal = WAKLOG_UNSET; cfg->default_keytab = WAKLOG_UNSET; cfg->afs_cell = WAKLOG_UNSET; + cfg->afs_cell_realm = WAKLOG_UNSET; cfg->forked = 0; cfg->configured = 0; @@ -746,11 +785,13 @@ waklog_create_dir_config (MK_POOL * p, char *dir) cfg->path = ap_pstrdup(p, dir ); cfg->protect = WAKLOG_UNSET; cfg->usertokens = WAKLOG_UNSET; + cfg->disable_token_cache = WAKLOG_UNSET; cfg->keytab = WAKLOG_UNSET; cfg->principal = WAKLOG_UNSET; cfg->default_principal = WAKLOG_UNSET; cfg->default_keytab = WAKLOG_UNSET; cfg->afs_cell = WAKLOG_UNSET; + cfg->afs_cell_realm = WAKLOG_UNSET; cfg->forked = 0; cfg->configured = 0; @@ -768,6 +809,8 @@ static void *waklog_merge_dir_config(MK_POOL *p, void *parent_conf, void *newloc merged->path = child->path != WAKLOG_UNSET ? child->path : parent->path; merged->usertokens = child->usertokens != WAKLOG_UNSET ? child->usertokens : parent->usertokens; + + merged->disable_token_cache = child->disable_token_cache != WAKLOG_UNSET ? child->disable_token_cache : parent->disable_token_cache; merged->principal = child->principal != WAKLOG_UNSET ? child->principal : parent->principal; @@ -778,6 +821,8 @@ static void *waklog_merge_dir_config(MK_POOL *p, void *parent_conf, void *newloc merged->default_principal = child->default_principal != WAKLOG_UNSET ? child->default_principal : parent->default_principal; merged->afs_cell = child->afs_cell != WAKLOG_UNSET ? child->afs_cell : parent->afs_cell; + + merged->afs_cell_realm = child->afs_cell_realm != WAKLOG_UNSET ? child->afs_cell_realm : parent->afs_cell_realm; return (void *) merged; @@ -793,6 +838,8 @@ static void *waklog_merge_server_config(MK_POOL *p, void *parent_conf, void *new merged->usertokens = nconf->usertokens == WAKLOG_UNSET ? pconf->usertokens : nconf->usertokens; + merged->disable_token_cache = nconf->disable_token_cache == WAKLOG_UNSET ? pconf->disable_token_cache : nconf->disable_token_cache; + merged->keytab = nconf->keytab == WAKLOG_UNSET ? ap_pstrdup(p, pconf->keytab) : ( nconf->keytab == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->keytab) ); @@ -802,6 +849,9 @@ static void *waklog_merge_server_config(MK_POOL *p, void *parent_conf, void *new merged->afs_cell = nconf->afs_cell == WAKLOG_UNSET ? ap_pstrdup(p, pconf->afs_cell) : ( nconf->afs_cell == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->afs_cell) ); + merged->afs_cell_realm = nconf->afs_cell_realm == WAKLOG_UNSET ? ap_pstrdup(p, pconf->afs_cell_realm) : + ( nconf->afs_cell_realm == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->afs_cell_realm) ); + merged->default_keytab = nconf->default_keytab == WAKLOG_UNSET ? ap_pstrdup(p, pconf->default_keytab) : ( nconf->default_keytab == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->default_keytab) ); @@ -814,7 +864,7 @@ static void *waklog_merge_server_config(MK_POOL *p, void *parent_conf, void *new } static const char * -set_waklog_protect (cmd_parms * params, void *mconfig, int flag) +set_waklog_enabled (cmd_parms * params, void *mconfig, int flag) { waklog_config *cfg = mconfig ? ( waklog_config * ) mconfig : ( waklog_config * ) ap_get_module_config(params->server->module_config, &waklog_module ); @@ -822,7 +872,7 @@ set_waklog_protect (cmd_parms * params, void *mconfig, int flag) cfg->protect = flag; cfg->configured = 1; log_error (APLOG_MARK, APLOG_DEBUG, 0, params->server, - "mod_waklog: waklog_protect set on %s", cfg->path ? cfg->path : "NULL"); + "mod_waklog: waklog_enabled set on %s", cfg->path ? cfg->path : "NULL"); return (NULL); } @@ -856,7 +906,7 @@ void add_to_renewtable(MK_POOL *p, char *keytab, char *principal) { } static const char * -set_waklog_principal (cmd_parms *params, void *mconfig, char *principal, char *keytab) +set_waklog_location_principal (cmd_parms *params, void *mconfig, char *principal, char *keytab) { waklog_config *cfg = mconfig ? ( waklog_config * ) mconfig : ( waklog_config * ) ap_get_module_config(params->server->module_config, &waklog_module ); @@ -875,16 +925,42 @@ set_waklog_principal (cmd_parms *params, void *mconfig, char *principal, char *k } static const char * -set_waklog_use_afs_cell (cmd_parms * params, void *mconfig, char *file) +set_waklog_afs_cell (cmd_parms * params, void *mconfig, char *file) { - waklog_config *cfg = mconfig ? ( waklog_config * ) mconfig : + waklog_config *waklog_mconfig = ( waklog_config * ) mconfig; + waklog_config *waklog_srvconfig = ( waklog_config * ) ap_get_module_config(params->server->module_config, &waklog_module ); - log_error (APLOG_MARK, APLOG_DEBUG, 0, params->server, + log_error (APLOG_MARK, APLOG_INFO, 0, params->server, "mod_waklog: will use afs_cell: %s", file); - cfg->afs_cell = ap_pstrdup (params->pool, file); - cfg->configured = 1; + waklog_srvconfig->cell_in_principal = 0; + waklog_srvconfig->afs_cell = ap_pstrdup (params->pool, file); + waklog_srvconfig->configured = 1; + + if (waklog_mconfig != NULL) { + waklog_mconfig->cell_in_principal = waklog_srvconfig->cell_in_principal; + waklog_mconfig->afs_cell = ap_pstrdup (params->pool, file); + waklog_mconfig->configured = 1; + } + return (NULL); +} + +static const char * +set_waklog_afs_cell_realm (cmd_parms * params, void *mconfig, char *file) +{ + waklog_config *waklog_mconfig = ( waklog_config * ) mconfig; + waklog_config *waklog_srvconfig = + ( waklog_config * ) ap_get_module_config(params->server->module_config, &waklog_module ); + + log_error (APLOG_MARK, APLOG_INFO, 0, params->server, + "mod_waklog: will use afs_cell_realm: %s", file); + + waklog_srvconfig->afs_cell_realm = ap_pstrdup (params->pool, file); + + if (waklog_mconfig != NULL) { + waklog_mconfig->afs_cell_realm = ap_pstrdup (params->pool, file); + } return (NULL); } @@ -934,6 +1010,22 @@ set_waklog_use_usertokens (cmd_parms * params, void *mconfig, int flag) } +static const char * +set_waklog_disable_token_cache (cmd_parms * params, void *mconfig, int flag) +{ + waklog_config *cfg = mconfig ? ( waklog_config * ) mconfig : + ( waklog_config * ) ap_get_module_config(params->server->module_config, &waklog_module ); + + cfg->disable_token_cache = flag; + + cfg->configured = 1; + + log_error (APLOG_MARK, APLOG_DEBUG, 0, params->server, + "mod_waklog: waklog_disable_token_cache set"); + return (NULL); +} + + #ifndef APACHE2 static void waklog_child_exit( server_rec *s, MK_POOL *p ) { #else @@ -976,8 +1068,6 @@ waklog_child_init (server_rec * s, MK_POOL * p) char *cell; - cell = strdup(AFS_CELL); - log_error (APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: child_init called for pid %d", getpid()); if ( !sharedspace ) { @@ -989,11 +1079,11 @@ waklog_child_init (server_rec * s, MK_POOL * p) memset (&child, 0, sizeof(child)); - if ( code = krb5_init_context(&child.kcontext) ) { + if ( ( code = krb5_init_context(&child.kcontext) ) ) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't init kerberos context %d", code ); } - if ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) { + if ( ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", code ); } @@ -1008,6 +1098,7 @@ waklog_child_init (server_rec * s, MK_POOL * p) set_auth( s, NULL, 0, cfg->default_principal, cfg->default_keytab, 0); } + cell = strdup(cfg->afs_cell); pr_Initialize( 0, AFSDIR_CLIENT_ETC_DIR, cell ); #ifdef APACHE2 @@ -1022,21 +1113,27 @@ waklog_child_init (server_rec * s, MK_POOL * p) command_rec waklog_cmds[] = { - command ("WaklogProtected", set_waklog_protect, 0, FLAG, - "enable waklog on a location or directory basis"), - - command ("WaklogPrincipal", set_waklog_principal, 0, TAKE2, - "Use the supplied keytab rather than the default"), + command ("WaklogAFSCell", set_waklog_afs_cell, 0, TAKE1, + "Use the supplied AFS cell (required)"), - command ("WaklogUseAFSCell", set_waklog_use_afs_cell, 0, TAKE1, - "Use the supplied AFS cell rather than the default"), + command ("WaklogAFSCellRealm", set_waklog_afs_cell_realm, 0, TAKE1, + "Assume that the AFS cell belongs to the specified Kerberos realm (optional)"), - command ("WaklogUseUserTokens", set_waklog_use_usertokens, 0, FLAG, - "Use the requesting user tokens (from webauth)"), + command ("WaklogEnabled", set_waklog_enabled, 0, FLAG, + "enable waklog on a server, location, or directory basis"), command ("WaklogDefaultPrincipal", set_waklog_default_principal, 0, TAKE2, - "Set the default principal that the server runs as"), - + "Set the default principal that the server runs as"), + + command ("WaklogLocationPrincipal", set_waklog_location_principal, 0, TAKE2, + "Set the principal on a -specific basis"), + + command ("WaklogDisableTokenCache", set_waklog_disable_token_cache, 0, FLAG, + "Ignore the token cache (location-specific); useful for scripts that need kerberos tickets."), + + command ("WaklogUseUserTokens", set_waklog_use_usertokens, 0, FLAG, + "Use the requesting user tokens (from webauth)"), + {NULL} }; @@ -1079,18 +1176,22 @@ waklog_child_routine (void *data, child_info * pinfo) memset (&child, 0, sizeof(child)); - if ( code = krb5_init_context(&child.kcontext) ) { + if ( ( code = krb5_init_context(&child.kcontext) ) ) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't init kerberos context %d", code ); } - if ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) { + if ( ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", code ); } + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: about to pr_Initialize"); + /* need to do this so we can make PTS calls */ - cell = strdup(AFS_CELL); /* stupid */ + cell = strdup(cfg->afs_cell); /* stupid */ pr_Initialize( 0, AFSDIR_CLIENT_ETC_DIR, cell ); - + + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: still here"); + while(1) { for ( i = 0; i < renewcount; ++i ) { @@ -1155,6 +1256,14 @@ waklog_init_handler (apr_pool_t * p, apr_pool_t * plog, * see http://issues.apache.org/bugzilla/show_bug.cgi?id=37519 */ apr_pool_userdata_get (&data, userdata_key, s->process->pool); + + if (cfg->afs_cell==NULL) { + log_error (APLOG_MARK, APLOG_ERR, 0, s, + "mod_waklog: afs_cell==NULL; please provide the WaklogAFSCell directive"); + /** clobber apache */ + exit(-1); + } + if (!data) { apr_pool_userdata_set ((const void *) 1, userdata_key, @@ -1163,7 +1272,7 @@ waklog_init_handler (apr_pool_t * p, apr_pool_t * plog, else { log_error (APLOG_MARK, APLOG_INFO, 0, s, - "mod_waklog: version %s initialized.", version); + "mod_waklog: version %s initialized for cell %s", version, cfg->afs_cell); if ( sharedspace ) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: shared memory already allocated." ); @@ -1268,7 +1377,6 @@ waklog_init (server_rec * s, MK_POOL * p) extern char *version; int pid; waklog_config *cfg; - char *cell; int fd = -1; int use_existing = 1; int oldrenewcount; @@ -1312,7 +1420,7 @@ waklog_init (server_rec * s, MK_POOL * p) /* mmap the region */ - if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != -1 ) { + if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != (void *) -1 ) { log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: shared mmap region ok %d", sharedspace ); close(fd); } else { @@ -1328,7 +1436,7 @@ waklog_init (server_rec * s, MK_POOL * p) #endif /* mmap our shared space for our lock */ - if ( sharedlock = ( locktype * ) mmap ( NULL, sizeof(locktype), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, 0 ) ) { + if ( ( sharedlock = ( locktype * ) mmap ( NULL, sizeof(locktype), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, 0 ) ) ) { #ifndef use_pthreads rwlock_init(sharedlock, USYNC_PROCESS, NULL ); #else @@ -1390,6 +1498,12 @@ waklog_phase0 (request_rec * r) log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 using default user %s", cfg->default_principal); set_auth(r->server, r, 0, cfg->default_principal, cfg->default_keytab, 0); } else { + + if (child.token.ticketLen) { + memset( &child.token, 0, sizeof (struct ktc_token) ); + ktc_ForgetAllTokens(); + } + log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 not doing nothin."); } @@ -1485,6 +1599,12 @@ waklog_phase7 (request_rec * r) } else if ( cfg->default_principal ) { log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase7 using default user %s", cfg->default_principal); rc = set_auth( r->server, r, 0, cfg->default_principal, cfg->default_keytab, 0); + } else { + log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: no tokens"); + if (child.token.ticketLen) { + memset(&child.token, 0, sizeof(struct ktc_token)); + ktc_ForgetAllTokens(); + } } if ( rc ) { @@ -1598,7 +1718,7 @@ module MODULE_VAR_EXPORT waklog_module = { waklog_phase6, /* [#6] determine MIME type */ waklog_phase7, /* [#7] pre-run fixups */ waklog_phase9, /* [#9] log a transaction */ - NULL, /* [#2] header parser */ + waklog_phase2, /* [#2] header parser */ waklog_child_init, /* child_init */ waklog_child_exit, /* child_exit */ waklog_phase0 /* [#0] post read-request */