[hcoop/debian/libapache-mod-waklog.git] / mod_waklog.c

#include "httpd.h"
#include "http_config.h"
#include "http_conf_globals.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "http_core.h"
#include "ap_config.h"
#include <krb5.h>

#if defined(sun)
#include <sys/ioccom.h>
#endif /* sun */
#include <stropts.h>
#include <kerberosIV/krb.h>
#include <kerberosIV/des.h>
#include <afs/venus.h>
#include <afs/auth.h>
#include <rx/rxkad.h>

#include <asm/bitops.h>
#include <sys/shm.h>

#define KEYTAB_PATH "/home/drh/keytab.umweb.drhtest"
#define PRINCIPAL "umweb/drhtest"

#define K5PATH "FILE:/tmp/waklog.creds.k5"
#define K4PATH "/tmp/waklog.creds.k4"

module waklog_module;

struct ClearToken {
    long AuthHandle;
    char HandShakeKey[ 8 ];
    long ViceId;
    long BeginTimestamp;
    long EndTimestamp;
};

typedef struct {
    int		configured;
    int		protect;
    char	*keytab;
    char	*keytab_principal;
    char	*afs_cell;
} waklog_host_config;

typedef struct {
	struct ktc_token	token;
} waklog_child_config;
waklog_child_config	*child = NULL;


    static void *
waklog_create_dir_config( pool *p, char *path )
{
    waklog_host_config *cfg;

    cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
    cfg->configured = 0;
    cfg->protect = 0;
    cfg->keytab = 0;
    cfg->keytab_principal = 0;
    cfg->afs_cell = "umich.edu";

    return( cfg );
}


    static void *
waklog_create_server_config( pool *p, server_rec *s )
{
    waklog_host_config *cfg;

    cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
    cfg->configured = 0;
    cfg->protect = 0;
    cfg->keytab = 0;
    cfg->keytab_principal = 0;
    cfg->afs_cell = "umich.edu";

    return( cfg );
}


    static const char *
set_waklog_protect( cmd_parms *params, void *mconfig, int flag )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    cfg->protect = flag;
    cfg->configured = 1;
    return( NULL );
}


    static const char *
set_waklog_use_keytab( cmd_parms *params, void *mconfig, char *file  )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
	    "mod_waklog: using keytab: %s", file );

    cfg->keytab = file;
    cfg->configured = 1;
    return( NULL );
}


    static void
waklog_child_init( server_rec *s, pool *p )
{

    if ( child  == NULL ) {
	child = (waklog_child_config *) ap_palloc( p, sizeof( waklog_child_config ) );
    }

    memset( &child->token, 0, sizeof( struct ktc_token ) );

    setpag();

    return;
}


command_rec waklog_cmds[ ] =
{
    { "WaklogProtected", set_waklog_protect,
    NULL, RSRC_CONF | ACCESS_CONF, FLAG,
    "enable waklog on a location or directory basis" },

    { "WaklogUseKeytab", set_waklog_use_keytab,
    NULL, RSRC_CONF, TAKE1,
    "Use the supplied keytab file rather than the user's TGT" },

    { NULL }
};


    static void
token_cleanup( void *data )
{
    request_rec		*r = (request_rec *)data;

    if ( child->token.ticketLen ) {
	memset( &child->token, 0, sizeof( struct ktc_token ) );

	ktc_ForgetAllTokens();

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: ktc_ForgetAllTokens succeeded" );
    }
    return;
}


    static int
waklog_kinit( server_rec *s )
{
    krb5_error_code		kerror;
    krb5_context		kcontext = NULL;
    krb5_principal		kprinc = NULL;
    krb5_get_init_creds_opt	kopts;
    krb5_creds			v5creds;
    CREDENTIALS			v4creds;
    krb5_ccache			kccache = NULL;
    krb5_keytab			keytab = NULL;
    char			ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
    waklog_host_config		*cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_kinit called" );

    if (( kerror = krb5_init_context( &kcontext ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
        	(char *)error_message( kerror ));

        goto cleanup;
    }

    /* use the path */
    if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

   if (( kerror = krb5_parse_name( kcontext, PRINCIPAL, &kprinc ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

       	goto cleanup;
    }

    krb5_get_init_creds_opt_init( &kopts );
    krb5_get_init_creds_opt_set_tkt_life( &kopts, 10*60*60 );
    krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
    krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
    krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );

    cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
	    &waklog_module );

    /* which keytab should we use? */
    strncpy( ktbuf, cfg->keytab ? cfg->keytab : KEYTAB_PATH, sizeof( ktbuf ) - 1 );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	    "mod_waklog: waklog_kinit using: %s", ktbuf );

    if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    /* get the krbtgt */
    if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds, 
		kprinc, keytab, 0, NULL, &kopts ))) {

	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

   if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
    	    kprinc, keytab, NULL, NULL )) != 0 ) {

	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds );
    krb5_free_cred_contents( kcontext, &v5creds );
    if ( kerror != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_kinit success" );

cleanup:
    if ( keytab )
	(void)krb5_kt_close( kcontext, keytab );
    if ( kprinc )
	krb5_free_principal( kcontext, kprinc );
    if ( kccache )
	krb5_cc_close( kcontext, kccache );
    if ( kcontext )
	krb5_free_context( kcontext );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_kinit: exiting" );

    return( 0 );
}


    static void
waklog_aklog( request_rec *r )
{
    int				rc;
    char			buf[ 1024 ];
    const char          	*k4path = NULL;
    const char          	*k5path = NULL;
    krb5_error_code		kerror;
    krb5_context		kcontext = NULL;
    krb5_creds			increds;
    krb5_creds			*v5credsp = NULL;
    CREDENTIALS			v4creds;
    krb5_ccache			kccache = NULL;
    struct ktc_principal	server = { "afs", "", "" };
    struct ktc_principal	client;
    struct ktc_token		token;
    waklog_host_config		*cfg;

    k5path = ap_table_get( r->subprocess_env, "KRB5CCNAME" );
    k4path = ap_table_get( r->subprocess_env, "KRBTKFILE" );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: waklog_aklog called: k5path: %s, k4path: %s", k5path, k4path );

    if ( !k5path || !k4path ) {   
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: waklog_aklog giving up" );
	goto cleanup;
    }

    /*
    ** Get/build creds from file/tgs, then see if we need to SetToken
    */

    if (( kerror = krb5_init_context( &kcontext ))) {
	/* Authentication Required ( kerberos error ) */
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		(char *)error_message( kerror ));

	goto cleanup;
    }

    krb524_init_ets(kcontext);

    memset( (char *)&increds, 0, sizeof(increds));

    cfg = (waklog_host_config *) ap_get_module_config(
	    r->server->module_config, &waklog_module );

    /* afs/<cell> or afs */
    strncpy( buf, "afs", sizeof( buf ) - 1 );
    if ( strcmp( cfg->afs_cell, "umich.edu" ) ) {
	strncat( buf, "/" ,		sizeof( buf ) - strlen( buf ) - 1 );
	strncat( buf, cfg->afs_cell,	sizeof( buf ) - strlen( buf ) - 1 );
    }

    /* set server part */
    if (( kerror = krb5_parse_name( kcontext, buf, &increds.server ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		(char *)error_message( kerror ));

	goto cleanup;
    }

    if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
    	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
    		(char *)error_message( kerror ));
    
        goto cleanup;
    }

    /* set client part */
    krb5_cc_get_principal( kcontext, kccache, &increds.client );

    increds.times.endtime = 0;
    /* Ask for DES since that is what V4 understands */
    increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;

    /* get the V5 credentials */
    if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
		&increds, &v5credsp ) ) ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	    "mod_waklog: krb5_get_credentials: %s", error_message( kerror ));
	goto cleanup;
    }

    /* get the V4 credentials */
    if (( kerror = krb524_convert_creds_kdc( kcontext, v5credsp, &v4creds ) ) ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	    "mod_waklog: krb524_convert_creds_kdc: %s", error_message( kerror ));
	goto cleanup;
    }

    /* assemble the token */
    token.kvno = v4creds.kvno;
    token.startTime = v4creds.issue_date;
    token.endTime = v5credsp->times.endtime;
    memmove( &token.sessionKey, v4creds.session, 8 );
    token.ticketLen = v4creds.ticket_st.length ;
    memmove( token.ticket, v4creds.ticket_st.dat, token.ticketLen );

    /* make sure we have to do this */
    if ( child->token.kvno != token.kvno ||
	    child->token.ticketLen != token.ticketLen ||
	    memcmp( &child->token.sessionKey, &token.sessionKey,
		    sizeof( token.sessionKey ) ) ||
	    memcmp( child->token.ticket, token.ticket, token.ticketLen ) ) {

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %s.%s@%s", v4creds.service, v4creds.instance,
		v4creds.realm );
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %d %d %d", v4creds.lifetime, v4creds.kvno,
		v4creds.issue_date );
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %s %s", v4creds.pname, v4creds.pinst );
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: %d", v4creds.ticket_st.length );

	/* build the name */
	strncpy( buf, v4creds.pname, sizeof( buf ) - 1 );
	if ( v4creds.pinst[ 0 ] ) {
		strncat( buf, ".",		sizeof( buf ) - strlen( buf ) - 1 );
		strncat( buf, v4creds.pinst,    sizeof( buf ) - strlen( buf ) - 1 );
	}

	/* assemble the client */
	strncpy( client.name, buf,		sizeof( client.name ) - 1 );
	strncpy( client.instance, "",		sizeof( client.instance) - 1 );
	strncpy( client.cell, v4creds.realm,	sizeof( client.cell ) - 1 );

	strncpy( server.cell, cfg->afs_cell ,	sizeof( server.cell ) - 1 );

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: server: name=%s, instance=%s, cell=%s",
		server.name, server.instance, server.cell );

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: client: name=%s, instance=%s, cell=%s",
		 client.name, client.instance, client.cell );

	/* use the path */
	krb_set_tkt_string( (char *)k4path );

	/* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
	write( 2, "", 0 );

	if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
	    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: settoken returned %d", rc );
	}

	/* save this */
	memmove( &child->token, &token, sizeof( struct ktc_token ) );

	/* we'll need to unlog when this connection is done. */
	ap_register_cleanup( r->pool, (void *)r, token_cleanup, ap_null_cleanup );
    }

cleanup:
    if ( v5credsp )
	krb5_free_cred_contents( kcontext, v5credsp );
    if ( increds.client )
	krb5_free_principal( kcontext, increds.client );
    if ( increds.server )
	krb5_free_principal( kcontext, increds.server );
    if ( kccache )
	krb5_cc_close( kcontext, kccache );
    if ( kcontext )
	krb5_free_context( kcontext );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	        "mod_waklog: finished with waklog_aklog" );

    return;

}

    static int
waklog_child_routine( void *s, child_info *pinfo )
{
    if ( !getuid() ) {
	ap_log_error( APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, s,
		"mod_waklog: waklog_child_routine called as root" );

	/* this was causing the credential file to get owned by root */
	setgid(ap_group_id);
	setuid(ap_user_id);
    }

    while( 1 ) {
	waklog_kinit( s );
	sleep( 300 /* 10*60*60 - 5*60 */ );
    }

}


    static void
waklog_init( server_rec *s, pool *p )
{
    extern char	*version;
    int pid;

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, s,
	    "mod_waklog: version %s initialized.", version );

    pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
	    NULL, NULL, NULL );

    ap_log_error( APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, s,
	    "mod_waklog: ap_bspawn_child: %d.", pid );
}


    static int
waklog_phase0( request_rec *r )
{
    waklog_host_config  *cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase0 called" );

    /* directory config? */
    cfg = (waklog_host_config *)ap_get_module_config(
            r->per_dir_config, &waklog_module);

    /* server config? */
    if ( !cfg->configured ) {
	cfg = (waklog_host_config *)ap_get_module_config(
	    r->server->module_config, &waklog_module);
    }

    if ( !cfg->protect ) {
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: phase0 declining" );
        return( DECLINED );
    }

    /* do this only if we are still unauthenticated */
    if ( !child->token.ticketLen ) {

	/* set our environment variables */
	ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
	ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );

	/* stuff the credentials into the kernel */
	waklog_aklog( r );
    }
    
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase0 returning" );
    return DECLINED;
}


    static int
waklog_phase7( request_rec *r )
{
    waklog_host_config	*cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase7 called" );

    /* directory config? */
    cfg = (waklog_host_config *)ap_get_module_config(
            r->per_dir_config, &waklog_module);

    /* server config? */
    if ( !cfg->configured ) {
	cfg = (waklog_host_config *)ap_get_module_config(
	    r->server->module_config, &waklog_module);
    }

    if ( !cfg->protect ) {
        return( DECLINED );
    }

    /* stuff the credentials into the kernel */
    waklog_aklog( r );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase7 returning" );

    return DECLINED;
}

    static void
waklog_new_connection( conn_rec *c ) {
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, c->server,
	"mod_waklog: new_connection called: conn_rec: 0x%08x pid: %d", c, getpid() );
    return;
}

module MODULE_VAR_EXPORT waklog_module = {
    STANDARD_MODULE_STUFF, 
    waklog_init,              /* module initializer                  */
    waklog_create_dir_config, /* create per-dir    config structures */
    NULL,                  /* merge  per-dir    config structures */
    waklog_create_server_config, /* create per-server config structures */
    NULL,                  /* merge  per-server config structures */
    waklog_cmds,           /* table of config file commands       */
    NULL,                  /* [#8] MIME-typed-dispatched handlers */
    NULL,                  /* [#1] URI to filename translation    */
    NULL,                  /* [#4] validate user id from request  */
    NULL,                  /* [#5] check if the user is ok _here_ */
    NULL,                  /* [#3] check access by host address   */
    NULL,                  /* [#6] determine MIME type            */
    waklog_phase7,         /* [#7] pre-run fixups                 */
    NULL,                  /* [#9] log a transaction              */
    NULL,                  /* [#2] header parser                  */
    waklog_child_init,     /* child_init                          */
    NULL,                  /* child_exit                          */
    waklog_phase0          /* [#0] post read-request              */
#ifdef EAPI
   ,NULL,                  /* EAPI: add_module                    */
    NULL,                  /* EAPI: remove_module                 */
    NULL,                  /* EAPI: rewrite_command               */
    waklog_new_connection  /* EAPI: new_connection                */
#endif
};
Commit	Line	Data
bed98ff9	1	#include "httpd.h"
bed98ff9	2	#include "http_config.h"
7193eb01	3	#include "http_conf_globals.h"
bed98ff9	4	#include "http_log.h"
7193eb01	5	#include "http_protocol.h"
	6	#include "http_request.h"
	7	#include "http_core.h"
bed98ff9	8	#include "ap_config.h"
4e1ae1cd	9	#include <krb5.h>
bed98ff9	10
7193eb01	11	#if defined(sun)
bed98ff9	12	#include <sys/ioccom.h>
7193eb01	13	#endif /* sun */
bed98ff9	14	#include <stropts.h>
	15	#include <kerberosIV/krb.h>
	16	#include <kerberosIV/des.h>
	17	#include <afs/venus.h>
7193eb01	18	#include <afs/auth.h>
	19	#include <rx/rxkad.h>
	20
	21	#include <asm/bitops.h>
	22	#include <sys/shm.h>
bed98ff9	23
7193eb01	24	#define KEYTAB_PATH "/home/drh/keytab.umweb.drhtest"
7193eb01	25	#define PRINCIPAL "umweb/drhtest"
4e1ae1cd	26
7193eb01	27	#define K5PATH "FILE:/tmp/waklog.creds.k5"
	28	#define K4PATH "/tmp/waklog.creds.k4"
	29
313dde40	30	module waklog_module;
bed98ff9	31
	32	struct ClearToken {
	33	long AuthHandle;
	34	char HandShakeKey[ 8 ];
	35	long ViceId;
	36	long BeginTimestamp;
	37	long EndTimestamp;
	38	};
	39
313dde40	40	typedef struct {
4e1ae1cd	41	int configured;
	42	int protect;
	43	char *keytab;
7193eb01	44	char *keytab_principal;
403921ef	45	char *afs_cell;
313dde40	46	} waklog_host_config;
313dde40	47
7193eb01	48	typedef struct {
	49	struct ktc_token token;
	50	} waklog_child_config;
	51	waklog_child_config *child = NULL;
313dde40	52
e21f34f0	53
313dde40	54	static void *
	55	waklog_create_dir_config( pool p, char path )
	56	{
	57	waklog_host_config *cfg;
	58
	59	cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
	60	cfg->configured = 0;
	61	cfg->protect = 0;
7193eb01	62	cfg->keytab = 0;
7193eb01	63	cfg->keytab_principal = 0;
403921ef	64	cfg->afs_cell = "umich.edu";
313dde40	65
	66	return( cfg );
	67	}
	68
	69
	70	static void *
	71	waklog_create_server_config( pool p, server_rec s )
	72	{
	73	waklog_host_config *cfg;
	74
	75	cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
	76	cfg->configured = 0;
	77	cfg->protect = 0;
7193eb01	78	cfg->keytab = 0;
7193eb01	79	cfg->keytab_principal = 0;
403921ef	80	cfg->afs_cell = "umich.edu";
313dde40	81
	82	return( cfg );
	83	}
	84
	85
313dde40	86	static const char *
	87	set_waklog_protect( cmd_parms params, void mconfig, int flag )
	88	{
	89	waklog_host_config *cfg;
	90
	91	if ( params->path == NULL ) {
	92	cfg = (waklog_host_config *) ap_get_module_config(
	93	params->server->module_config, &waklog_module );
	94	} else {
	95	cfg = (waklog_host_config *)mconfig;
	96	}
	97
	98	cfg->protect = flag;
	99	cfg->configured = 1;
	100	return( NULL );
	101	}
	102
	103
4e1ae1cd	104	static const char *
	105	set_waklog_use_keytab( cmd_parms params, void mconfig, char *file )
	106	{
	107	waklog_host_config *cfg;
	108
	109	if ( params->path == NULL ) {
	110	cfg = (waklog_host_config *) ap_get_module_config(
	111	params->server->module_config, &waklog_module );
	112	} else {
	113	cfg = (waklog_host_config *)mconfig;
	114	}
	115
3ed1e28a	116	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, params->server,
	117	"mod_waklog: using keytab: %s", file );
	118
4e1ae1cd	119	cfg->keytab = file;
	120	cfg->configured = 1;
	121	return( NULL );
	122	}
	123
	124
b74fad73	125	static void
313dde40	126	waklog_child_init( server_rec s, pool p )
b74fad73	127	{
7193eb01	128
	129	if ( child == NULL ) {
	130	child = (waklog_child_config *) ap_palloc( p, sizeof( waklog_child_config ) );
	131	}
	132
	133	memset( &child->token, 0, sizeof( struct ktc_token ) );
	134
b74fad73	135	setpag();
7193eb01	136
b74fad73	137	return;
	138	}
	139
	140
313dde40	141	command_rec waklog_cmds[ ] =
	142	{
	143	{ "WaklogProtected", set_waklog_protect,
	144	NULL, RSRC_CONF \| ACCESS_CONF, FLAG,
	145	"enable waklog on a location or directory basis" },
	146
4e1ae1cd	147	{ "WaklogUseKeytab", set_waklog_use_keytab,
	148	NULL, RSRC_CONF, TAKE1,
	149	"Use the supplied keytab file rather than the user's TGT" },
	150
313dde40	151	{ NULL }
	152	};
	153
	154
bed98ff9	155	static void
e2df6441	156	token_cleanup( void *data )
bed98ff9	157	{
bed98ff9	158	request_rec r = (request_rec )data;
bed98ff9	159
7193eb01	160	if ( child->token.ticketLen ) {
7193eb01	161	memset( &child->token, 0, sizeof( struct ktc_token ) );
bed98ff9	162
7193eb01	163	ktc_ForgetAllTokens();
bed98ff9	164
7193eb01	165	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	166	"mod_waklog: ktc_ForgetAllTokens succeeded" );
	167	}
b74fad73	168	return;
bed98ff9	169	}
	170
	171
4e1ae1cd	172	static int
e2df6441	173	waklog_kinit( server_rec *s )
4e1ae1cd	174	{
4e1ae1cd	175	krb5_error_code kerror;
e2df6441	176	krb5_context kcontext = NULL;
e2df6441	177	krb5_principal kprinc = NULL;
4e1ae1cd	178	krb5_get_init_creds_opt kopts;
7193eb01	179	krb5_creds v5creds;
7193eb01	180	CREDENTIALS v4creds;
e2df6441	181	krb5_ccache kccache = NULL;
e2df6441	182	krb5_keytab keytab = NULL;
4e1ae1cd	183	char ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
e21f34f0	184	waklog_host_config *cfg;
4e1ae1cd	185
e21f34f0	186	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	187	"mod_waklog: waklog_kinit called" );
4e1ae1cd	188
e21f34f0	189	if (( kerror = krb5_init_context( &kcontext ))) {
	190	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	191	(char *)error_message( kerror ));
4e1ae1cd	192
e2df6441	193	goto cleanup;
e21f34f0	194	}
4e1ae1cd	195
e21f34f0	196	/* use the path */
	197	if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
	198	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	199	(char *)error_message( kerror ));
4e1ae1cd	200
e2df6441	201	goto cleanup;
e21f34f0	202	}
4e1ae1cd	203
e21f34f0	204	if (( kerror = krb5_parse_name( kcontext, PRINCIPAL, &kprinc ))) {
	205	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	206	(char *)error_message( kerror ));
7193eb01	207
e2df6441	208	goto cleanup;
e21f34f0	209	}
7193eb01	210
e21f34f0	211	krb5_get_init_creds_opt_init( &kopts );
	212	krb5_get_init_creds_opt_set_tkt_life( &kopts, 106060 );
	213	krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
	214	krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
	215	krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );
7193eb01	216
e21f34f0	217	cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
e21f34f0	218	&waklog_module );
7193eb01	219
e21f34f0	220	/* which keytab should we use? */
403921ef	221	strncpy( ktbuf, cfg->keytab ? cfg->keytab : KEYTAB_PATH, sizeof( ktbuf ) - 1 );
7193eb01	222
e21f34f0	223	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	224	"mod_waklog: waklog_kinit using: %s", ktbuf );
7193eb01	225
e21f34f0	226	if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
	227	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	228	(char *)error_message( kerror ));
7193eb01	229
e2df6441	230	goto cleanup;
e21f34f0	231	}
7193eb01	232
e21f34f0	233	/* get the krbtgt */
e21f34f0	234	if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds,
403921ef	235	kprinc, keytab, 0, NULL, &kopts ))) {
7193eb01	236
e21f34f0	237	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	238	(char *)error_message( kerror ));
7193eb01	239
e2df6441	240	goto cleanup;
e21f34f0	241	}
7193eb01	242
e21f34f0	243	if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
e21f34f0	244	kprinc, keytab, NULL, NULL )) != 0 ) {
7193eb01	245
e21f34f0	246	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	247	(char *)error_message( kerror ));
7193eb01	248
e2df6441	249	goto cleanup;
e21f34f0	250	}
7193eb01	251
e21f34f0	252	if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
	253	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	254	(char *)error_message( kerror ));
7193eb01	255
e2df6441	256	goto cleanup;
e21f34f0	257	}
7193eb01	258
e2df6441	259	kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds );
	260	krb5_free_cred_contents( kcontext, &v5creds );
	261	if ( kerror != 0 ) {
e21f34f0	262	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	263	(char *)error_message( kerror ));
7193eb01	264
e2df6441	265	goto cleanup;
e21f34f0	266	}
7193eb01	267
e21f34f0	268	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	269	"mod_waklog: waklog_kinit success" );
	270
	271	cleanup:
	272	if ( keytab )
	273	(void)krb5_kt_close( kcontext, keytab );
	274	if ( kprinc )
	275	krb5_free_principal( kcontext, kprinc );
	276	if ( kccache )
	277	krb5_cc_close( kcontext, kccache );
	278	if ( kcontext )
	279	krb5_free_context( kcontext );
e21f34f0	280
e21f34f0	281	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	282	"mod_waklog: waklog_kinit: exiting" );
7193eb01	283
	284	return( 0 );
	285	}
	286
	287
	288	static void
	289	waklog_aklog( request_rec *r )
	290	{
	291	int rc;
	292	char buf[ 1024 ];
	293	const char *k4path = NULL;
	294	const char *k5path = NULL;
	295	krb5_error_code kerror;
e2df6441	296	krb5_context kcontext = NULL;
7193eb01	297	krb5_creds increds;
	298	krb5_creds *v5credsp = NULL;
	299	CREDENTIALS v4creds;
e2df6441	300	krb5_ccache kccache = NULL;
403921ef	301	struct ktc_principal server = { "afs", "", "" };
7193eb01	302	struct ktc_principal client;
7193eb01	303	struct ktc_token token;
403921ef	304	waklog_host_config *cfg;
7193eb01	305
	306	k5path = ap_table_get( r->subprocess_env, "KRB5CCNAME" );
	307	k4path = ap_table_get( r->subprocess_env, "KRBTKFILE" );
	308
	309	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	310	"mod_waklog: waklog_aklog called: k5path: %s, k4path: %s", k5path, k4path );
	311
	312	if ( !k5path \|\| !k4path ) {
	313	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	314	"mod_waklog: waklog_aklog giving up" );
e2df6441	315	goto cleanup;
4e1ae1cd	316	}
4e1ae1cd	317
7193eb01	318	/*
	319	** Get/build creds from file/tgs, then see if we need to SetToken
	320	*/
	321
	322	if (( kerror = krb5_init_context( &kcontext ))) {
	323	/* Authentication Required ( kerberos error ) */
4e1ae1cd	324	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
4e1ae1cd	325	(char *)error_message( kerror ));
7193eb01	326
e2df6441	327	goto cleanup;
4e1ae1cd	328	}
4e1ae1cd	329
403921ef	330	krb524_init_ets(kcontext);
403921ef	331
7193eb01	332	memset( (char *)&increds, 0, sizeof(increds));
4e1ae1cd	333
403921ef	334	cfg = (waklog_host_config *) ap_get_module_config(
	335	r->server->module_config, &waklog_module );
	336
	337	/* afs/<cell> or afs */
	338	strncpy( buf, "afs", sizeof( buf ) - 1 );
	339	if ( strcmp( cfg->afs_cell, "umich.edu" ) ) {
	340	strncat( buf, "/" , sizeof( buf ) - strlen( buf ) - 1 );
	341	strncat( buf, cfg->afs_cell, sizeof( buf ) - strlen( buf ) - 1 );
	342	}
	343
7193eb01	344	/* set server part */
403921ef	345	if (( kerror = krb5_parse_name( kcontext, buf, &increds.server ))) {
4e1ae1cd	346	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	347	(char *)error_message( kerror ));
	348
e2df6441	349	goto cleanup;
4e1ae1cd	350	}
4e1ae1cd	351
7193eb01	352	if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
	353	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	354	(char *)error_message( kerror ));
	355
e2df6441	356	goto cleanup;
7193eb01	357	}
4e1ae1cd	358
7193eb01	359	/* set client part */
7193eb01	360	krb5_cc_get_principal( kcontext, kccache, &increds.client );
4e1ae1cd	361
7193eb01	362	increds.times.endtime = 0;
	363	/* Ask for DES since that is what V4 understands */
	364	increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
	365
	366	/* get the V5 credentials */
	367	if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
	368	&increds, &v5credsp ) ) ) {
403921ef	369	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
403921ef	370	"mod_waklog: krb5_get_credentials: %s", error_message( kerror ));
e2df6441	371	goto cleanup;
4e1ae1cd	372	}
4e1ae1cd	373
7193eb01	374	/* get the V4 credentials */
7193eb01	375	if (( kerror = krb524_convert_creds_kdc( kcontext, v5credsp, &v4creds ) ) ) {
403921ef	376	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
403921ef	377	"mod_waklog: krb524_convert_creds_kdc: %s", error_message( kerror ));
e2df6441	378	goto cleanup;
4e1ae1cd	379	}
4e1ae1cd	380
7193eb01	381	/* assemble the token */
	382	token.kvno = v4creds.kvno;
	383	token.startTime = v4creds.issue_date;
	384	token.endTime = v5credsp->times.endtime;
	385	memmove( &token.sessionKey, v4creds.session, 8 );
	386	token.ticketLen = v4creds.ticket_st.length ;
	387	memmove( token.ticket, v4creds.ticket_st.dat, token.ticketLen );
	388
	389	/* make sure we have to do this */
	390	if ( child->token.kvno != token.kvno \|\|
	391	child->token.ticketLen != token.ticketLen \|\|
	392	memcmp( &child->token.sessionKey, &token.sessionKey,
	393	sizeof( token.sessionKey ) ) \|\|
	394	memcmp( child->token.ticket, token.ticket, token.ticketLen ) ) {
	395
	396	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	397	"mod_waklog: %s.%s@%s", v4creds.service, v4creds.instance,
	398	v4creds.realm );
	399	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	400	"mod_waklog: %d %d %d", v4creds.lifetime, v4creds.kvno,
	401	v4creds.issue_date );
	402	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	403	"mod_waklog: %s %s", v4creds.pname, v4creds.pinst );
	404	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	405	"mod_waklog: %d", v4creds.ticket_st.length );
	406
	407	/* build the name */
403921ef	408	strncpy( buf, v4creds.pname, sizeof( buf ) - 1 );
7193eb01	409	if ( v4creds.pinst[ 0 ] ) {
403921ef	410	strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
403921ef	411	strncat( buf, v4creds.pinst, sizeof( buf ) - strlen( buf ) - 1 );
7193eb01	412	}
	413
	414	/* assemble the client */
403921ef	415	strncpy( client.name, buf, sizeof( client.name ) - 1 );
	416	strncpy( client.instance, "", sizeof( client.instance) - 1 );
	417	strncpy( client.cell, v4creds.realm, sizeof( client.cell ) - 1 );
	418
	419	strncpy( server.cell, cfg->afs_cell , sizeof( server.cell ) - 1 );
7193eb01	420
	421	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	422	"mod_waklog: server: name=%s, instance=%s, cell=%s",
	423	server.name, server.instance, server.cell );
	424
	425	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	426	"mod_waklog: client: name=%s, instance=%s, cell=%s",
	427	client.name, client.instance, client.cell );
	428
	429	/* use the path */
	430	krb_set_tkt_string( (char *)k4path );
	431
	432	/* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
	433	write( 2, "", 0 );
	434
	435	if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
	436	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	437	"mod_waklog: settoken returned %d", rc );
	438	}
	439
	440	/* save this */
	441	memmove( &child->token, &token, sizeof( struct ktc_token ) );
	442
	443	/* we'll need to unlog when this connection is done. */
e2df6441	444	ap_register_cleanup( r->pool, (void *)r, token_cleanup, ap_null_cleanup );
7193eb01	445	}
7193eb01	446
e2df6441	447	cleanup:
	448	if ( v5credsp )
	449	krb5_free_cred_contents( kcontext, v5credsp );
	450	if ( increds.client )
	451	krb5_free_principal( kcontext, increds.client );
	452	if ( increds.server )
	453	krb5_free_principal( kcontext, increds.server );
	454	if ( kccache )
	455	krb5_cc_close( kcontext, kccache );
	456	if ( kcontext )
	457	krb5_free_context( kcontext );
3ed1e28a	458
7193eb01	459	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	460	"mod_waklog: finished with waklog_aklog" );
	461
e2df6441	462	return;
e2df6441	463
4e1ae1cd	464	}
4e1ae1cd	465
e21f34f0	466	static int
	467	waklog_child_routine( void s, child_info pinfo )
	468	{
e21f34f0	469	if ( !getuid() ) {
132ef613	470	ap_log_error( APLOG_MARK, APLOG_ERR\|APLOG_NOERRNO, s,
e21f34f0	471	"mod_waklog: waklog_child_routine called as root" );
	472
	473	/* this was causing the credential file to get owned by root */
	474	setgid(ap_group_id);
	475	setuid(ap_user_id);
	476	}
	477
	478	while( 1 ) {
e2df6441	479	waklog_kinit( s );
132ef613	480	sleep( 300 /* 106060 - 560 / );
e21f34f0	481	}
	482
	483	}
	484
	485
	486	static void
	487	waklog_init( server_rec s, pool p )
	488	{
	489	extern char *version;
	490	int pid;
	491
	492	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, s,
	493	"mod_waklog: version %s initialized.", version );
	494
	495	pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
	496	NULL, NULL, NULL );
	497
132ef613	498	ap_log_error( APLOG_MARK, APLOG_ERR\|APLOG_NOERRNO, s,
e21f34f0	499	"mod_waklog: ap_bspawn_child: %d.", pid );
	500	}
	501
4e1ae1cd	502
bed98ff9	503	static int
7193eb01	504	waklog_phase0( request_rec *r )
bed98ff9	505	{
313dde40	506	waklog_host_config *cfg;
313dde40	507
7193eb01	508	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	509	"mod_waklog: phase0 called" );
	510
313dde40	511	/* directory config? */
	512	cfg = (waklog_host_config *)ap_get_module_config(
	513	r->per_dir_config, &waklog_module);
bed98ff9	514
313dde40	515	/* server config? */
313dde40	516	if ( !cfg->configured ) {
7193eb01	517	cfg = (waklog_host_config *)ap_get_module_config(
7193eb01	518	r->server->module_config, &waklog_module);
313dde40	519	}
313dde40	520
7193eb01	521	if ( !cfg->protect ) {
4e1ae1cd	522	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	523	"mod_waklog: phase0 declining" );
	524	return( DECLINED );
	525	}
4e1ae1cd	526
7193eb01	527	/* do this only if we are still unauthenticated */
7193eb01	528	if ( !child->token.ticketLen ) {
4e1ae1cd	529
e21f34f0	530	/* set our environment variables */
	531	ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
	532	ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );
3ed1e28a	533
7193eb01	534	/* stuff the credentials into the kernel */
7193eb01	535	waklog_aklog( r );
4e1ae1cd	536	}
7193eb01	537
	538	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	539	"mod_waklog: phase0 returning" );
	540	return DECLINED;
	541	}
4e1ae1cd	542
1e18ef7d	543
7193eb01	544	static int
	545	waklog_phase7( request_rec *r )
	546	{
	547	waklog_host_config *cfg;
1e18ef7d	548
7193eb01	549	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	550	"mod_waklog: phase7 called" );
1e18ef7d	551
7193eb01	552	/* directory config? */
	553	cfg = (waklog_host_config *)ap_get_module_config(
	554	r->per_dir_config, &waklog_module);
1e18ef7d	555
7193eb01	556	/* server config? */
	557	if ( !cfg->configured ) {
	558	cfg = (waklog_host_config *)ap_get_module_config(
	559	r->server->module_config, &waklog_module);
bed98ff9	560	}
bed98ff9	561
7193eb01	562	if ( !cfg->protect ) {
7193eb01	563	return( DECLINED );
bed98ff9	564	}
bed98ff9	565
7193eb01	566	/* stuff the credentials into the kernel */
7193eb01	567	waklog_aklog( r );
bed98ff9	568
7193eb01	569	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	570	"mod_waklog: phase7 returning" );
bed98ff9	571
7193eb01	572	return DECLINED;
bed98ff9	573	}
bed98ff9	574
7193eb01	575	static void
	576	waklog_new_connection( conn_rec *c ) {
	577	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, c->server,
	578	"mod_waklog: new_connection called: conn_rec: 0x%08x pid: %d", c, getpid() );
	579	return;
	580	}
bed98ff9	581
313dde40	582	module MODULE_VAR_EXPORT waklog_module = {
bed98ff9	583	STANDARD_MODULE_STUFF,
313dde40	584	waklog_init, /* module initializer */
313dde40	585	waklog_create_dir_config, /* create per-dir config structures */
bed98ff9	586	NULL, /* merge per-dir config structures */
313dde40	587	waklog_create_server_config, /* create per-server config structures */
bed98ff9	588	NULL, /* merge per-server config structures */
313dde40	589	waklog_cmds, /* table of config file commands */
bed98ff9	590	NULL, /* [#8] MIME-typed-dispatched handlers */
	591	NULL, /* [#1] URI to filename translation */
	592	NULL, /* [#4] validate user id from request */
	593	NULL, /* [#5] check if the user is ok _here_ */
	594	NULL, /* [#3] check access by host address */
	595	NULL, /* [#6] determine MIME type */
7193eb01	596	waklog_phase7, /* [#7] pre-run fixups */
bed98ff9	597	NULL, /* [#9] log a transaction */
313dde40	598	NULL, /* [#2] header parser */
313dde40	599	waklog_child_init, /* child_init */
bed98ff9	600	NULL, /* child_exit */
7193eb01	601	waklog_phase0 /* [#0] post read-request */
bed98ff9	602	#ifdef EAPI
	603	,NULL, /* EAPI: add_module */
	604	NULL, /* EAPI: remove_module */
	605	NULL, /* EAPI: rewrite_command */
7193eb01	606	waklog_new_connection /* EAPI: new_connection */
bed98ff9	607	#endif
bed98ff9	608	};