#include <sys/ioccom.h>
#endif /* sun */
#include <stropts.h>
-#include <kerberosIV/krb.h>
-#include <kerberosIV/des.h>
#include <afs/venus.h>
#include <afs/auth.h>
#include <rx/rxkad.h>
-#include <asm/bitops.h>
-#include <sys/shm.h>
-
-#define KEYTAB "/home/drh/keytab.umweb.drhtest"
-#define KEYTAB_PRINCIPAL "umweb/drhtest"
+#define KEYTAB "/home/drh/keytab.itdwww"
+#define KEYTAB_PRINCIPAL "itdwww"
#define TKT_LIFE 10*60*60
-#define SLEEP_TIME 5*60 /* should be TKT_LIFE */
+#define SLEEP_TIME TKT_LIFE - 5*60
#define AFS_CELL "umich.edu" /* NB: lower case */
module waklog_module;
-struct ClearToken {
- long AuthHandle;
- char HandShakeKey[ 8 ];
- long ViceId;
- long BeginTimestamp;
- long EndTimestamp;
-};
-
typedef struct {
int configured;
int protect;
} waklog_child_config;
waklog_child_config child;
-void
-bin_dump( char *s, char *cp, int count )
-{
- char *buffer;
- char c;
- int w;
- int i;
- long o;
-
- o = 0;
- buffer = cp;
- while ( count > 0 ) {
- c = 16;
- if (c > count) {
- c = count;
- }
- sprintf( s, "%05lx:", o);
- s += strlen(s);
- w = 0;
- for (i = 0; i < c/2; ++i) {
- w += 5;
- sprintf( s, " %04x", ((unsigned short *)buffer)[i]);
- s += strlen(s);
- }
- if (c & 1) {
- w += 3;
- sprintf( s, " %02x", buffer[c-1]);
- s += strlen(s);
- }
- while (w < 41) {
- ++w;
- sprintf( s, "%c", ' ');
- s += strlen(s);
- }
- for (i = 0; i < c; ++i) {
- if (isprint(buffer[i])) {
- sprintf( s, "%c", buffer[i]);
- } else {
- sprintf( s, ".");
- }
- s += strlen(s);
- }
- sprintf( s, "\n" );
- s += strlen(s);
- o += c;
- buffer += c;
- count -= c;
- }
- sprintf( s, "%05lx:\0", o );
-}
-
-
+#if 0
static void *
waklog_create_dir_config( pool *p, char *path )
{
return( cfg );
}
+#endif /* 0 */
static void *
cfg->keytab_principal = KEYTAB_PRINCIPAL;
cfg->afs_cell = AFS_CELL;
+#if 0
+ ap_set_module_config( s->module_config, &waklog_module, cfg);
+#endif /* 0 */
+
return( cfg );
}
{
waklog_host_config *cfg;
+#if 0
if ( params->path == NULL ) {
+#endif /* 0 */
cfg = (waklog_host_config *) ap_get_module_config(
params->server->module_config, &waklog_module );
+#if 0
} else {
cfg = (waklog_host_config *)mconfig;
}
+#endif /* 0 */
cfg->protect = flag;
cfg->configured = 1;
{
waklog_host_config *cfg;
+#if 0
if ( params->path == NULL ) {
+#endif /* 0 */
cfg = (waklog_host_config *) ap_get_module_config(
params->server->module_config, &waklog_module );
+#if 0
} else {
cfg = (waklog_host_config *)mconfig;
}
+#endif /* 0 */
ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
- "mod_waklog: using keytab: %s", file );
+ "mod_waklog: will use keytab: %s", file );
- cfg->keytab = file;
+ cfg->keytab = ap_pstrdup ( params->pool, file );
cfg->configured = 1;
return( NULL );
}
{
waklog_host_config *cfg;
+#if 0
if ( params->path == NULL ) {
+#endif /* 0 */
cfg = (waklog_host_config *) ap_get_module_config(
params->server->module_config, &waklog_module );
+#if 0
} else {
cfg = (waklog_host_config *)mconfig;
}
+#endif /* 0 */
ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
- "mod_waklog: using keytab_principal: %s", file );
+ "mod_waklog: will use keytab_principal: %s", file );
- cfg->keytab_principal = file;
+ cfg->keytab_principal = ap_pstrdup ( params->pool, file );
cfg->configured = 1;
return( NULL );
}
{
waklog_host_config *cfg;
+#if 0
if ( params->path == NULL ) {
+#endif /* 0 */
cfg = (waklog_host_config *) ap_get_module_config(
params->server->module_config, &waklog_module );
+#if 0
} else {
cfg = (waklog_host_config *)mconfig;
}
+#endif /* 0 */
ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
- "mod_waklog: using afs_cell: %s", file );
+ "mod_waklog: will use afs_cell: %s", file );
- cfg->afs_cell = file;
+ cfg->afs_cell = ap_pstrdup( params->pool, file );
cfg->configured = 1;
return( NULL );
}
"enable waklog on a location or directory basis" },
{ "WaklogUseKeytabPath", set_waklog_use_keytab,
- NULL, RSRC_CONF, TAKE1,
+ NULL, RSRC_CONF | ACCESS_CONF, TAKE1,
"Use the supplied keytab rather than the default" },
{ "WaklogUseKeytabPrincipal", set_waklog_use_keytab_principal,
- NULL, RSRC_CONF, TAKE1,
+ NULL, RSRC_CONF | ACCESS_CONF, TAKE1,
"Use the supplied keytab principal rather than the default" },
{ "WaklogUseAFSCell", set_waklog_use_afs_cell,
- NULL, RSRC_CONF, TAKE1,
+ NULL, RSRC_CONF | ACCESS_CONF, TAKE1,
"Use the supplied AFS cell rather than the default" },
{ NULL }
krb5_keytab keytab = NULL;
char ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
waklog_host_config *cfg;
+ int i;
ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
- "mod_waklog: waklog_kinit called" );
+ "mod_waklog: waklog_kinit called: pid: %d", getpid() );
cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
&waklog_module );
goto cleanup;
}
- if (( kerror = krb5_parse_name( kcontext, cfg->keytab_principal, &kprinc ))) {
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: keytab_principal: %s", cfg->keytab_principal );
+
+ if (( kerror = krb5_parse_name( kcontext, cfg->keytab_principal, &kprinc ))) {
ap_log_error( APLOG_MARK, APLOG_ERR, s,
(char *)error_message( kerror ));
goto cleanup;
}
+#if 0
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: kprinc->realm: %.*s", kprinc->realm.length, kprinc->realm.data );
+
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: kprinc->length: %d", kprinc->length );
+ for ( i = 0; i < kprinc->length; i++ ) {
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: kprinc->data[%d].data: %.*s", i, kprinc->data[i].length, kprinc->data[i].data );
+ }
+#endif /* 0 */
+
krb5_get_init_creds_opt_init( &kopts );
krb5_get_init_creds_opt_set_tkt_life( &kopts, TKT_LIFE );
krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
goto cleanup;
}
+ memset( (char *)&v5creds, 0, sizeof(v5creds));
+
/* get the krbtgt */
if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds,
kprinc, keytab, 0, NULL, &kopts ))) {
goto cleanup;
}
- if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
- kprinc, keytab, NULL, NULL )) != 0 ) {
+#if 0
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: v5creds.client->realm: %.*s", v5creds.client->realm.length, v5creds.client->realm.data );
+
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: v5creds.client->length: %d", v5creds.client->length );
+ for ( i = 0; i < v5creds.client->length; i++ ) {
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: v5creds.client->data[%d].data: %.*s",
+ i, v5creds.client->data[i].length, v5creds.client->data[i].data );
+ }
+
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: v5creds.server->realm: %.*s", v5creds.server->realm.length, v5creds.server->realm.data );
+
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: v5creds.server->length: %d", v5creds.server->length );
+ for ( i = 0; i < v5creds.server->length; i++ ) {
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: v5creds.server->data[%d].data: %.*s",
+ i, v5creds.server->data[i].length, v5creds.server->data[i].data );
+ }
+
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: waklog_kinit #4" );
+
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
+ "mod_waklog: waklog_kinit kprinc==v5creds.server: %s",
+ krb5_principal_compare( kcontext, kprinc, v5creds.server ) ? "true" : "false" );
+#endif /* 0 */
+
+#if 0
+#error the proof of the pudding is in the eating
+ if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
+ v5creds.server, keytab, NULL, &vopts )) != 0 ) {
ap_log_error( APLOG_MARK, APLOG_ERR, s,
(char *)error_message( kerror ));
goto cleanup;
}
+#endif /* 0 */
if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
ap_log_error( APLOG_MARK, APLOG_ERR, s,
token.ticketLen = v5credsp->ticket.length;
memmove( token.ticket, v5credsp->ticket.data, token.ticketLen );
- /*
- ** bin_dump( buf, (char *) &token, token.ticketLen + 24 );
- ** ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
- ** "mod_waklog: token\n%s", buf );
- */
-
/* make sure we have to do this */
if ( child.token.kvno != token.kvno ||
child.token.ticketLen != token.ticketLen ||
sizeof( token.sessionKey ) )) ||
(memcmp( child.token.ticket, token.ticket, token.ticketLen )) ) {
- /*
- ** bin_dump( buf, (char *) &child.token, child.token.ticketLen + 24 );
- ** ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
- ** "mod_waklog: child.token\n%s", buf );
- */
+ ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
+ "mod_waklog: client: %s", buf );
/* build the name */
memmove( buf, v5credsp->client->data[0].data, v5credsp->client->data[0].length );
buf[ v5credsp->client->data[0].length ] = '\0';
if ( v5credsp->client->length > 1 ) {
- strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
+ strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
buflen = strlen( buf );
memmove( buf + buflen, v5credsp->client->data[1].data, v5credsp->client->data[1].length );
buf[ buflen + v5credsp->client->data[1].length ] = '\0';
ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
"mod_waklog: phase0 called" );
+#if 0
/* directory config? */
cfg = (waklog_host_config *)ap_get_module_config(
r->per_dir_config, &waklog_module);
+
/* server config? */
if ( !cfg->configured ) {
+#endif /* 0 */
cfg = (waklog_host_config *)ap_get_module_config(
r->server->module_config, &waklog_module);
+#if 0
}
+#endif /* 0 */
if ( !cfg->protect ) {
ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
return( DECLINED );
}
+ /* set our environment variables */
+ ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
+ ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );
+
/* do this only if we are still unauthenticated */
if ( !child.token.ticketLen ) {
- /* set our environment variables */
- ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
- ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );
-
/* stuff the credentials into the kernel */
waklog_aklog( r );
}
ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
"mod_waklog: phase7 called" );
+#if 0
/* directory config? */
cfg = (waklog_host_config *)ap_get_module_config(
r->per_dir_config, &waklog_module);
/* server config? */
if ( !cfg->configured ) {
+#endif /* 0 */
cfg = (waklog_host_config *)ap_get_module_config(
r->server->module_config, &waklog_module);
+#if 0
}
+#endif /* 0 */
if ( !cfg->protect ) {
return( DECLINED );
module MODULE_VAR_EXPORT waklog_module = {
STANDARD_MODULE_STUFF,
- waklog_init, /* module initializer */
+ waklog_init, /* module initializer */
+#if 0
waklog_create_dir_config, /* create per-dir config structures */
+#else /* 0 */
+ NULL, /* create per-dir config structures */
+#endif /* 0 */
NULL, /* merge per-dir config structures */
waklog_create_server_config, /* create per-server config structures */
NULL, /* merge per-server config structures */