[hcoop/zz_old/modwaklog.git] / mod_waklog.c

#include "httpd.h"
#include "http_config.h"
#include "http_conf_globals.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "http_core.h"
#include "ap_config.h"
#include <krb5.h>

#if defined(sun)
#include <sys/ioccom.h>
#endif /* sun */
#include <stropts.h>
#include <afs/venus.h>
#include <afs/auth.h>
#include <rx/rxkad.h>

#define KEYTAB			"/home/drh/keytab.umweb.drhtest"
#define KEYTAB_PRINCIPAL	"umweb/drhtest"

#define TKT_LIFE	10*60*60
#define	SLEEP_TIME	5*60 /* should be TKT_LIFE */

#define AFS_CELL	"umich.edu" /* NB: lower case */

#define K5PATH		"FILE:/tmp/waklog.creds.k5"
#define K4PATH		"/tmp/waklog.creds.k4"

module waklog_module;

struct ClearToken {
    long AuthHandle;
    char HandShakeKey[ 8 ];
    long ViceId;
    long BeginTimestamp;
    long EndTimestamp;
};

typedef struct {
    int		configured;
    int		protect;
    char	*keytab;
    char	*keytab_principal;
    char	*afs_cell;
} waklog_host_config;

typedef struct {
	struct ktc_token	token;
} waklog_child_config;
waklog_child_config	child;


    static void *
waklog_create_server_config( pool *p, server_rec *s )
{
    waklog_host_config *cfg;

    cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
    cfg->configured = 0;
    cfg->protect = 0;
    cfg->keytab = KEYTAB;
    cfg->keytab_principal = KEYTAB_PRINCIPAL;
    cfg->afs_cell = AFS_CELL;

    return( cfg );
}


    static const char *
set_waklog_protect( cmd_parms *params, void *mconfig, int flag )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    cfg->protect = flag;
    cfg->configured = 1;
    return( NULL );
}


    static const char *
set_waklog_use_keytab( cmd_parms *params, void *mconfig, char *file  )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
	    "mod_waklog: using keytab: %s", file );

    cfg->keytab = file;
    cfg->configured = 1;
    return( NULL );
}


    static const char *
set_waklog_use_keytab_principal( cmd_parms *params, void *mconfig, char *file  )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
	    "mod_waklog: using keytab_principal: %s", file );

    cfg->keytab_principal = file;
    cfg->configured = 1;
    return( NULL );
}


    static const char *
set_waklog_use_afs_cell( cmd_parms *params, void *mconfig, char *file  )
{
    waklog_host_config          *cfg;

    if ( params->path == NULL ) {
        cfg = (waklog_host_config *) ap_get_module_config(
                params->server->module_config, &waklog_module );
    } else {
        cfg = (waklog_host_config *)mconfig;
    }

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, params->server,
	    "mod_waklog: using afs_cell: %s", file );

    cfg->afs_cell = file;
    cfg->configured = 1;
    return( NULL );
}


    static void
waklog_child_init( server_rec *s, pool *p )
{

    memset( &child.token, 0, sizeof( struct ktc_token ) );

    setpag();

    return;
}


command_rec waklog_cmds[ ] =
{
    { "WaklogProtected", set_waklog_protect,
    NULL, RSRC_CONF | ACCESS_CONF, FLAG,
    "enable waklog on a location or directory basis" },

    { "WaklogUseKeytabPath", set_waklog_use_keytab,
    NULL, RSRC_CONF, TAKE1,
    "Use the supplied keytab rather than the default" },

    { "WaklogUseKeytabPrincipal", set_waklog_use_keytab_principal,
    NULL, RSRC_CONF, TAKE1,
    "Use the supplied keytab principal rather than the default" },

    { "WaklogUseAFSCell", set_waklog_use_afs_cell,
    NULL, RSRC_CONF, TAKE1,
    "Use the supplied AFS cell rather than the default" },

    { NULL }
};


    static void
token_cleanup( void *data )
{
    request_rec		*r = (request_rec *)data;

    if ( child.token.ticketLen ) {
	memset( &child.token, 0, sizeof( struct ktc_token ) );

	ktc_ForgetAllTokens();

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d", getpid() );
    }
    return;
}


    static int
waklog_kinit( server_rec *s )
{
    krb5_error_code		kerror;
    krb5_context		kcontext = NULL;
    krb5_principal		kprinc = NULL;
    krb5_get_init_creds_opt	kopts;
    krb5_creds			v5creds;
    krb5_ccache			kccache = NULL;
    krb5_keytab			keytab = NULL;
    char			ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
    waklog_host_config		*cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_kinit called" );

    cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
	    &waklog_module );

    if (( kerror = krb5_init_context( &kcontext ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
        	(char *)error_message( kerror ));

        goto cleanup;
    }

    /* use the path */
    if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

   if (( kerror = krb5_parse_name( kcontext, cfg->keytab_principal, &kprinc ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

       	goto cleanup;
    }

    krb5_get_init_creds_opt_init( &kopts );
    krb5_get_init_creds_opt_set_tkt_life( &kopts, TKT_LIFE );
    krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
    krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
    krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );

    /* keytab from config */
    strncpy( ktbuf, cfg->keytab, sizeof( ktbuf ) - 1 );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	    "mod_waklog: waklog_kinit using: %s", ktbuf );

    if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    /* get the krbtgt */
    if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds, 
		kprinc, keytab, 0, NULL, &kopts ))) {

	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

   if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
    	    kprinc, keytab, NULL, NULL )) != 0 ) {

	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds );
    krb5_free_cred_contents( kcontext, &v5creds );
    if ( kerror != 0 ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, s,
		(char *)error_message( kerror ));

    	goto cleanup;
    }

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_kinit success" );

cleanup:
    if ( keytab )
	(void)krb5_kt_close( kcontext, keytab );
    if ( kprinc )
	krb5_free_principal( kcontext, kprinc );
    if ( kccache )
	krb5_cc_close( kcontext, kccache );
    if ( kcontext )
	krb5_free_context( kcontext );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, s,
	"mod_waklog: waklog_kinit: exiting" );

    return( 0 );
}


    static void
waklog_aklog( request_rec *r )
{
    int				rc;
    char			buf[ 2048 ];
    const char          	*k4path = NULL;
    const char          	*k5path = NULL;
    krb5_error_code		kerror;
    krb5_context		kcontext = NULL;
    krb5_creds			increds;
    krb5_creds			*v5credsp = NULL;
    krb5_ccache			kccache = NULL;
    struct ktc_principal	server = { "afs", "", "" };
    struct ktc_principal	client;
    struct ktc_token		token;
    waklog_host_config		*cfg;
    int				buflen;

    k5path = ap_table_get( r->subprocess_env, "KRB5CCNAME" );
    k4path = ap_table_get( r->subprocess_env, "KRBTKFILE" );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: waklog_aklog called: k5path: %s, k4path: %s", k5path, k4path );

    if ( !k5path || !k4path ) {   
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: waklog_aklog giving up" );
	goto cleanup;
    }

    /*
    ** Get/build creds from file/tgs, then see if we need to SetToken
    */

    if (( kerror = krb5_init_context( &kcontext ))) {
	/* Authentication Required ( kerberos error ) */
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		(char *)error_message( kerror ));

	goto cleanup;
    }

    memset( (char *)&increds, 0, sizeof(increds));

    cfg = (waklog_host_config *) ap_get_module_config(
	    r->server->module_config, &waklog_module );

    /* afs/<cell> or afs */
    strncpy( buf, "afs", sizeof( buf ) - 1 );
    if ( strcmp( cfg->afs_cell, AFS_CELL ) ) {
	strncat( buf, "/" ,		sizeof( buf ) - strlen( buf ) - 1 );
	strncat( buf, cfg->afs_cell,	sizeof( buf ) - strlen( buf ) - 1 );
    }

    /* set server part */
    if (( kerror = krb5_parse_name( kcontext, buf, &increds.server ))) {
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		(char *)error_message( kerror ));

	goto cleanup;
    }

    if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
    	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
    		(char *)error_message( kerror ));
    
        goto cleanup;
    }

    /* set client part */
    krb5_cc_get_principal( kcontext, kccache, &increds.client );

    increds.times.endtime = 0;
    /* Ask for DES since that is what V4 understands */
    increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;

    /* get the V5 credentials */
    if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
		&increds, &v5credsp ) ) ) {
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	    "mod_waklog: krb5_get_credentials: %s", error_message( kerror ));
	goto cleanup;
    }

    /* don't overflor */
    if ( v5credsp->ticket.length >= 344 ) {	/* from krb524d.c */
	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	    "mod_waklog: ticket size (%d) to big to fake", v5credsp->ticket.length );
	goto cleanup;
    }

    /* assemble the token */
    memset( &token, 0, sizeof( struct ktc_token ) );

    token.startTime = v5credsp->times.starttime ? v5credsp->times.starttime : v5credsp->times.authtime;
    token.endTime = v5credsp->times.endtime;
    memmove( &token.sessionKey, v5credsp->keyblock.contents,  v5credsp->keyblock.length );
    token.kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
    token.ticketLen = v5credsp->ticket.length;
    memmove( token.ticket, v5credsp->ticket.data, token.ticketLen );

    /* make sure we have to do this */
    if ( child.token.kvno != token.kvno ||
	    child.token.ticketLen != token.ticketLen ||
	    (memcmp( &child.token.sessionKey, &token.sessionKey,
		    sizeof( token.sessionKey ) )) ||
	    (memcmp( child.token.ticket, token.ticket, token.ticketLen )) ) {

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: client: %s", buf );

	/* build the name */
	memmove( buf, v5credsp->client->data[0].data, v5credsp->client->data[0].length );
	buf[ v5credsp->client->data[0].length ] = '\0';
	if ( v5credsp->client->length > 1 ) {
		strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
		buflen = strlen( buf );
		memmove( buf + buflen, v5credsp->client->data[1].data, v5credsp->client->data[1].length );
		buf[ buflen + v5credsp->client->data[1].length ] = '\0';
	}

	/* assemble the client */
	strncpy( client.name, buf,		sizeof( client.name ) - 1 );
	strncpy( client.instance, "",		sizeof( client.instance) - 1 );
	memmove( buf, v5credsp->client->realm.data, v5credsp->client->realm.length );
 	buf[ v5credsp->client->realm.length ] = '\0';
 	strncpy( client.cell, buf,		sizeof( client.cell ) - 1 );

	/* assemble the server's cell */
	strncpy( server.cell, cfg->afs_cell ,	sizeof( server.cell ) - 1 );

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: server: name=%s, instance=%s, cell=%s",
		server.name, server.instance, server.cell );

	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
		"mod_waklog: client: name=%s, instance=%s, cell=%s",
		 client.name, client.instance, client.cell );

	/* use the path */
	krb_set_tkt_string( (char *)k4path );

	/* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
	write( 2, "", 0 );

	if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
	    ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
		"mod_waklog: settoken returned %d", rc );
	    goto cleanup;
	}

	/* save this */
	memmove( &child.token, &token, sizeof( struct ktc_token ) );

	/* we'll need to unlog when this connection is done. */
	ap_register_cleanup( r->pool, (void *)r, token_cleanup, ap_null_cleanup );
    }

cleanup:
    if ( v5credsp )
	krb5_free_cred_contents( kcontext, v5credsp );
    if ( increds.client )
	krb5_free_principal( kcontext, increds.client );
    if ( increds.server )
	krb5_free_principal( kcontext, increds.server );
    if ( kccache )
	krb5_cc_close( kcontext, kccache );
    if ( kcontext )
	krb5_free_context( kcontext );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	        "mod_waklog: finished with waklog_aklog" );

    return;

}

    static int
waklog_child_routine( void *s, child_info *pinfo )
{
    if ( !getuid() ) {
	ap_log_error( APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, s,
		"mod_waklog: waklog_child_routine called as root" );

	/* this was causing the credential file to get owned by root */
	setgid(ap_group_id);
	setuid(ap_user_id);
    }

    while( 1 ) {
	waklog_kinit( s );
	sleep( SLEEP_TIME );
    }

}


    static void
waklog_init( server_rec *s, pool *p )
{
    extern char	*version;
    int pid;

    ap_log_error( APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, s,
	    "mod_waklog: version %s initialized.", version );

    pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
	    NULL, NULL, NULL );

    ap_log_error( APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, s,
	    "mod_waklog: ap_bspawn_child: %d.", pid );
}


    static int
waklog_phase0( request_rec *r )
{
    waklog_host_config  *cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase0 called" );

    /* directory config? */
    cfg = (waklog_host_config *)ap_get_module_config(
            r->per_dir_config, &waklog_module);

    /* server config? */
    if ( !cfg->configured ) {
	cfg = (waklog_host_config *)ap_get_module_config(
	    r->server->module_config, &waklog_module);
    }

    if ( !cfg->protect ) {
	ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	    "mod_waklog: phase0 declining" );
        return( DECLINED );
    }

    /* do this only if we are still unauthenticated */
    if ( !child.token.ticketLen ) {

	/* set our environment variables */
	ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
	ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );

	/* stuff the credentials into the kernel */
	waklog_aklog( r );
    }
    
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase0 returning" );
    return DECLINED;
}


    static int
waklog_phase7( request_rec *r )
{
    waklog_host_config	*cfg;

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase7 called" );

    /* directory config? */
    cfg = (waklog_host_config *)ap_get_module_config(
            r->per_dir_config, &waklog_module);

    /* server config? */
    if ( !cfg->configured ) {
	cfg = (waklog_host_config *)ap_get_module_config(
	    r->server->module_config, &waklog_module);
    }

    if ( !cfg->protect ) {
        return( DECLINED );
    }

    /* stuff the credentials into the kernel */
    waklog_aklog( r );

    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r->server,
	"mod_waklog: phase7 returning" );

    return DECLINED;
}

    static void
waklog_new_connection( conn_rec *c ) {
    ap_log_error( APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, c->server,
	"mod_waklog: new_connection called: pid: %d", getpid() );
    return;
}

module MODULE_VAR_EXPORT waklog_module = {
    STANDARD_MODULE_STUFF, 
    waklog_init,           /* module initializer                  */
    NULL, 		   /* create per-dir    config structures */
    NULL,                  /* merge  per-dir    config structures */
    waklog_create_server_config, /* create per-server config structures */
    NULL,                  /* merge  per-server config structures */
    waklog_cmds,           /* table of config file commands       */
    NULL,                  /* [#8] MIME-typed-dispatched handlers */
    NULL,                  /* [#1] URI to filename translation    */
    NULL,                  /* [#4] validate user id from request  */
    NULL,                  /* [#5] check if the user is ok _here_ */
    NULL,                  /* [#3] check access by host address   */
    NULL,                  /* [#6] determine MIME type            */
    waklog_phase7,         /* [#7] pre-run fixups                 */
    NULL,                  /* [#9] log a transaction              */
    NULL,                  /* [#2] header parser                  */
    waklog_child_init,     /* child_init                          */
    NULL,                  /* child_exit                          */
    waklog_phase0          /* [#0] post read-request              */
#ifdef EAPI
   ,NULL,                  /* EAPI: add_module                    */
    NULL,                  /* EAPI: remove_module                 */
    NULL,                  /* EAPI: rewrite_command               */
    waklog_new_connection  /* EAPI: new_connection                */
#endif
};
Commit	Line	Data
bed98ff9	1	#include "httpd.h"
bed98ff9	2	#include "http_config.h"
7193eb01	3	#include "http_conf_globals.h"
bed98ff9	4	#include "http_log.h"
7193eb01	5	#include "http_protocol.h"
	6	#include "http_request.h"
	7	#include "http_core.h"
bed98ff9	8	#include "ap_config.h"
4e1ae1cd	9	#include <krb5.h>
bed98ff9	10
7193eb01	11	#if defined(sun)
bed98ff9	12	#include <sys/ioccom.h>
7193eb01	13	#endif /* sun */
bed98ff9	14	#include <stropts.h>
bed98ff9	15	#include <afs/venus.h>
7193eb01	16	#include <afs/auth.h>
	17	#include <rx/rxkad.h>
	18
58bbdc54	19	#define KEYTAB "/home/drh/keytab.umweb.drhtest"
58bbdc54	20	#define KEYTAB_PRINCIPAL "umweb/drhtest"
4e1ae1cd	21
58bbdc54	22	#define TKT_LIFE 106060
	23	#define SLEEP_TIME 560 / should be TKT_LIFE */
	24
	25	#define AFS_CELL "umich.edu" /* NB: lower case */
	26
	27	#define K5PATH "FILE:/tmp/waklog.creds.k5"
	28	#define K4PATH "/tmp/waklog.creds.k4"
7193eb01	29
313dde40	30	module waklog_module;
bed98ff9	31
	32	struct ClearToken {
	33	long AuthHandle;
	34	char HandShakeKey[ 8 ];
	35	long ViceId;
	36	long BeginTimestamp;
	37	long EndTimestamp;
	38	};
	39
313dde40	40	typedef struct {
4e1ae1cd	41	int configured;
	42	int protect;
	43	char *keytab;
7193eb01	44	char *keytab_principal;
403921ef	45	char *afs_cell;
313dde40	46	} waklog_host_config;
313dde40	47
7193eb01	48	typedef struct {
	49	struct ktc_token token;
	50	} waklog_child_config;
58bbdc54	51	waklog_child_config child;
58bbdc54	52
e21f34f0	53
313dde40	54	static void *
	55	waklog_create_server_config( pool p, server_rec s )
	56	{
	57	waklog_host_config *cfg;
	58
	59	cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
	60	cfg->configured = 0;
	61	cfg->protect = 0;
58bbdc54	62	cfg->keytab = KEYTAB;
	63	cfg->keytab_principal = KEYTAB_PRINCIPAL;
	64	cfg->afs_cell = AFS_CELL;
313dde40	65
	66	return( cfg );
	67	}
	68
	69
313dde40	70	static const char *
	71	set_waklog_protect( cmd_parms params, void mconfig, int flag )
	72	{
	73	waklog_host_config *cfg;
	74
	75	if ( params->path == NULL ) {
	76	cfg = (waklog_host_config *) ap_get_module_config(
	77	params->server->module_config, &waklog_module );
	78	} else {
	79	cfg = (waklog_host_config *)mconfig;
	80	}
	81
	82	cfg->protect = flag;
	83	cfg->configured = 1;
	84	return( NULL );
	85	}
	86
	87
4e1ae1cd	88	static const char *
	89	set_waklog_use_keytab( cmd_parms params, void mconfig, char *file )
	90	{
	91	waklog_host_config *cfg;
	92
	93	if ( params->path == NULL ) {
	94	cfg = (waklog_host_config *) ap_get_module_config(
	95	params->server->module_config, &waklog_module );
	96	} else {
	97	cfg = (waklog_host_config *)mconfig;
	98	}
	99
3ed1e28a	100	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, params->server,
	101	"mod_waklog: using keytab: %s", file );
	102
4e1ae1cd	103	cfg->keytab = file;
	104	cfg->configured = 1;
	105	return( NULL );
	106	}
	107
	108
58bbdc54	109	static const char *
58bbdc54	110	set_waklog_use_keytab_principal( cmd_parms params, void mconfig, char *file )
b74fad73	111	{
58bbdc54	112	waklog_host_config *cfg;
7193eb01	113
58bbdc54	114	if ( params->path == NULL ) {
	115	cfg = (waklog_host_config *) ap_get_module_config(
	116	params->server->module_config, &waklog_module );
	117	} else {
	118	cfg = (waklog_host_config *)mconfig;
7193eb01	119	}
7193eb01	120
58bbdc54	121	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, params->server,
	122	"mod_waklog: using keytab_principal: %s", file );
	123
	124	cfg->keytab_principal = file;
	125	cfg->configured = 1;
	126	return( NULL );
	127	}
	128
	129
	130	static const char *
	131	set_waklog_use_afs_cell( cmd_parms params, void mconfig, char *file )
	132	{
	133	waklog_host_config *cfg;
	134
	135	if ( params->path == NULL ) {
	136	cfg = (waklog_host_config *) ap_get_module_config(
	137	params->server->module_config, &waklog_module );
	138	} else {
	139	cfg = (waklog_host_config *)mconfig;
	140	}
	141
	142	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, params->server,
	143	"mod_waklog: using afs_cell: %s", file );
	144
	145	cfg->afs_cell = file;
	146	cfg->configured = 1;
	147	return( NULL );
	148	}
	149
	150
	151	static void
	152	waklog_child_init( server_rec s, pool p )
	153	{
	154
	155	memset( &child.token, 0, sizeof( struct ktc_token ) );
7193eb01	156
b74fad73	157	setpag();
7193eb01	158
b74fad73	159	return;
	160	}
	161
	162
313dde40	163	command_rec waklog_cmds[ ] =
	164	{
	165	{ "WaklogProtected", set_waklog_protect,
	166	NULL, RSRC_CONF \| ACCESS_CONF, FLAG,
	167	"enable waklog on a location or directory basis" },
	168
58bbdc54	169	{ "WaklogUseKeytabPath", set_waklog_use_keytab,
	170	NULL, RSRC_CONF, TAKE1,
	171	"Use the supplied keytab rather than the default" },
	172
	173	{ "WaklogUseKeytabPrincipal", set_waklog_use_keytab_principal,
	174	NULL, RSRC_CONF, TAKE1,
	175	"Use the supplied keytab principal rather than the default" },
	176
	177	{ "WaklogUseAFSCell", set_waklog_use_afs_cell,
4e1ae1cd	178	NULL, RSRC_CONF, TAKE1,
58bbdc54	179	"Use the supplied AFS cell rather than the default" },
4e1ae1cd	180
313dde40	181	{ NULL }
	182	};
	183
	184
bed98ff9	185	static void
e2df6441	186	token_cleanup( void *data )
bed98ff9	187	{
bed98ff9	188	request_rec r = (request_rec )data;
bed98ff9	189
58bbdc54	190	if ( child.token.ticketLen ) {
58bbdc54	191	memset( &child.token, 0, sizeof( struct ktc_token ) );
bed98ff9	192
7193eb01	193	ktc_ForgetAllTokens();
bed98ff9	194
7193eb01	195	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
58bbdc54	196	"mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d", getpid() );
7193eb01	197	}
b74fad73	198	return;
bed98ff9	199	}
	200
	201
4e1ae1cd	202	static int
e2df6441	203	waklog_kinit( server_rec *s )
4e1ae1cd	204	{
4e1ae1cd	205	krb5_error_code kerror;
e2df6441	206	krb5_context kcontext = NULL;
e2df6441	207	krb5_principal kprinc = NULL;
4e1ae1cd	208	krb5_get_init_creds_opt kopts;
7193eb01	209	krb5_creds v5creds;
e2df6441	210	krb5_ccache kccache = NULL;
e2df6441	211	krb5_keytab keytab = NULL;
4e1ae1cd	212	char ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
e21f34f0	213	waklog_host_config *cfg;
4e1ae1cd	214
e21f34f0	215	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	216	"mod_waklog: waklog_kinit called" );
4e1ae1cd	217
58bbdc54	218	cfg = (waklog_host_config *) ap_get_module_config( s->module_config,
	219	&waklog_module );
	220
e21f34f0	221	if (( kerror = krb5_init_context( &kcontext ))) {
	222	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	223	(char *)error_message( kerror ));
4e1ae1cd	224
e2df6441	225	goto cleanup;
e21f34f0	226	}
4e1ae1cd	227
e21f34f0	228	/* use the path */
	229	if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
	230	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	231	(char *)error_message( kerror ));
4e1ae1cd	232
e2df6441	233	goto cleanup;
e21f34f0	234	}
4e1ae1cd	235
58bbdc54	236	if (( kerror = krb5_parse_name( kcontext, cfg->keytab_principal, &kprinc ))) {
e21f34f0	237	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	238	(char *)error_message( kerror ));
7193eb01	239
e2df6441	240	goto cleanup;
e21f34f0	241	}
7193eb01	242
e21f34f0	243	krb5_get_init_creds_opt_init( &kopts );
58bbdc54	244	krb5_get_init_creds_opt_set_tkt_life( &kopts, TKT_LIFE );
e21f34f0	245	krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
	246	krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
	247	krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );
7193eb01	248
58bbdc54	249	/* keytab from config */
58bbdc54	250	strncpy( ktbuf, cfg->keytab, sizeof( ktbuf ) - 1 );
7193eb01	251
e21f34f0	252	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	253	"mod_waklog: waklog_kinit using: %s", ktbuf );
7193eb01	254
e21f34f0	255	if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
	256	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	257	(char *)error_message( kerror ));
7193eb01	258
e2df6441	259	goto cleanup;
e21f34f0	260	}
7193eb01	261
e21f34f0	262	/* get the krbtgt */
e21f34f0	263	if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds,
403921ef	264	kprinc, keytab, 0, NULL, &kopts ))) {
7193eb01	265
e21f34f0	266	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	267	(char *)error_message( kerror ));
7193eb01	268
e2df6441	269	goto cleanup;
e21f34f0	270	}
7193eb01	271
e21f34f0	272	if (( kerror = krb5_verify_init_creds( kcontext, &v5creds,
e21f34f0	273	kprinc, keytab, NULL, NULL )) != 0 ) {
7193eb01	274
e21f34f0	275	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	276	(char *)error_message( kerror ));
7193eb01	277
e2df6441	278	goto cleanup;
e21f34f0	279	}
7193eb01	280
e21f34f0	281	if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
	282	ap_log_error( APLOG_MARK, APLOG_ERR, s,
	283	(char *)error_message( kerror ));
7193eb01	284
e2df6441	285	goto cleanup;
e21f34f0	286	}
7193eb01	287
e2df6441	288	kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds );
	289	krb5_free_cred_contents( kcontext, &v5creds );
	290	if ( kerror != 0 ) {
e21f34f0	291	ap_log_error( APLOG_MARK, APLOG_ERR, s,
e21f34f0	292	(char *)error_message( kerror ));
7193eb01	293
e2df6441	294	goto cleanup;
e21f34f0	295	}
7193eb01	296
e21f34f0	297	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	298	"mod_waklog: waklog_kinit success" );
	299
	300	cleanup:
	301	if ( keytab )
	302	(void)krb5_kt_close( kcontext, keytab );
	303	if ( kprinc )
	304	krb5_free_principal( kcontext, kprinc );
	305	if ( kccache )
	306	krb5_cc_close( kcontext, kccache );
	307	if ( kcontext )
	308	krb5_free_context( kcontext );
e21f34f0	309
e21f34f0	310	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, s,
e2df6441	311	"mod_waklog: waklog_kinit: exiting" );
7193eb01	312
	313	return( 0 );
	314	}
	315
	316
	317	static void
	318	waklog_aklog( request_rec *r )
	319	{
	320	int rc;
58bbdc54	321	char buf[ 2048 ];
7193eb01	322	const char *k4path = NULL;
	323	const char *k5path = NULL;
	324	krb5_error_code kerror;
e2df6441	325	krb5_context kcontext = NULL;
7193eb01	326	krb5_creds increds;
7193eb01	327	krb5_creds *v5credsp = NULL;
e2df6441	328	krb5_ccache kccache = NULL;
403921ef	329	struct ktc_principal server = { "afs", "", "" };
7193eb01	330	struct ktc_principal client;
7193eb01	331	struct ktc_token token;
403921ef	332	waklog_host_config *cfg;
58bbdc54	333	int buflen;
7193eb01	334
	335	k5path = ap_table_get( r->subprocess_env, "KRB5CCNAME" );
	336	k4path = ap_table_get( r->subprocess_env, "KRBTKFILE" );
	337
	338	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	339	"mod_waklog: waklog_aklog called: k5path: %s, k4path: %s", k5path, k4path );
	340
	341	if ( !k5path \|\| !k4path ) {
	342	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	343	"mod_waklog: waklog_aklog giving up" );
e2df6441	344	goto cleanup;
4e1ae1cd	345	}
4e1ae1cd	346
7193eb01	347	/*
	348	** Get/build creds from file/tgs, then see if we need to SetToken
	349	*/
	350
	351	if (( kerror = krb5_init_context( &kcontext ))) {
	352	/* Authentication Required ( kerberos error ) */
4e1ae1cd	353	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
4e1ae1cd	354	(char *)error_message( kerror ));
7193eb01	355
e2df6441	356	goto cleanup;
4e1ae1cd	357	}
4e1ae1cd	358
7193eb01	359	memset( (char *)&increds, 0, sizeof(increds));
4e1ae1cd	360
403921ef	361	cfg = (waklog_host_config *) ap_get_module_config(
	362	r->server->module_config, &waklog_module );
	363
	364	/* afs/<cell> or afs */
	365	strncpy( buf, "afs", sizeof( buf ) - 1 );
58bbdc54	366	if ( strcmp( cfg->afs_cell, AFS_CELL ) ) {
403921ef	367	strncat( buf, "/" , sizeof( buf ) - strlen( buf ) - 1 );
	368	strncat( buf, cfg->afs_cell, sizeof( buf ) - strlen( buf ) - 1 );
	369	}
	370
7193eb01	371	/* set server part */
403921ef	372	if (( kerror = krb5_parse_name( kcontext, buf, &increds.server ))) {
4e1ae1cd	373	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	374	(char *)error_message( kerror ));
	375
e2df6441	376	goto cleanup;
4e1ae1cd	377	}
4e1ae1cd	378
7193eb01	379	if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
	380	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
	381	(char *)error_message( kerror ));
	382
e2df6441	383	goto cleanup;
7193eb01	384	}
4e1ae1cd	385
7193eb01	386	/* set client part */
7193eb01	387	krb5_cc_get_principal( kcontext, kccache, &increds.client );
4e1ae1cd	388
7193eb01	389	increds.times.endtime = 0;
	390	/* Ask for DES since that is what V4 understands */
	391	increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
	392
	393	/* get the V5 credentials */
	394	if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
	395	&increds, &v5credsp ) ) ) {
403921ef	396	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
403921ef	397	"mod_waklog: krb5_get_credentials: %s", error_message( kerror ));
e2df6441	398	goto cleanup;
4e1ae1cd	399	}
4e1ae1cd	400
58bbdc54	401	/* don't overflor */
58bbdc54	402	if ( v5credsp->ticket.length >= 344 ) { /* from krb524d.c */
403921ef	403	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
58bbdc54	404	"mod_waklog: ticket size (%d) to big to fake", v5credsp->ticket.length );
e2df6441	405	goto cleanup;
4e1ae1cd	406	}
4e1ae1cd	407
7193eb01	408	/* assemble the token */
58bbdc54	409	memset( &token, 0, sizeof( struct ktc_token ) );
	410
	411	token.startTime = v5credsp->times.starttime ? v5credsp->times.starttime : v5credsp->times.authtime;
7193eb01	412	token.endTime = v5credsp->times.endtime;
58bbdc54	413	memmove( &token.sessionKey, v5credsp->keyblock.contents, v5credsp->keyblock.length );
	414	token.kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
	415	token.ticketLen = v5credsp->ticket.length;
	416	memmove( token.ticket, v5credsp->ticket.data, token.ticketLen );
7193eb01	417
58bbdc54	418	/* make sure we have to do this */
	419	if ( child.token.kvno != token.kvno \|\|
	420	child.token.ticketLen != token.ticketLen \|\|
	421	(memcmp( &child.token.sessionKey, &token.sessionKey,
	422	sizeof( token.sessionKey ) )) \|\|
	423	(memcmp( child.token.ticket, token.ticket, token.ticketLen )) ) {
	424
8258901d	425	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
8258901d	426	"mod_waklog: client: %s", buf );
7193eb01	427
7193eb01	428	/* build the name */
58bbdc54	429	memmove( buf, v5credsp->client->data[0].data, v5credsp->client->data[0].length );
	430	buf[ v5credsp->client->data[0].length ] = '\0';
	431	if ( v5credsp->client->length > 1 ) {
8258901d	432	strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
58bbdc54	433	buflen = strlen( buf );
	434	memmove( buf + buflen, v5credsp->client->data[1].data, v5credsp->client->data[1].length );
	435	buf[ buflen + v5credsp->client->data[1].length ] = '\0';
7193eb01	436	}
	437
	438	/* assemble the client */
403921ef	439	strncpy( client.name, buf, sizeof( client.name ) - 1 );
403921ef	440	strncpy( client.instance, "", sizeof( client.instance) - 1 );
58bbdc54	441	memmove( buf, v5credsp->client->realm.data, v5credsp->client->realm.length );
	442	buf[ v5credsp->client->realm.length ] = '\0';
	443	strncpy( client.cell, buf, sizeof( client.cell ) - 1 );
403921ef	444
58bbdc54	445	/* assemble the server's cell */
403921ef	446	strncpy( server.cell, cfg->afs_cell , sizeof( server.cell ) - 1 );
7193eb01	447
	448	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	449	"mod_waklog: server: name=%s, instance=%s, cell=%s",
	450	server.name, server.instance, server.cell );
	451
	452	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	453	"mod_waklog: client: name=%s, instance=%s, cell=%s",
	454	client.name, client.instance, client.cell );
	455
	456	/* use the path */
	457	krb_set_tkt_string( (char *)k4path );
	458
	459	/* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
	460	write( 2, "", 0 );
	461
	462	if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
58bbdc54	463	ap_log_error( APLOG_MARK, APLOG_ERR, r->server,
7193eb01	464	"mod_waklog: settoken returned %d", rc );
58bbdc54	465	goto cleanup;
7193eb01	466	}
	467
	468	/* save this */
58bbdc54	469	memmove( &child.token, &token, sizeof( struct ktc_token ) );
7193eb01	470
7193eb01	471	/* we'll need to unlog when this connection is done. */
e2df6441	472	ap_register_cleanup( r->pool, (void *)r, token_cleanup, ap_null_cleanup );
7193eb01	473	}
7193eb01	474
e2df6441	475	cleanup:
	476	if ( v5credsp )
	477	krb5_free_cred_contents( kcontext, v5credsp );
	478	if ( increds.client )
	479	krb5_free_principal( kcontext, increds.client );
	480	if ( increds.server )
	481	krb5_free_principal( kcontext, increds.server );
	482	if ( kccache )
	483	krb5_cc_close( kcontext, kccache );
	484	if ( kcontext )
	485	krb5_free_context( kcontext );
3ed1e28a	486
7193eb01	487	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	488	"mod_waklog: finished with waklog_aklog" );
	489
e2df6441	490	return;
e2df6441	491
4e1ae1cd	492	}
4e1ae1cd	493
e21f34f0	494	static int
	495	waklog_child_routine( void s, child_info pinfo )
	496	{
e21f34f0	497	if ( !getuid() ) {
132ef613	498	ap_log_error( APLOG_MARK, APLOG_ERR\|APLOG_NOERRNO, s,
e21f34f0	499	"mod_waklog: waklog_child_routine called as root" );
	500
	501	/* this was causing the credential file to get owned by root */
	502	setgid(ap_group_id);
	503	setuid(ap_user_id);
	504	}
	505
	506	while( 1 ) {
e2df6441	507	waklog_kinit( s );
58bbdc54	508	sleep( SLEEP_TIME );
e21f34f0	509	}
	510
	511	}
	512
	513
	514	static void
	515	waklog_init( server_rec s, pool p )
	516	{
	517	extern char *version;
	518	int pid;
	519
	520	ap_log_error( APLOG_MARK, APLOG_INFO\|APLOG_NOERRNO, s,
	521	"mod_waklog: version %s initialized.", version );
	522
	523	pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
	524	NULL, NULL, NULL );
	525
132ef613	526	ap_log_error( APLOG_MARK, APLOG_ERR\|APLOG_NOERRNO, s,
e21f34f0	527	"mod_waklog: ap_bspawn_child: %d.", pid );
	528	}
	529
4e1ae1cd	530
bed98ff9	531	static int
7193eb01	532	waklog_phase0( request_rec *r )
bed98ff9	533	{
313dde40	534	waklog_host_config *cfg;
313dde40	535
7193eb01	536	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	537	"mod_waklog: phase0 called" );
	538
313dde40	539	/* directory config? */
	540	cfg = (waklog_host_config *)ap_get_module_config(
	541	r->per_dir_config, &waklog_module);
bed98ff9	542
313dde40	543	/* server config? */
313dde40	544	if ( !cfg->configured ) {
7193eb01	545	cfg = (waklog_host_config *)ap_get_module_config(
7193eb01	546	r->server->module_config, &waklog_module);
313dde40	547	}
313dde40	548
7193eb01	549	if ( !cfg->protect ) {
4e1ae1cd	550	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	551	"mod_waklog: phase0 declining" );
	552	return( DECLINED );
	553	}
4e1ae1cd	554
7193eb01	555	/* do this only if we are still unauthenticated */
58bbdc54	556	if ( !child.token.ticketLen ) {
4e1ae1cd	557
e21f34f0	558	/* set our environment variables */
	559	ap_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
	560	ap_table_set( r->subprocess_env, "KRBTKFILE", K4PATH );
3ed1e28a	561
7193eb01	562	/* stuff the credentials into the kernel */
7193eb01	563	waklog_aklog( r );
4e1ae1cd	564	}
7193eb01	565
	566	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
	567	"mod_waklog: phase0 returning" );
	568	return DECLINED;
	569	}
4e1ae1cd	570
1e18ef7d	571
7193eb01	572	static int
	573	waklog_phase7( request_rec *r )
	574	{
	575	waklog_host_config *cfg;
1e18ef7d	576
7193eb01	577	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	578	"mod_waklog: phase7 called" );
1e18ef7d	579
7193eb01	580	/* directory config? */
	581	cfg = (waklog_host_config *)ap_get_module_config(
	582	r->per_dir_config, &waklog_module);
1e18ef7d	583
7193eb01	584	/* server config? */
	585	if ( !cfg->configured ) {
	586	cfg = (waklog_host_config *)ap_get_module_config(
	587	r->server->module_config, &waklog_module);
bed98ff9	588	}
bed98ff9	589
7193eb01	590	if ( !cfg->protect ) {
7193eb01	591	return( DECLINED );
bed98ff9	592	}
bed98ff9	593
7193eb01	594	/* stuff the credentials into the kernel */
7193eb01	595	waklog_aklog( r );
bed98ff9	596
7193eb01	597	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, r->server,
7193eb01	598	"mod_waklog: phase7 returning" );
bed98ff9	599
7193eb01	600	return DECLINED;
bed98ff9	601	}
bed98ff9	602
7193eb01	603	static void
	604	waklog_new_connection( conn_rec *c ) {
	605	ap_log_error( APLOG_MARK, APLOG_NOERRNO\|APLOG_ERR, c->server,
58bbdc54	606	"mod_waklog: new_connection called: pid: %d", getpid() );
7193eb01	607	return;
7193eb01	608	}
bed98ff9	609
313dde40	610	module MODULE_VAR_EXPORT waklog_module = {
bed98ff9	611	STANDARD_MODULE_STUFF,
003832b1	612	waklog_init, /* module initializer */
003832b1	613	NULL, /* create per-dir config structures */
bed98ff9	614	NULL, /* merge per-dir config structures */
313dde40	615	waklog_create_server_config, /* create per-server config structures */
bed98ff9	616	NULL, /* merge per-server config structures */
313dde40	617	waklog_cmds, /* table of config file commands */
bed98ff9	618	NULL, /* [#8] MIME-typed-dispatched handlers */
	619	NULL, /* [#1] URI to filename translation */
	620	NULL, /* [#4] validate user id from request */
	621	NULL, /* [#5] check if the user is ok _here_ */
	622	NULL, /* [#3] check access by host address */
	623	NULL, /* [#6] determine MIME type */
7193eb01	624	waklog_phase7, /* [#7] pre-run fixups */
bed98ff9	625	NULL, /* [#9] log a transaction */
313dde40	626	NULL, /* [#2] header parser */
313dde40	627	waklog_child_init, /* child_init */
bed98ff9	628	NULL, /* child_exit */
7193eb01	629	waklog_phase0 /* [#0] post read-request */
bed98ff9	630	#ifdef EAPI
	631	,NULL, /* EAPI: add_module */
	632	NULL, /* EAPI: remove_module */
	633	NULL, /* EAPI: rewrite_command */
7193eb01	634	waklog_new_connection /* EAPI: new_connection */
bed98ff9	635	#endif
bed98ff9	636	};