Changes for compatibility with Apache 2.
[hcoop/zz_old/modwaklog.git] / mod_waklog.c
CommitLineData
87822447 1#define _LARGEFILE64_SOURCE
2
bed98ff9 3#include "httpd.h"
4#include "http_config.h"
bed98ff9 5#include "http_log.h"
7193eb01 6#include "http_protocol.h"
7#include "http_request.h"
8#include "http_core.h"
87822447 9
10#ifdef STANDARD20_MODULE_STUFF
11#include <apr_strings.h>
12#include <apr_base64.h>
13#include <apr_compat.h>
14#include <apu_compat.h>
15
16module AP_MODULE_DECLARE_DATA waklog_module;
17
18#define MK_POOL apr_pool_t
19#define MK_TABLE_GET apr_table_get
20#include "unixd.h"
21extern unixd_config_rec unixd_config;
22#define ap_user_id unixd_config.user_id
23#define ap_group_id unixd_config.group_id
24#define ap_user_name unixd_config.user_name
25#define command(name, func, var, type, usage) \
26 AP_INIT_ ## type (name, (void*) func, \
27 (void*)APR_OFFSETOF(waklog_config, var), \
28 OR_AUTHCFG | RSRC_CONF, usage)
29typedef struct {
30 int dummy;
31} child_info;
32
33const char *userdata_key = "waklog_init";
34#else
bed98ff9 35#include "ap_config.h"
87822447 36
37module waklog_module;
38#define MK_POOL pool
39#define MK_TABLE_GET ap_table_get
40#define command(name, func, var, type, usage) \
41 { name, func, \
42 (void*)XtOffsetOf(waklog_config, var), \
43 OR_AUTHCFG | RSRC_CONF, type, usage }
44#endif /* STANDARD20_MODULE_STUFF */
45
46#define getModConfig(P, X) P = (waklog_host_config *) ap_get_module_config( (X)->module_config, &waklog_module );
47
4e1ae1cd 48#include <krb5.h>
bed98ff9 49
7193eb01 50#if defined(sun)
bed98ff9 51#include <sys/ioccom.h>
7193eb01 52#endif /* sun */
bed98ff9 53#include <stropts.h>
bed98ff9 54#include <afs/venus.h>
7193eb01 55#include <afs/auth.h>
56#include <rx/rxkad.h>
57
87822447 58#define KEYTAB "/etc/keytab.wwwserver"
59#define KEYTAB_PRINCIPAL "someplacewwwserver"
60#define AFS_CELL "someplace.edu"
4e1ae1cd 61
58bbdc54 62#define TKT_LIFE 10*60*60
b52ccbb1 63#define SLEEP_TIME TKT_LIFE - 5*60
87822447 64/* If there's an error, retry more aggressively */
65#define ERR_SLEEP_TIME 5*60
58bbdc54 66
58bbdc54 67
68#define K5PATH "FILE:/tmp/waklog.creds.k5"
7193eb01 69
313dde40 70typedef struct {
87822447 71 int forked;
4e1ae1cd 72 int configured;
73 int protect;
74 char *keytab;
7193eb01 75 char *keytab_principal;
403921ef 76 char *afs_cell;
87822447 77 MK_POOL *p;
313dde40 78} waklog_host_config;
79
7193eb01 80typedef struct {
81 struct ktc_token token;
82} waklog_child_config;
58bbdc54 83waklog_child_config child;
84
87822447 85static void
86log_error(const char *file, int line, int level, int status,
87 const server_rec *s, const char *fmt, ...)
4d47a8d9 88{
87822447 89 char errstr[1024];
90 va_list ap;
4d47a8d9 91
87822447 92 va_start(ap, fmt);
93 vsnprintf(errstr, sizeof(errstr), fmt, ap);
94 va_end(ap);
4d47a8d9 95
87822447 96#ifdef STANDARD20_MODULE_STUFF
97 ap_log_error(file, line, level | APLOG_NOERRNO, status, s, "%s", errstr);
98#else
99 ap_log_error(file, line, level | APLOG_NOERRNO, s, "%s", errstr);
100#endif
4d47a8d9 101
87822447 102}
4d47a8d9 103
313dde40 104 static void *
87822447 105waklog_create_server_config( MK_POOL *p, server_rec *s )
313dde40 106{
107 waklog_host_config *cfg;
108
109 cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
87822447 110 cfg->p = p;
111 cfg->forked = 0;
313dde40 112 cfg->configured = 0;
113 cfg->protect = 0;
58bbdc54 114 cfg->keytab = KEYTAB;
115 cfg->keytab_principal = KEYTAB_PRINCIPAL;
116 cfg->afs_cell = AFS_CELL;
313dde40 117
87822447 118 log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: server config created." );
119
313dde40 120 return( cfg );
121}
122
123
313dde40 124 static const char *
125set_waklog_protect( cmd_parms *params, void *mconfig, int flag )
126{
127 waklog_host_config *cfg;
128
87822447 129 getModConfig(cfg, params->server );
313dde40 130
131 cfg->protect = flag;
132 cfg->configured = 1;
87822447 133 log_error( APLOG_MARK, APLOG_DEBUG, 0, params->server, "mod_waklog: waklog_protect set" );
313dde40 134 return( NULL );
135}
136
137
4e1ae1cd 138 static const char *
161ffd84 139set_waklog_keytab( cmd_parms *params, void *mconfig, char *file )
4e1ae1cd 140{
141 waklog_host_config *cfg;
142
87822447 143 getModConfig(cfg, params->server );
4e1ae1cd 144
87822447 145 log_error( APLOG_MARK, APLOG_INFO, 0, params->server,
146 "mod_waklog: will use keytab: %s", file );
3ed1e28a 147
b52ccbb1 148 cfg->keytab = ap_pstrdup ( params->pool, file );
4e1ae1cd 149 cfg->configured = 1;
150 return( NULL );
151}
152
153
58bbdc54 154 static const char *
155set_waklog_use_keytab_principal( cmd_parms *params, void *mconfig, char *file )
b74fad73 156{
58bbdc54 157 waklog_host_config *cfg;
7193eb01 158
87822447 159 getModConfig(cfg, params->server );
7193eb01 160
87822447 161 log_error( APLOG_MARK, APLOG_INFO, 0, params->server,
162 "mod_waklog: will use keytab_principal: %s", file );
58bbdc54 163
b52ccbb1 164 cfg->keytab_principal = ap_pstrdup ( params->pool, file );
58bbdc54 165 cfg->configured = 1;
166 return( NULL );
167}
168
169
170 static const char *
171set_waklog_use_afs_cell( cmd_parms *params, void *mconfig, char *file )
172{
173 waklog_host_config *cfg;
174
87822447 175 getModConfig(cfg, params->server );
58bbdc54 176
87822447 177 log_error( APLOG_MARK, APLOG_INFO, 0, params->server,
178 "mod_waklog: will use afs_cell: %s", file );
58bbdc54 179
b52ccbb1 180 cfg->afs_cell = ap_pstrdup( params->pool, file );
58bbdc54 181 cfg->configured = 1;
182 return( NULL );
183}
184
185
186 static void
87822447 187#ifdef STANDARD20_MODULE_STUFF
188waklog_child_init(MK_POOL *p, server_rec *s)
189#else
190waklog_child_init(server_rec *s, MK_POOL *p)
191#endif
58bbdc54 192{
193
87822447 194 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
195 "mod_waklog: child_init called" );
196
58bbdc54 197 memset( &child.token, 0, sizeof( struct ktc_token ) );
7193eb01 198
b74fad73 199 setpag();
7193eb01 200
87822447 201 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
202 "mod_waklog: child_init returned" );
203
b74fad73 204 return;
205}
206
87822447 207typedef struct {
208 int wak_protect;
209 char *wak_keytab;
210 char *wak_ktprinc;
211 char *wak_afscell;
212} waklog_config;
b74fad73 213
313dde40 214command_rec waklog_cmds[ ] =
215{
87822447 216 command("WaklogProtected", set_waklog_protect, wak_protect, FLAG, "enable waklog on a location or directory basis"),
313dde40 217
87822447 218 command("WaklogKeytab", set_waklog_keytab, wak_keytab, TAKE1, "Use the supplied keytab rather than the default"),
58bbdc54 219
87822447 220 command("WaklogUseKeytabPrincipal", set_waklog_use_keytab_principal, wak_ktprinc, TAKE1, "Use the supplied keytab principal rather than the default"),
58bbdc54 221
87822447 222 command("WaklogUseAFSCell", set_waklog_use_afs_cell, wak_afscell, TAKE1, "Use the supplied AFS cell rather than the default"),
4e1ae1cd 223
313dde40 224 { NULL }
225};
226
227
87822447 228 static int
e2df6441 229token_cleanup( void *data )
bed98ff9 230{
231 request_rec *r = (request_rec *)data;
bed98ff9 232
58bbdc54 233 if ( child.token.ticketLen ) {
234 memset( &child.token, 0, sizeof( struct ktc_token ) );
bed98ff9 235
7193eb01 236 ktc_ForgetAllTokens();
bed98ff9 237
87822447 238 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
239 "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d", getpid() );
7193eb01 240 }
87822447 241 return 0;
bed98ff9 242}
243
244
4e1ae1cd 245 static int
e2df6441 246waklog_kinit( server_rec *s )
4e1ae1cd 247{
87822447 248 krb5_error_code kerror = 0;
e2df6441 249 krb5_context kcontext = NULL;
250 krb5_principal kprinc = NULL;
4e1ae1cd 251 krb5_get_init_creds_opt kopts;
7193eb01 252 krb5_creds v5creds;
e2df6441 253 krb5_ccache kccache = NULL;
254 krb5_keytab keytab = NULL;
4e1ae1cd 255 char ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
b52ccbb1 256 int i;
87822447 257 waklog_host_config *cfg;
4e1ae1cd 258
87822447 259 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
260 "mod_waklog: waklog_kinit called: pid: %d", getpid() );
4e1ae1cd 261
87822447 262 getModConfig(cfg, s);
58bbdc54 263
e21f34f0 264 if (( kerror = krb5_init_context( &kcontext ))) {
87822447 265 log_error( APLOG_MARK, APLOG_ERR, 0, s,
266 "mod_waklog: %s", (char *)error_message( kerror ));
4e1ae1cd 267
e2df6441 268 goto cleanup;
e21f34f0 269 }
4e1ae1cd 270
e21f34f0 271 /* use the path */
272 if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
87822447 273 log_error( APLOG_MARK, APLOG_ERR, 0, s,
274 "mod_waklog: %s", (char *)error_message( kerror ));
4e1ae1cd 275
e2df6441 276 goto cleanup;
e21f34f0 277 }
4e1ae1cd 278
87822447 279 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
280 "mod_waklog: keytab_principal: %s", cfg->keytab_principal );
b52ccbb1 281
282 if (( kerror = krb5_parse_name( kcontext, cfg->keytab_principal, &kprinc ))) {
87822447 283 log_error( APLOG_MARK, APLOG_ERR, 0, s,
284 "mod_waklog: %s", (char *)error_message( kerror ));
7193eb01 285
e2df6441 286 goto cleanup;
e21f34f0 287 }
7193eb01 288
e21f34f0 289 krb5_get_init_creds_opt_init( &kopts );
58bbdc54 290 krb5_get_init_creds_opt_set_tkt_life( &kopts, TKT_LIFE );
e21f34f0 291 krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
292 krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
293 krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );
7193eb01 294
58bbdc54 295 /* keytab from config */
296 strncpy( ktbuf, cfg->keytab, sizeof( ktbuf ) - 1 );
7193eb01 297
87822447 298 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
299 "mod_waklog: waklog_kinit using: %s", ktbuf );
7193eb01 300
e21f34f0 301 if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
87822447 302 log_error( APLOG_MARK, APLOG_ERR, 0, s,
303 "mod_waklog:krb5_kt_resolve %s", (char *)error_message( kerror ));
7193eb01 304
e2df6441 305 goto cleanup;
e21f34f0 306 }
7193eb01 307
b52ccbb1 308 memset( (char *)&v5creds, 0, sizeof(v5creds));
309
e21f34f0 310 /* get the krbtgt */
311 if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds,
403921ef 312 kprinc, keytab, 0, NULL, &kopts ))) {
7193eb01 313
87822447 314 log_error( APLOG_MARK, APLOG_ERR, 0, s,
315 "mod_waklog:krb5_get_init_creds_keytab %s", (char *)error_message( kerror ));
7193eb01 316
e2df6441 317 goto cleanup;
e21f34f0 318 }
7193eb01 319
e21f34f0 320 if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
87822447 321 log_error( APLOG_MARK, APLOG_ERR, 0, s,
322 "mod_waklog:krb5_cc_initialize %s", (char *)error_message( kerror ));
7193eb01 323
e2df6441 324 goto cleanup;
e21f34f0 325 }
7193eb01 326
e2df6441 327 kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds );
328 krb5_free_cred_contents( kcontext, &v5creds );
329 if ( kerror != 0 ) {
87822447 330 log_error( APLOG_MARK, APLOG_ERR, 0, s,
331 "mod_waklog: %s", (char *)error_message( kerror ));
7193eb01 332
e2df6441 333 goto cleanup;
e21f34f0 334 }
7193eb01 335
87822447 336 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
337 "mod_waklog: waklog_kinit success" );
e2df6441 338
339cleanup:
340 if ( keytab )
341 (void)krb5_kt_close( kcontext, keytab );
342 if ( kprinc )
343 krb5_free_principal( kcontext, kprinc );
344 if ( kccache )
345 krb5_cc_close( kcontext, kccache );
346 if ( kcontext )
347 krb5_free_context( kcontext );
e21f34f0 348
87822447 349 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
350 "mod_waklog: waklog_kinit: exiting" );
7193eb01 351
87822447 352 return( kerror );
7193eb01 353}
354
355
356 static void
357waklog_aklog( request_rec *r )
358{
359 int rc;
bd173fe7 360 char buf[ MAXKTCTICKETLEN ];
7193eb01 361 const char *k5path = NULL;
362 krb5_error_code kerror;
e2df6441 363 krb5_context kcontext = NULL;
7193eb01 364 krb5_creds increds;
365 krb5_creds *v5credsp = NULL;
e2df6441 366 krb5_ccache kccache = NULL;
403921ef 367 struct ktc_principal server = { "afs", "", "" };
7193eb01 368 struct ktc_principal client;
369 struct ktc_token token;
403921ef 370 waklog_host_config *cfg;
58bbdc54 371 int buflen;
7193eb01 372
87822447 373 k5path = MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" );
7193eb01 374
87822447 375 log_error( APLOG_MARK, APLOG_INFO, 0, r->server,
376 "mod_waklog: waklog_aklog called: k5path: %s", k5path );
7193eb01 377
161ffd84 378 if ( k5path == NULL ) {
87822447 379 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
380 "mod_waklog: waklog_aklog giving up" );
e2df6441 381 goto cleanup;
4e1ae1cd 382 }
383
7193eb01 384 /*
385 ** Get/build creds from file/tgs, then see if we need to SetToken
386 */
387
388 if (( kerror = krb5_init_context( &kcontext ))) {
389 /* Authentication Required ( kerberos error ) */
87822447 390 log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
391 (char *)error_message( kerror ));
392
e2df6441 393 goto cleanup;
4e1ae1cd 394 }
395
7193eb01 396 memset( (char *)&increds, 0, sizeof(increds));
4e1ae1cd 397
87822447 398 getModConfig(cfg, r->server );
403921ef 399
400 /* afs/<cell> or afs */
401 strncpy( buf, "afs", sizeof( buf ) - 1 );
58bbdc54 402 if ( strcmp( cfg->afs_cell, AFS_CELL ) ) {
403921ef 403 strncat( buf, "/" , sizeof( buf ) - strlen( buf ) - 1 );
404 strncat( buf, cfg->afs_cell, sizeof( buf ) - strlen( buf ) - 1 );
405 }
406
7193eb01 407 /* set server part */
403921ef 408 if (( kerror = krb5_parse_name( kcontext, buf, &increds.server ))) {
87822447 409 log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
410 (char *)error_message( kerror ));
4e1ae1cd 411
e2df6441 412 goto cleanup;
4e1ae1cd 413 }
414
7193eb01 415 if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
87822447 416 log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
417 (char *)error_message( kerror ));
7193eb01 418
e2df6441 419 goto cleanup;
7193eb01 420 }
4e1ae1cd 421
7193eb01 422 /* set client part */
423 krb5_cc_get_principal( kcontext, kccache, &increds.client );
4e1ae1cd 424
7193eb01 425 increds.times.endtime = 0;
426 /* Ask for DES since that is what V4 understands */
427 increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
428
429 /* get the V5 credentials */
430 if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
431 &increds, &v5credsp ) ) ) {
87822447 432 log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
433 "mod_waklog: krb5_get_credentials: %s", error_message( kerror ));
e2df6441 434 goto cleanup;
4e1ae1cd 435 }
436
c4ad0387 437 /* don't overflow */
438 if ( v5credsp->ticket.length >= MAXKTCTICKETLEN ) { /* from krb524d.c */
87822447 439 log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
440 "mod_waklog: ticket size (%d) too big to fake", v5credsp->ticket.length );
e2df6441 441 goto cleanup;
4e1ae1cd 442 }
443
7193eb01 444 /* assemble the token */
58bbdc54 445 memset( &token, 0, sizeof( struct ktc_token ) );
446
447 token.startTime = v5credsp->times.starttime ? v5credsp->times.starttime : v5credsp->times.authtime;
7193eb01 448 token.endTime = v5credsp->times.endtime;
58bbdc54 449 memmove( &token.sessionKey, v5credsp->keyblock.contents, v5credsp->keyblock.length );
450 token.kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
451 token.ticketLen = v5credsp->ticket.length;
452 memmove( token.ticket, v5credsp->ticket.data, token.ticketLen );
7193eb01 453
58bbdc54 454 /* make sure we have to do this */
455 if ( child.token.kvno != token.kvno ||
456 child.token.ticketLen != token.ticketLen ||
457 (memcmp( &child.token.sessionKey, &token.sessionKey,
458 sizeof( token.sessionKey ) )) ||
459 (memcmp( child.token.ticket, token.ticket, token.ticketLen )) ) {
460
87822447 461 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
462 "mod_waklog: client: %s", buf );
7193eb01 463
464 /* build the name */
bd173fe7 465 memmove( buf, v5credsp->client->data[0].data,
466 min( v5credsp->client->data[0].length, MAXKTCNAMELEN - 1 ) );
58bbdc54 467 buf[ v5credsp->client->data[0].length ] = '\0';
468 if ( v5credsp->client->length > 1 ) {
8258901d 469 strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
58bbdc54 470 buflen = strlen( buf );
bd173fe7 471 memmove( buf + buflen, v5credsp->client->data[1].data,
472 min( v5credsp->client->data[1].length, MAXKTCNAMELEN - strlen( buf ) - 1 ) );
58bbdc54 473 buf[ buflen + v5credsp->client->data[1].length ] = '\0';
7193eb01 474 }
475
476 /* assemble the client */
403921ef 477 strncpy( client.name, buf, sizeof( client.name ) - 1 );
478 strncpy( client.instance, "", sizeof( client.instance) - 1 );
bd173fe7 479 memmove( buf, v5credsp->client->realm.data,
480 min( v5credsp->client->realm.length, MAXKTCNAMELEN - 1 ) );
58bbdc54 481 buf[ v5credsp->client->realm.length ] = '\0';
482 strncpy( client.cell, buf, sizeof( client.cell ) - 1 );
403921ef 483
58bbdc54 484 /* assemble the server's cell */
403921ef 485 strncpy( server.cell, cfg->afs_cell , sizeof( server.cell ) - 1 );
7193eb01 486
87822447 487 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
488 "mod_waklog: server: name=%s, instance=%s, cell=%s",
489 server.name, server.instance, server.cell );
490
491 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
492 "mod_waklog: client: name=%s, instance=%s, cell=%s",
493 client.name, client.instance, client.cell );
7193eb01 494
495 /* use the path */
7193eb01 496
497 /* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
498 write( 2, "", 0 );
499
500 if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
87822447 501 log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
502 "mod_waklog: settoken returned %d", rc );
58bbdc54 503 goto cleanup;
7193eb01 504 }
505
506 /* save this */
58bbdc54 507 memmove( &child.token, &token, sizeof( struct ktc_token ) );
7193eb01 508
509 /* we'll need to unlog when this connection is done. */
e2df6441 510 ap_register_cleanup( r->pool, (void *)r, token_cleanup, ap_null_cleanup );
7193eb01 511 }
512
e2df6441 513cleanup:
514 if ( v5credsp )
515 krb5_free_cred_contents( kcontext, v5credsp );
516 if ( increds.client )
517 krb5_free_principal( kcontext, increds.client );
518 if ( increds.server )
519 krb5_free_principal( kcontext, increds.server );
520 if ( kccache )
521 krb5_cc_close( kcontext, kccache );
522 if ( kcontext )
523 krb5_free_context( kcontext );
3ed1e28a 524
87822447 525 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
526 "mod_waklog: finished with waklog_aklog" );
7193eb01 527
e2df6441 528 return;
529
4e1ae1cd 530}
531
e21f34f0 532 static int
533waklog_child_routine( void *s, child_info *pinfo )
534{
e21f34f0 535 if ( !getuid() ) {
87822447 536 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
537 "mod_waklog: waklog_child_routine called as root" );
e21f34f0 538
539 /* this was causing the credential file to get owned by root */
540 setgid(ap_group_id);
541 setuid(ap_user_id);
542 }
543
544 while( 1 ) {
e2df6441 545 waklog_kinit( s );
87822447 546 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
547 "mod_waklog: child_routine sleeping" );
58bbdc54 548 sleep( SLEEP_TIME );
87822447 549 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
550 "mod_waklog: slept, calling waklog_kinit" );
e21f34f0 551 }
552
553}
554
87822447 555#ifdef STANDARD20_MODULE_STUFF
556static int
557waklog_init_handler(apr_pool_t *p, apr_pool_t *plog,
558 apr_pool_t *ptemp, server_rec *s)
559{
560 int rv;
561 extern char *version;
562 apr_proc_t *proc;
563 waklog_host_config *cfg;
564 void *data;
565
566 getModConfig(cfg, s);
567
568 /* initialize_module() will be called twice, and if it's a DSO
569 * then all static data from the first call will be lost. Only
570 * set up our static data on the second call.
571 * see http://issues.apache.org/bugzilla/show_bug.cgi?id=37519 */
572 apr_pool_userdata_get(&data, userdata_key, s->process->pool);
573
574 if (!data) {
575 apr_pool_userdata_set((const void *)1, userdata_key,
576 apr_pool_cleanup_null, s->process->pool);
577 } else {
578 log_error( APLOG_MARK, APLOG_INFO, 0, s,
579 "mod_waklog: version %s initialized.", version );
580
581 proc = (apr_proc_t *)ap_pcalloc( s->process->pool, sizeof(apr_proc_t));
582
583 rv = apr_proc_fork(proc, s->process->pool);
584
585 if (rv == APR_INCHILD) {
586 waklog_child_routine(s, NULL);
587 } else {
588 apr_pool_note_subprocess(s->process->pool, proc, APR_KILL_ALWAYS);
589 }
590 /* parent and child */
591 cfg->forked = proc->pid;
592 }
593 return 0;
594}
595#else
e21f34f0 596 static void
87822447 597waklog_init( server_rec *s, MK_POOL *p )
e21f34f0 598{
599 extern char *version;
600 int pid;
601
87822447 602 log_error( APLOG_MARK, APLOG_INFO, 0, s,
603 "mod_waklog: version %s initialized.", version );
e21f34f0 604
605 pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
606 NULL, NULL, NULL );
607
87822447 608 log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
609 "mod_waklog: ap_bspawn_child: %d.", pid );
e21f34f0 610}
87822447 611#endif
4e1ae1cd 612
bed98ff9 613 static int
7193eb01 614waklog_phase0( request_rec *r )
bed98ff9 615{
313dde40 616 waklog_host_config *cfg;
617
87822447 618 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
619 "mod_waklog: phase0 called" );
7193eb01 620
87822447 621 getModConfig(cfg, r->server );
313dde40 622
87822447 623 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
624 "mod_waklog: phase0, checking cfg->protect" );
7193eb01 625 if ( !cfg->protect ) {
87822447 626 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
627 "mod_waklog: phase0 declining" );
7193eb01 628 return( DECLINED );
629 }
4e1ae1cd 630
87822447 631 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
632 "mod_waklog: phase0, NOT setting environment variable" );
633 /* set our environment variable */
634 apr_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
b52ccbb1 635
87822447 636 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
637 "mod_waklog: phase0, checking child.token.ticketLen" );
7193eb01 638 /* do this only if we are still unauthenticated */
58bbdc54 639 if ( !child.token.ticketLen ) {
87822447 640
641 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
642 "mod_waklog: phase0, calling waklog_aklog" );
7193eb01 643 /* stuff the credentials into the kernel */
644 waklog_aklog( r );
4e1ae1cd 645 }
7193eb01 646
87822447 647 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
648 "mod_waklog: phase0 returning" );
7193eb01 649 return DECLINED;
650}
4e1ae1cd 651
1e18ef7d 652
7193eb01 653 static int
654waklog_phase7( request_rec *r )
655{
656 waklog_host_config *cfg;
1e18ef7d 657
87822447 658 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
659 "mod_waklog: phase7 called" );
1e18ef7d 660
87822447 661 getModConfig(cfg, r->server );
bed98ff9 662
7193eb01 663 if ( !cfg->protect ) {
664 return( DECLINED );
bed98ff9 665 }
666
7193eb01 667 /* stuff the credentials into the kernel */
87822447 668
669 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
670 "mod_waklog: phase7, calling waklog_aklog" );
7193eb01 671 waklog_aklog( r );
bed98ff9 672
87822447 673 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
674 "mod_waklog: phase7 returning" );
bed98ff9 675
7193eb01 676 return DECLINED;
bed98ff9 677}
678
87822447 679static
680#ifdef STANDARD20_MODULE_STUFF
681int
682#else
683void
684#endif
685waklog_new_connection( conn_rec *c
686#ifdef STANDARD20_MODULE_STUFF
687 , void *dummy
688#endif
689 ) {
690 log_error( APLOG_MARK, APLOG_DEBUG, 0, c->base_server,
691 "mod_waklog: new_connection called: pid: %d", getpid() );
692 return
693#ifdef STANDARD20_MODULE_STUFF
694 0
695#endif
696 ;
7193eb01 697}
bed98ff9 698
c4ad0387 699
1196adfe 700/*
701** Here's a quick explaination for phase0 and phase2:
702** Apache does a stat() on the path between phase0 and
703** phase2, and must by ACLed rl to succeed. So, at
704** phase0 we acquire credentials for umweb:servers from
705** a keytab, and at phase2 we must ensure we remove them.
706**
707** Failure to "unlog" would be a security risk.
708*/
709 static int
710waklog_phase2( request_rec *r )
c4ad0387 711{
161ffd84 712
87822447 713 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
714 "mod_waklog: phase2 called" );
1196adfe 715
c4ad0387 716 if ( child.token.ticketLen ) {
717 memset( &child.token, 0, sizeof( struct ktc_token ) );
718
719 ktc_ForgetAllTokens();
720
87822447 721 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
722 "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d", getpid() );
c4ad0387 723 }
1196adfe 724
87822447 725 log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
726 "mod_waklog: phase2 returning" );
1196adfe 727
c4ad0387 728 return DECLINED;
729}
730
87822447 731#ifndef STANDARD20_MODULE_STUFF
313dde40 732module MODULE_VAR_EXPORT waklog_module = {
bed98ff9 733 STANDARD_MODULE_STUFF,
003832b1 734 waklog_init, /* module initializer */
b52ccbb1 735#if 0
4d47a8d9 736 waklog_create_dir_config, /* create per-dir config structures */
b52ccbb1 737#else /* 0 */
738 NULL, /* create per-dir config structures */
739#endif /* 0 */
bed98ff9 740 NULL, /* merge per-dir config structures */
313dde40 741 waklog_create_server_config, /* create per-server config structures */
bed98ff9 742 NULL, /* merge per-server config structures */
313dde40 743 waklog_cmds, /* table of config file commands */
bed98ff9 744 NULL, /* [#8] MIME-typed-dispatched handlers */
745 NULL, /* [#1] URI to filename translation */
746 NULL, /* [#4] validate user id from request */
747 NULL, /* [#5] check if the user is ok _here_ */
748 NULL, /* [#3] check access by host address */
749 NULL, /* [#6] determine MIME type */
7193eb01 750 waklog_phase7, /* [#7] pre-run fixups */
bed98ff9 751 NULL, /* [#9] log a transaction */
c4ad0387 752 waklog_phase2, /* [#2] header parser */
313dde40 753 waklog_child_init, /* child_init */
bed98ff9 754 NULL, /* child_exit */
7193eb01 755 waklog_phase0 /* [#0] post read-request */
bed98ff9 756#ifdef EAPI
757 ,NULL, /* EAPI: add_module */
758 NULL, /* EAPI: remove_module */
759 NULL, /* EAPI: rewrite_command */
7193eb01 760 waklog_new_connection /* EAPI: new_connection */
bed98ff9 761#endif
762};
87822447 763#else
764static void
765waklog_register_hooks(apr_pool_t *p)
766{
767 ap_hook_fixups(waklog_phase7, NULL, NULL, APR_HOOK_FIRST);
768 ap_hook_header_parser(waklog_phase2, NULL, NULL, APR_HOOK_FIRST);
769 ap_hook_child_init(waklog_child_init, NULL, NULL, APR_HOOK_FIRST);
770 ap_hook_post_read_request(waklog_phase0, NULL, NULL, APR_HOOK_FIRST);
771 ap_hook_pre_connection(waklog_new_connection, NULL, NULL, APR_HOOK_FIRST);
772 ap_hook_post_config(waklog_init_handler, NULL, NULL, APR_HOOK_MIDDLE);
773}
774
775
776module AP_MODULE_DECLARE_DATA waklog_module =
777{
778 STANDARD20_MODULE_STUFF,
779 NULL, /* create per-dir conf structures */
780 NULL, /* merge per-dir conf structures */
781 waklog_create_server_config, /* create per-server conf structures */
782 NULL, /* merge per-server conf structures */
783 waklog_cmds, /* table of configuration directives */
784 waklog_register_hooks /* register hooks */
785};
786#endif
161ffd84 787