mod_waklog.c

   1 #define _LARGEFILE64_SOURCE
   2
   3 #include "httpd.h"
   4 #include "http_config.h"
   5 #include "http_log.h"
   6 #include "http_protocol.h"
   7 #include "http_request.h"
   8 #include "http_core.h"
   9
  10 #ifdef STANDARD20_MODULE_STUFF
  11 #include <apr_strings.h>
  12 #include <apr_base64.h>
  13 #include <apr_compat.h>
  14 #include <apu_compat.h>
  15
  16 module AP_MODULE_DECLARE_DATA waklog_module;
  17
  18 #define MK_POOL apr_pool_t
  19 #define MK_TABLE_GET apr_table_get
  20 #include "unixd.h"
  21 extern unixd_config_rec unixd_config;
  22 #define ap_user_id        unixd_config.user_id
  23 #define ap_group_id       unixd_config.group_id
  24 #define ap_user_name      unixd_config.user_name
  25 #define command(name, func, var, type, usage)           \
  26   AP_INIT_ ## type (name, (void*) func,                 \
  27         (void*)APR_OFFSETOF(waklog_config, var),     \
  28         OR_AUTHCFG | RSRC_CONF, usage)
  29 typedef struct {
  30        int dummy;
  31 } child_info;
  32
  33 const char *userdata_key = "waklog_init";
  34 #else
  35 #include "ap_config.h"
  36
  37 module waklog_module;
  38 #define MK_POOL pool
  39 #define MK_TABLE_GET ap_table_get
  40 #define command(name, func, var, type, usage)           \
  41   { name, func,                                         \
  42     (void*)XtOffsetOf(waklog_config, var),           \
  43     OR_AUTHCFG | RSRC_CONF, type, usage }
  44 #endif /* STANDARD20_MODULE_STUFF */
  45
  46 #define getModConfig(P, X) P = (waklog_host_config *) ap_get_module_config( (X)->module_config, &waklog_module );
  47
  48 #include <krb5.h>
  49
  50 #if defined(sun)
  51 #include <sys/ioccom.h>
  52 #endif /* sun */
  53 #include <stropts.h>
  54 #include <afs/venus.h>
  55 #include <afs/auth.h>
  56 #include <rx/rxkad.h>
  57
  58 #define KEYTAB                  "/etc/keytab.wwwserver"
  59 #define KEYTAB_PRINCIPAL        "someplacewwwserver"
  60 #define AFS_CELL      "someplace.edu"
  61
  62 #define TKT_LIFE        10*60*60
  63 #define SLEEP_TIME      TKT_LIFE - 5*60
  64 /* If there's an error, retry more aggressively */
  65 #define ERR_SLEEP_TIME  5*60
  66
  67
  68 #define K5PATH          "FILE:/tmp/waklog.creds.k5"
  69
  70 typedef struct {
  71     int         forked;
  72     int         configured;
  73     int         protect;
  74     char        *keytab;
  75     char        *keytab_principal;
  76     char        *afs_cell;
  77     MK_POOL      *p;
  78 } waklog_host_config;
  79
  80 typedef struct {
  81         struct ktc_token        token;
  82 } waklog_child_config;
  83 waklog_child_config     child;
  84
  85 static void
  86 log_error(const char *file, int line, int level, int status,
  87            const server_rec *s, const char *fmt, ...)
  88 {
  89    char errstr[1024];
  90    va_list ap;
  91
  92    va_start(ap, fmt);
  93    vsnprintf(errstr, sizeof(errstr), fmt, ap);
  94    va_end(ap);
  95
  96 #ifdef STANDARD20_MODULE_STUFF
  97    ap_log_error(file, line, level | APLOG_NOERRNO, status, s, "%s", errstr);
  98 #else
  99    ap_log_error(file, line, level | APLOG_NOERRNO, s, "%s", errstr);
 100 #endif
 101
 102 }
 103
 104     static void *
 105 waklog_create_server_config( MK_POOL *p, server_rec *s )
 106 {
 107     waklog_host_config *cfg;
 108
 109     cfg = (waklog_host_config *)ap_pcalloc( p, sizeof( waklog_host_config ));
 110     cfg->p = p;
 111     cfg->forked = 0;
 112     cfg->configured = 0;
 113     cfg->protect = 0;
 114     cfg->keytab = KEYTAB;
 115     cfg->keytab_principal = KEYTAB_PRINCIPAL;
 116     cfg->afs_cell = AFS_CELL;
 117
 118     log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: server config created." );
 119
 120     return( cfg );
 121 }
 122
 123
 124     static const char *
 125 set_waklog_protect( cmd_parms *params, void *mconfig, int flag )
 126 {
 127     waklog_host_config          *cfg;
 128
 129     getModConfig(cfg, params->server );
 130
 131     cfg->protect = flag;
 132     cfg->configured = 1;
 133     log_error( APLOG_MARK, APLOG_DEBUG, 0, params->server, "mod_waklog: waklog_protect set" );
 134     return( NULL );
 135 }
 136
 137
 138     static const char *
 139 set_waklog_keytab( cmd_parms *params, void *mconfig, char *file  )
 140 {
 141     waklog_host_config          *cfg;
 142
 143     getModConfig(cfg, params->server );
 144
 145     log_error( APLOG_MARK, APLOG_INFO, 0, params->server,
 146                 "mod_waklog: will use keytab: %s", file );
 147
 148     cfg->keytab = ap_pstrdup ( params->pool, file );
 149     cfg->configured = 1;
 150     return( NULL );
 151 }
 152
 153
 154     static const char *
 155 set_waklog_use_keytab_principal( cmd_parms *params, void *mconfig, char *file  )
 156 {
 157     waklog_host_config          *cfg;
 158
 159     getModConfig(cfg, params->server );
 160
 161     log_error( APLOG_MARK, APLOG_INFO, 0, params->server,
 162                 "mod_waklog: will use keytab_principal: %s", file );
 163
 164     cfg->keytab_principal = ap_pstrdup ( params->pool, file );
 165     cfg->configured = 1;
 166     return( NULL );
 167 }
 168
 169
 170     static const char *
 171 set_waklog_use_afs_cell( cmd_parms *params, void *mconfig, char *file  )
 172 {
 173     waklog_host_config          *cfg;
 174
 175     getModConfig(cfg, params->server );
 176
 177     log_error( APLOG_MARK, APLOG_INFO, 0, params->server,
 178                 "mod_waklog: will use afs_cell: %s", file );
 179
 180     cfg->afs_cell = ap_pstrdup( params->pool, file );
 181     cfg->configured = 1;
 182     return( NULL );
 183 }
 184
 185
 186     static void
 187 #ifdef STANDARD20_MODULE_STUFF
 188 waklog_child_init(MK_POOL *p, server_rec *s)
 189 #else
 190 waklog_child_init(server_rec *s, MK_POOL *p)
 191 #endif
 192 {
 193
 194     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 195                 "mod_waklog: child_init called" );
 196
 197     memset( &child.token, 0, sizeof( struct ktc_token ) );
 198
 199     setpag();
 200
 201     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 202                 "mod_waklog: child_init returned" );
 203
 204     return;
 205 }
 206
 207 typedef struct {
 208   int wak_protect;
 209   char *wak_keytab;
 210   char *wak_ktprinc;
 211   char *wak_afscell;
 212 } waklog_config;
 213
 214 command_rec waklog_cmds[ ] =
 215 {
 216     command("WaklogProtected", set_waklog_protect, wak_protect, FLAG, "enable waklog on a location or directory basis"),
 217
 218     command("WaklogKeytab", set_waklog_keytab, wak_keytab, TAKE1, "Use the supplied keytab rather than the default"),
 219
 220     command("WaklogUseKeytabPrincipal", set_waklog_use_keytab_principal, wak_ktprinc, TAKE1, "Use the supplied keytab principal rather than the default"),
 221
 222     command("WaklogUseAFSCell", set_waklog_use_afs_cell, wak_afscell, TAKE1, "Use the supplied AFS cell rather than the default"),
 223
 224     { NULL }
 225 };
 226
 227
 228     static int
 229 token_cleanup( void *data )
 230 {
 231     request_rec         *r = (request_rec *)data;
 232
 233     if ( child.token.ticketLen ) {
 234         memset( &child.token, 0, sizeof( struct ktc_token ) );
 235
 236         ktc_ForgetAllTokens();
 237
 238         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 239                     "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d", getpid() );
 240     }
 241     return 0;
 242 }
 243
 244
 245     static int
 246 waklog_kinit( server_rec *s )
 247 {
 248     krb5_error_code             kerror = 0;
 249     krb5_context                kcontext = NULL;
 250     krb5_principal              kprinc = NULL;
 251     krb5_get_init_creds_opt     kopts;
 252     krb5_creds                  v5creds;
 253     krb5_ccache                 kccache = NULL;
 254     krb5_keytab                 keytab = NULL;
 255     char                        ktbuf[ MAX_KEYTAB_NAME_LEN + 1 ];
 256     int                         i;
 257     waklog_host_config *cfg;
 258
 259     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 260                 "mod_waklog: waklog_kinit called: pid: %d", getpid() );
 261
 262     getModConfig(cfg, s);
 263
 264     if (( kerror = krb5_init_context( &kcontext ))) {
 265         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 266                     "mod_waklog: %s", (char *)error_message( kerror ));
 267
 268         goto cleanup;
 269     }
 270
 271     /* use the path */
 272     if (( kerror = krb5_cc_resolve( kcontext, K5PATH, &kccache )) != 0 ) {
 273         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 274                     "mod_waklog: %s", (char *)error_message( kerror ));
 275
 276         goto cleanup;
 277     }
 278
 279     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 280                 "mod_waklog: keytab_principal: %s", cfg->keytab_principal );
 281
 282     if (( kerror = krb5_parse_name( kcontext, cfg->keytab_principal, &kprinc ))) {
 283         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 284                     "mod_waklog: %s", (char *)error_message( kerror ));
 285
 286         goto cleanup;
 287     }
 288
 289     krb5_get_init_creds_opt_init( &kopts );
 290     krb5_get_init_creds_opt_set_tkt_life( &kopts, TKT_LIFE );
 291     krb5_get_init_creds_opt_set_renew_life( &kopts, 0 );
 292     krb5_get_init_creds_opt_set_forwardable( &kopts, 1 );
 293     krb5_get_init_creds_opt_set_proxiable( &kopts, 0 );
 294
 295     /* keytab from config */
 296     strncpy( ktbuf, cfg->keytab, sizeof( ktbuf ) - 1 );
 297
 298     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 299                 "mod_waklog: waklog_kinit using: %s", ktbuf );
 300
 301     if (( kerror = krb5_kt_resolve( kcontext, ktbuf, &keytab )) != 0 ) {
 302         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 303                     "mod_waklog:krb5_kt_resolve %s", (char *)error_message( kerror ));
 304
 305         goto cleanup;
 306     }
 307
 308     memset( (char *)&v5creds, 0, sizeof(v5creds));
 309
 310     /* get the krbtgt */
 311     if (( kerror = krb5_get_init_creds_keytab( kcontext, &v5creds,
 312                 kprinc, keytab, 0, NULL, &kopts ))) {
 313
 314         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 315                     "mod_waklog:krb5_get_init_creds_keytab %s", (char *)error_message( kerror ));
 316
 317         goto cleanup;
 318     }
 319
 320     if (( kerror = krb5_cc_initialize( kcontext, kccache, kprinc )) != 0 ) {
 321         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 322                     "mod_waklog:krb5_cc_initialize %s", (char *)error_message( kerror ));
 323
 324         goto cleanup;
 325     }
 326
 327     kerror = krb5_cc_store_cred( kcontext, kccache, &v5creds );
 328     krb5_free_cred_contents( kcontext, &v5creds );
 329     if ( kerror != 0 ) {
 330         log_error( APLOG_MARK, APLOG_ERR, 0, s,
 331                     "mod_waklog: %s", (char *)error_message( kerror ));
 332
 333         goto cleanup;
 334     }
 335
 336     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 337                 "mod_waklog: waklog_kinit success" );
 338
 339 cleanup:
 340     if ( keytab )
 341         (void)krb5_kt_close( kcontext, keytab );
 342     if ( kprinc )
 343         krb5_free_principal( kcontext, kprinc );
 344     if ( kccache )
 345         krb5_cc_close( kcontext, kccache );
 346     if ( kcontext )
 347         krb5_free_context( kcontext );
 348
 349     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 350                 "mod_waklog: waklog_kinit: exiting" );
 351
 352     return( kerror );
 353 }
 354
 355
 356     static void
 357 waklog_aklog( request_rec *r )
 358 {
 359     int                         rc;
 360     char                        buf[ MAXKTCTICKETLEN ];
 361     const char                  *k5path = NULL;
 362     krb5_error_code             kerror;
 363     krb5_context                kcontext = NULL;
 364     krb5_creds                  increds;
 365     krb5_creds                  *v5credsp = NULL;
 366     krb5_ccache                 kccache = NULL;
 367     struct ktc_principal        server = { "afs", "", "" };
 368     struct ktc_principal        client;
 369     struct ktc_token            token;
 370     waklog_host_config          *cfg;
 371     int                         buflen;
 372
 373     k5path = MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" );
 374
 375     log_error( APLOG_MARK, APLOG_INFO, 0, r->server,
 376                 "mod_waklog: waklog_aklog called: k5path: %s", k5path );
 377
 378     if ( k5path == NULL ) {
 379         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 380                     "mod_waklog: waklog_aklog giving up" );
 381         goto cleanup;
 382     }
 383
 384     /*
 385     ** Get/build creds from file/tgs, then see if we need to SetToken
 386     */
 387
 388     if (( kerror = krb5_init_context( &kcontext ))) {
 389         /* Authentication Required ( kerberos error ) */
 390         log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
 391                     (char *)error_message( kerror ));
 392
 393         goto cleanup;
 394     }
 395
 396     memset( (char *)&increds, 0, sizeof(increds));
 397
 398     getModConfig(cfg, r->server );
 399
 400     /* afs/<cell> or afs */
 401     strncpy( buf, "afs", sizeof( buf ) - 1 );
 402     if ( strcmp( cfg->afs_cell, AFS_CELL ) ) {
 403         strncat( buf, "/" ,             sizeof( buf ) - strlen( buf ) - 1 );
 404         strncat( buf, cfg->afs_cell,    sizeof( buf ) - strlen( buf ) - 1 );
 405     }
 406
 407     /* set server part */
 408     if (( kerror = krb5_parse_name( kcontext, buf, &increds.server ))) {
 409         log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
 410                     (char *)error_message( kerror ));
 411
 412         goto cleanup;
 413     }
 414
 415     if (( kerror = krb5_cc_resolve( kcontext, k5path, &kccache )) != 0 ) {
 416         log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
 417                     (char *)error_message( kerror ));
 418
 419         goto cleanup;
 420     }
 421
 422     /* set client part */
 423     krb5_cc_get_principal( kcontext, kccache, &increds.client );
 424
 425     increds.times.endtime = 0;
 426     /* Ask for DES since that is what V4 understands */
 427     increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
 428
 429     /* get the V5 credentials */
 430     if (( kerror = krb5_get_credentials( kcontext, 0, kccache,
 431                 &increds, &v5credsp ) ) ) {
 432         log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
 433                     "mod_waklog: krb5_get_credentials: %s", error_message( kerror ));
 434         goto cleanup;
 435     }
 436
 437     /* don't overflow */
 438     if ( v5credsp->ticket.length >= MAXKTCTICKETLEN ) { /* from krb524d.c */
 439         log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
 440                     "mod_waklog: ticket size (%d) too big to fake", v5credsp->ticket.length );
 441         goto cleanup;
 442     }
 443
 444     /* assemble the token */
 445     memset( &token, 0, sizeof( struct ktc_token ) );
 446
 447     token.startTime = v5credsp->times.starttime ? v5credsp->times.starttime : v5credsp->times.authtime;
 448     token.endTime = v5credsp->times.endtime;
 449     memmove( &token.sessionKey, v5credsp->keyblock.contents,  v5credsp->keyblock.length );
 450     token.kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
 451     token.ticketLen = v5credsp->ticket.length;
 452     memmove( token.ticket, v5credsp->ticket.data, token.ticketLen );
 453
 454     /* make sure we have to do this */
 455     if ( child.token.kvno != token.kvno ||
 456             child.token.ticketLen != token.ticketLen ||
 457             (memcmp( &child.token.sessionKey, &token.sessionKey,
 458                     sizeof( token.sessionKey ) )) ||
 459             (memcmp( child.token.ticket, token.ticket, token.ticketLen )) ) {
 460
 461         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 462                     "mod_waklog: client: %s", buf );
 463
 464         /* build the name */
 465         memmove( buf, v5credsp->client->data[0].data,
 466                 min( v5credsp->client->data[0].length, MAXKTCNAMELEN - 1 ) );
 467         buf[ v5credsp->client->data[0].length ] = '\0';
 468         if ( v5credsp->client->length > 1 ) {
 469                 strncat( buf, ".", sizeof( buf ) - strlen( buf ) - 1 );
 470                 buflen = strlen( buf );
 471                 memmove( buf + buflen, v5credsp->client->data[1].data,
 472                         min( v5credsp->client->data[1].length, MAXKTCNAMELEN - strlen( buf ) - 1 ) );
 473                 buf[ buflen + v5credsp->client->data[1].length ] = '\0';
 474         }
 475
 476         /* assemble the client */
 477         strncpy( client.name, buf,              sizeof( client.name ) - 1 );
 478         strncpy( client.instance, "",           sizeof( client.instance) - 1 );
 479         memmove( buf, v5credsp->client->realm.data,
 480                 min( v5credsp->client->realm.length, MAXKTCNAMELEN - 1 ) );
 481         buf[ v5credsp->client->realm.length ] = '\0';
 482         strncpy( client.cell, buf,              sizeof( client.cell ) - 1 );
 483
 484         /* assemble the server's cell */
 485         strncpy( server.cell, cfg->afs_cell ,   sizeof( server.cell ) - 1 );
 486
 487         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 488                     "mod_waklog: server: name=%s, instance=%s, cell=%s",
 489                     server.name, server.instance, server.cell );
 490
 491         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 492                     "mod_waklog: client: name=%s, instance=%s, cell=%s",
 493                     client.name, client.instance, client.cell );
 494
 495         /* use the path */
 496
 497         /* rumor: we have to do this for AIX 4.1.4 with AFS 3.4+ */
 498         write( 2, "", 0 );
 499
 500         if ( ( rc = ktc_SetToken( &server, &token, &client, 0 ) ) ) {
 501             log_error( APLOG_MARK, APLOG_ERR, 0, r->server,
 502                         "mod_waklog: settoken returned %d", rc );
 503             goto cleanup;
 504         }
 505
 506         /* save this */
 507         memmove( &child.token, &token, sizeof( struct ktc_token ) );
 508
 509         /* we'll need to unlog when this connection is done. */
 510         ap_register_cleanup( r->pool, (void *)r, token_cleanup, ap_null_cleanup );
 511     }
 512
 513 cleanup:
 514     if ( v5credsp )
 515         krb5_free_cred_contents( kcontext, v5credsp );
 516     if ( increds.client )
 517         krb5_free_principal( kcontext, increds.client );
 518     if ( increds.server )
 519         krb5_free_principal( kcontext, increds.server );
 520     if ( kccache )
 521         krb5_cc_close( kcontext, kccache );
 522     if ( kcontext )
 523         krb5_free_context( kcontext );
 524
 525     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 526                "mod_waklog: finished with waklog_aklog" );
 527
 528     return;
 529
 530 }
 531
 532     static int
 533 waklog_child_routine( void *s, child_info *pinfo )
 534 {
 535     if ( !getuid() ) {
 536         log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 537                  "mod_waklog: waklog_child_routine called as root" );
 538
 539         /* this was causing the credential file to get owned by root */
 540         setgid(ap_group_id);
 541         setuid(ap_user_id);
 542     }
 543
 544     while( 1 ) {
 545         waklog_kinit( s );
 546         log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 547                  "mod_waklog: child_routine sleeping" );
 548         sleep( SLEEP_TIME );
 549         log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 550                  "mod_waklog: slept, calling waklog_kinit" );
 551     }
 552
 553 }
 554
 555 #ifdef STANDARD20_MODULE_STUFF
 556 static int
 557 waklog_init_handler(apr_pool_t *p, apr_pool_t *plog,
 558                     apr_pool_t *ptemp, server_rec *s)
 559 {
 560     int rv;
 561     extern char *version;
 562     apr_proc_t *proc;
 563     waklog_host_config          *cfg;
 564     void *data;
 565
 566     getModConfig(cfg, s);
 567
 568     /* initialize_module() will be called twice, and if it's a DSO
 569      * then all static data from the first call will be lost. Only
 570      * set up our static data on the second call.
 571      * see http://issues.apache.org/bugzilla/show_bug.cgi?id=37519 */
 572     apr_pool_userdata_get(&data, userdata_key, s->process->pool);
 573
 574     if (!data) {
 575         apr_pool_userdata_set((const void *)1, userdata_key,
 576                               apr_pool_cleanup_null, s->process->pool);
 577     } else {
 578         log_error( APLOG_MARK, APLOG_INFO, 0, s,
 579                    "mod_waklog: version %s initialized.", version );
 580
 581         proc = (apr_proc_t *)ap_pcalloc( s->process->pool, sizeof(apr_proc_t));
 582
 583         rv = apr_proc_fork(proc, s->process->pool);
 584
 585         if (rv == APR_INCHILD) {
 586             waklog_child_routine(s, NULL);
 587         } else {
 588             apr_pool_note_subprocess(s->process->pool, proc, APR_KILL_ALWAYS);
 589         }
 590         /* parent and child */
 591         cfg->forked = proc->pid;
 592     }
 593     return 0;
 594 }
 595 #else
 596     static void
 597 waklog_init( server_rec *s, MK_POOL *p )
 598 {
 599     extern char *version;
 600     int pid;
 601
 602     log_error( APLOG_MARK, APLOG_INFO, 0, s,
 603                "mod_waklog: version %s initialized.", version );
 604
 605     pid = ap_bspawn_child( p, waklog_child_routine, s, kill_always,
 606             NULL, NULL, NULL );
 607
 608     log_error( APLOG_MARK, APLOG_DEBUG, 0, s,
 609                "mod_waklog: ap_bspawn_child: %d.", pid );
 610 }
 611 #endif
 612
 613     static int
 614 waklog_phase0( request_rec *r )
 615 {
 616     waklog_host_config  *cfg;
 617
 618     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 619                "mod_waklog: phase0 called" );
 620
 621     getModConfig(cfg, r->server );
 622
 623     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 624         "mod_waklog: phase0, checking cfg->protect" );
 625     if ( !cfg->protect ) {
 626         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 627                    "mod_waklog: phase0 declining" );
 628         return( DECLINED );
 629     }
 630
 631     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 632         "mod_waklog: phase0, NOT setting environment variable" );
 633     /* set our environment variable */
 634     apr_table_set( r->subprocess_env, "KRB5CCNAME", K5PATH );
 635
 636     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 637         "mod_waklog: phase0, checking child.token.ticketLen" );
 638     /* do this only if we are still unauthenticated */
 639     if ( !child.token.ticketLen ) {
 640
 641         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 642         "mod_waklog: phase0, calling waklog_aklog" );
 643         /* stuff the credentials into the kernel */
 644         waklog_aklog( r );
 645     }
 646
 647     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 648                "mod_waklog: phase0 returning" );
 649     return DECLINED;
 650 }
 651
 652
 653     static int
 654 waklog_phase7( request_rec *r )
 655 {
 656     waklog_host_config  *cfg;
 657
 658     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 659                "mod_waklog: phase7 called" );
 660
 661     getModConfig(cfg, r->server );
 662
 663     if ( !cfg->protect ) {
 664         return( DECLINED );
 665     }
 666
 667     /* stuff the credentials into the kernel */
 668
 669     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 670         "mod_waklog: phase7, calling waklog_aklog" );
 671     waklog_aklog( r );
 672
 673     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 674                "mod_waklog: phase7 returning" );
 675
 676     return DECLINED;
 677 }
 678
 679 static
 680 #ifdef STANDARD20_MODULE_STUFF
 681 int
 682 #else
 683 void
 684 #endif
 685 waklog_new_connection( conn_rec *c
 686 #ifdef STANDARD20_MODULE_STUFF
 687                        , void *dummy
 688 #endif
 689                        ) {
 690         log_error( APLOG_MARK, APLOG_DEBUG, 0, c->base_server,
 691                    "mod_waklog: new_connection called: pid: %d", getpid() );
 692     return
 693 #ifdef STANDARD20_MODULE_STUFF
 694       0
 695 #endif
 696       ;
 697 }
 698
 699
 700 /*
 701 **  Here's a quick explaination for phase0 and phase2:
 702 **  Apache does a stat() on the path between phase0 and
 703 **  phase2, and must by ACLed rl to succeed.  So, at
 704 **  phase0 we acquire credentials for umweb:servers from
 705 **  a keytab, and at phase2 we must ensure we remove them.
 706 **
 707 **  Failure to "unlog" would be a security risk.
 708 */
 709     static int
 710 waklog_phase2( request_rec *r )
 711 {
 712
 713     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 714                "mod_waklog: phase2 called" );
 715
 716     if ( child.token.ticketLen ) {
 717         memset( &child.token, 0, sizeof( struct ktc_token ) );
 718
 719         ktc_ForgetAllTokens();
 720
 721         log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 722                    "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d", getpid() );
 723     }
 724
 725     log_error( APLOG_MARK, APLOG_DEBUG, 0, r->server,
 726                "mod_waklog: phase2 returning" );
 727
 728     return DECLINED;
 729 }
 730
 731 #ifndef STANDARD20_MODULE_STUFF
 732 module MODULE_VAR_EXPORT waklog_module = {
 733     STANDARD_MODULE_STUFF,
 734     waklog_init,           /* module initializer                  */
 735 #if 0
 736     waklog_create_dir_config, /* create per-dir    config structures */
 737 #else /* 0 */
 738     NULL,                  /* create per-dir    config structures */
 739 #endif /* 0 */
 740     NULL,                  /* merge  per-dir    config structures */
 741     waklog_create_server_config, /* create per-server config structures */
 742     NULL,                  /* merge  per-server config structures */
 743     waklog_cmds,           /* table of config file commands       */
 744     NULL,                  /* [#8] MIME-typed-dispatched handlers */
 745     NULL,                  /* [#1] URI to filename translation    */
 746     NULL,                  /* [#4] validate user id from request  */
 747     NULL,                  /* [#5] check if the user is ok _here_ */
 748     NULL,                  /* [#3] check access by host address   */
 749     NULL,                  /* [#6] determine MIME type            */
 750     waklog_phase7,         /* [#7] pre-run fixups                 */
 751     NULL,                  /* [#9] log a transaction              */
 752     waklog_phase2,         /* [#2] header parser                  */
 753     waklog_child_init,     /* child_init                          */
 754     NULL,                  /* child_exit                          */
 755     waklog_phase0          /* [#0] post read-request              */
 756 #ifdef EAPI
 757    ,NULL,                  /* EAPI: add_module                    */
 758     NULL,                  /* EAPI: remove_module                 */
 759     NULL,                  /* EAPI: rewrite_command               */
 760     waklog_new_connection  /* EAPI: new_connection                */
 761 #endif
 762 };
 763 #else
 764 static void
 765 waklog_register_hooks(apr_pool_t *p)
 766 {
 767     ap_hook_fixups(waklog_phase7, NULL, NULL, APR_HOOK_FIRST);
 768     ap_hook_header_parser(waklog_phase2, NULL, NULL, APR_HOOK_FIRST);
 769     ap_hook_child_init(waklog_child_init, NULL, NULL, APR_HOOK_FIRST);
 770     ap_hook_post_read_request(waklog_phase0, NULL, NULL, APR_HOOK_FIRST);
 771     ap_hook_pre_connection(waklog_new_connection, NULL, NULL, APR_HOOK_FIRST);
 772     ap_hook_post_config(waklog_init_handler, NULL, NULL, APR_HOOK_MIDDLE);
 773 }
 774
 775
 776 module AP_MODULE_DECLARE_DATA waklog_module =
 777 {
 778    STANDARD20_MODULE_STUFF,
 779    NULL,                        /* create per-dir    conf structures  */
 780    NULL,                        /* merge  per-dir    conf structures  */
 781    waklog_create_server_config, /* create per-server conf structures  */
 782    NULL,                        /* merge  per-server conf structures  */
 783    waklog_cmds,                 /* table of configuration directives  */
 784    waklog_register_hooks          /* register hooks                     */
 785 };
 786 #endif
 787